create shared nixos config between physical and VM
rename nixos -> nix
This commit is contained in:
parent
472175c5a3
commit
32154e7163
39 changed files with 114 additions and 196 deletions
|
|
@ -1,127 +0,0 @@
|
|||
{ pkgs, lib, config, ... }:
|
||||
let
|
||||
cfg = config.lab.backups;
|
||||
beforeEverything = pkgs.writeShellScriptBin "beforeEverything" ''
|
||||
if [ -d "${cfg.snapshotLocation}" ]; then
|
||||
${pkgs.btrfs-progs}/bin/btrfs subvolume delete ${cfg.snapshotLocation}
|
||||
fi
|
||||
|
||||
${pkgs.btrfs-progs}/bin/btrfs subvolume snapshot -r ${cfg.subvolumeLocation} ${cfg.snapshotLocation}
|
||||
'';
|
||||
|
||||
borgmaticConfig = pkgs.writeTextFile {
|
||||
name = "borgmatic-config";
|
||||
text = ''
|
||||
source_directories:
|
||||
- ${cfg.snapshotLocation}
|
||||
repositories:
|
||||
- path: ${cfg.repoLocation}
|
||||
label: nfs
|
||||
- path: ssh://admin@ec2-3-254-121-39.eu-west-1.compute.amazonaws.com/mnt/data/nfs.borg
|
||||
label: ec2
|
||||
ssh_command: "${pkgs.openssh}/bin/ssh -i ${config.age.secrets."ec2_borg_server.pem".path} -o StrictHostKeychecking=no -o ConnectTimeout=10 -o ConnectionAttempts=3"
|
||||
keep_daily: 7
|
||||
keep_weekly: 4
|
||||
keep_monthly: 6
|
||||
encryption_passcommand: "${pkgs.coreutils}/bin/cat ''${BORG_PASSPHRASE_FILE}"
|
||||
before_everything:
|
||||
- ${beforeEverything}/bin/beforeEverything
|
||||
postgresql_databases:
|
||||
- name: nextcloud
|
||||
hostname: lewis.dmz
|
||||
username: nextcloud
|
||||
password: ''${NEXTCLOUD_DATABASE_PASSWORD}
|
||||
format: tar
|
||||
- name: hedgedoc
|
||||
hostname: lewis.dmz
|
||||
username: hedgedoc
|
||||
password: ''${HEDGEDOC_DATABASE_PASSWORD}
|
||||
format: tar
|
||||
- name: paperless
|
||||
hostname: lewis.dmz
|
||||
username: paperless
|
||||
password: ''${PAPERLESS_DATABASE_PASSWORD}
|
||||
format: tar
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
options.lab.backups = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Whether to enable backups of persistent data on this machine.
|
||||
'';
|
||||
};
|
||||
|
||||
repoLocation = lib.mkOption {
|
||||
default = "${config.lab.storage.dataMountPoint}/backups/nfs.borg";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Location of the Borg repository to back up to.
|
||||
'';
|
||||
};
|
||||
|
||||
subvolumeLocation = lib.mkOption {
|
||||
default = "${config.lab.storage.dataMountPoint}/nfs";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Location of the btrfs subvolume holding the data.
