svn path=/configurations/trunk/tud/; revision=29660
svn path=/configurations/trunk/tud/; revision=29660
Eelco Dolstra committed
Oct 5, 2011 at 13:14 UTC
53e6b694ec9e673e3fb862cea44b594c0c099aae
1 file changed
+117
-68
cartman.nix
+117
-68
@@ -37,6 +37,8 @@ rec {
37
loader.grub.copyKernels = true;
38
initrd.kernelModules = ["arcmsr"];
39
kernelModules = ["kvm-intel"];
40
+ vesa = false; # otherwise "out of sync" on the KVM switch
41
+ blacklistedKernelModules = [ "i915" ];
42
};
43
44
fileSystems =
@@ -86,10 +88,14 @@ rec {
88
extraHosts = "192.168.1.5 cartman";
89
90
firewall.enable = true;
89
- firewall.allowedTCPPorts = [ 80 443 10051 ];
91
+ firewall.allowedTCPPorts = [ 80 443 843 10051 5999 ];
92
firewall.allowedUDPPorts = [ 53 67 ];
93
firewall.rejectPackets = true;
94
firewall.allowPing = true;
95
+ firewall.extraCommands =
96
+ ''
97
+ ip46tables -I nixos-fw-accept -p tcp --dport 843 --syn -j LOG --log-level info --log-prefix "POLICY REQUEST: "
98
+ '';
99
100
nat.enable = true;
101
nat.internalIPs = "192.168.1.0/22";
@@ -98,8 +104,10 @@ rec {
104
105
localCommands =
106
''
107
+ ${pkgs.iptables}/sbin/iptables -t nat -F PREROUTING
108
+
109
# lucifer ssh (to give Karl/Armijn access for the BAT project)
102
- #iptables -t nat -A PREROUTING -p tcp -i eth1 --dport 22222 -j DNAT --to 192.168.1.25:22
110
+ ${pkgs.iptables}/sbin/iptables -t nat -A PREROUTING -p tcp -d ${myIP} --dport 5950 -j DNAT --to 192.168.1.26:22
111
112
# Cleanup.
113
ip -6 route flush dev sixxs
@@ -107,7 +115,7 @@ rec {
115
ip tunnel del sixxs
116
117
# Set up a SixXS tunnel for IPv6 connectivity.
110
- ip tunnel add sixxs mode sit local 130.161.158.181 remote 192.87.102.107 ttl 64
118
+ ip tunnel add sixxs mode sit local ${myIP} remote 192.87.102.107 ttl 64
119
ip link set dev sixxs mtu 1280 up
120
ip -6 addr add 2001:610:600:88d::2/64 dev sixxs
121
ip -6 route add default via 2001:610:600:88d::1 dev sixxs
@@ -120,6 +128,10 @@ rec {
128
129
# Forward traffic to our Nova cloud to "stan".
130
ip -6 route add 2001:610:685:2::/64 via 2001:610:685:1:222:19ff:fe55:bf2e
131
+
132
+ # Amazon MTurk experiment.
