Format repo
This commit is contained in:
parent
eed797fb13
commit
5341235bc3
21 changed files with 1200 additions and 1076 deletions
|
|
@ -1,12 +1,16 @@
|
|||
{ pkgs, lib, config, ... }:
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.lab.backups;
|
||||
|
||||
borgmaticConfig = pkgs.writeTextFile {
|
||||
name = "borgmatic-config.yaml";
|
||||
|
||||
text = lib.generators.toYAML { } {
|
||||
source_directories = [ "/mnt/longhorn/persistent/longhorn-backup" ];
|
||||
text = lib.generators.toYAML {} {
|
||||
source_directories = ["/mnt/longhorn/persistent/longhorn-backup"];
|
||||
|
||||
repositories = [
|
||||
{
|
||||
|
|
@ -27,8 +31,7 @@ let
|
|||
encryption_passcommand = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."borg/borgPassphrase".path}";
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.lab.backups = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
|
|
@ -48,13 +51,13 @@ in
|
|||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
environment.systemPackages = with pkgs; [ borgbackup ];
|
||||
environment.systemPackages = with pkgs; [borgbackup];
|
||||
# Converted from:
|
||||
# https://github.com/borgmatic-collective/borgmatic/tree/84823dfb912db650936e3492f6ead7e0e0d32a0f/sample/systemd
|
||||
systemd.services.borgmatic = {
|
||||
description = "borgmatic backup";
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
wants = ["network-online.target"];
|
||||
after = ["network-online.target"];
|
||||
unitConfig.ConditionACPower = true;
|
||||
preStart = "${pkgs.coreutils}/bin/sleep 10s";
|
||||
|
||||
|
|
@ -75,7 +78,7 @@ in
|
|||
|
||||
systemd.timers.borgmatic = {
|
||||
description = "Run borgmatic backup";
|
||||
wantedBy = [ "timers.target" ];
|
||||
wantedBy = ["timers.target"];
|
||||
timerConfig = {
|
||||
OnCalendar = "*-*-* 3:00:00";
|
||||
Persistent = true;
|
||||
|
|
@ -84,8 +87,8 @@ in
|
|||
};
|
||||
|
||||
sops.secrets = {
|
||||
"borg/borgPassphrase" = { };
|
||||
"borg/borgbasePrivateKey" = { };
|
||||
"borg/borgPassphrase" = {};
|
||||
"borg/borgbasePrivateKey" = {};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
{ lib, config, ... }:
|
||||
let
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.lab.data-sharing;
|
||||
|
||||
nfsShares = [
|
||||
|
|
@ -13,13 +16,12 @@ let
|
|||
|
||||
nfsExports = lib.strings.concatLines (
|
||||
builtins.map
|
||||
(share:
|
||||
"${share} 192.168.30.0/16(rw,sync,no_subtree_check,no_root_squash) 127.0.0.1/8(rw,sync,no_subtree_check,no_root_squash) 10.0.0.0/8(rw,sync,no_subtree_check,no_root_squash)"
|
||||
)
|
||||
nfsShares
|
||||
(
|
||||
share: "${share} 192.168.30.0/16(rw,sync,no_subtree_check,no_root_squash) 127.0.0.1/8(rw,sync,no_subtree_check,no_root_squash) 10.0.0.0/8(rw,sync,no_subtree_check,no_root_squash)"
|
||||
)
|
||||
nfsShares
|
||||
);
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.lab.data-sharing = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
|
|
|
|||
|
|
@ -1,17 +1,27 @@
|
|||
{ self, pkgs, config, lib, inputs, machine, ... }: {
|
||||
imports = [
|
||||
./storage.nix
|
||||
./backups.nix
|
||||
./networking
|
||||
./data-sharing.nix
|
||||
./monitoring
|
||||
./k3s
|
||||
./tailscale.nix
|
||||
machine.nixosModule
|
||||
inputs.disko.nixosModules.disko
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
inputs.nix-snapshotter.nixosModules.nix-snapshotter
|
||||
] ++ lib.lists.optional (machine.isRaspberryPi) inputs.nixos-hardware.nixosModules.raspberry-pi-4;
|
||||
{
|
||||
self,
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
inputs,
|
||||
machine,
|
||||
...
