From 08195188b26106adf79e0c37ed65cc0ff435d25e Mon Sep 17 00:00:00 2001
From: Yves Dubromelle <root@phenom.dubronetwork.fr>
Date: Wed, 1 Mar 2017 22:52:34 +0100
Subject: [PATCH] =?UTF-8?q?d=C3=A9placement=20de=20nix-serve=20et=20fail2b?=
 =?UTF-8?q?an=20dans=20private?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 base/activation-manuelle/nix-serve-client.nix | 30 ---------
 base/activation-manuelle/nix-serve-server.nix | 31 ---------
 base/activation-manuelle/service-fail2ban.nix | 64 -------------------
 base/base.nix                                 |  5 --
 4 files changed, 130 deletions(-)
 delete mode 100644 base/activation-manuelle/nix-serve-client.nix
 delete mode 100644 base/activation-manuelle/nix-serve-server.nix
 delete mode 100644 base/activation-manuelle/service-fail2ban.nix

diff --git a/base/activation-manuelle/nix-serve-client.nix b/base/activation-manuelle/nix-serve-client.nix
deleted file mode 100644
index 2bd718e..0000000
--- a/base/activation-manuelle/nix-serve-client.nix
+++ /dev/null
@@ -1,30 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  inherit (lib) mkIf mkMerge mkThenElse;
-  cfg = config.r6d.config-generator;
-  computers = config.r6d.computers;
-  profiles = config.r6d.profiles;
-in
-
-mkIf cfg.nix-serve-client {
-
-  nix = {
-    # Cache http pour le store
-    requireSignedBinaryCaches = false;
-    binaryCaches =  [
-      (mkIf (profiles.isDubronetwork && (! computers.isPedro) && (! computers.isRollo)) "http://nix-cache.dubronetwork.fr:5001")
-      #(mkIf (profiles.isDubronetwork && computers.isPhenom) "http://latitude.grudu.net:5000")
-      (mkIf (profiles.isDubronetwork && computers.isPhenom) "http://monstre.grudu.net:5000")
-      (mkIf (profiles.isDubronetwork && computers.isPhenom) "http://radx.grudu.net:5000")
-
-      (mkIf profiles.isPrunetwork "https://cache.nixos.org/")
-      (mkIf (profiles.isPrunetwork && !profiles.isServer)   "http://nix-cache.dubronetwork.fr:5001")
-      (mkIf (profiles.isPrunetwork && computers.isRadx)     "http://monstre.grudu.net:5000")
-      (mkIf (profiles.isPrunetwork && computers.isRadx)     "http://phenom.grudu.net:5000")
-    ];
-    extraOptions = ''
-    connect-timeout = 5
-    '';
-  };
-}
diff --git a/base/activation-manuelle/nix-serve-server.nix b/base/activation-manuelle/nix-serve-server.nix
deleted file mode 100644
index 1a9e42d..0000000
--- a/base/activation-manuelle/nix-serve-server.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  inherit (lib) mkIf mkMerge mkThenElse;
-  cfg = config.r6d.config-generator;
-  computers = config.r6d.computers;
-  profiles = config.r6d.profiles;
-in
-
-mkIf cfg.nix-serve-server {
-
-  # Cache http pour le store
-
-  # Services
-  services.nix-serve = {
-    enable = true;
-  };
-
-  # Réseau
-  networking.firewall = {
-    allowedTCPPorts = [
-      #5000 # ouvert sur tinc
-    ];
-    allowedUDPPorts = [
-    ];
-    extraCommands = ''
-      iptables  -A INPUT -i tinc.grudunet -p tcp --dport 5000 -j ACCEPT
-      ip6tables -A INPUT -i tinc.grudunet -p tcp --dport 5000 -j ACCEPT
-    '';
-  };
-}
diff --git a/base/activation-manuelle/service-fail2ban.nix b/base/activation-manuelle/service-fail2ban.nix
deleted file mode 100644
index c285fc4..0000000
--- a/base/activation-manuelle/service-fail2ban.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-let
-  inherit (lib) mkIf mkMerge mkThenElse;
-  cfg = config.r6d.config-generator;
-  computers = config.r6d.computers;
-  profiles = config.r6d.profiles;
-
-  ignoreip = "pedro.dubronetwork.fr cube.dubronetwork.fr voyage.prunetwork.fr xray.prunetwork.fr 192.168.0.0/16 172.16.0.0/16";
-  destemail = "admins@dubronetwork.fr";
-in
-
-mkIf cfg.fail2ban {
-
-  # Gestion de fail2ban
-
-  # Paquets
-  environment.systemPackages = with pkgs; [
-    mailutils
-    whois
-  ];
-
-
-  # Services
-  services = {
-    fail2ban = {
-      enable = true;
-      jails = {
-        DEFAULT = ''
-          # "ignoreip" can be an IP address, a CIDR mask or a DNS host
-          ignoreip = 127.0.0.1/8 ${ignoreip}
-
-          # 1 jour
-          # bantime  = 86400
-          # 5 jours 
-          bantime  = 432000
-
-          maxretry = 3
-
-          destemail = ${destemail}
-
-          # https://github.com/Baughn/nixpkgs/blob/master/nixos/modules/services/security/fail2ban.nix
-          findtime = 600
-          maxretry = 3
-          backend  = systemd
-          enabled  = true
-        '';
-        ssh-route = ''
-          filter   = sshd
-          action   = route[blocktype=blackhole]
-        '';
-        # désactivation car souci de PATH avec les commandes mail ou sendmail. Nécessite un path motifiable
-        # ticket à ouvrir
-        #ssh-mail = ''
-        #  filter   = sshd
-        #  action   = sendmail[sendername=Fail2ban @${config.networking.hostName}]
-        #'';
-      };
-    };
-  };
-
-  # https://github.com/NixOS/nixpkgs/issues/8437
-  services.fail2ban.jails.ssh-iptables = "enabled = true";
-}
diff --git a/base/base.nix b/base/base.nix
index 8b9902c..d351f06 100644
--- a/base/base.nix
+++ b/base/base.nix
@@ -10,10 +10,5 @@ in
 {
   imports = [
     ./network-dns.nix
-
-    # inclusion conditionnelle
-    ./activation-manuelle/service-fail2ban.nix
-    ./activation-manuelle/nix-serve-client.nix
-    ./activation-manuelle/nix-serve-server.nix
   ];
 }