133
+ ${pkgs.iptables}/sbin/iptables -t nat -A PREROUTING -p tcp -d ${myIP} --dport 5998 -j DNAT --to 192.168.1.26:5998
134
+ ${pkgs.iptables}/sbin/iptables -t nat -A PREROUTING -p tcp -d ${myIP} --dport 5999 -j DNAT --to 192.168.1.26:5999
135
'';
136
};
137
@@ -141,8 +153,8 @@ rec {
153
mailto = "rob.vermaas@gmail.com";
154
systemCronJobs =
155
[
144
- "15 0 * * * root (TZ=CET date; ${pkgs.rsync}/bin/rsync -razv --numeric-ids --delete /data/postgresql /data/webserver/tarballs unixhome.st.ewi.tudelft.nl::bfarm/) >> /var/log/backup.log 2>&1"
145
- "00 03 * * * root ${pkgs.nixUnstable}/bin/nix-collect-garbage --max-atime $(date +\\%s -d '2 weeks ago') > /var/log/gc.log 2>&1"
156
+ #"15 0 * * * root (TZ=CET date; ${pkgs.rsync}/bin/rsync -razv --numeric-ids --delete /data/postgresql /data/webserver/tarballs unixhome.st.ewi.tudelft.nl::bfarm/) >> /var/log/backup.log 2>&1"
157
+ "0 3 * * * root nix-store --gc --max-freed \"$((50 * 1024**3 - 1024 * $(df /nix/store | tail -n 1 | awk '{ print $4 }')))\" > /var/log/gc.log 2>&1"
158
"* * * * * root ${pkgs.python}/bin/python ${ZabbixApacheUpdater} -z 192.168.1.5 -c cartman"
159
160
# Force the sixxs tunnel to stay alive by periodically
@@ -152,59 +164,46 @@ rec {
164
];
165
};
166
155
- postgresql = {
156
- enable = true;
157
- enableTCPIP = true;
158
- dataDir = "/data/postgresql";
159
- authentication = ''
160
- local all mediawiki ident mediawiki-users
161
- local all all ident sameuser
162
- host all all 127.0.0.1/32 md5
163
- host all all ::1/128 md5
164
- host all all 192.168.1.18/32 md5
165
- host all all 130.161.159.80/32 md5
166
- host all all 94.208.32.143/32 md5
167
- '';
168
- };
169
-
167
httpd = {
168
enable = true;
169
logPerVirtualHost = true;
170
adminAddr = "e.dolstra@tudelft.nl";
171
hostName = "localhost";
172
176
- sslServerCert = "/root/ssl-secrets/server.crt";
177
- sslServerKey = "/root/ssl-secrets/server.key";
178
-
179
- extraModules = ["deflate"];
180
- extraConfig = ''
181
- AddType application/nix-package .nixpkg
173
+ extraModules = ["deflate"];
174
+ extraConfig =
175
+ ''
176
+ AddType application/nix-package .nixpkg
177
183
- SSLProtocol all -TLSv1
184
-
185
- <Location /server-status>
186
- SetHandler server-status
187
- Allow from 127.0.0.1 # If using a remote host for monitoring replace 127.0.0.1 with its IP.
188
- Order deny,allow
189
- Deny from all
190
- </Location>
191
- ExtendedStatus On
192
- '';
178
+ <Location /server-status>
179
+ SetHandler server-status
180
+ Allow from 127.0.0.1 # If using a remote host for monitoring replace 127.0.0.1 with its IP.
181
+ Order deny,allow
182
+ Deny from all
183
+ </Location>
184
+
185
+ ExtendedStatus On
186
+ '';
187
194
- servedFiles = [
195
- { urlPath = "/releases.css";
196
- file = releasesCSS;
197
- }
198
- { urlPath = "/css/releases.css"; # legacy; old releases point here
199
- file = releasesCSS;
200
- }
201
- { urlPath = "/releases/css/releases.css"; # legacy; old releases point here
202
- file = releasesCSS;
203
- }
204
- ];
188
+ servedFiles =
189
+ [ { urlPath = "/releases.css";
190
+ file = releasesCSS;
191
+ }
192
+ { urlPath = "/css/releases.css"; # legacy; old releases point here
193
+ file = releasesCSS;
194
+ }
195
+ { urlPath = "/releases/css/releases.css"; # legacy; old releases point here
196
+ file = releasesCSS;
197
+ }
198
+ ];
199
200
virtualHosts = [
201
202
+ { # Catch-all site.
203
+ hostName = "www.nixos.org";
204
+ globalRedirect = "http://nixos.org/";
205
+ }
206
+
207
{ hostName = "buildfarm.st.ewi.tudelft.nl";
208
documentRoot = cleanSource ./webroot;
209
enableUserDir = true;
