nixos/hosts/elysia-clarki.nix

{
  config,
  pkgs,
  lib,
  ...
}: let
  sopsPath = key: config.sops.secrets.${key}.path;
in {
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  boot.supportedFilesystems = ["zfs"];

  networking.hostName = "elysia-clarki";
  networking.interfaces.eno1.useDHCP = true;
  networking.hostId = "265bb40a";

  settings.ssh.openOutsideVPN = true;

  virtualisation = {
    podman = {
      enable = true;
      # Create a `docker` alias for podman, to use it as a drop-in replacement
      dockerCompat = true;
      dockerSocket.enable = true;
      defaultNetwork.dnsname.enable = true;
      extraPackages = with pkgs; [zfs];
    };
    oci-containers.backend = "podman";
    # Override storage driver
    containers.storage.settings = {
      storage = {
        driver = "zfs";
        graphroot = "/var/lib/containers/storage";
        runroot = "/run/containers/storage";
      };
    };
  };

  services.photoprism = {
    enable = true;
    url = "https://elysia-clarki";
    port = 2342;
    rootDir = "/srv/hnd/photoprism";
    environmentFile = config.sops.secrets."photoprism-env".path;
  };
  services.nginx.virtualHosts."foto.home" = {
    forceSSL = true;
    sslTrustedCertificate = pkgs.writeText "ca.crt" (builtins.readFile ../secrets/ca.crt);
    sslCertificateKey = sopsPath "nginx-cert-key";
    sslCertificate = sopsPath "nginx-cert-crt";
    locations."/" = {
      proxyPass = "http://localhost:${builtins.toString config.services.photoprism.port}";
      proxyWebsockets = true;
    };
  };

  services.resticConfigured = {
    enable = true;
    rootDir = "/srv/hnd/restic";
    openFirewall = true;
  };

  #### TASKSERVER ####
  services.taskserver = {
    enable = true;
    dataDir = "/srv/hnd/taskserver";
    fqdn = "elysia-clarki";
    listenHost = "0.0.0.0";
    organisations.default = {
      users = ["malte"];
    };
    pki.manual = {
      ca.cert = sopsPath "taskserver-ca-cert";
      server.key = sopsPath "taskserver-server-key";
      server.crl = sopsPath "taskserver-server-crl";
      server.cert = sopsPath "taskserver-server-cert";
    };
  };

  # Everything related to the binary cache and hydra
  # ‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾
  services.nix-serve = {
    enable = true;
    secretKeyFile = config.sops.secrets."nix-store-signing-key".path;
  };
  networking.firewall.interfaces.${config.services.tailscale.interfaceName}.allowedTCPPorts = [
    config.services.nix-serve.port
  ];

  services.hydra = {
    enable = true;
    package = pkgs.hydra;
    notificationSender = "hydra@home";
    hydraURL = "hydra.home";
    minimumDiskFree = 10;
    useSubstitutes = true;
  };
  nix.buildMachines = [
    {
      hostName = "helix-texta";
      maxJobs = 6;
      speedFactor = 16;
      sshKey = "/run/secrets/hydra-overseer-key";
      sshUser = "hydra-minion";
      supportedFeatures = ["kvm" "big-parallel"];
      systems = ["x86_64-linux" "i686-linux"];
    }
    {
      hostName = "murex-pecten";
      maxJobs = 6;
      speedFactor = 32;
      sshKey = "/run/secrets/hydra-overseer-key";
      sshUser = "hydra-minion";
      supportedFeatures = ["kvm" "big-parallel"];
      systems = ["x86_64-linux" "i686-linux"];
    }
  ];
  # TODO: This doesn't seem to work
  programs.ssh.extraConfig = ''
    Host *
      StrictHostKeyChecking accept-new
  '';
  nix.extraOptions = ''
    allowed-uris = http:// https://
  '';
  # TODO: Move to hash based passwords!
  systemd.services."hydra-initial-setup" = {
    description = "Setup hydra admin password once";
    serviceConfig = {
      Type = "oneshot";
      RemainAfterExit = true;
      LoadCredential = "USER_PW:${config.sops.secrets."hydra-admin-password".path}";
    };
    wantedBy = lib.singleton "multi-user.target";
    requires = lib.singleton "hydra-init.service";
    after = lib.singleton "hydra-init.service";
    environment = {
      inherit (config.systemd.services.hydra-init.environment) HYDRA_DBI;
    };
    script = let
      hydra-create-user = "${pkgs.hydra}/bin/hydra-create-user";
    in ''
      if [ ! -e ~hydra/.setup-is-complete ]; then
        # create admin user
        ${hydra-create-user} admin --full-name 'Admin Mc. Admining' --email-address 'admin@elysia-clarki' --password "$USER_PW" --role admin || exit 1
        # done
        touch ~hydra/.setup-is-complete
      fi
    '';
  };
  services.nginx.virtualHosts."hydra.home" = {
    forceSSL = true;
    sslTrustedCertificate = pkgs.writeText "ca.crt" (builtins.readFile ../secrets/ca.crt);
    sslCertificateKey = sopsPath "nginx-cert-key";
    sslCertificate = sopsPath "nginx-cert-crt";
    locations."/" = {
      proxyPass = "http://localhost:${builtins.toString config.services.hydra.port}";
    };
  };

  services.fwupd.enable = true;

  #### RUNTIME SECRETS ####
  sops.defaultSopsFile = ../secrets/hosts/elysia-clarki/secrets.yaml;
  sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
  sops.secrets = let
    taskserverSecretConfig = {
      owner = config.users.users.taskd.name;
      group = config.users.groups.taskd.name;
      mode = "0440";
    };
  in {
    taskserver-ca-cert = taskserverSecretConfig;
    taskserver-server-key = taskserverSecretConfig;
    taskserver-server-crl = taskserverSecretConfig;
    hydra-admin-password = {
      owner = config.users.users.hydra.name;
      mode = "0400";
    };
    nix-store-signing-key = {
      mode = "0400";
    };
    taskserver-server-cert = taskserverSecretConfig;
    photoprism-env = {};
    nginx-cert-key = {
      owner = config.users.users.nginx.name;
      mode = "0400";
    };
    nginx-cert-crt = {
      owner = config.users.users.nginx.name;
      mode = "0400";
    };
    hydra-overseer-key = {
      owner = config.users.users.hydra-queue-runner.name;
      mode = "0400";
    };
  };

  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
  system.stateVersion = "21.05"; # Did you read the comment?
}