move users to generic subfolder

.gitignore

@@ -1,3 +1,3 @@
-userdata/userdata.json
+local/profiles/users.json
 hardware-configuration.nix
 networking.nix

README.md

@@ -1,9 +1,9 @@
 # SelfPrivacy NixOS configuration
 
 This is a NixOS config which builds a SelfPrivacy server distribution
-based on data provided in `userdata/userdata.json`.
+based on data provided in `local/profiles/users.json`.
 
-JSON schema is provided in `userdata/schema.json` for reference.
+JSON schema is provided in `generic/profiles/schema.json` for reference.
 
 **hardware-configuration.nix is not included.**
 

configuration.nix

@@ -5,28 +5,28 @@ let
 in
 {
   imports = [
+    ./generic/api/api.nix
+    ./generic/api/api-module.nix
+    ./generic/modules/userdata.nix
+    ./generic/services/userdata.nix
+    ./generic/systems/limits.nix
+    ./generic/systems/tmpfiles.nix
+    ./generic/systems/users.nix
+    ./local/services/backup/restic.nix
+    ./local/services/git/gitea.nix
+    ./local/services/letsencrypt/acme.nix
+    ./local/services/letsencrypt/resolve.nix
+    ./local/services/mailserver/alps.nix
+    ./local/services/mailserver/mailserver.nix
+    ./local/services/nextcloud/nextcloud.nix
+    ./local/services/passmgr/bitwarden.nix
+    ./local/services/passmgr/bitwarden.nix
+    ./local/services/social/pleroma.nix
+    ./local/services/videomeet/jitsi.nix
+    ./local/services/vpn/ocserv.nix
+    ./local/services/webserver/memcached.nix
+    ./local/services/webserver/nginx.nix
     ./hardware-configuration.nix
-
-    ./variables-module.nix
-    ./variables.nix
-    ./files.nix
-    ./users.nix
-    ./mailserver/system/mailserver.nix
-    ./mailserver/system/alps.nix
-    ./vpn/ocserv.nix
-    ./api/api.nix
-    ./api/api-module.nix
-    ./social/pleroma.nix
-    ./letsencrypt/acme.nix
-    ./letsencrypt/resolve.nix
-    ./backup/restic.nix
-    ./passmgr/bitwarden.nix
-    ./webserver/nginx.nix
-    ./webserver/memcached.nix
-    ./nextcloud/nextcloud.nix
-    ./resources/limits.nix
-    ./videomeet/jitsi.nix
-    ./git/gitea.nix
   ];
 
   nixpkgs.overlays = [ (nix-overlay) ];
@@ -59,8 +59,8 @@ in
   environment.variables = {
     DOMAIN = config.services.userdata.domain;
   };
-  system.autoUpgrade.enable = config.services.userdata.autoUpgrade.enable;
+  system.autoUpgrade.enable = true;
-  system.autoUpgrade.allowReboot = config.services.userdata.autoUpgrade.allowReboot;
+  system.autoUpgrade.allowReboot = false;
   system.autoUpgrade.channel = https://nixos.org/channels/nixos-21.05-small;
   nix = {
     optimise.automatic = true;

generic/api/api-module.nix

@@ -43,12 +43,6 @@ in
         B2 account key
       '';
     };
-    b2Bucket = mkOption {
-      type = types.str;
-      description = ''
-        B2 bucket
-      '';
-    };
     resticPassword = mkOption {
       type = types.str;
       description = ''
@@ -68,7 +62,6 @@ in
         ENABLE_SWAGGER = (if cfg.enableSwagger then "1" else "0");
         B2_ACCOUNT_ID = cfg.b2AccountId;
         B2_ACCOUNT_KEY = cfg.b2AccountKey;
-        B2_BUCKET = cfg.b2Bucket;
         RESTIC_PASSWORD = cfg.resticPassword;
       } // config.networking.proxy.envVars;
       path = [ "/var/" "/var/dkim/" pkgs.coreutils pkgs.gnutar pkgs.xz.bin pkgs.gzip pkgs.gitMinimal config.nix.package.out pkgs.nixos-rebuild pkgs.restic pkgs.mkpasswd ];

generic/api/api.nix

@@ -6,7 +6,6 @@
     enableSwagger = config.services.userdata.api.enableSwagger;
     b2AccountId = config.services.userdata.backblaze.accountId;
     b2AccountKey = config.services.userdata.backblaze.accountKey;
-    b2Bucket = config.services.userdata.backblaze.bucket;
     resticPassword = config.services.userdata.resticPassword;
   };
 