|
||||
'';
|
||||
};
|
||||
|
||||
snapshotLocation = lib.mkOption {
|
||||
default = "${config.lab.storage.dataMountPoint}/snapshot-nfs";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Location to (temporary) create a snapshot of the subvolume.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
environment.systemPackages = with pkgs; [ borgbackup postgresql ];
|
||||
# Converted from:
|
||||
# https://github.com/borgmatic-collective/borgmatic/tree/84823dfb912db650936e3492f6ead7e0e0d32a0f/sample/systemd
|
||||
systemd.services.borgmatic = {
|
||||
description = "borgmatic backup";
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
unitConfig.ConditionACPower = true;
|
||||
preStart = "${pkgs.coreutils}/bin/sleep 10s";
|
||||
path = with pkgs; [ postgresql ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
Nice = 19;
|
||||
CPUSchedulingPolicy = "batch";
|
||||
IOSchedulingClass = "best-effort";
|
||||
IOSchedulingPriority = 7;
|
||||
IOWeight = 100;
|
||||
Restart = "no";
|
||||
LogRateLimitIntervalSec = 0;
|
||||
EnvironmentFile = config.age.secrets."database_passwords.env".path;
|
||||
Environment = "BORG_PASSPHRASE_FILE=${config.age.secrets."borg_passphrase".path}";
|
||||
};
|
||||
|
||||
script = "${pkgs.systemd}/bin/systemd-inhibit --who=\"borgmatic\" --what=\"sleep:shutdown\" --why=\"Prevent interrupting scheduled backup\" ${pkgs.borgmatic}/bin/borgmatic --verbosity -2 --syslog-verbosity 1 -c ${borgmaticConfig}";
|
||||
};
|
||||
|
||||
systemd.timers.borgmatic = {
|
||||
description = "Run borgmatic backup";
|
||||
wantedBy = [ "timers.target" ];
|
||||
timerConfig = {
|
||||
OnCalendar = "*-*-* 3:00:00";
|
||||
Persistent = true;
|
||||
RandomizedDelaySec = "3h";
|
||||
};
|
||||
};
|
||||
|
||||
age.secrets = {
|
||||
"database_passwords.env".file = ../secrets/database_passwords.env.age;
|
||||
"borg_passphrase".file = ../secrets/borg_passphrase.age;
|
||||
"ec2_borg_server.pem".file = ../secrets/ec2_borg_server.pem.age;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,83 +0,0 @@
|
|||
{ pkgs, lib, config, ... }:
|
||||
let
|
||||
cfg = config.lab.data-sharing;
|
||||
nfsShares = [
|
||||
"/nextcloud/data"
|
||||
"/radicale"
|
||||
"/freshrss/data"
|
||||
"/freshrss/extensions"
|
||||
"/pihole/data"
|
||||
"/pihole/dnsmasq"
|
||||
"/hedgedoc/uploads"
|
||||
"/traefik/acme"
|
||||
"/forgejo"
|
||||
"/kitchenowl/data"
|
||||
"/syncthing/config"
|
||||
"/paperless-ngx/data"
|
||||
"/paperless-ngx/redisdata"
|
||||
];
|
||||
nfsExports = lib.strings.concatLines (
|
||||
builtins.map
|
||||
(share:
|
||||
"${cfg.nfsRoot}${share} 192.168.30.0/24(rw,sync,no_subtree_check,no_root_squash)"
|
||||
)
|
||||
nfsShares
|
||||
);
|
||||
in
|
||||
{
|
||||
options.lab.data-sharing = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Configure this server to serve our data using NFS and PostgreSQL.
|
||||
'';
|
||||
};
|
||||
|
||||
nfsRoot = lib.mkOption {
|
||||
default = "/mnt/data/nfs";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Root directory of NFS data.
|
||||
'';
|
||||
};
|
||||
|
||||
postgresDir = lib.mkOption {
|
||||
default = "/mnt/data/postgresql/${config.services.postgresql.package.psqlSchema}";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Postgresql data directory.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
networking.firewall.interfaces.${config.lab.networking.dmzBridgeName}.allowedTCPPorts = [
|
||||
2049 # NFS
|
||||
5432 # PostgeSQL
|
||||
111 # NFS
|
||||
20048 # NFS
|
||||
];
|
||||
|
||||
services = {
|
||||
nfs.server = {
|
||||
enable = true;
|
||||
exports = nfsExports;
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_15;
|
||||
enableTCPIP = true;
|
||||
|
||||
dataDir = cfg.postgresDir;
|
||||
|
||||
authentication = ''
|
||||
host nextcloud nextcloud all md5
|
||||
host hedgedoc hedgedoc all md5
|
||||
host paperless paperless all md5
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,31 +0,0 @@
|
|||
{ lib, config, ... }:
|
||||
|
||||
let cfg = config.lab;
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
./storage.nix
|
||||
./terraform-database
|
||||
./ssh-certificates.nix
|
||||
./k3s
|
||||
./backups.nix
|
||||
./networking
|
||||
./data-sharing.nix
|
||||
];
|
||||
|
||||
options.lab.dataHost.enable = lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Whether this machine holds application data.
|
||||
This enables NFS and PostgreSQL to serve this data, and sets up backups.
|
||||
Also enables networking on the DMZ to enable serving data.
