@cryptotaxi247 / infra-1 / commits / f70e6b1e

Move stuff over from cartman

Eelco Dolstra committed Jun 7, 2013 at 17:00 UTC f70e6b1e1198030bc813cf4ed2aae08ba2ddfcfb
1 file changed +79 -19
nixos-org/webserver.nix
+79 -19
@@ -13,10 +13,10 @@ let
13 [ { urlPath = "/tarballs";
14 dir = "/tarballs";
15 }
16 - /*
16 { urlPath = "/irc";
18 - dir = "/data/webserver/irc";
17 + dir = "/data/irc";
18 }
19 + /*
20 { urlPath = "/update";
21 dir = "/data/webserver/update";
22 }
@@ -35,11 +35,6 @@ let
35 { urlPath = "/releases";
36 dir = "/releases";
37 }
38 - /*
39 - { urlPath = "/binary-cache";
40 - dir = "/data/releases/binary-cache";
41 - }
42 - */
38 ];
39
40 extraConfig =
@@ -64,6 +59,8 @@ let
59 <Location /releases/binary-cache>
60 ErrorDocument 404 "No such file."
61 </Location>
62 +
63 + Redirect /binary-cache http://cache.nixos.org
64 '';
65
66 extraSubservices =
@@ -88,24 +85,17 @@ let
85 enableUploads = true;
86 uploadDir = "/data/nixos-mediawiki-upload";
87 }
91 - { function = import <services/subversion>;
92 - id = "nix";
93 - urlPrefix = "";
94 - toplevelRedirect = false;
95 - dataDir = "/data/subversion-nix";
96 - notificationSender = "svn@svn.nixos.org";
97 - organisation = {
98 - name = "Nix";
99 - url = http://nixos.org/;
100 - logo = "/logo/nixos-lores.png";
101 - };
102 - }
88 ];
89 };
90
91 in
92
93 {
94 + networking.firewall.enable = true;
95 + networking.firewall.rejectPackets = true;
96 + networking.firewall.allowPing = true;
97 + networking.firewall.allowedTCPPorts = [ 80 443 ];
98 +
99 security.pam.enableSSHAgentAuth = true;
100
101 services.httpd = {
@@ -145,6 +135,33 @@ in
135
136 nixosVHostConfig
137
138 + (nixosVHostConfig // {
139 + enableSSL = true;
140 + sslServerCert = "/root/ssl-secrets/ssl-nixos-org.crt";
141 + sslServerKey = "/root/ssl-secrets/ssl-nixos-org.key";
142 + extraConfig = nixosVHostConfig.extraConfig +
143 + ''
144 + SSLCertificateChainFile /root/ssl-secrets/startssl-class1.pem
145 + SSLCACertificateFile /root/ssl-secrets/startssl-ca.pem
146 + # Required by Catalyst.
147 + RequestHeader set X-Forwarded-Port 443
148 + '';
149 + extraSubservices = nixosVHostConfig.extraSubservices ++
150 + [ { function = import <services/subversion>;
151 + id = "nix";
152 + urlPrefix = "";
153 + toplevelRedirect = false;
154 + dataDir = "/data/subversion-nix";
155 + notificationSender = "svn@svn.nixos.org";
156 + organisation = {
157 + name = "Nix";
158 + url = http://nixos.org/;
159 + logo = "/logo/nixos-lores.png";
160 + };
161 + }
162 + ];
163 + })
164 +
165 { hostName = "tarballs.nixos.org";
166 documentRoot = "/tarballs";
167 }
@@ -176,6 +193,29 @@ in
193 [ "ssh-dss AAAAB3NzaC1kc3MAAACBAOo3foMFsYvc+LEVVTAeXpaxdOFG6O2NE9coxZYN6UtwE477GwkvZ4uKymAekq3TB8I6dDg4QFfE27fIip/rQHJ/Rus+KsxwnTbwPzE0WcZVpkKQsepsoqLkfwMpiPfn5/oxcnJsimwRY/E95aJmmOHdGaYWrc0t4ARa+6teUgdFAAAAFQCSQq2Wil0/X4hDypGGUKlKvYyaWQAAAIAy/0fSDnz1tZOQBGq7q78y406HfWghErrVlrW9g+foJQG5pgXXcdJs9JCIrlaKivUKITDsYnQaCjrZaK8eHnc4ksbkSLfDOxFnR5814ulCftrgEDOv9K1UU3pYketjFMvQCA2U48lR6jG/99CPNXPH55QEFs8H97cIsdLQw9wM4gAAAIEAmzWZlXLzIf3eiHQggXqvw3+C19QvxQITcYHYVTx/XYqZi1VZ/fkY8bNmdcJsWFyOHgEhpEca+xM/SNvH/14rXDmt0wtclLEx/4GVLi59hQCnnKqv7HzJg8RF4v6XTiROBAEEdb4TaFuFn+JCvqPzilTzXTexvZKJECOvfYcY+10= eelco.dolstra@logicblox.com" ];
194 };
195
196 + users.extraUsers.rbvermaa =
197 + { createHome = true;
