Start migrating config to NixOS modules

modules/backup-job.nix

@@ -1,10 +1,12 @@
 { config, lib, pkgs, ... }:
 with lib;
 let
-  cfg = config.services.custom-backup-job;
+  cfg = config.custom.services.backup-job;
 in
 {
-  options.services.custom-backup-job = {
+  options.custom.services.backup-job = {
+    enable = mkEnableOption "backup-job";
+
     additionalPaths = mkOption {
       type = with types; listOf path;
       default = [ ];
@@ -35,7 +37,7 @@ in
     };
   };
 
-  config = {
+  config = mkIf cfg.enable {
 
     sops.secrets = {
       borgPassphrase = {
@@ -43,6 +45,7 @@ in
         key = "borg/passphrase";
       };
     };
+
     services.borgbackup.jobs.data = {
       paths = [ "/nix/var/data" cfg.sshKey ] ++ cfg.additionalPaths;
       doInit = false;

modules/binary-cache.nix

@@ -1,13 +1,20 @@
-{ config, ... }:
+{ config, lib, ... }:
+with lib;
+let
+  cfg = config.custom.services.binary-cache;
+in
 {
+  options.custom.services.binary-cache = {
 
-  sops.secrets = {
+    enable = mkEnableOption "binary-cache";
-    nixCacheKey = {
+
-      key = "nix/cache_secret_key";
+    secretKeyFile = mkOption {
+      type = types.path;
     };
   };
 
 
+  config = mkIf cfg.enable {
     services.nix-serve = {
       enable = true;
       port = 1500;
@@ -30,4 +37,5 @@
         };
       };
     };
+  };
 }

modules/default.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    ./backup-job.nix
+    ./monit.nix
+    ./gitlab-runner.nix
+    ./openssh.nix
+    ./murmur.nix
+  ];
+}

modules/dokuwiki.nix

@@ -1,5 +1,8 @@
 { config, lib, pkgs, ... }:
+with lib;
 let
+  cfg = config.custom.services.dokuwiki;
+
   configureWiki = name: {
 
     sops.secrets."usersFile-${name}" = {
@@ -25,7 +28,20 @@ let
     };
   };
 in
-lib.mkMerge [
+{
+  options.custom.services.dokuwiki = {
+
+    enable = mkEnableOption "dokuwiki";
+
+    secretKeyFile = mkOption {
+      type = types.path;
+    };
+  };
+
+
+  config = mkIf cfg.enable
+    (lib.mkMerge [
       (configureWiki "anderia")
       (configureWiki "arkadia")
-]
+    ]);
+}

modules/gitlab-runner.nix

@@ -1,5 +1,14 @@
 { config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.custom.services.gitlab-runner;
+in
 {
+  options.custom.services.gitlab-runner = {
+    enable = mkEnableOption "gitlab-runner";
+  };
+
+  config = mkIf cfg.enable {
     sops.secrets = {
       runnerRegistrationConfig = {
         owner = config.users.users.gitlab-runner.name;
@@ -79,4 +88,5 @@
           system.stateVersion = "22.05";
         };
     };
+  };
 }

modules/monit.nix

@@ -1,10 +1,12 @@
 { config, lib, pkgs, ... }:
 with lib;
 let
-  cfg = config.services.custom-monit;
+  cfg = config.custom.services.monit;
 in
 {
-  options.services.custom-monit = {
+  options.custom.services.monit = {
+    enable = mkEnableOption "monit";
+
     additionalConfig = mkOption {
       type = types.lines;
       default = "";

modules/murmur.nix

@@ -1,5 +1,15 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
+with lib;
+let
+  cfg = config.custom.services.murmur;
+in
 {
+  options.custom.services.murmur = {
+    enable = mkEnableOption "murmur";
+  };
+
+
+  config = mkIf cfg.enable {
     sops.secrets.murmurEnvFile = {
       owner = config.systemd.services.murmur.serviceConfig.User;
       key = "murmur.env";
@@ -13,4 +23,5 @@
       environmentFile = config.sops.secrets.murmurEnvFile.path;
       imgMsgLength = 13107200;
     };
+  };
 }

modules/openssh.nix

@@ -1,9 +1,20 @@
-{ pkgs, lib, config, ... }:
+{ config, lib, ... }:
+with lib;
+let
+  cfg = config.custom.services.openssh;
+in
 {
+  options.custom.services.openssh = {
+    enable = mkEnableOption "openssh";
+  };
+
+
+  config = mkIf cfg.enable {
     services.openssh.enable = true;
     services.openssh.permitRootLogin = "prohibit-password";
     users.users.root.openssh.authorizedKeys.keyFiles = [
       ../ssh_keys/phfroidmont-desktop.pub
       ../ssh_keys/froidmpa-laptop.pub
     ];
+  };
 }

profiles/backend.nix

@@ -3,13 +3,10 @@
   imports = [
     ../environment.nix
     ../hardware/hcloud.nix
-    ../modules/openssh.nix
+    ../modules
     ../modules/nginx.nix
-    ../modules/murmur.nix
     ../modules/synapse.nix
     ../modules/nextcloud.nix
-    ../modules/custom-backup-job.nix
-    ../modules/custom-monit.nix
     ../modules/dokuwiki.nix
     ../modules/website-marie.nix
     ../modules/roundcube.nix
@@ -23,7 +20,9 @@
     };
   };
 
-  services.custom-backup-job = {
+  custom = {
+    services.backup-job = {
+      enable = true;
       additionalPaths = [ "/var/lib/nextcloud/config" ];
       readWritePaths = [ "/nix/var/data/murmur" "/nix/var/data/backup/" ];
       preHook = ''
@@ -36,7 +35,9 @@
       sshKey = config.sops.secrets.borgSshKey.path;
     };
 