|
||||
}: {
|
||||
imports =
|
||||
[
|
||||
./storage.nix
|
||||
./backups.nix
|
||||
./networking
|
||||
./data-sharing.nix
|
||||
./monitoring
|
||||
./k3s
|
||||
./tailscale.nix
|
||||
machine.nixosModule
|
||||
inputs.disko.nixosModules.disko
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
inputs.nix-snapshotter.nixosModules.nix-snapshotter
|
||||
]
|
||||
++ lib.lists.optional (machine.isRaspberryPi) inputs.nixos-hardware.nixosModules.raspberry-pi-4;
|
||||
|
||||
config = {
|
||||
time.timeZone = "Europe/Amsterdam";
|
||||
|
|
@ -31,7 +41,9 @@
|
|||
i18n = {
|
||||
defaultLocale = "en_US.UTF-8";
|
||||
|
||||
extraLocaleSettings = let extraLocale = "nl_NL.UTF-8"; in {
|
||||
extraLocaleSettings = let
|
||||
extraLocale = "nl_NL.UTF-8";
|
||||
in {
|
||||
LC_ADDRESS = extraLocale;
|
||||
LC_IDENTIFICATION = extraLocale;
|
||||
LC_MEASUREMENT = extraLocale;
|
||||
|
|
@ -97,12 +109,12 @@
|
|||
];
|
||||
|
||||
boot = lib.mkIf (! machine.isRaspberryPi) {
|
||||
kernelModules = [ "kvm-intel" ];
|
||||
extraModulePackages = [ ];
|
||||
kernelModules = ["kvm-intel"];
|
||||
extraModulePackages = [];
|
||||
kernel.sysctl."fs.inotify.max_user_instances" = 256;
|
||||
|
||||
initrd = {
|
||||
kernelModules = [ ];
|
||||
kernelModules = [];
|
||||
|
||||
availableKernelModules = [
|
||||
"ahci"
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{ kubenix, ... }: {
|
||||
imports = [ kubenix.modules.k8s ];
|
||||
{kubenix, ...}: {
|
||||
imports = [kubenix.modules.k8s];
|
||||
kubernetes.resources.clusterRoleBindings.cluster-admins = {
|
||||
roleRef = {
|
||||
apiGroup = "rbac.authorization.k8s.io";
|
||||
|
|
|
|||
|
|
@ -1,8 +1,13 @@
|
|||
{ self, inputs, pkgs, lib, config, ... }:
|
||||
let
|
||||
cfg = config.lab.k3s;
|
||||
in
|
||||
{
|
||||
self,
|
||||
inputs,
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.lab.k3s;
|
||||
in {
|
||||
options.lab.k3s = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
|
|
@ -62,68 +67,66 @@ in
|
|||
address = "/run/nix-snapshotter/nix-snapshotter.sock";
|
||||
};
|
||||
|
||||
plugins =
|
||||
let
|
||||
k3s-cni-plugins = pkgs.buildEnv {
|
||||
name = "k3s-cni-plugins";
|
||||
paths = with pkgs; [
|
||||
cni-plugins
|
||||
cni-plugin-flannel
|
||||
];
|
||||
};
|
||||
in
|
||||
{
|
||||
"io.containerd.grpc.v1.cri" = {
|
||||
stream_server_address = "127.0.0.1";
|
||||
stream_server_port = "10010";
|
||||
enable_selinux = false;
|
||||
enable_unprivileged_ports = true;
|
||||
enable_unprivileged_icmp = true;
|
||||
disable_apparmor = true;
|
||||
disable_cgroup = true;
|
||||