@@ -249,6 +248,8 @@ rec {
248
# go to svn.strategoxt.org.
249
{ hostName = "buildfarm.st.ewi.tudelft.nl";
250
enableSSL = true;
251
+ sslServerCert = "/root/ssl-secrets/server.crt";
252
+ sslServerKey = "/root/ssl-secrets/server.key";
253
globalRedirect = "http://buildfarm.st.ewi.tudelft.nl/";
254
}
255
@@ -275,6 +276,8 @@ rec {
276
277
{ hostName = "svn.strategoxt.org";
278
enableSSL = true;
279
+ sslServerCert = "/root/ssl-secrets/server.crt";
280
+ sslServerKey = "/root/ssl-secrets/server.key";
281
extraSubservices = [
282
{ function = import /etc/nixos/services/subversion;
283
id = "strategoxt";
@@ -322,6 +325,34 @@ rec {
325
documentRoot = "/data/webserver/dist/strategoxt2";
326
}
327
328
+ { hostName = "ssl.nixos.org";
329
+ serverAliases = [ "ipv6.nixos.org" ];
330
+ documentRoot = "/home/eelco/nix-homepage";
331
+ enableSSL = true;
332
+ sslServerCert = "/root/ssl-secrets/ssl-nixos-org.crt";
333
+ sslServerKey = "/root/ssl-secrets/ssl-nixos-org.key";
334
+ extraConfig =
335
+ ''
336
+ SSLCertificateChainFile /root/ssl-secrets/startssl-class1.pem
337
+ SSLCACertificateFile /root/ssl-secrets/startssl-ca.pem
338
+ '';
339
+ extraSubservices = [
340
+ { function = import /etc/nixos/services/subversion;
341
+ id = "nix";
342
+ urlPrefix = "";
343
+ toplevelRedirect = false;
344
+ dataDir = "/data/subversion-nix";
345
+ notificationSender = "svn@svn.nixos.org";
346
+ userCreationDomain = "st.ewi.tudelft.nl";
347
+ organisation = {
348
+ name = "Nix";
349
+ url = http://nixos.org/;
350
+ logo = http://nixos.org/logo/nixos-lores.png;
351
+ };
352
+ }
353
+ ];
354
+ }
355
+
356
{ hostName = "nixos.org";
357
serverAliases = [ "ipv6.nixos.org" ];
358
documentRoot = "/home/eelco/nix-homepage";
@@ -345,6 +376,18 @@ rec {
376
file = releasesCSS;
377
}
378
];
379
+
380
+ extraConfig = ''
381
+ <Proxy *>
382
+ Order deny,allow
383
+ Allow from all
384
+ </Proxy>
385
+
386
+ ProxyPass /mturk http://wendy:3000/mturk retry=5
387
+ ProxyPassReverse /mturk http://wendy:3000/mturk
388
+ ProxyPass /mturk-sandbox http://wendy:3001/mturk-sandbox retry=5
389
+ ProxyPassReverse /mturk-sandbox http://wendy:3001/mturk-sandbox
390
+ '';
391
}
392
393
{ hostName = "syntax-definition.org";
@@ -360,12 +403,10 @@ rec {
403
];
404
}
405
363
- { hostName = "www.nixos.org";
364
- globalRedirect = "http://nixos.org/";
365
- }
366
-
406
{ hostName = "svn.nixos.org";
407
enableSSL = true;
408
+ sslServerCert = "/root/ssl-secrets/server.crt";
409
+ sslServerKey = "/root/ssl-secrets/server.key";
410
extraSubservices = [
411
{ function = import /etc/nixos/services/subversion;
412
id = "nix";
@@ -431,12 +472,16 @@ rec {
472
{ serviceType = "mediawiki";
473
siteName = "Nix Wiki";
474
logo = "http://nixos.org/logo/nix-wiki.png";
475
+ defaultSkin = "nixos";
476
extraConfig =
477
''
478
$wgEmailConfirmToEdit = true;
479
'';
480
enableUploads = true;
481
uploadDir = "/data/nixos-mediawiki-upload";
482
+ dbServer = "webdsl.org";
483
+ dbUser = "mediawiki";
484
+ dbPassword = import ./mediawiki-password.nix;
485
}
486
];
487
}
@@ -474,7 +519,7 @@ rec {
519
'';
520
}
521
477
- { hostName = "vnc.nixos.org";
522
+ { hostName = "mturk.nixos.org";
523
extraConfig = ''
