Start migrating config to NixOS modules

modules/backup-job.nix

@@ -1,10 +1,12 @@
 { config, lib, pkgs, ... }:
 with lib;
 let
-  cfg = config.services.custom-backup-job;
+  cfg = config.custom.services.backup-job;
 in
 {
-  options.services.custom-backup-job = {
+  options.custom.services.backup-job = {
+    enable = mkEnableOption "backup-job";
+
     additionalPaths = mkOption {
       type = with types; listOf path;
       default = [ ];
@@ -35,7 +37,7 @@ in
     };
   };
 
-  config = {
+  config = mkIf cfg.enable {
 
     sops.secrets = {
       borgPassphrase = {
@@ -43,6 +45,7 @@ in
         key = "borg/passphrase";
       };
     };
+
     services.borgbackup.jobs.data = {
       paths = [ "/nix/var/data" cfg.sshKey ] ++ cfg.additionalPaths;
       doInit = false;

modules/binary-cache.nix

@@ -1,32 +1,40 @@
-{ config, ... }:
+{ config, lib, ... }:
+with lib;
+let
+  cfg = config.custom.services.binary-cache;
+in
 {
+  options.custom.services.binary-cache = {
 
-  sops.secrets = {
+    enable = mkEnableOption "binary-cache";
-    nixCacheKey = {
+
-      key = "nix/cache_secret_key";
+    secretKeyFile = mkOption {
+      type = types.path;
     };
   };
 
 
-  services.nix-serve = {
+  config = mkIf cfg.enable {
-    enable = true;
+    services.nix-serve = {
-    port = 1500;
+      enable = true;
-    secretKeyFile = config.sops.secrets.nixCacheKey.path;
+      port = 1500;
-  };
+      secretKeyFile = config.sops.secrets.nixCacheKey.path;
+    };
 
-  services.nginx = {
+    services.nginx = {
-    virtualHosts = {
+      virtualHosts = {
-      "cache.${config.networking.domain}" = {
+        "cache.${config.networking.domain}" = {
 
-        enableACME = true;
+          enableACME = true;
-        forceSSL = true;
+          forceSSL = true;
 
-        locations."/".extraConfig = ''
+          locations."/".extraConfig = ''
-          proxy_pass http://localhost:${toString config.services.nix-serve.port};
+            proxy_pass http://localhost:${toString config.services.nix-serve.port};
-          proxy_set_header Host $host;
+            proxy_set_header Host $host;
-          proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Real-IP $remote_addr;
-          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        '';
+          '';
+        };
       };
     };
   };

modules/default.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+{
+  imports = [
+    ./backup-job.nix
+    ./monit.nix
+    ./gitlab-runner.nix
+    ./openssh.nix
+    ./murmur.nix
+  ];
+}

modules/dokuwiki.nix

@@ -1,5 +1,8 @@
 { config, lib, pkgs, ... }:
+with lib;
 let
+  cfg = config.custom.services.dokuwiki;
+
   configureWiki = name: {
 
     sops.secrets."usersFile-${name}" = {
@@ -25,7 +28,20 @@ let
     };
   };
 in
-lib.mkMerge [
+{
-  (configureWiki "anderia")
+  options.custom.services.dokuwiki = {
-  (configureWiki "arkadia")
+
-]
+    enable = mkEnableOption "dokuwiki";
+
+    secretKeyFile = mkOption {
+      type = types.path;
+    };
+  };
+
+
+  config = mkIf cfg.enable
+    (lib.mkMerge [
+      (configureWiki "anderia")
+      (configureWiki "arkadia")
+    ]);
+}

modules/gitlab-runner.nix

@@ -1,82 +1,92 @@
 { config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.custom.services.gitlab-runner;
+in
 {
-  sops.secrets = {
+  options.custom.services.gitlab-runner = {
-    runnerRegistrationConfig = {
+    enable = mkEnableOption "gitlab-runner";
-      owner = config.users.users.gitlab-runner.name;
-      key = "gitlab/runner_registration_config";
-    };
   };
 
