server modules

server/mods/sysd.nix

@@ -0,0 +1,64 @@
+{ config, lib, pkgs, ... }:
+{
+  services.openssh = {
+    enable = true;
+    settings.PasswordAuthentication = false;
+  };
+  systemd = {
+    tmpfiles.rules = [
+      "d /var/spool/postfix 0755 postfix postfix -"
+      "d /var/spool/postfix/private 0755 postfix postfix -"
+    ];
+    timers = {
+      tgbot-send = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnCalendar = "*-*-01 16:00:00";
+          Persistent = true;
+        };
+      };
+      network-watchdog = {
+        wantedBy = [ "timers.target" ];
+        timerConfig = {
+          OnBootSec = 30;
+          AccuracySec = 1;
+          OnUnitActiveSec = 10;
+        };
+      };
+    };
+    services = {
+      tgbot-send = {
+        serviceConfig.Type = "oneshot";
+        script = ''
+          . /secrets/tgbot.env
+          ${pkgs.curl}/bin/curl "https://api.telegram.org/$BOT/sendMessage" \
+            -X POST -d "chat_id=$CHAT_ID" -d "text=$TEXT" 2> /dev/null | \
+            ${pkgs.jq}/bin/jq '.result.date |= strftime("%Y-%m-%d %H:%M:%S")'
+        '';
+      };
+      network-watchdog = {
+        serviceConfig = {
+          Type = "oneshot";
+          LogLevelMax = "notice";
+        };
+        script = ''
+          if [ ! -e /run/network.failures ] || \
+            ${pkgs.iputils}/bin/ping -c 1 -W 3 1.1.1.1 &> /dev/null; then
+            failures=0
+          else
+            failures=$((1+$(cat /run/network.failures)))
+          fi
+          if [ $failures -gt 0 ]; then
+            echo "<5>failures = $failures"
+          fi
+          if [ $failures -ge 3 ]; then
+            echo "<4>restarting NetworkManager"
+            systemctl restart NetworkManager.service
+            failures=0
+          fi
+          echo $failures > /run/network.failures
+        '';
+      };
+    };
+  };
+}