diff options
Diffstat (limited to 'nixpkgs/nixos/modules/services/admin')
| -rw-r--r-- | nixpkgs/nixos/modules/services/admin/oxidized.nix | 116 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/admin/salt/master.nix | 63 | ||||
| -rw-r--r-- | nixpkgs/nixos/modules/services/admin/salt/minion.nix | 67 |
3 files changed, 246 insertions, 0 deletions
diff --git a/nixpkgs/nixos/modules/services/admin/oxidized.nix b/nixpkgs/nixos/modules/services/admin/oxidized.nix new file mode 100644 index 000000000000..39112c3970d5 --- /dev/null +++ b/nixpkgs/nixos/modules/services/admin/oxidized.nix @@ -0,0 +1,116 @@ +{ config, pkgs, lib, ... }: + +with lib; + +let + cfg = config.services.oxidized; +in +{ + options.services.oxidized = { + enable = mkEnableOption "the oxidized configuration backup service"; + + user = mkOption { + type = types.str; + default = "oxidized"; + description = '' + User under which the oxidized service runs. + ''; + }; + + group = mkOption { + type = types.str; + default = "oxidized"; + description = '' + Group under which the oxidized service runs. + ''; + }; + + dataDir = mkOption { + type = types.path; + default = "/var/lib/oxidized"; + description = "State directory for the oxidized service."; + }; + + configFile = mkOption { + type = types.path; + example = literalExample '' + pkgs.writeText "oxidized-config.yml" ''' + --- + debug: true + use_syslog: true + input: + default: ssh + ssh: + secure: true + interval: 3600 + model_map: + dell: powerconnect + hp: procurve + source: + default: csv + csv: + delimiter: !ruby/regexp /:/ + file: "/var/lib/oxidized/.config/oxidized/router.db" + map: + name: 0 + model: 1 + username: 2 + password: 3 + pid: "/var/lib/oxidized/.config/oxidized/pid" + rest: 127.0.0.1:8888 + retries: 3 + # ... additional config + '''; + ''; + description = '' + Path to the oxidized configuration file. + ''; + }; + + routerDB = mkOption { + type = types.path; + example = literalExample '' + pkgs.writeText "oxidized-router.db" ''' + hostname-sw1:powerconnect:username1:password2 + hostname-sw2:procurve:username2:password2 + # ... additional hosts + ''' + ''; + description = '' + Path to the file/database which contains the targets for oxidized. + ''; + }; + }; + + config = mkIf cfg.enable { + users.groups.${cfg.group} = { }; + users.users.${cfg.user} = { + description = "Oxidized service user"; + group = cfg.group; + home = cfg.dataDir; + createHome = true; + }; + + systemd.services.oxidized = { + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + + preStart = '' + mkdir -p ${cfg.dataDir}/.config/oxidized + ln -f -s ${cfg.routerDB} ${cfg.dataDir}/.config/oxidized/router.db + ln -f -s ${cfg.configFile} ${cfg.dataDir}/.config/oxidized/config + ''; + + serviceConfig = { + ExecStart = "${pkgs.oxidized}/bin/oxidized"; + User = cfg.user; + Group = cfg.group; + UMask = "0077"; + NoNewPrivileges = true; + Restart = "always"; + WorkingDirectory = cfg.dataDir; + KillSignal = "SIGKILL"; + }; + }; + }; +} diff --git a/nixpkgs/nixos/modules/services/admin/salt/master.nix b/nixpkgs/nixos/modules/services/admin/salt/master.nix new file mode 100644 index 000000000000..c6b1b0cc0bd8 --- /dev/null +++ b/nixpkgs/nixos/modules/services/admin/salt/master.nix @@ -0,0 +1,63 @@ +{ config, pkgs, lib, ... }: + +with lib; + +let + + cfg = config.services.salt.master; + + fullConfig = lib.recursiveUpdate { + # Provide defaults for some directories to allow an immutable config dir + + # Default is equivalent to /etc/salt/master.d/*.conf + default_include = "/var/lib/salt/master.d/*.conf"; + # Default is in /etc/salt/pki/master + pki_dir = "/var/lib/salt/pki/master"; + } cfg.configuration; + +in + +{ + options = { + services.salt.master = { + enable = mkEnableOption "Salt master service"; + configuration = mkOption { + type = types.attrs; + default = {}; + description = "Salt master configuration as Nix attribute set."; + }; + }; + }; + + config = mkIf cfg.enable { + environment = { + # Set this up in /etc/salt/master so `salt`, `salt-key`, etc. work. + # The alternatives are + # - passing --config-dir to all salt commands, not just the master unit, + # - setting a global environment variable, + etc."salt/master".source = pkgs.writeText "master" ( + builtins.toJSON fullConfig + ); + systemPackages = with pkgs; [ salt ]; + }; + systemd.services.salt-master = { + description = "Salt Master"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + path = with pkgs; [ + utillinux # for dmesg + ]; + serviceConfig = { + ExecStart = "${pkgs.salt}/bin/salt-master"; + LimitNOFILE = 16384; + Type = "notify"; + NotifyAccess = "all"; + }; + restartTriggers = [ + config.environment.etc."salt/master".source + ]; + }; + }; + + meta.maintainers = with lib.maintainers; [ aneeshusa ]; +} diff --git a/nixpkgs/nixos/modules/services/admin/salt/minion.nix b/nixpkgs/nixos/modules/services/admin/salt/minion.nix new file mode 100644 index 000000000000..c8fa9461a209 --- /dev/null +++ b/nixpkgs/nixos/modules/services/admin/salt/minion.nix @@ -0,0 +1,67 @@ +{ config, pkgs, lib, ... }: + +with lib; + +let + + cfg = config.services.salt.minion; + + fullConfig = lib.recursiveUpdate { + # Provide defaults for some directories to allow an immutable config dir + # NOTE: the config dir being immutable prevents `minion_id` caching + + # Default is equivalent to /etc/salt/minion.d/*.conf + default_include = "/var/lib/salt/minion.d/*.conf"; + # Default is in /etc/salt/pki/minion + pki_dir = "/var/lib/salt/pki/minion"; + } cfg.configuration; + +in + +{ + options = { + services.salt.minion = { + enable = mkEnableOption "Salt minion service"; + configuration = mkOption { + type = types.attrs; + default = {}; + description = '' + Salt minion configuration as Nix attribute set. + See <link xlink:href="https://docs.saltstack.com/en/latest/ref/configuration/minion.html"/> + for details. + ''; + }; + }; + }; + + config = mkIf cfg.enable { + environment = { + # Set this up in /etc/salt/minion so `salt-call`, etc. work. + # The alternatives are + # - passing --config-dir to all salt commands, not just the minion unit, + # - setting aglobal environment variable. + etc."salt/minion".source = pkgs.writeText "minion" ( + builtins.toJSON fullConfig + ); + systemPackages = with pkgs; [ salt ]; + }; + systemd.services.salt-minion = { + description = "Salt Minion"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + path = with pkgs; [ + utillinux + ]; + serviceConfig = { + ExecStart = "${pkgs.salt}/bin/salt-minion"; + LimitNOFILE = 8192; + Type = "notify"; + NotifyAccess = "all"; + }; + restartTriggers = [ + config.environment.etc."salt/minion".source + ]; + }; + }; +} + |