|
||||
'';
|
||||
};
|
||||
|
||||
config.lab = lib.mkIf cfg.dataHost.enable {
|
||||
backups.enable = true;
|
||||
data-sharing.enable = true;
|
||||
networking.allowDMZConnectivity = true;
|
||||
};
|
||||
}
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
{ kubenix, ... }: {
|
||||
imports = [ kubenix.modules.k8s ];
|
||||
kubernetes.resources.clusterRoleBindings.pim-cluster-admin = {
|
||||
roleRef = {
|
||||
apiGroup = "rbac.authorization.k8s.io";
|
||||
kind = "ClusterRole";
|
||||
name = "cluster-admin";
|
||||
};
|
||||
subjects = [
|
||||
{
|
||||
kind = "User";
|
||||
name = "pim";
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
@ -1,32 +0,0 @@
|
|||
{ pkgs, lib, config, kubenix, ... }:
|
||||
let cfg = config.lab.k3s;
|
||||
in {
|
||||
options.lab.k3s.enable = lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Whether to start k3s with custom configuration.
|
||||
'';
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
environment.systemPackages = [ pkgs.k3s ];
|
||||
networking.firewall.allowedTCPPorts = [ 6443 ];
|
||||
|
||||
services.k3s = {
|
||||
enable = true;
|
||||
role = "server";
|
||||
extraFlags = "--tls-san ${config.networking.fqdn} --data-dir ${config.lab.dataDisk.mountPoint}/k3s";
|
||||
};
|
||||
|
||||
system.activationScripts.k3s-bootstrap.text =
|
||||
let
|
||||
k3sBootstrapFile = (kubenix.evalModules.x86_64-linux {
|
||||
module = import ./bootstrap.nix;
|
||||
}).config.kubernetes.result;
|
||||
in
|
||||
''
|
||||
ln -sf ${k3sBootstrapFile} ${config.lab.dataDisk.mountPoint}/k3s/server/manifests/k3s-bootstrap.json
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
@ -1,165 +0,0 @@
|
|||
{ lib, config, machine, ... }:
|
||||
let cfg = config.lab.networking;
|
||||
in {
|
||||
imports = [ ./dmz ];
|
||||
|
||||
options.lab.networking = {
|
||||
allowDMZConnectivity = lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Whether to allow networking on the DMZ bridge interface.
|
||||
'';
|
||||
};
|
||||
|
||||
staticDMZIPv4Address = lib.mkOption {
|
||||
default = "";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Assign a static IPv4 address on the DMZ interface.
|
||||
'';
|
||||
};
|
||||
|
||||
staticDMZIPv6Address = lib.mkOption {
|
||||
default = "";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Assign a static IPv6 address on the DMZ interface.
|
||||
'';
|
||||
};
|
||||
|
||||
publicIPv4 = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Public IPv4 address of our home.
|
||||
'';
|
||||
};
|
||||
|
||||
dockerSwarmInternalIPv4 = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Internal IPv4 address of the Docker Swarm.
|
||||
'';
|
||||
};
|
||||
|
||||
dockerSwarmIPv6 = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Globally routable IPv6 address of the Docker Swarm.
|
||||
'';
|
||||
};
|
||||
|
||||
dmzRouterIPv4 = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
The router's IPv4 address on the DMZ network.
|
||||
'';
|
||||
};
|
||||
|
||||
dmzServicesIPv4 = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
The IPv4 address of the interface serving DHCP and DNS on the DMZ network.
|
||||
'';
|
||||
};
|
||||
|
||||
dmzServicesIPv6 = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
The IPv6 address of the interface serving DHCP and DNS on the DMZ network.
|
||||
'';
|
||||
};
|
||||
|
||||
dmzBridgeName = lib.mkOption {
|
||||
default = "bridgedmz";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
The name of the DMZ bridge.