restrict_oom_score_adj = true;
|
||||
sandbox_image = "rancher/mirrored-pause:3.6";
|
||||
containerd.snapshotter = "nix";
|
||||
plugins = let
|
||||
k3s-cni-plugins = pkgs.buildEnv {
|
||||
name = "k3s-cni-plugins";
|
||||
paths = with pkgs; [
|
||||
cni-plugins
|
||||
cni-plugin-flannel
|
||||
];
|
||||
};
|
||||
in {
|
||||
"io.containerd.grpc.v1.cri" = {
|
||||
stream_server_address = "127.0.0.1";
|
||||
stream_server_port = "10010";
|
||||
enable_selinux = false;
|
||||
enable_unprivileged_ports = true;
|
||||
enable_unprivileged_icmp = true;
|
||||
disable_apparmor = true;
|
||||
disable_cgroup = true;
|
||||
restrict_oom_score_adj = true;
|
||||
sandbox_image = "rancher/mirrored-pause:3.6";
|
||||
containerd.snapshotter = "nix";
|
||||
|
||||
cni = {
|
||||
conf_dir = "/var/lib/rancher/k3s/agent/etc/cni/net.d/";
|
||||
bin_dir = "${k3s-cni-plugins}/bin";
|
||||
};
|
||||
cni = {
|
||||
conf_dir = "/var/lib/rancher/k3s/agent/etc/cni/net.d/";
|
||||
bin_dir = "${k3s-cni-plugins}/bin";
|
||||
};
|
||||
};
|
||||
|
||||
"io.containerd.transfer.v1.local".unpack_config = [{
|
||||
"io.containerd.transfer.v1.local".unpack_config = [
|
||||
{
|
||||
platform = "linux/amd64";
|
||||
snapshotter = "nix";
|
||||
}];
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services = {
|
||||
nix-snapshotter.enable = true;
|
||||
|
||||
k3s =
|
||||
let
|
||||
serverFlagList = [
|
||||
"--image-service-endpoint=unix:///run/nix-snapshotter/nix-snapshotter.sock"
|
||||
"--snapshotter=overlayfs"
|
||||
"--container-runtime-endpoint=unix:///run/containerd/containerd.sock"
|
||||
"--tls-san=${config.networking.fqdn}"
|
||||
"--disable=servicelb"
|
||||
"--cluster-cidr=10.42.0.0/16,2001:cafe:42::/56"
|
||||
"--service-cidr=10.43.0.0/16,2001:cafe:43::/112"
|
||||
];
|
||||
k3s = let
|
||||
serverFlagList = [
|
||||
"--image-service-endpoint=unix:///run/nix-snapshotter/nix-snapshotter.sock"
|
||||
"--snapshotter=overlayfs"
|
||||
"--container-runtime-endpoint=unix:///run/containerd/containerd.sock"
|
||||
"--tls-san=${config.networking.fqdn}"
|
||||
"--disable=servicelb"
|
||||
"--cluster-cidr=10.42.0.0/16,2001:cafe:42::/56"
|
||||
"--service-cidr=10.43.0.0/16,2001:cafe:43::/112"
|
||||
];
|
||||
|
||||
serverFlags = builtins.concatStringsSep " " serverFlagList;
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
role = cfg.role;
|
||||
tokenFile = config.sops.secrets."k3s/serverToken".path;
|
||||
extraFlags = lib.mkIf (cfg.role == "server") (lib.mkForce serverFlags);
|
||||
clusterInit = cfg.clusterInit;
|
||||
serverAddr = lib.mkIf (! (cfg.serverAddr == null)) cfg.serverAddr;