198 + description = "Rob Vermaas";
199 + extraGroups = [ "wheel" ];
200 + group = "users";
201 + home = "/home/rbvermaa";
202 + isSystemUser = false;
203 + useDefaultShell = true;
204 + openssh.authorizedKeys.keys =
205 + [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDI6/qMXX80oWm+NyftRw45D+mRJwJQ6gexkUhp1OgZc3MuW6Zm2RO2IZHEjJLSMUndZebbznPmPPM58VxiyQnRYH2+hn+qCrwSsyCUxA8Gz6PpxeaeUMlpbsuXOPFbvBraDZEqIvx/gIK849nIahGz3EcfaY73lVRP+MrrVHBGyQmaOLoNfzrJp8rZfLqokQQXmG1d3DzjkIi87TZLgrdxQewpk/4eKBKf8FDnEYeV3ood78SPa3syS48al99Q7e8JyAEZJfyCQkUSUxgSizU5+se1A5seDJg2Vsqef1Ah23g/lTtSn93vtjjLvObvMJTSplBO8ttG/3ylIewWYER/ rbvermaa@nixos" ];
206 + };
207 +
208 + users.extraUsers.irclogs =
209 + { createHome = true;
210 + description = "#nixos IRC Logging";
211 + group = "users";
212 + home = "/home/irclogs";
213 + isSystemUser = false;
214 + useDefaultShell = true;
215 + openssh.authorizedKeys.keys =
216 + [ "ssh-dss AAAAB3NzaC1kc3MAAACBAMrcUf4qQj8XcG1nfG5/6rbfb4a89nV13KcJLBOVWa3Tn4YHeVz1lQDRHvnLK9YKM7MybDXD2wVG5nKuMbJMW5aZPEGrVUM4SQFXtnaNBgmoACrbG978Da/vNjGY89Q7GS/YqA24ASKnc09cRFsTmU0e/9BCbz9zXO4sJ8GaGHz7AAAAFQDZrJCdxTQ8GVvoFjL9Q1s1VHiClwAAAIBK+6r/kP/9VUzfRepEHCVObTIRYIhC9YcIZe2pMyCQSUIAjkGd5hkA8XQecs5/ym5Ddm2j61Kvt2jtGXQVP2F04wIFDuGK4GAfPpYjvLJaXtVxj1Ho4K2W/+WgKG1NEh466myZNsHr3v1MufbxNIS03lg6s8oJI4TmCaWtVHNW+AAAAIEAqh+ablUfEZAr6" ];
217 + };
218 +
219 users.extraUsers.tarball-mirror =
220 { description = "Nixpkg starball mirroring user";
221 home = "/home/tarball-mirror";
@@ -184,6 +224,24 @@ in
224 openssh.authorizedKeys.keys = singleton "ssh-dss AAAAB3NzaC1kc3MAAACBAOo3foMFsYvc+LEVVTAeXpaxdOFG6O2NE9coxZYN6UtwE477GwkvZ4uKymAekq3TB8I6dDg4QFfE27fIip/rQHJ/Rus+KsxwnTbwPzE0WcZVpkKQsepsoqLkfwMpiPfn5/oxcnJsimwRY/E95aJmmOHdGaYWrc0t4ARa+6teUgdFAAAAFQCSQq2Wil0/X4hDypGGUKlKvYyaWQAAAIAy/0fSDnz1tZOQBGq7q78y406HfWghErrVlrW9g+foJQG5pgXXcdJs9JCIrlaKivUKITDsYnQaCjrZaK8eHnc4ksbkSLfDOxFnR5814ulCftrgEDOv9K1UU3pYketjFMvQCA2U48lR6jG/99CPNXPH55QEFs8H97cIsdLQw9wM4gAAAIEAmzWZlXLzIf3eiHQggXqvw3+C19QvxQITcYHYVTx/XYqZi1VZ/fkY8bNmdcJsWFyOHgEhpEca+xM/SNvH/14rXDmt0wtclLEx/4GVLi59hQCnnKqv7HzJg8RF4v6XTiROBAEEdb4TaFuFn+JCvqPzilTzXTexvZKJECOvfYcY+10= eelco.dolstra@logicblox.com";
225 };
226
227 + systemd.services.mirror-tarballs =
228 + { description = "Mirror Nixpkgs tarballs";
229 + path = [ config.environment.nix pkgs.curl pkgs.git ];
230 + #environment.DRY_RUN = "1";
231 + environment.HYDRA_DISALLOW_UNFREE = "1";
232 + environment.NIX_PATH = "nixpkgs=/home/tarball-mirror/nixpkgs";
233 + environment.NIX_REMOTE = "daemon";
234 + environment.CURL_CA_BUNDLE = "/etc/ssl/certs/ca-bundle.crt";
235 + serviceConfig.User = "tarball-mirror";
236 + script =
237 + ''
238 + export NIX_CURL_FLAGS="--silent --show-error --connect-timeout 30"
239 + cd /home/tarball-mirror/nixpkgs
240 + git pull
241 + exec /nix/var/nix/profiles/per-user/root/channels/nixos/nixpkgs/maintainers/scripts/copy-tarballs.sh
242 + '';
243 + };
244 +
245 system.activationScripts.setShmMax =
246 ''
247 ${pkgs.procps}/sbin/sysctl -q -w kernel.shmmax=$((1 * 1024**3))
@@ -192,6 +250,7 @@ in
250 services.postgresql = {
251 enable = true;
252 package = pkgs.postgresql92;
253 + dataDir = "/data/postgresql";
254 extraConfig = ''
255 max_connections = 10
256 work_mem = 16MB
@@ -208,4 +267,5 @@ in
267 mwusers wwwrun mediawiki
268 '';
269 };
270 +
271 }