-  users.groups.gitlab-runner = { };
+  config = mkIf cfg.enable {
-  users.users.gitlab-runner = {
+    sops.secrets = {
-    isSystemUser = true;
+      runnerRegistrationConfig = {
-    group = config.users.groups.gitlab-runner.name;
+        owner = config.users.users.gitlab-runner.name;
-  };
+        key = "gitlab/runner_registration_config";
-
-  containers.gitlab-runner = {
-    autoStart = true;
-
-    privateNetwork = true;
-    hostAddress = "192.168.100.1";
-    localAddress = "192.168.100.2";
-
-    bindMounts = {
-      "${config.sops.secrets.runnerRegistrationConfig.path}" = {
-        hostPath = config.sops.secrets.runnerRegistrationConfig.path;
       };
     };
 
-    config =
+    users.groups.gitlab-runner = { };
-      let
+    users.users.gitlab-runner = {
-        hostConfig = config;
+      isSystemUser = true;
-      in
+      group = config.users.groups.gitlab-runner.name;
-      args@{ config, ... }: {
+    };
 
-        nix = {
+    containers.gitlab-runner = {
-          package = pkgs.nixUnstable;
+      autoStart = true;
-          extraOptions = ''
+
-            experimental-features = nix-command flakes
+      privateNetwork = true;
+      hostAddress = "192.168.100.1";
+      localAddress = "192.168.100.2";
+
+      bindMounts = {
+        "${config.sops.secrets.runnerRegistrationConfig.path}" = {
+          hostPath = config.sops.secrets.runnerRegistrationConfig.path;
+        };
+      };
+
+      config =
+        let
+          hostConfig = config;
+        in
+        args@{ config, ... }: {
+
+          nix = {
+            package = pkgs.nixUnstable;
+            extraOptions = ''
+              experimental-features = nix-command flakes
+            '';
+          };
+
+          environment.systemPackages = with pkgs; [
+            git
+            htop
+            nload
+          ];
+
+          users.groups.gitlab-runner = { };
+          users.users.gitlab-runner = {
+            isSystemUser = true;
+            group = config.users.groups.gitlab-runner.name;
+          };
+
+          programs.ssh.extraConfig = ''
+            StrictHostKeyChecking=no
+            UserKnownHostsFile=/dev/null
           '';
-        };
 
-        environment.systemPackages = with pkgs; [
+          services = {
-          git
+            openssh.enable = true;
-          htop
+            gitlab-runner = {
-          nload
+              enable = true;
-        ];
+              services = {
-
+                shell = {
-        users.groups.gitlab-runner = { };
+                  registrationConfigFile = hostConfig.sops.secrets.runnerRegistrationConfig.path;
-        users.users.gitlab-runner = {
+                  executor = "shell";
-          isSystemUser = true;
+                  tagList = [ "nix" ];
-          group = config.users.groups.gitlab-runner.name;
+                };
-        };
-
-        programs.ssh.extraConfig = ''
-          StrictHostKeyChecking=no
-          UserKnownHostsFile=/dev/null
-        '';
-
-        services = {
-          openssh.enable = true;
-          gitlab-runner = {
-            enable = true;
-            services = {
-              shell = {
-                registrationConfigFile = hostConfig.sops.secrets.runnerRegistrationConfig.path;
-                executor = "shell";
-                tagList = [ "nix" ];
               };
             };
           };
-        };
 
-        systemd.services.gitlab-runner.serviceConfig = {
+          systemd.services.gitlab-runner.serviceConfig = {
-          DynamicUser = lib.mkForce false;
+            DynamicUser = lib.mkForce false;
-          User = config.users.users.gitlab-runner.name;
+            User = config.users.users.gitlab-runner.name;
-          Group = config.users.groups.gitlab-runner.name;
+            Group = config.users.groups.gitlab-runner.name;
-        };
+          };
 