|
||||
'';
|
||||
};
|
||||
|
||||
mainNicNamePattern = lib.mkOption {
|
||||
default = "en*";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Pattern to match the name of this machine's main NIC.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
networking = {
|
||||
hostName = machine.hostName;
|
||||
domain = machine.domain;
|
||||
nftables.enable = true;
|
||||
useDHCP = machine.type == "virtual";
|
||||
|
||||
firewall = {
|
||||
enable = true;
|
||||
checkReversePath = false;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.network = lib.mkIf (machine.type == "physical") {
|
||||
enable = true;
|
||||
|
||||
netdevs = {
|
||||
"20-vlandmz" = {
|
||||
vlanConfig.Id = 30;
|
||||
|
||||
netdevConfig = {
|
||||
Kind = "vlan";
|
||||
Name = "vlandmz";
|
||||
};
|
||||
};
|
||||
|
||||
"20-bridgedmz" = {
|
||||
netdevConfig = {
|
||||
Kind = "bridge";
|
||||
Name = cfg.dmzBridgeName;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networks = {
|
||||
"30-main-nic" = {
|
||||
matchConfig.Name = cfg.mainNicNamePattern;
|
||||
vlan = [ "vlandmz" ];
|
||||
|
||||
networkConfig = {
|
||||
DHCP = "yes";
|
||||
};
|
||||
};
|
||||
|
||||
"40-vlandmz" = {
|
||||
matchConfig.Name = "vlandmz";
|
||||
linkConfig.RequiredForOnline = "enslaved";
|
||||
|
||||
networkConfig = {
|
||||
IPv6AcceptRA = false;
|
||||
LinkLocalAddressing = "no";
|
||||
Bridge = cfg.dmzBridgeName;
|
||||
};
|
||||
};
|
||||
|
||||
"40-bridgedmz" = {
|
||||
matchConfig.Name = cfg.dmzBridgeName;
|
||||
linkConfig.RequiredForOnline = "carrier";
|
||||
|
||||
networkConfig = {
|
||||
IPv6AcceptRA = cfg.allowDMZConnectivity;
|
||||
LinkLocalAddressing = if cfg.allowDMZConnectivity then "ipv6" else "no";
|
||||
DHCP = lib.mkIf (cfg.allowDMZConnectivity && cfg.staticDMZIPv4Address == "") "yes";
|
||||
Address = lib.lists.optional (cfg.staticDMZIPv4Address != "") cfg.staticDMZIPv4Address
|
||||
++ lib.lists.optional (cfg.staticDMZIPv6Address != "") cfg.staticDMZIPv6Address;
|
||||
};
|
||||
};
|
||||
|
||||
"40-vms" = {
|
||||
matchConfig.Name = "vm-*";
|
||||
networkConfig.Bridge = cfg.dmzBridgeName;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,68 +0,0 @@
|
|||
{ pkgs, lib, config, dns, ... }@inputs:
|
||||
let
|
||||
cfg = config.lab.networking.dmzServices;
|
||||
kunisZoneFile = pkgs.writeTextFile {
|
||||
name = "kunis-zone-file";
|
||||
text = (dns.lib.toString "kun.is" (import ./zones/kun.is.nix inputs));
|
||||
};
|
||||
|
||||
geokunis2nlZoneFile = pkgs.writeTextFile {
|
||||
name = "geokunis2nl-zone-file";
|
||||
text = (dns.lib.toString "geokunis2.nl" (import ./zones/geokunis2.nl.nix inputs));
|
||||
};
|
||||
in
|
||||
{
|
||||
options.lab.networking.dmzServices.enable = lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Whether to enable an authoritative DNS server and DNSmasq for DMZ network.
|
||||
'';
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
lab.networking.allowDMZConnectivity = true;
|
||||
|
||||
networking.firewall.interfaces.${config.lab.networking.dmzBridgeName} = {
|
||||
allowedTCPPorts = [ 53 5353 ];
|
||||
allowedUDPPorts = [ 53 67 5353 ];
|
||||
};
|
||||
|
||||
services = {
|
||||
bind = {
|
||||
enable = true;
|
||||
forwarders = [ ];
|
||||
|
||||
extraOptions = ''
|
||||
allow-transfer { none; };
|
||||
allow-recursion { none; };
|
||||
version none;
|
||||
notify no;
|
||||
'';
|
||||
|
||||
zones = {
|
||||
"kun.is" = {
|
||||
master = true;
|
||||
file = kunisZoneFile;
|
||||
allowQuery = [ "any" ];
|
||||
};
|
||||
|
||||
"geokunis2.nl" = {
|
||||
master = true;
|
||||
file = geokunis2nlZoneFile;
|
||||
allowQuery = [ "any" ];
|
||||
