nyanloutre/nixos-config
1
1
Fork 1
Code Issues Pull requests Releases Wiki Activity

Dossier services

Browse source
This commit is contained in:
nyanloutre 2018-05-04 16:26:49 +02:00
parent 0a3a10edb3
commit 4ac696f617
3 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

128
services/haproxy-acme.nix Normal file
View file

@ -0,0 +1,128 @@
{ lib, config, pkgs, ... }:
with lib;
let
cfg = config.services.haproxy-acme;
nginx_port = 54321;
in
{
options.services.haproxy-acme = {
enable = mkEnableOption "HAproxy + ACME";
domaine = mkOption {
type = types.string;
example = "example.com";
description = ''
Sous domaine à utiliser
Il est necessaire d'avoir un enregistrement pointant sur la wildcard de ce domaine vers le serveur
'';
};
services = mkOption {
type = types.attrsOf types.attrs;
example = ''
haproxy_backends = {
example = { ip = "127.0.0.1"; port = 1234; auth = false; };
};
'';
description = "Liste des noms de domaines associés à leur backend";
};
};
config = mkIf cfg.enable {
services.haproxy.enable = true;
services.haproxy.config = ''
global
log /dev/log local0
log /dev/log local1 notice
user haproxy
group haproxy
ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
ssl-default-server-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets
defaults
option forwardfor
option http-server-close
timeout client 10s
timeout connect 4s
timeout server 30s
userlist LOUTRE
user paul password $6$6rDdCtzSVsAwB6KP$V8bR7KP7FSL2BSEh6n3op6iYhAnsVSPI2Ar3H6MwKrJ/lZRzUI8a0TwVBD2JPnAntUhLpmRudrvdq2Ls2odAy.
frontend public
bind :::80 v4v6
bind :::443 v4v6 ssl crt /var/lib/acme/${cfg.domaine}/full.pem alpn h2,http/1.1
mode http
acl letsencrypt-acl path_beg /.well-known/acme-challenge/
acl haproxy-acl path_beg /haproxy
redirect scheme https code 301 if !{ ssl_fc } !letsencrypt-acl
http-response set-header Strict-Transport-Security max-age=15768000
use_backend letsencrypt-backend if letsencrypt-acl
use_backend haproxy_stats if haproxy-acl
${concatStrings (
mapAttrsToList (name: value:
" acl ${name}-acl hdr(host) -i ${name}.${cfg.domaine}\n"
+ " use_backend ${name}-backend if ${name}-acl\n"
) cfg.services)}
backend letsencrypt-backend
mode http
server letsencrypt 127.0.0.1:${toString nginx_port}
backend haproxy_stats
mode http
stats enable
stats hide-version
acl AuthOK_LOUTRE http_auth(LOUTRE)
http-request auth realm LOUTRE if !AuthOK_LOUTRE
${concatStrings (
mapAttrsToList (name: value:
''
backend ${name}-backend
mode http
server ${name} ${value.ip}:${toString value.port}
${(if value.auth then (
"\n acl AuthOK_LOUTRE http_auth(LOUTRE)\n"
+ " http-request auth realm LOUTRE if !AuthOK_LOUTRE\n"
) else "")}
''
) cfg.services)}
'';
services.nginx.enable = true;
services.nginx.virtualHosts = {
"acme" = {
listen = [ { addr = "127.0.0.1"; port = nginx_port; } ];
locations = { "/" = { root = "/var/www/challenges"; }; };
};
};
security.acme.certs = {
${cfg.domaine} = {
extraDomains = mapAttrs' (name: value:
nameValuePair ("${name}.${cfg.domaine}") (null)
) cfg.services;
webroot = "/var/www/challenges/";
email = "paul@nyanlout.re";
user = "haproxy";
group = "haproxy";
postRun = ''
systemctl reload haproxy.service
'';
};
};
security.acme.directory = "/var/lib/acme";
networking.firewall.allowedTCPPorts = [
80 443
];
};
}

70
services/mail-server.nix Normal file
View file

@ -0,0 +1,70 @@
{ lib, config, pkgs, ... }:
with lib;
let
cfg = config.services.mailserver;
in
{
options.services.mailserver = {
enable = mkEnableOption "Mail Server";
domaine = mkOption {
type = types.string;
example = "example.com";
description = "Nom de domaine du serveur de mails";
};
};
imports = [
(builtins.fetchTarball {
url = "https://github.com/r-raymond/nixos-mailserver/archive/v2.1.4.tar.gz";
sha256 = "1n7k8vlsd1p0fa7s3kgd40bnykpk7pv579aqssx9wia3kl5s7c1b";
})
];
config = mkIf cfg.enable {
mailserver = {
enable = true;
fqdn = "mail.${cfg.domaine}";
domains = [ cfg.domaine ];
# A list of all login accounts. To create the password hashes, use
# mkpasswd -m sha-512 "super secret password"
loginAccounts = {
"paul@${cfg.domaine}" = {
hashedPassword = "$6$8wWQbtqVqUoH8$pQKg0bZPcjCbuPvyhjJ1lQy949M/AgfmAye/hDEIVUnCfwtlUxC1yj8CBHpNKeiiXhd8IUqk9r0/IJNvB6okf0";
};
};
# Certificate setup
certificateScheme = 1;
certificateFile = "/var/lib/acme/${cfg.domaine}/fullchain.pem";
keyFile = "/var/lib/acme/${cfg.domaine}/key.pem";
# Length of the Diffie Hillman prime used
dhParamBitLength = 4096;
# Enable IMAP and POP3
enableImap = true;
enablePop3 = true;
enableImapSsl = true;
enablePop3Ssl = true;
# Enable the ManageSieve protocol
enableManageSieve = true;
};
security.acme.certs = {
"${cfg.domaine}" = {
extraDomains = {
"mail.${cfg.domaine}" = null;
};
postRun = ''
systemctl reload dovecot2.service
'';
};
};
};
}