-        system.stateVersion = "22.05";
+          system.stateVersion = "22.05";
-      };
+        };
+    };
   };
 }

modules/monit.nix

@@ -1,10 +1,12 @@
 { config, lib, pkgs, ... }:
 with lib;
 let
-  cfg = config.services.custom-monit;
+  cfg = config.custom.services.monit;
 in
 {
-  options.services.custom-monit = {
+  options.custom.services.monit = {
+    enable = mkEnableOption "monit";
+
     additionalConfig = mkOption {
       type = types.lines;
       default = "";

modules/murmur.nix

@@ -1,16 +1,27 @@
-{ config, lib, pkgs, ... }:
+{ config, lib, ... }:
+with lib;
+let
+  cfg = config.custom.services.murmur;
+in
 {
-  sops.secrets.murmurEnvFile = {
+  options.custom.services.murmur = {
-    owner = config.systemd.services.murmur.serviceConfig.User;
+    enable = mkEnableOption "murmur";
-    key = "murmur.env";
-    restartUnits = [ "murmur.service" ];
   };
 
-  services.murmur = {
+
-    enable = true;
+  config = mkIf cfg.enable {
-    bandwidth = 128000;
+    sops.secrets.murmurEnvFile = {
-    password = "$MURMURD_PASSWORD";
+      owner = config.systemd.services.murmur.serviceConfig.User;
-    environmentFile = config.sops.secrets.murmurEnvFile.path;
+      key = "murmur.env";
-    imgMsgLength = 13107200;
+      restartUnits = [ "murmur.service" ];
+    };
+
+    services.murmur = {
+      enable = true;
+      bandwidth = 128000;
+      password = "$MURMURD_PASSWORD";
+      environmentFile = config.sops.secrets.murmurEnvFile.path;
+      imgMsgLength = 13107200;
+    };
   };
 }

modules/openssh.nix

@@ -1,9 +1,20 @@
-{ pkgs, lib, config, ... }:
+{ config, lib, ... }:
+with lib;
+let
+  cfg = config.custom.services.openssh;
+in
 {
-  services.openssh.enable = true;
+  options.custom.services.openssh = {
-  services.openssh.permitRootLogin = "prohibit-password";
+    enable = mkEnableOption "openssh";
-  users.users.root.openssh.authorizedKeys.keyFiles = [
+  };
-    ../ssh_keys/phfroidmont-desktop.pub
+
-    ../ssh_keys/froidmpa-laptop.pub
+
-  ];
+  config = mkIf cfg.enable {
+    services.openssh.enable = true;
+    services.openssh.permitRootLogin = "prohibit-password";
+    users.users.root.openssh.authorizedKeys.keyFiles = [
+      ../ssh_keys/phfroidmont-desktop.pub
+      ../ssh_keys/froidmpa-laptop.pub
+    ];
+  };
 }

profiles/backend.nix

@@ -3,13 +3,10 @@
   imports = [
     ../environment.nix
     ../hardware/hcloud.nix
-    ../modules/openssh.nix
+    ../modules
     ../modules/nginx.nix
-    ../modules/murmur.nix
     ../modules/synapse.nix
     ../modules/nextcloud.nix
-    ../modules/custom-backup-job.nix
-    ../modules/custom-monit.nix
     ../modules/dokuwiki.nix
     ../modules/website-marie.nix
     ../modules/roundcube.nix
@@ -23,36 +20,50 @@
     };
   };
 