-  services.custom-monit.additionalConfig = ''
+    services.monit = {
+      enable = true;
+      additionalConfig = ''
         check file nextcloud-data-mounted with path /var/lib/nextcloud/data/index.html
           start = "${pkgs.systemd}/bin/systemctl start nextcloud-data-sshfs.service"
 
@@ -53,6 +54,16 @@
               with timeout 20 seconds
           then alert
       '';
+    };
+
+    services.dokuwiki.enable = true;
+
+    services.openssh.enable = true;
+
+    services.murmur.enable = true;
+  };
+
+
 
   networking.interfaces.enp1s0 = {
     useDHCP = true;

profiles/db.nix

@@ -3,10 +3,8 @@
   imports = [
     ../environment.nix
     ../hardware/hcloud.nix
-    ../modules/openssh.nix
+    ../modules
     ../modules/postgresql.nix
-    ../modules/custom-backup-job.nix
-    ../modules/custom-monit.nix
     ../modules/monitoring-exporters.nix
   ];
 
@@ -19,7 +17,9 @@
     };
   };
 
-  services.custom-backup-job = {
+  custom = {
+    services.backup-job = {
+      enable = true;
       readWritePaths = [ "/nix/var/data/postgresql" "/nix/var/data/backup/" ];
       preHook = ''
         ${pkgs.postgresql_12}/bin/pg_dump -U synapse synapse > /nix/var/data/postgresql/synapse.dmp
@@ -31,4 +31,7 @@
       sshKey = config.sops.secrets.borgSshKey.path;
     };
 
+    services.openssh.enable = true;
+  };
+
 }

profiles/storage.nix

@@ -3,6 +3,7 @@
   imports = [
     ../environment.nix
     ../hardware/hetzner-dedicated-storage1.nix
+    ../modules
     ../modules/openssh.nix
     ../modules/mailserver.nix
     ../modules/nginx.nix
@@ -10,10 +11,7 @@
     ../modules/stb.nix
     ../modules/monero.nix
     ../modules/torrents.nix
-    ../modules/custom-backup-job.nix
-    ../modules/custom-monit.nix
     ../modules/jitsi.nix
-    ../modules/gitlab-runner.nix
     ../modules/binary-cache.nix
     ../modules/grafana.nix
     ../modules/monitoring-exporters.nix
@@ -24,6 +22,47 @@
       owner = config.services.borgbackup.jobs.data.user;
       key = "borg/client_keys/storage1/private";
     };
+    nixCacheKey = {
+      key = "nix/cache_secret_key";
+    };
+  };
+
+  custom = {
+    services.binary-cache = {
+      enable = true;
+      secretKeyFile = config.sops.secrets.nixCacheKey.path;
+    };
+
+    services.backup-job = {
+      enable = true;
+      readWritePaths = [ "/nix/var/data/backup" ];
+      preHook = "${pkgs.docker}/bin/docker exec stb-mariadb sh -c 'mysqldump -u stb -pstb stb' > /nix/var/data/backup/stb_mariadb.sql";
+      postHook = "touch /nix/var/data/backup/backup-ok";
+      startAt = "04:00";
+      sshKey = config.sops.secrets.borgSshKey.path;
+    };
+
+    services.monit = {
+      enable = true;
+      additionalConfig = ''
+        check host nextcloud with address cloud.banditlair.com
+          if failed port 443 protocol https with timeout 20 seconds then alert
+        check host anderia-wiki with address anderia.banditlair.com
+          if failed port 443 protocol https with timeout 20 seconds then alert
+        check host arkadia-wiki with address arkadia.banditlair.com
+          if failed port 443 protocol https with timeout 20 seconds then alert
+        check host website-marie with address osteopathie.froidmont.org
+          if failed port 443 protocol https with timeout 20 seconds then alert
+        check host webmail with address webmail.banditlair.com
+          if failed port 443 protocol https with timeout 20 seconds then alert
+
+        check program raid-md127 with path "${pkgs.mdadm}/bin/mdadm --misc --detail --test /dev/md127"
+          if status != 0 then alert
+      '';
+    };
+
+    services.gitlab-runner.enable = true;
+    services.openssh.enable = true;
   };
 
   networking.firewall.allowedTCPPorts = [ 80 443 18080 ];
@@ -49,30 +88,6 @@
   };
   users.groups.steam = { };
 
-  services.custom-backup-job = {
-    readWritePaths = [ "/nix/var/data/backup" ];
-    preHook = "${pkgs.docker}/bin/docker exec stb-mariadb sh -c 'mysqldump -u stb -pstb stb' > /nix/var/data/backup/stb_mariadb.sql";
-    postHook = "touch /nix/var/data/backup/backup-ok";
-    startAt = "04:00";
-    sshKey = config.sops.secrets.borgSshKey.path;
-  };
-
-  services.custom-monit.additionalConfig = ''
-    check host nextcloud with address cloud.banditlair.com
-      if failed port 443 protocol https with timeout 20 seconds then alert
-    check host anderia-wiki with address anderia.banditlair.com
-      if failed port 443 protocol https with timeout 20 seconds then alert
-    check host arkadia-wiki with address arkadia.banditlair.com
-      if failed port 443 protocol https with timeout 20 seconds then alert
-    check host website-marie with address osteopathie.froidmont.org
-      if failed port 443 protocol https with timeout 20 seconds then alert
-    check host webmail with address webmail.banditlair.com
-      if failed port 443 protocol https with timeout 20 seconds then alert
-
-    check program raid-md127 with path "${pkgs.mdadm}/bin/mdadm --misc --detail --test /dev/md127"
-      if status != 0 then alert
-  '';
-
   services.minecraft-server = {
     enable = true;
     package = pkgs-unstable.minecraft-server;