slaves = [
|
||||
"87.253.155.96/27"
|
||||
"157.97.168.160/27"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
dnsmasq = {
|
||||
enable = true;
|
||||
settings = import ./dnsmasq.nix inputs;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,50 +0,0 @@
|
|||
{ config, ... }:
|
||||
let
|
||||
inherit (config.lab.networking) publicIPv4 dockerSwarmInternalIPv4 dmzServicesIPv4 dmzServicesIPv6 dmzRouterIPv4;
|
||||
in
|
||||
{
|
||||
no-resolv = true;
|
||||
local = "/dmz/";
|
||||
dhcp-fqdn = true;
|
||||
no-hosts = true;
|
||||
expand-hosts = true;
|
||||
domain = "dmz";
|
||||
dhcp-authoritative = true;
|
||||
ra-param = "*,0,0";
|
||||
alias = "${publicIPv4},${dockerSwarmInternalIPv4}";
|
||||
log-dhcp = true;
|
||||
log-queries = true;
|
||||
port = "5353";
|
||||
host-record = [
|
||||
"hermes.dmz,${dmzServicesIPv4},${dmzServicesIPv6}"
|
||||
"ipv4.hermes.dmz,${dmzServicesIPv4}"
|
||||
"ipv6.hermes.dmz,${dmzServicesIPv6}"
|
||||
];
|
||||
|
||||
server = [
|
||||
dmzRouterIPv4
|
||||
"/geokunis2.nl/${dmzServicesIPv4}"
|
||||
"/kun.is/${dmzServicesIPv4}"
|
||||
];
|
||||
|
||||
dhcp-range = [
|
||||
"192.168.30.50,192.168.30.127,15m"
|
||||
"2a0d:6e00:1a77:30::,ra-stateless,ra-names"
|
||||
];
|
||||
|
||||
dhcp-host = [
|
||||
"b8:27:eb:b9:ab:e2,esrom"
|
||||
"ca:fe:c0:ff:ee:08,maestro,${dockerSwarmInternalIPv4}"
|
||||
];
|
||||
|
||||
dhcp-option = [
|
||||
"3,${dmzRouterIPv4}"
|
||||
"option:dns-server,${dmzRouterIPv4}"
|
||||
"option6:dns-server,[2a02:58:19a:30::1]"
|
||||
];
|
||||
|
||||
address = [
|
||||
"/ns.pizzapim.nl/ns.geokunis2.nl/${dmzServicesIPv4}"
|
||||
"/ns.pizzapim.nl/ns.geokunis2.nl/${dmzServicesIPv6}"
|
||||
];
|
||||
}
|
||||
|
|
@ -1,68 +0,0 @@
|
|||
{ config, dns, ... }:
|
||||
with dns.lib.combinators;
|
||||
let
|
||||
inherit (config.lab.networking) publicIPv4 dmzServicesIPv6 dockerSwarmIPv6;
|
||||
in
|
||||
{
|
||||
SOA = {
|
||||
nameServer = "ns";
|
||||
adminEmail = "hostmaster@geokunis2.nl";
|
||||
serial = 2024011401;
|
||||
};
|
||||
|
||||
NS = [
|
||||
"ns.geokunis2.nl."
|
||||
"ns0.transip.net."
|
||||
"ns1.transip.nl."
|
||||
"ns2.transip.eu."
|
||||
];
|
||||
|
||||
MX = [ (mx.mx 10 "mail.geokunis2.nl.") ];
|
||||
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ dockerSwarmIPv6 ];
|
||||
CAA = letsEncrypt "caa@geokunis2.nl";
|
||||
|
||||
subdomains = {
|
||||
"*" = {
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ dockerSwarmIPv6 ];
|
||||
};
|
||||
|
||||
ns = {
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ dmzServicesIPv6 ];
|
||||
};
|
||||
|
||||
ns1 = {
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ dmzServicesIPv6 ];
|
||||
};
|
||||
|
||||
ns2 = {
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ dmzServicesIPv6 ];
|
||||
};
|
||||
|
||||
# Override because we don't support IPv6 for KMS.
|
||||
kms = {
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ ];
|
||||
};
|
||||
|
||||
wg = {
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ "2a0d:6e00:1a77::1" ];
|
||||
};
|
||||
|
||||
wg4 = {
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ ];
|
||||
};
|
||||
|
||||
wg6 = {
|
||||
A = [ ];
|
||||
AAAA = [ "2a0d:6e00:1a77::1" ];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,64 +0,0 @@
|
|||
{ config, dns, ... }:
|
||||
with dns.lib.combinators;
|
||||
let
|
||||
inherit (config.lab.networking) publicIPv4 dmzServicesIPv6 dockerSwarmIPv6;
|
||||
in
|
||||
{
|
||||
CAA = letsEncrypt "caa@kun.is";
|
||||
|
||||
SOA = {
|
||||
nameServer = "ns1";
|
||||
adminEmail = "webmaster@kun.is";
|
||||
serial = 2024011401;
|
||||
};
|
||||
|
||||
NS = [
|
||||
"ns1.kun.is."