generic/modules/userdata.nix

@@ -15,7 +15,6 @@ in
       default = true;
       type = types.nullOr types.bool;
     };
-    # General server options
     hostname = mkOption {
       description = "The hostname of the server.";
       type = types.nullOr types.str;
@@ -26,28 +25,6 @@ in
       '';
       type = types.nullOr types.str;
     };
-    timezone = mkOption {
-      description = ''
-        Timezone used by the server
-      '';
-      type = types.nullOr types.str;
-      default = "Europe/Uzhgorod";
-    };
-    autoUpgrade = {
-      enable = mkOption {
-        description = "Enable auto-upgrade of the server.";
-        default = true;
-        type = types.nullOr types.bool;
-      };
-      allowReboot = mkOption {
-        description = "Allow the server to reboot during the upgrade.";
-        default = false;
-        type = types.nullOr types.bool;
-      };
-    };
-    ########################
-    # Server admin options #
-    ########################
     username = mkOption {
       description = ''
         Username that was defined at the initial setup process
@@ -60,16 +37,6 @@ in
       '';
       type = types.nullOr types.str;
     };
-    sshKeys = mkOption {
-      description = ''
-        SSH keys of the user that was defined at the initial setup process
-      '';
-      type = types.nullOr (types.listOf types.str);
-      default = [ ];
-    };
-    ###############
-    # API options #
-    ###############
     api = {
       token = mkOption {
         description = ''
@@ -85,9 +52,6 @@ in
         type = types.bool;
       };
     };
-    #############
-    #  Secrets  #
-    #############
     backblaze = {
       bucket = mkOption {
         description = "Bucket name used for userdata backups";
@@ -108,9 +72,6 @@ in
         type = types.nullOr types.str;
       };
     };
-    ##############
-    #  Services  #
-    ##############
     databasePassword = mkOption {
       description = ''
         Password for the database
@@ -165,18 +126,12 @@ in
         type = types.nullOr types.bool;
       };
     };
-    #############
-    #  Backups  #
-    #############
     resticPassword = mkOption {
       description = ''
         Password for the restic
       '';
       type = types.nullOr types.str;
     };
-    #########
-    #  SSH  #
-    #########
     ssh = {
       enable = mkOption {
         default = true;
@@ -187,7 +142,7 @@ in
           Root SSH Keys
         '';
         type = types.nullOr (types.listOf types.str);
-        default = [ "" ];
+        default = [""];
       };
       passwordAuthentication = mkOption {
         description = ''
@@ -197,15 +152,19 @@ in
         type = types.nullOr types.bool;
       };
     };
-    ###########
+    timezone = mkOption {
-    #  Users  #
+      description = ''
-    ###########
+        Timezone used by the server
+      '';
+      type = types.nullOr types.str;
+      default = "Europe/Uzhgorod";
+    };
     users = mkOption {
       description = ''
         Users that will be created on the server
       '';
       type = types.nullOr (types.listOf (types.attrsOf types.anything));
-      default = [ ];
+      default = [];
     };
   };
 }

generic/profiles/schema.json

@@ -3,17 +3,6 @@
     "$id": "https://git.selfprivacy.org/inex/selfprivacy-nixos-config/raw/branch/master/userdata/schema.json",
     "type": "object",
     "properties": {
-        "autoUpgrade": {
-            "type": "object",
-            "properties": {
-                "enable": {
-                    "type": "boolean"
-                },
-                "allowReboot": {
-                    "type": "boolean"
-                }
-            }
-        },
         "hostname": {
             "type": "string"
         },
@@ -26,12 +15,6 @@
         "hashedMasterPassword": {
             "type": "string"
         },
-        "sshKeys": {
-            "type": "array",
-            "items": {
-                "type": "string"
-            }
-        },
         "timezone": {
             "type": "string"
         },

generic/services/userdata.nix

@@ -0,0 +1,6 @@
+{ pkgs, ... }:
+{
+  services = {
+    userdata = builtins.fromJSON (builtins.readFile ./../../local/profiles/users.json);
+  };
+}