|
||||
};
|
||||
serverFlags = builtins.concatStringsSep " " serverFlagList;
|
||||
in {
|
||||
enable = true;
|
||||
role = cfg.role;
|
||||
tokenFile = config.sops.secrets."k3s/serverToken".path;
|
||||
extraFlags = lib.mkIf (cfg.role == "server") (lib.mkForce serverFlags);
|
||||
clusterInit = cfg.clusterInit;
|
||||
serverAddr = lib.mkIf (! (cfg.serverAddr == null)) cfg.serverAddr;
|
||||
};
|
||||
|
||||
# Required for Longhorn
|
||||
openiscsi = {
|
||||
|
|
@ -143,11 +146,14 @@ in
|
|||
k3s-bootstrap = lib.mkIf (cfg.role == "server") {
|
||||
text = (
|
||||
let
|
||||
k3sBootstrapFile = (inputs.kubenix.evalModules.x86_64-linux {
|
||||
module = import ./bootstrap.nix;
|
||||
}).config.kubernetes.result;
|
||||
in
|
||||
''
|
||||
k3sBootstrapFile =
|
||||
(inputs.kubenix.evalModules.x86_64-linux {
|
||||
module = import ./bootstrap.nix;
|
||||
})
|
||||
.config
|
||||
.kubernetes
|
||||
.result;
|
||||
in ''
|
||||
mkdir -p /var/lib/rancher/k3s/server/manifests
|
||||
ln -sf ${k3sBootstrapFile} /var/lib/rancher/k3s/server/manifests/k3s-bootstrap.json
|
||||
''
|
||||
|
|
@ -166,18 +172,16 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
sops.secrets =
|
||||
let
|
||||
keyPathBase = "/var/lib/rancher/k3s/server/tls";
|
||||
in
|
||||
{
|
||||
"k3s/serverToken" = { };
|
||||
"k3s/keys/clientCAKey".path = "${keyPathBase}/client-ca.key";
|
||||
"k3s/keys/requestHeaderCAKey".path = "${keyPathBase}/request-header-ca.key";
|
||||
"k3s/keys/serverCAKey".path = "${keyPathBase}/server-ca.key";
|
||||
"k3s/keys/serviceKey".path = "${keyPathBase}/service.key";
|
||||
"k3s/keys/etcd/peerCAKey".path = "${keyPathBase}/etcd/peer-ca.key";
|
||||
"k3s/keys/etcd/serverCAKey".path = "${keyPathBase}/etcd/server-ca.key";
|
||||
};
|
||||
sops.secrets = let
|
||||
keyPathBase = "/var/lib/rancher/k3s/server/tls";
|
||||
in {
|
||||
"k3s/serverToken" = {};
|
||||
"k3s/keys/clientCAKey".path = "${keyPathBase}/client-ca.key";
|
||||
"k3s/keys/requestHeaderCAKey".path = "${keyPathBase}/request-header-ca.key";
|
||||
"k3s/keys/serverCAKey".path = "${keyPathBase}/server-ca.key";
|
||||
"k3s/keys/serviceKey".path = "${keyPathBase}/service.key";
|
||||
"k3s/keys/etcd/peerCAKey".path = "${keyPathBase}/etcd/peer-ca.key";
|
||||
"k3s/keys/etcd/serverCAKey".path = "${keyPathBase}/etcd/server-ca.key";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,8 +1,11 @@
|
|||
{ lib, config, machines, ... }:
|
||||
let
|
||||
cfg = config.lab.monitoring;
|
||||
in
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
machines,
|
||||
...