-  services.custom-backup-job = {
+  custom = {
-    additionalPaths = [ "/var/lib/nextcloud/config" ];
+    services.backup-job = {
-    readWritePaths = [ "/nix/var/data/murmur" "/nix/var/data/backup/" ];
+      enable = true;
-    preHook = ''
+      additionalPaths = [ "/var/lib/nextcloud/config" ];
-      cp /var/lib/murmur/murmur.sqlite /nix/var/data/murmur/murmur.sqlite
+      readWritePaths = [ "/nix/var/data/murmur" "/nix/var/data/backup/" ];
-    '';
+      preHook = ''
-    postHook = ''
+        cp /var/lib/murmur/murmur.sqlite /nix/var/data/murmur/murmur.sqlite
-      touch /nix/var/data/backup/backup-ok
+      '';
-    '';
+      postHook = ''
-    startAt = "03:30";
+        touch /nix/var/data/backup/backup-ok
-    sshKey = config.sops.secrets.borgSshKey.path;
+      '';
+      startAt = "03:30";
+      sshKey = config.sops.secrets.borgSshKey.path;
+    };
+
+    services.monit = {
+      enable = true;
+      additionalConfig = ''
+        check file nextcloud-data-mounted with path /var/lib/nextcloud/data/index.html
+          start = "${pkgs.systemd}/bin/systemctl start nextcloud-data-sshfs.service"
+
+        check host jellyfin with address jellyfin.banditlair.com
+          if failed port 443 protocol https with timeout 20 seconds then alert
+        check host stb with address www.societe-de-tir-bertrix.com
+          if failed port 443 protocol https with timeout 20 seconds then alert
+
+        check host transmission with address transmission.banditlair.com
+          if failed
+              port 443
+              protocol https
+              status = 401
+              with timeout 20 seconds
+          then alert
+      '';
+    };
+
+    services.dokuwiki.enable = true;
+
+    services.openssh.enable = true;
+
+    services.murmur.enable = true;
   };
 
-  services.custom-monit.additionalConfig = ''
-    check file nextcloud-data-mounted with path /var/lib/nextcloud/data/index.html
-      start = "${pkgs.systemd}/bin/systemctl start nextcloud-data-sshfs.service"
 
-    check host jellyfin with address jellyfin.banditlair.com
-      if failed port 443 protocol https with timeout 20 seconds then alert
-    check host stb with address www.societe-de-tir-bertrix.com
-      if failed port 443 protocol https with timeout 20 seconds then alert
-
-    check host transmission with address transmission.banditlair.com
-      if failed
-          port 443
-          protocol https
-          status = 401
-          with timeout 20 seconds
-      then alert
-  '';
 
   networking.interfaces.enp1s0 = {
     useDHCP = true;

profiles/db.nix

@@ -3,10 +3,8 @@
   imports = [
     ../environment.nix
     ../hardware/hcloud.nix
-    ../modules/openssh.nix
+    ../modules
     ../modules/postgresql.nix
-    ../modules/custom-backup-job.nix
-    ../modules/custom-monit.nix
     ../modules/monitoring-exporters.nix
   ];
 
@@ -19,16 +17,21 @@
     };
   };
 
-  services.custom-backup-job = {
+  custom = {
-    readWritePaths = [ "/nix/var/data/postgresql" "/nix/var/data/backup/" ];
+    services.backup-job = {
-    preHook = ''
+      enable = true;
-      ${pkgs.postgresql_12}/bin/pg_dump -U synapse synapse > /nix/var/data/postgresql/synapse.dmp
+      readWritePaths = [ "/nix/var/data/postgresql" "/nix/var/data/backup/" ];
-      ${pkgs.postgresql_12}/bin/pg_dump -U nextcloud nextcloud > /nix/var/data/postgresql/nextcloud.dmp
+      preHook = ''
-      ${pkgs.postgresql_12}/bin/pg_dump -U roundcube roundcube > /nix/var/data/postgresql/roundcube.dmp
+        ${pkgs.postgresql_12}/bin/pg_dump -U synapse synapse > /nix/var/data/postgresql/synapse.dmp
-    '';
+        ${pkgs.postgresql_12}/bin/pg_dump -U nextcloud nextcloud > /nix/var/data/postgresql/nextcloud.dmp
-    postHook = "touch /nix/var/data/backup/backup-ok";
+        ${pkgs.postgresql_12}/bin/pg_dump -U roundcube roundcube > /nix/var/data/postgresql/roundcube.dmp
-    startAt = "03:00";
+      '';
-    sshKey = config.sops.secrets.borgSshKey.path;
+      postHook = "touch /nix/var/data/backup/backup-ok";
+      startAt = "03:00";
+      sshKey = config.sops.secrets.borgSshKey.path;
+    };
+
+    services.openssh.enable = true;
   };
 
