create shared nixos config between physical and VM

rename nixos -> nix
This commit is contained in:
Pim Kunis 2024-01-28 12:06:30 +01:00
parent 472175c5a3
commit 32154e7163
39 changed files with 114 additions and 196 deletions

View file

@ -38,7 +38,7 @@
pkgs = nixpkgs.legacyPackages.${system}; pkgs = nixpkgs.legacyPackages.${system};
lib = pkgs.lib; lib = pkgs.lib;
pkgs-unstable = nixpkgs-unstable.legacyPackages.${system}; pkgs-unstable = nixpkgs-unstable.legacyPackages.${system};
machines = import ./nixos/machines; machines = import ./nix/machines;
physicalMachines = lib.filterAttrs (n: v: v.type == "physical") machines; physicalMachines = lib.filterAttrs (n: v: v.type == "physical") machines;
# TODO: Maybe use mergeAttrLists # TODO: Maybe use mergeAttrLists
mkNixosSystems = systemDef: mkNixosSystems = systemDef:
@ -78,7 +78,7 @@
nixosConfigurations = mkNixosSystems (machine: { nixosConfigurations = mkNixosSystems (machine: {
inherit system; inherit system;
specialArgs = { inherit machines machine kubenix dns microvm disko agenix; }; specialArgs = { inherit machines machine kubenix dns microvm disko agenix; };
modules = [ ./nixos ]; modules = [ ./nix/physical.nix ];
}); });
deploy = { deploy = {

View file

@ -15,6 +15,7 @@
ssh = { ssh = {
useCertificates = true; useCertificates = true;
# TODO: automatically set this?
hostCert = builtins.readFile ./jefke_host_ed25519-cert.pub; hostCert = builtins.readFile ./jefke_host_ed25519-cert.pub;
userCert = builtins.readFile ./jefke_user_ed25519-cert.pub; userCert = builtins.readFile ./jefke_user_ed25519-cert.pub;
}; };

81
nix/physical.nix Normal file
View file

@ -0,0 +1,81 @@
{ pkgs, config, lib, modulesPath, machine, microvm, disko, agenix, machines, ... }: {
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
microvm.nixosModules.host
./shared.nix
];
config = {
boot = {
kernelModules = [ "kvm-intel" ];
extraModulePackages = [ ];
initrd = {
availableKernelModules = [
"ahci"
"xhci_pci"
"nvme"
"usbhid"
"usb_storage"
"sd_mod"
"sdhci_pci"
];
kernelModules = [ ];
};
loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
};
nixpkgs = {
config.allowUnfree = true;
hostPlatform = "x86_64-linux";
};
hardware.cpu.intel.updateMicrocode = config.hardware.enableRedistributableFirmware;
age.identityPaths = [ "/etc/age_ed25519" ];
virtualisation.libvirtd.enable = true;
nix = {
package = pkgs.nixFlakes;
extraOptions = ''
experimental-features = nix-command flakes
'';
};
system = {
stateVersion = "23.05";
activationScripts.diff = ''
if [[ -e /run/current-system ]]; then
${pkgs.nix}/bin/nix store diff-closures /run/current-system "$systemConfig"
fi
'';
};
microvm.vms =
let
vmsForHypervisor = lib.attrValues (lib.filterAttrs (n: v: v.type == "virtual" && v.hypervisorName == machine.hostName) machines);
in
lib.attrsets.mergeAttrsList (map
(vm:
{
"${vm.hostName}" = {
# TODO Simplify?
specialArgs = { inherit agenix disko pkgs lib microvm; machine = vm; hypervisorConfig = config; };
config = {
imports = [
./virtual.nix
];
};
};
}
)
vmsForHypervisor
);
};
}

View file

@ -1,4 +1,4 @@
{ pkgs, lib, config, agenix, disko, machine, hypervisorConfig, ... }: { { pkgs, machine, disko, agenix, ... }: {
imports = [ imports = [
./modules ./modules
./lab.nix ./lab.nix
@ -7,17 +7,7 @@
agenix.nixosModules.default agenix.nixosModules.default
]; ];
options.lab.vmMacAddress = lib.mkOption {
type = lib.types.str;
description = ''
The MAC address of the VM's main NIC.
'';
};
# TODO: remove overlap with physical nixos module
# Perhaps a sane defaults module?
config = { config = {
system.stateVersion = hypervisorConfig.system.stateVersion;
time.timeZone = "Europe/Amsterdam"; time.timeZone = "Europe/Amsterdam";
i18n = { i18n = {
@ -100,20 +90,5 @@
parted parted
radvd radvd
]; ];
microvm = {
shares = [{
source = "/nix/store";
mountPoint = "/nix/.ro-store";
tag = "ro-store";
proto = "virtiofs";
}];
interfaces = [{
type = "tap";
id = "vm-${machine.hostName}";
mac = config.lab.vmMacAddress;
}];
};
}; };
} }