524
<Proxy *>
525
Order deny,allow
@@ -483,8 +528,20 @@ rec {
528
529
ProxyRequests Off
530
ProxyPreserveHost On
486
- ProxyPass / http://stan:6080/ retry=5
487
- ProxyPassReverse / http://stan:6080/
531
+ ProxyPass / http://wendy/~mturk/ retry=5
532
+ ProxyPassReverse / http://wendy/~mturk/
533
+ '';
534
+ }
535
+
536
+ { hostName = "mturk-view.nixos.org";
537
+ extraConfig = ''
538
+ Redirect permanent / http://nixos.org/mturk/
539
+ '';
540
+ }
541
+
542
+ { hostName = "mturk-view-sandbox.nixos.org";
543
+ extraConfig = ''
544
+ Redirect permanent / http://nixos.org/mturk-sandbox/
545
'';
546
}
547
@@ -496,14 +553,10 @@ rec {
553
backups =
554
let genericBackup = { server = "webdata.tudelft.nl";
555
protocol = "webdav";
499
- https = true ;
556
+ https = true;
557
symlinks = "ignore";
558
};
559
in [
503
- ( genericBackup // { name = "postgresql";
504
- local = config.services.postgresqlBackup.location;
505
- remote = "/staff-groups/ewi/st/strategoxt/backup/postgresql";
506
- } )
560
( genericBackup // { name = "subversion";
561
local = "/data/subversion";
562
remote = "/staff-groups/ewi/st/strategoxt/backup/subversion/subversion";
@@ -511,7 +564,6 @@ rec {
564
( genericBackup // { name = "subversion-nix";
565
local = "/data/subversion-nix";
566
remote = "/staff-groups/ewi/st/strategoxt/backup/subversion/subversion-nix";
514
- period = "15 03 * * *";
567
} )
568
( genericBackup // { name = "subversion-ptg";
569
local = "/data/subversion-ptg";
@@ -520,27 +572,22 @@ rec {
572
( genericBackup // { name = "subversion-strategoxt";
573
local = "/data/subversion-strategoxt";
574
remote = "/staff-groups/ewi/st/strategoxt/backup/subversion/subversion-strategoxt";
523
- period = "15 02 * * *";
575
} )
576
( genericBackup // { name = "webserver-dist-nix";
577
local = "/data/webserver/dist/nix";
578
remote = "/staff-groups/ewi/st/strategoxt/backup/webserver-dist-nix";
528
- period = "5 03 * * *";
579
} )
580
# ( genericBackup // { name = "webserver-tarballs";
581
# local = "/data/webserver/tarballs";
582
# remote = "/staff-groups/ewi/st/strategoxt/backup/webserver-tarballs";
533
-# period = "5 03 * * *";
583
# } )
584
( genericBackup // { name = "pt-wiki";
585
local = "/data/pt-wiki";
586
remote = "/staff-groups/ewi/st/strategoxt/backup/pt-wiki";
538
- period = "55 02 * * *";
587
} )
588
( genericBackup // { name = "nixos-mediawiki-upload";
589
local = "/data/nixos-mediawiki-upload";
590
remote = "/staff-groups/ewi/st/strategoxt/backup/nixos-mediawiki-upload";
543
- period = "20 03 * * *";
591
} )
592
];
593
};
@@ -548,9 +595,11 @@ rec {
595
zabbixAgent.enable = true;
596
597
zabbixServer.enable = true;
551
- zabbixServer.dbServer = "lucifer";
598
+ zabbixServer.dbServer = "webdsl.org";
599
zabbixServer.dbPassword = import ./zabbix-password.nix;
600
601
+ flashpolicyd.enable = true;
602
+
603
};
604
605
# Needed for the Nixpkgs mirror script.
@@ -585,8 +634,8 @@ rec {
634
(flip concatMapStrings machines (m: "${m.ipAddress} ${m.hostName}\n"));
635
636
in
588
- { startOn = "network-interfaces";
637
+ { startOn = "started network-interfaces";
638
exec = "${pkgs.dnsmasq}/bin/dnsmasq --conf-file=${confFile}";
639
};
591
-
640
+
641
}