|
||||
}: let
|
||||
cfg = config.lab.monitoring;
|
||||
in {
|
||||
options = {
|
||||
lab.monitoring = {
|
||||
enable = lib.mkOption {
|
||||
|
|
@ -18,8 +21,9 @@ in
|
|||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
networking.firewall.allowedTCPPorts = [ config.services.prometheus.exporters.node.port ]
|
||||
++ lib.lists.optionals cfg.server.enable [ 80 ];
|
||||
networking.firewall.allowedTCPPorts =
|
||||
[config.services.prometheus.exporters.node.port]
|
||||
++ lib.lists.optionals cfg.server.enable [80];
|
||||
|
||||
services.prometheus = {
|
||||
enable = cfg.server.enable;
|
||||
|
|
@ -32,12 +36,15 @@ in
|
|||
|
||||
scrapeConfigs = lib.mkIf cfg.server.enable (
|
||||
let
|
||||
generated = lib.attrsets.mapAttrsToList
|
||||
generated =
|
||||
lib.attrsets.mapAttrsToList
|
||||
(name: machine: {
|
||||
job_name = name;
|
||||
static_configs = [{
|
||||
targets = [ "${name}.dmz:${toString config.services.prometheus.exporters.node.port}" ];
|
||||
}];
|
||||
static_configs = [
|
||||
{
|
||||
targets = ["${name}.dmz:${toString config.services.prometheus.exporters.node.port}"];
|
||||
}
|
||||
];
|
||||
})
|
||||
machines;
|
||||
|
||||
|
|
@ -53,12 +60,14 @@ in
|
|||
password = "admin";
|
||||
};
|
||||
|
||||
static_configs = [{
|
||||
targets = [ "pikvm.dmz" ];
|
||||
}];
|
||||
static_configs = [
|
||||
{
|
||||
targets = ["pikvm.dmz"];
|
||||
}
|
||||
];
|
||||
};
|
||||
in
|
||||
generated ++ [ pikvm ]
|
||||
generated ++ [pikvm]
|
||||
);
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,8 @@
|
|||
{ lib, machine, ... }: {
|
||||
{
|
||||
lib,
|
||||
machine,
|
||||
...
|
||||
}: {
|
||||
config = {
|
||||
networking = {
|
||||
domain = "dmz";
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
{ lib, config, ... }:
|
||||
let
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.lab.storage;
|
||||
modules = [
|
||||
{
|
||||
|
|
@ -7,7 +10,7 @@ let
|
|||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-label/NIXOS_SD";
|
||||
fsType = "ext4";
|
||||
options = [ "noatime" ];
|
||||
options = ["noatime"];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -87,7 +90,7 @@ let
|
|||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
mountOptions = [ "defaults" ];
|
||||
mountOptions = ["defaults"];
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -145,7 +148,7 @@ let
|
|||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
mountOptions = [ "defaults" ];
|
||||
mountOptions = ["defaults"];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -155,8 +158,7 @@ let
|
|||
};
|
||||
}
|
||||
];
|
||||
in
|
||||
{
|
||||
in {
|
||||
imports = modules;
|
||||
|
||||
options.lab.storage = {
|
||||
|
|
|
|||
|
|
@ -1,8 +1,10 @@
|
|||
{ lib, config, ... }:
|
||||
let
|
||||
cfg = config.lab.tailscale;
|
||||
in
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.lab.tailscale;
|
||||
in {
|
||||
options = {
|
||||
lab.tailscale = {
|
||||
enable = lib.mkEnableOption "tailscale";
|
||||
|
|
@ -21,15 +23,17 @@ in
|
|||
useRoutingFeatures = "server";
|
||||
openFirewall = true;
|
||||
|
||||
extraUpFlags = [
|
||||
"--accept-dns=false"
|
||||
"--hostname=${config.networking.hostName}"
|
||||
] ++ lib.lists.optional cfg.advertiseExitNode "--advertise-exit-node"
|
||||
++ lib.lists.optional cfg.advertiseExitNode "--advertise-routes=192.168.30.0/24";
|
||||
extraUpFlags =
|
||||
[
|
||||
"--accept-dns=false"
|
||||
"--hostname=${config.networking.hostName}"
|
||||
]
|
||||
++ lib.lists.optional cfg.advertiseExitNode "--advertise-exit-node"
|
||||
++ lib.lists.optional cfg.advertiseExitNode "--advertise-routes=192.168.30.0/24";
|
||||
};
|
||||
|
||||
sops.secrets."tailscale/authKey" = { };
|
||||
sops.secrets."tailscale/authKey" = {};
|
||||
|
||||
systemd.network.wait-online.ignoredInterfaces = [ "tailscale0" ];
|
||||
systemd.network.wait-online.ignoredInterfaces = ["tailscale0"];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Reference in a new issue