generic/systems/tmpfiles.nix

@@ -14,24 +14,17 @@ in
         CLOUDFLARE_DNS_API_TOKEN=${cfg.cloudflare.apiKey}
         CLOUDFLARE_ZONE_API_TOKEN=${cfg.cloudflare.apiKey}
       '';
-      rcloneConfig = builtins.replaceStrings [ "\n" "\"" "\\" ] [ "\\n" "\\\"" "\\\\" ] ''
-        [backblaze]
-        type = b2
-        account = ${cfg.backblaze.accountId}
-        key = ${cfg.backblaze.accountKey}
-      '';
     in
     [
       (if cfg.bitwarden.enable then "d /var/lib/bitwarden 0777 bitwarden_rs bitwarden_rs -" else "")
       (if cfg.bitwarden.enable then "d /var/lib/bitwarden/backup 0777 bitwarden_rs bitwarden_rs -" else "")
       (if cfg.pleroma.enable then "d /var/lib/pleroma 0600 pleroma pleroma - -" else "")
       "d /var/lib/restic 0600 restic - - -"
-      "f+ /var/lib/restic/pass 0400 restic - - ${resticPass}"
+      "f /var/lib/restic/pass 0400 restic - - ${resticPass}"
-      "f+ /root/.config/rclone/rclone.conf 0400 root root - ${rcloneConfig}"
+      (if cfg.pleroma.enable then "f /var/lib/pleroma/secrets.exs 0755 pleroma pleroma - -" else "")
-      (if cfg.pleroma.enable then "f+ /var/lib/pleroma/secrets.exs 0755 pleroma pleroma - -" else "")
+      "f /var/domain 0444 selfprivacy-api selfprivacy-api - ${domain}"
-      "f+ /var/domain 0444 selfprivacy-api selfprivacy-api - ${domain}"
+      (if cfg.nextcloud.enable then "f /var/lib/nextcloud/db-pass 0440 nextcloud nextcloud - ${nextcloudDBPass}" else "")
-      (if cfg.nextcloud.enable then "f+ /var/lib/nextcloud/db-pass 0440 nextcloud nextcloud - ${nextcloudDBPass}" else "")
+      (if cfg.nextcloud.enable then "f /var/lib/nextcloud/admin-pass 0440 nextcloud nextcloud - ${nextcloudAdminPass}" else "")
-      (if cfg.nextcloud.enable then "f+ /var/lib/nextcloud/admin-pass 0440 nextcloud nextcloud - ${nextcloudAdminPass}" else "")
+      "f /var/lib/cloudflare/Credentials.ini 0440 nginx acmerecievers - ${cloudflareCredentials}"
-      "f+ /var/lib/cloudflare/Credentials.ini 0440 nginx acmerecievers - ${cloudflareCredentials}"
     ];
 }

generic/systems/users.nix

@@ -9,7 +9,6 @@ in
       "${cfg.username}" = {
         isNormalUser = true;
         hashedPassword = cfg.hashedMasterPassword;
-        openssh.authorizedKeys.keys = cfg.sshKeys;
       };
     } // builtins.listToAttrs (builtins.map
       (user: {
@@ -17,7 +16,6 @@ in
         value = {
           isNormalUser = true;
           hashedPassword = user.hashedPassword;
-          openssh.authorizedKeys.keys = user.sshKeys;
         };
       })
       cfg.users);

local/services/nextcloud/nextcloud.nix

@@ -18,7 +18,7 @@ in
 
     config = {
       # Further forces Nextcloud to use HTTPS
-      overwriteProtocol = "https";
+      overwriteProtocol = "http";
 
       # Nextcloud PostegreSQL database configuration, recommended over using SQLite
       dbtype = "sqlite";

local/services/social/pleroma.nix

@@ -15,9 +15,9 @@ in
       group = "pleroma";
       configs = [
         (builtins.replaceStrings
-          [ "$DOMAIN" "$LUSER" "$DB_PASSWORD" ]
+        [ "$DOMAIN" "$LUSER" "$DB_PASSWORD" ]
-          [ cfg.domain cfg.username cfg.databasePassword ]
+        [ cfg.domain cfg.username cfg.databasePassword ]
-          (builtins.readFile ./config.exs))
+        (builtins.readFile ./config.exs))
       ];
     };
     postgresql = {

result

@@ -0,0 +1 @@
+/nix/store/a7kmh1b3y8p4d15539dp1jbqggbs2zfs-nixos-system-ruleit-21.05.4394.2553aee74fe

variables.nix

@@ -1,6 +0,0 @@
-{ pkgs, ... }:
-{
-  services = {
-    userdata = builtins.fromJSON (builtins.readFile ./userdata/userdata.json);
-  };
-}