|
||||
"ns2.kun.is."
|
||||
];
|
||||
|
||||
MX = [
|
||||
(mx.mx 10 "mail.kun.is.")
|
||||
];
|
||||
|
||||
subdomains = {
|
||||
"*" = {
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ dockerSwarmIPv6 ];
|
||||
};
|
||||
|
||||
ns = {
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ dmzServicesIPv6 ];
|
||||
};
|
||||
|
||||
ns1 = {
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ dmzServicesIPv6 ];
|
||||
};
|
||||
|
||||
ns2 = {
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ dmzServicesIPv6 ];
|
||||
};
|
||||
|
||||
# Override because we don't support IPv6 for Git SSH.
|
||||
git = {
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ ];
|
||||
};
|
||||
|
||||
# Override because we don't support IPv6 for KMS.
|
||||
kms = {
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ ];
|
||||
};
|
||||
|
||||
# Override because wg is on opnsense so ipv6 differs from "dmzServicesIPv6"
|
||||
wg = {
|
||||
A = [ publicIPv4 ];
|
||||
AAAA = [ "2a0d:6e00:1a77::1" ];
|
||||
};
|
||||
|
||||
};
|
||||
}
|
||||
|
|
@ -1,70 +0,0 @@
|
|||
{ lib, config, ... }:
|
||||
let
|
||||
cfg = config.lab.ssh;
|
||||
hostCert = builtins.toFile "host_ed25519-cert.pub" cfg.hostCert;
|
||||
userCert = builtins.toFile "user_ed25519-cert.pub" cfg.userCert;
|
||||
in
|
||||
{
|
||||
options.lab.ssh = {
|
||||
useCertificates = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to use certificates at all.
|
||||
'';
|
||||
};
|
||||
|
||||
hostCert = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
SSH host certificate
|
||||
'';
|
||||
};
|
||||
|
||||
userCert = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
SSH user certificate
|
||||
'';
|
||||
};
|
||||
|
||||
hostKey = lib.mkOption {
|
||||
default =
|
||||
../secrets/${config.networking.hostName}_host_ed25519.age;
|
||||
type = lib.types.path;
|
||||
description = ''
|
||||
SSH host key
|
||||
'';
|
||||
};
|
||||
|
||||
userKey = lib.mkOption {
|
||||
default =
|
||||
../secrets/${config.networking.hostName}_user_ed25519.age;
|
||||
type = lib.types.path;
|
||||
description = ''
|
||||
SSH user key
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.useCertificates {
|
||||
services.openssh = {
|
||||
extraConfig = ''
|
||||
HostCertificate ${hostCert}
|
||||
HostKey ${config.age.secrets.host_ed25519.path}
|
||||
'';
|
||||
};
|
||||
|
||||
programs.ssh = {
|
||||
extraConfig = ''
|
||||
CertificateFile ${userCert}
|
||||
IdentityFile ${config.age.secrets.user_ed25519.path}
|
||||
'';
|
||||
};
|
||||
|
||||
age.secrets = {
|
||||
"host_ed25519".file = cfg.hostKey;
|
||||
"user_ed25519".file = cfg.userKey;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,66 +0,0 @@
|
|||
{ lib, config, machine, ... }:
|
||||
let cfg = config.lab.storage;
|
||||
in {
|
||||
options.lab.storage = {
|
||||
osDisk = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
The disk to be used for the machine's operating system.
|
||||
'';
|
||||
};
|
||||
|
||||
dataPartition = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Partition to be used for data storage on this machine.
|
||||
'';
|
||||
};
|
||||
|
||||
dataMountPoint = lib.mkOption {
|
||||
default = "/mnt/data";
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
Mount point of the machine's data partition.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf (machine.type == "physical") {
|
||||
fileSystems.${cfg.dataMountPoint}.device = cfg.dataPartition;