 }

profiles/storage.nix

@@ -3,6 +3,7 @@
   imports = [
     ../environment.nix
     ../hardware/hetzner-dedicated-storage1.nix
+    ../modules
     ../modules/openssh.nix
     ../modules/mailserver.nix
     ../modules/nginx.nix
@@ -10,10 +11,7 @@
     ../modules/stb.nix
     ../modules/monero.nix
     ../modules/torrents.nix
-    ../modules/custom-backup-job.nix
-    ../modules/custom-monit.nix
     ../modules/jitsi.nix
-    ../modules/gitlab-runner.nix
     ../modules/binary-cache.nix
     ../modules/grafana.nix
     ../modules/monitoring-exporters.nix
@@ -24,6 +22,47 @@
       owner = config.services.borgbackup.jobs.data.user;
       key = "borg/client_keys/storage1/private";
     };
+    nixCacheKey = {
+      key = "nix/cache_secret_key";
+    };
+  };
+
+  custom = {
+    services.binary-cache = {
+      enable = true;
+      secretKeyFile = config.sops.secrets.nixCacheKey.path;
+    };
+
+    services.backup-job = {
+      enable = true;
+      readWritePaths = [ "/nix/var/data/backup" ];
+      preHook = "${pkgs.docker}/bin/docker exec stb-mariadb sh -c 'mysqldump -u stb -pstb stb' > /nix/var/data/backup/stb_mariadb.sql";
+      postHook = "touch /nix/var/data/backup/backup-ok";
+      startAt = "04:00";
+      sshKey = config.sops.secrets.borgSshKey.path;
+    };
+
+    services.monit = {
+      enable = true;
+      additionalConfig = ''
+        check host nextcloud with address cloud.banditlair.com
+          if failed port 443 protocol https with timeout 20 seconds then alert
+        check host anderia-wiki with address anderia.banditlair.com
+          if failed port 443 protocol https with timeout 20 seconds then alert
+        check host arkadia-wiki with address arkadia.banditlair.com
+          if failed port 443 protocol https with timeout 20 seconds then alert
+        check host website-marie with address osteopathie.froidmont.org
+          if failed port 443 protocol https with timeout 20 seconds then alert
+        check host webmail with address webmail.banditlair.com
+          if failed port 443 protocol https with timeout 20 seconds then alert
+
+        check program raid-md127 with path "${pkgs.mdadm}/bin/mdadm --misc --detail --test /dev/md127"
+          if status != 0 then alert
+      '';
+    };
+
+    services.gitlab-runner.enable = true;
+    services.openssh.enable = true;
   };
 
   networking.firewall.allowedTCPPorts = [ 80 443 18080 ];
@@ -49,30 +88,6 @@
   };
   users.groups.steam = { };
 
-  services.custom-backup-job = {
-    readWritePaths = [ "/nix/var/data/backup" ];
-    preHook = "${pkgs.docker}/bin/docker exec stb-mariadb sh -c 'mysqldump -u stb -pstb stb' > /nix/var/data/backup/stb_mariadb.sql";
-    postHook = "touch /nix/var/data/backup/backup-ok";
-    startAt = "04:00";
-    sshKey = config.sops.secrets.borgSshKey.path;
-  };
-
-  services.custom-monit.additionalConfig = ''
-    check host nextcloud with address cloud.banditlair.com
-      if failed port 443 protocol https with timeout 20 seconds then alert
-    check host anderia-wiki with address anderia.banditlair.com
-      if failed port 443 protocol https with timeout 20 seconds then alert
-    check host arkadia-wiki with address arkadia.banditlair.com
-      if failed port 443 protocol https with timeout 20 seconds then alert
-    check host website-marie with address osteopathie.froidmont.org
-      if failed port 443 protocol https with timeout 20 seconds then alert
-    check host webmail with address webmail.banditlair.com
-      if failed port 443 protocol https with timeout 20 seconds then alert
-
-    check program raid-md127 with path "${pkgs.mdadm}/bin/mdadm --misc --detail --test /dev/md127"
-      if status != 0 then alert
-  '';
-
   services.minecraft-server = {
     enable = true;
     package = pkgs-unstable.minecraft-server;