remove dataHost option

improve certificate directory structure
This commit is contained in:
Pim Kunis 2024-01-31 22:11:28 +01:00
parent 929d20a7d6
commit beb1c384ec
10 changed files with 25 additions and 45 deletions

View file

@ -1,7 +1,7 @@
{ pkgs, lib, machine, disko, agenix, ... }: { { pkgs, lib, machine, disko, agenix, ... }: {
imports = [ imports = [
./modules ./modules
./lab.nix ./globals.nix
machine.nixosModule machine.nixosModule
disko.nixosModules.disko disko.nixosModules.disko
agenix.nixosModules.default agenix.nixosModules.default

View file

@ -1,4 +1,21 @@
{ {
atlas = {
type = "physical";
nixosModule.lab = {
storage = {
osDisk = "/dev/sda";
dataPartition = "/dev/nvme0n1p1";
};
ssh = {
useCertificates = true;
hostCert = builtins.readFile ./certificates/atlas/host_ed25519.crt;
userCert = builtins.readFile ./certificates/atlas/user_ed25519.crt;
};
};
};
jefke = { jefke = {
type = "physical"; type = "physical";
@ -13,36 +30,20 @@
ssh = { ssh = {
useCertificates = true; useCertificates = true;
# TODO: automatically set this? hostCert = builtins.readFile ./certificates/jefke/host_ed25519.crt;
hostCert = builtins.readFile ./jefke_host_ed25519-cert.pub; userCert = builtins.readFile ./certificates/jefke/user_ed25519.crt;
userCert = builtins.readFile ./jefke_user_ed25519-cert.pub;
}; };
}; };
}; };
}; };
atlas = {
type = "physical";
nixosModule.lab = {
storage = {
osDisk = "/dev/sda";
dataPartition = "/dev/nvme0n1p1";
};
ssh = {
useCertificates = true;
hostCert = builtins.readFile ./atlas_host_ed25519-cert.pub;
userCert = builtins.readFile ./atlas_user_ed25519-cert.pub;
};
};
};
lewis = { lewis = {
type = "physical"; type = "physical";
nixosModule.lab = { nixosModule.lab = {
dataHost.enable = true; backups.enable = true;
data-sharing.enable = true;
networking.dmz.allowConnectivity = true;
storage = { storage = {
osDisk = "/dev/sda"; osDisk = "/dev/sda";
@ -51,8 +52,8 @@
ssh = { ssh = {
useCertificates = true; useCertificates = true;
hostCert = builtins.readFile ./lewis_host_ed25519-cert.pub; hostCert = builtins.readFile ./certificates/lewis/host_ed25519.crt;
userCert = builtins.readFile ./lewis_user_ed25519-cert.pub; userCert = builtins.readFile ./certificates/lewis/user_ed25519.crt;
}; };
}; };
}; };

View file

@ -1,7 +1,3 @@
{ lib, config, ... }:
let cfg = config.lab;
in
{ {
imports = [ imports = [
./storage.nix ./storage.nix
@ -13,21 +9,4 @@ in
./data-sharing.nix ./data-sharing.nix
./globals.nix ./globals.nix
]; ];
# TODO: remove this option; make this explicit on the host.
options.lab.dataHost.enable = lib.mkOption {
default = false;
type = lib.types.bool;
description = ''
Whether this machine holds application data.
This enables NFS and PostgreSQL to serve this data, and sets up backups.
Also enables networking on the DMZ to enable serving data.
'';
};
config.lab = lib.mkIf cfg.dataHost.enable {
backups.enable = true;
data-sharing.enable = true;
networking.dmz.allowConnectivity = true;
};
} }