|
||||
|
||||
# TODO: Rename this to 'osDisk'. Unfortunately, we would need to run nixos-anywhere again then.
|
||||
disko.devices.disk.vdb = {
|
||||
device = cfg.osDisk;
|
||||
type = "disk";
|
||||
|
||||
content = {
|
||||
type = "gpt";
|
||||
|
||||
partitions = {
|
||||
swap.size = "100%";
|
||||
|
||||
ESP = {
|
||||
type = "EF00";
|
||||
size = "500M";
|
||||
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "vfat";
|
||||
mountpoint = "/boot";
|
||||
};
|
||||
};
|
||||
|
||||
root = {
|
||||
end = "-4G";
|
||||
|
||||
content = {
|
||||
type = "filesystem";
|
||||
format = "btrfs";
|
||||
mountpoint = "/";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,49 +0,0 @@
|
|||
{ pkgs, lib, config, ... }:
|
||||
let cfg = config.lab.terraformDatabase;
|
||||
in {
|
||||
options.lab.terraformDatabase.enable = lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
description = ''
|
||||
Whether to start a postgreSQL database for Terraform states
|
||||
'';
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
networking.firewall.interfaces.${config.lab.networking.mainNicNamePattern}.allowedTCPPorts = [ 5432 ];
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = [ "terraformstates" ];
|
||||
package = pkgs.postgresql_15;
|
||||
enableTCPIP = true;
|
||||
|
||||
dataDir = "${config.lab.storage.dataMountPoint}/postgresql/${config.services.postgresql.package.psqlSchema}";
|
||||
|
||||
authentication = ''
|
||||
hostssl terraformstates terraform all cert
|
||||
'';
|
||||
|
||||
settings =
|
||||
let
|
||||
serverCert = builtins.toFile "postgresql_server.crt"
|
||||
(builtins.readFile ./postgresql_server.crt);
|
||||
in
|
||||
{
|
||||
ssl = true;
|
||||
ssl_cert_file = serverCert;
|
||||
ssl_key_file = config.age.secrets."postgresql_server.key".path;
|
||||
ssl_ca_file = serverCert;
|
||||
};
|
||||
|
||||
ensureUsers = [{ name = "terraform"; }];
|
||||
};
|
||||
|
||||
age.secrets."postgresql_server.key" = {
|
||||
file = ../../secrets/postgresql_server.key.age;
|
||||
mode = "400";
|
||||
owner = builtins.toString config.ids.uids.postgres;
|
||||
group = builtins.toString config.ids.gids.postgres;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,67 +0,0 @@
|
|||
Certificate:
|
||||
Data:
|
||||
Version: 1 (0x0)
|
||||
Serial Number:
|
||||
ef:2f:4d:d4:26:7e:33:1b
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
Issuer: CN=jefke.hyp
|
||||
Validity
|
||||
Not Before: Nov 22 19:12:03 2023 GMT
|
||||
Not After : Oct 29 19:12:03 2123 GMT
|
||||
Subject: CN=jefke.hyp
|
||||
Subject Public Key Info:
|
||||
Public Key Algorithm: rsaEncryption
|
||||
RSA Public-Key: (2048 bit)
|
||||
Modulus:
|
||||
00:c7:ab:eb:9c:d0:7f:4f:f1:ba:65:0a:8b:07:7b:
|
||||
2e:5b:f0:26:82:33:c9:73:e6:91:cc:11:94:05:1c:
|
||||
8d:67:29:cb:5e:67:35:02:80:54:af:99:4b:aa:ce:
|
||||
e8:56:62:be:63:cb:b2:4a:b0:a9:28:12:e2:77:50:
