nixos/hosts/elysia-clarki.nix

{
  config,
  pkgs,
  lib,
  ...
}: {
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.supportedFilesystems = ["zfs"];

  networking.hostName = "elysia-clarki";
  networking.interfaces.eno1.useDHCP = true;
  networking.hostId = "265bb40a";

  virtualisation = {
    podman = {
      enable = true;
      # Create a `docker` alias for podman, to use it as a drop-in replacement
      dockerCompat = true;
      dockerSocket.enable = true;
      defaultNetwork.dnsname.enable = true;
      extraPackages = with pkgs; [zfs];
    };
    oci-containers.backend = "podman";
    # Override storage driver
    containers.storage.settings = {
      storage = {
        driver = "zfs";
        graphroot = "/var/lib/containers/storage";
        runroot = "/run/containers/storage";
      };
    };
  };

  services.photoprism = {
    enable = true;
    url = "http://elysia-clarki:2342";
    rootDir = "/srv/hnd/photoprism";
    environmentFile = config.sops.secrets."photoprism-env".path;
  };

  services.resticConfigured = {
    enable = true;
    rootDir = "/srv/hnd/restic";
    openFirewall = true;
  };

  #### TASKSERVER ####
  services.taskserver = {
    enable = true;
    dataDir = "/srv/hnd/taskserver";
    fqdn = "elysia-clarki";
    listenHost = "0.0.0.0";
    organisations.default = {
      users = ["malte"];
    };
    pki.manual = let
      sopsPath = key: config.sops.secrets.${key}.path;
    in {
      ca.cert = sopsPath "taskserver-ca-cert";
      server.key = sopsPath "taskserver-server-key";
      server.crl = sopsPath "taskserver-server-crl";
      server.cert = sopsPath "taskserver-server-cert";
    };
  };

  services.nix-serve = {
    enable = true;
    secretKeyFile = config.sops.secrets."nix-store-signing-key".path;
  };
  networking.firewall.interfaces.${config.services.tailscale.interfaceName}.allowedTCPPorts = [
    config.services.nix-serve.port
  ];

  # TODO: This will not work until a few PRs are merged:
  #  - https://github.com/NixOS/hydra/pull/1175
  services.hydra = {
    enable = true;
    package = pkgs.hydra;
    notificationSender = "hydra@localhost";
    buildMachinesFiles = [];
    hydraURL = "elysia-clarki";
    #listenHost = "looking-glas";
    minimumDiskFree = 30;
    useSubstitutes = true;
  };
  networking.firewall.allowedTCPPorts = [config.services.hydra.port];

  nix.extraOptions = ''
    allowed-uris = http:// https://
  '';
  # TODO: Move to hash based passwords!
  systemd.services."hydra-initial-setup" = {
    description = "Setup hydra admin password once";
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      LoadCredential = "USER_PW:${config.sops.secrets."hydra-admin-password".path}";
    };
    wantedBy = lib.singleton "multi-user.target";
    requires = lib.singleton "hydra-init.service";
    after = lib.singleton "hydra-init.service";
    environment = {
      inherit (config.systemd.services.hydra-init.environment) HYDRA_DBI;
    };
    script = let
      hydra-create-user = "${pkgs.hydra}/bin/hydra-create-user";
    in ''
      if [ ! -e ~hydra/.setup-is-complete ]; then
        # create admin user
        ${hydra-create-user} admin --full-name 'Admin Mc. Admining' --email-address 'admin@elysia-clarki' --password "$USER_PW" --role admin || exit 1
        # done
        touch ~hydra/.setup-is-complete
      fi
    '';
  };

  services.fwupd.enable = true;

  #### RUNTIME SECRETS ####
  sops.defaultSopsFile = ../secrets/hosts/elysia-clarki/secrets.yaml;
  sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
  sops.secrets = let
    taskserverSecretConfig = {
      owner = config.users.users.taskd.name;
      group = config.users.groups.taskd.name;
      mode = "0440";
    };
  in {
    taskserver-ca-cert = taskserverSecretConfig;
    taskserver-server-key = taskserverSecretConfig;
    taskserver-server-crl = taskserverSecretConfig;
    hydra-admin-password = {
      owner = config.users.users.hydra.name;
      mode = "0400";
    };
    nix-store-signing-key = {
      mode = "0400";
    };
    taskserver-server-cert = taskserverSecretConfig;
    photoprism-env = {};
  };

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "21.05"; # Did you read the comment?
}