29
nix/virtual.nix Normal file
View file

@ -0,0 +1,29 @@
{ lib, config, machine, hypervisorConfig, ... }: {
imports = [ ./shared.nix ];
options.lab.vmMacAddress = lib.mkOption {
type = lib.types.str;
description = ''
The MAC address of the VM's main NIC.
'';
};
config = {
system.stateVersion = hypervisorConfig.system.stateVersion;
microvm = {
shares = [{
source = "/nix/store";
mountPoint = "/nix/.ro-store";
tag = "ro-store";
proto = "virtiofs";
}];
interfaces = [{
type = "tap";
id = "vm-${machine.hostName}";
mac = config.lab.vmMacAddress;
}];
};
};
}

View file

@ -1,168 +0,0 @@
{ pkgs, config, lib, modulesPath, machine, microvm, disko, agenix, machines, ... }: {
imports = [
(modulesPath + "/installer/scan/not-detected.nix")
./modules
./lab.nix
machine.nixosModule
disko.nixosModules.disko
agenix.nixosModules.default
microvm.nixosModules.host
];
config = {
boot = {
kernelModules = [ "kvm-intel" ];
extraModulePackages = [ ];
initrd = {
availableKernelModules = [
"ahci"
"xhci_pci"
"nvme"
"usbhid"
"usb_storage"
"sd_mod"
"sdhci_pci"
];
kernelModules = [ ];
};
loader = {
systemd-boot.enable = true;
efi.canTouchEfiVariables = true;
};
};
time.timeZone = "Europe/Amsterdam";
i18n = {
defaultLocale = "en_US.UTF-8";
extraLocaleSettings = {
LC_ADDRESS = "nl_NL.UTF-8";
LC_IDENTIFICATION = "nl_NL.UTF-8";
LC_MEASUREMENT = "nl_NL.UTF-8";
LC_MONETARY = "nl_NL.UTF-8";
LC_NAME = "nl_NL.UTF-8";
LC_NUMERIC = "nl_NL.UTF-8";
LC_PAPER = "nl_NL.UTF-8";
LC_TELEPHONE = "nl_NL.UTF-8";
LC_TIME = "nl_NL.UTF-8";
};
};
services = {
openssh = {
enable = true;
openFirewall = true;
settings = {
PasswordAuthentication = false;
KbdInteractiveAuthentication = false;
};
};
xserver = {
layout = "us";
xkbVariant = "";
};
};
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOodpLr+FDRyKyHjucHizNLVFHZ5AQmE9GmxMnOsSoaw pimkunis@thinkpadpim"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINUZp4BCxf7uLa1QWonx/Crf8tYZ5MKIZ+EuaBa82LrV user@user-laptop"
];
programs = {
ssh = {
knownHosts = {
dmz = {
hostNames = [ "*.dmz" ];
publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAX2IhgHNxC6JTvLu9cej+iWuG+uJFMXn4AiRro9533x";
certAuthority = true;
};
hypervisors = {
hostNames = [ "*.hyp" ];
publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFzRkH3d/KVJQouswY/DMpenWbDFVOnI3Vut0xR0e1tb";
certAuthority = true;
};
};
};
neovim = {
enable = true;
vimAlias = true;
viAlias = true;
};
};
nixpkgs = {
config.allowUnfree = true;
hostPlatform = "x86_64-linux";
};
environment.systemPackages = with pkgs; [
neofetch
wget
git
btop
htop
ripgrep
dig
tree
file
tcpdump
lsof
parted
radvd
];
hardware.cpu.intel.updateMicrocode = config.hardware.enableRedistributableFirmware;
age.identityPaths = [ "/etc/age_ed25519" ];
virtualisation.libvirtd.enable = true;
nix = {
package = pkgs.nixFlakes;
extraOptions = ''
experimental-features = nix-command flakes
'';
};
system = {
stateVersion = "23.05";
activationScripts.diff = ''
if [[ -e /run/current-system ]]; then
${pkgs.nix}/bin/nix store diff-closures /run/current-system "$systemConfig"
fi
'';
};
microvm.vms =
let
vmsForHypervisor = lib.attrValues (lib.filterAttrs (n: v: v.type == "virtual" && v.hypervisorName == machine.hostName) machines);
in
lib.attrsets.mergeAttrsList (map
(vm:
{
"${vm.hostName}" = {
# TODO Simplify?
specialArgs = { inherit agenix disko pkgs lib microvm; machine = vm; hypervisorConfig = config; };
config = {
imports = [
./vm.nix
];
};
};
}
)
vmsForHypervisor
);
};
}