|
||||
7d:d5:d2:3b:48:d8:32:59:25:26:ff:a6:5c:f6:eb:
|
||||
ae:5b:3d:7a:14:10:ba:90:9c:6f:1f:b9:d8:99:0e:
|
||||
b7:09:5e:62:69:c4:c0:c6:27:b0:d3:60:0d:47:4c:
|
||||
a5:11:53:f2:f1:4a:f9:a6:bc:d6:a3:35:a2:e8:e5:
|
||||
a9:d1:60:e8:e5:18:ce:d2:60:80:4e:dc:48:ae:7f:
|
||||
b7:ea:76:51:28:39:a4:b0:95:82:95:93:98:b2:9f:
|
||||
23:c9:81:69:59:a3:e4:f7:5a:1c:01:31:96:c1:4b:
|
||||
59:21:f8:a2:e6:9e:21:78:0e:6b:c1:68:c7:5c:16:
|
||||
9a:06:54:df:b6:77:1d:2d:89:d0:c8:9e:db:b5:d4:
|
||||
8c:fb:b9:4f:b7:6e:39:5f:39:8e:48:73:76:7d:46:
|
||||
6e:1f:8d:14:cb:40:b5:ff:c6:f0:c0:44:3c:ed:52:
|
||||
3f:4f:7b:69:63:93:c6:41:e6:5e:ed:33:50:20:46:
|
||||
db:93:bf:e8:52:51:95:f1:81:73:58:da:67:21:7b:
|
||||
12:bd
|
||||
Exponent: 65537 (0x10001)
|
||||
Signature Algorithm: sha256WithRSAEncryption
|
||||
aa:5c:89:41:a6:b7:3d:65:87:ca:50:c4:f3:58:aa:d3:b4:55:
|
||||
b1:a7:8d:18:26:17:e5:8a:21:24:a1:49:53:77:31:5b:55:63:
|
||||
be:01:d8:fe:b7:06:7c:da:07:1f:94:6a:de:96:ad:ca:3b:20:
|
||||
2a:e1:35:90:19:83:6d:37:d1:15:12:de:3c:0e:46:be:66:a1:
|
||||
6a:1d:ec:72:dc:46:79:69:e4:af:77:c8:ff:cd:d6:7d:16:88:
|
||||
ab:44:fd:70:fc:40:47:ff:43:95:11:5a:9a:56:0c:d2:dd:7c:
|
||||
3b:87:aa:10:26:fa:25:a3:a0:43:8a:1b:ec:54:11:7e:65:67:
|
||||
d2:06:e1:3e:3b:e1:0e:b0:80:ef:4b:35:3f:fc:34:1d:95:2e:
|
||||
ee:c1:67:38:da:b3:74:86:4b:95:8c:0c:1d:51:28:c1:42:e9:
|
||||
77:68:d7:ec:3b:66:30:c6:e5:2a:62:ea:15:fb:24:56:cf:02:
|
||||
d0:25:54:a7:58:15:b5:2a:71:93:56:c0:69:7a:36:18:6c:31:
|
||||
b1:8e:3c:77:d7:77:ac:fc:e1:94:c5:08:bb:35:ac:48:5f:6b:
|
||||
8b:c8:c8:78:f4:a9:ca:4f:9d:51:54:89:97:c9:af:a1:fa:71:
|
||||
df:58:f6:ff:04:7c:c8:1c:95:6b:1a:e3:a7:f6:43:1c:27:94:
|
||||
10:03:ce:ec
|
||||
-----BEGIN CERTIFICATE-----
|
||||
MIICpjCCAY4CCQDvL03UJn4zGzANBgkqhkiG9w0BAQsFADAUMRIwEAYDVQQDDAlq
|
||||
ZWZrZS5oeXAwIBcNMjMxMTIyMTkxMjAzWhgPMjEyMzEwMjkxOTEyMDNaMBQxEjAQ
|
||||
BgNVBAMMCWplZmtlLmh5cDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
|
||||
AMer65zQf0/xumUKiwd7LlvwJoIzyXPmkcwRlAUcjWcpy15nNQKAVK+ZS6rO6FZi
|
||||
vmPLskqwqSgS4ndQfdXSO0jYMlklJv+mXPbrrls9ehQQupCcbx+52JkOtwleYmnE
|
||||
wMYnsNNgDUdMpRFT8vFK+aa81qM1oujlqdFg6OUYztJggE7cSK5/t+p2USg5pLCV
|
||||
gpWTmLKfI8mBaVmj5PdaHAExlsFLWSH4ouaeIXgOa8Fox1wWmgZU37Z3HS2J0Mie
|
||||
27XUjPu5T7duOV85jkhzdn1Gbh+NFMtAtf/G8MBEPO1SP097aWOTxkHmXu0zUCBG
|
||||
25O/6FJRlfGBc1jaZyF7Er0CAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAqlyJQaa3
|
||||
PWWHylDE81iq07RVsaeNGCYX5YohJKFJU3cxW1VjvgHY/rcGfNoHH5Rq3patyjsg
|
||||
KuE1kBmDbTfRFRLePA5Gvmahah3sctxGeWnkr3fI/83WfRaIq0T9cPxAR/9DlRFa
|
||||
mlYM0t18O4eqECb6JaOgQ4ob7FQRfmVn0gbhPjvhDrCA70s1P/w0HZUu7sFnONqz
|
||||
dIZLlYwMHVEowULpd2jX7DtmMMblKmLqFfskVs8C0CVUp1gVtSpxk1bAaXo2GGwx
|
||||
sY48d9d3rPzhlMUIuzWsSF9ri8jIePSpyk+dUVSJl8mvofpx31j2/wR8yByVaxrj
|
||||
p/ZDHCeUEAPO7A==
|
||||
-----END CERTIFICATE-----
|
||||
Reference in a new issue