Compare commits
2 commits
2352a1a917
...
5341235bc3
| Author | SHA1 | Date | |
|---|---|---|---|
| 5341235bc3 | |||
| eed797fb13 |
22 changed files with 1214 additions and 1072 deletions
16
deploy.nix
16
deploy.nix
|
|
@ -1,21 +1,21 @@
|
|||
{ self, deploy-rs, ... }:
|
||||
let
|
||||
{
|
||||
self,
|
||||
deploy-rs,
|
||||
...
|
||||
}: let
|
||||
deployArch = "x86_64-linux";
|
||||
mkDeployNodes = nodeDef:
|
||||
builtins.mapAttrs
|
||||
(name: machine: nodeDef name machine)
|
||||
self.machines.${deployArch};
|
||||
in
|
||||
{
|
||||
in {
|
||||
deploy = {
|
||||
sshUser = "root";
|
||||
user = "root";
|
||||
|
||||
nodes = mkDeployNodes (name: machine:
|
||||
let
|
||||
nodes = mkDeployNodes (name: machine: let
|
||||
nixosConfiguration = self.nixosConfigurations.${name};
|
||||
in
|
||||
{
|
||||
in {
|
||||
hostname = nixosConfiguration.config.networking.fqdn;
|
||||
profiles.system = {
|
||||
remoteBuild = machine.arch != deployArch;
|
||||
|
|
|
|||
116
flake.lock
116
flake.lock
|
|
@ -109,6 +109,22 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat_4": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1696426674,
|
||||
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-parts": {
|
||||
"inputs": {
|
||||
"nixpkgs-lib": [
|
||||
|
|
@ -163,6 +179,27 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"gitignore": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"pre-commit-hooks",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1709087332,
|
||||
"narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "gitignore.nix",
|
||||
"rev": "637db329424fd7e46cf4185293b9cc8c88c95394",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "hercules-ci",
|
||||
"repo": "gitignore.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"kubenix": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat_2",
|
||||
|
|
@ -262,6 +299,22 @@
|
|||
}
|
||||
},
|
||||
"nixpkgs-stable": {
|
||||
"locked": {
|
||||
"lastModified": 1720386169,
|
||||
"narHash": "sha256-NGKVY4PjzwAa4upkGtAMz1npHGoRzWotlSnVlqI40mo=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "194846768975b7ad2c4988bdb82572c00222c0d7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-24.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-stable_2": {
|
||||
"locked": {
|
||||
"lastModified": 1729357638,
|
||||
"narHash": "sha256-66RHecx+zohbZwJVEPF7uuwHeqf8rykZTMCTqIrOew4=",
|
||||
|
|
@ -309,6 +362,45 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1726871744,
|
||||
"narHash": "sha256-V5LpfdHyQkUF7RfOaDPrZDP+oqz88lTJrMT1+stXNwo=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a1d92660c6b3b7c26fb883500a80ea9d33321be2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"pre-commit-hooks": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat_4",
|
||||
"gitignore": "gitignore",
|
||||
"nixpkgs": [
|
||||
"nixpkgs-unstable"
|
||||
],
|
||||
"nixpkgs-stable": "nixpkgs-stable"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1729104314,
|
||||
"narHash": "sha256-pZRZsq5oCdJt3upZIU4aslS9XwFJ+/nVtALHIciX/BI=",
|
||||
"owner": "cachix",
|
||||
"repo": "git-hooks.nix",
|
||||
"rev": "3c3e88f0f544d6bb54329832616af7eb971b6be6",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "cachix",
|
||||
"repo": "git-hooks.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"deploy-rs": "deploy-rs",
|
||||
|
|
@ -321,7 +413,9 @@
|
|||
"nixos-hardware": "nixos-hardware",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"nixpkgs-unstable": "nixpkgs-unstable",
|
||||
"sops-nix": "sops-nix"
|
||||
"pre-commit-hooks": "pre-commit-hooks",
|
||||
"sops-nix": "sops-nix",
|
||||
"treefmt-nix": "treefmt-nix"
|
||||
}
|
||||
},
|
||||
"sops-nix": {
|
||||
|
|
@ -329,7 +423,7 @@
|
|||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"nixpkgs-stable": "nixpkgs-stable"
|
||||
"nixpkgs-stable": "nixpkgs-stable_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1729775275,
|
||||
|
|
@ -410,6 +504,24 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"treefmt-nix": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1730025913,
|
||||
"narHash": "sha256-Y9NtFmP8ciLyRsopcCx1tyoaaStKeq+EndwtGCgww7I=",
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"rev": "bae131e525cc8718da22fbeb8d8c7c43c4ea502a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"utils": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
|
|
|
|||
18
flake.nix
18
flake.nix
|
|
@ -17,6 +17,12 @@
|
|||
deploy-rs.url = "github:serokell/deploy-rs";
|
||||
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
|
||||
flake-utils.url = "github:numtide/flake-utils";
|
||||
treefmt-nix.url = "github:numtide/treefmt-nix";
|
||||
|
||||
pre-commit-hooks = {
|
||||
url = "github:cachix/git-hooks.nix";
|
||||
inputs.nixpkgs.follows = "nixpkgs-unstable";
|
||||
};
|
||||
|
||||
disko = {
|
||||
url = "github:nix-community/disko";
|
||||
|
|
@ -49,8 +55,11 @@
|
|||
};
|
||||
};
|
||||
|
||||
outputs =
|
||||
inputs@{ nixpkgs, flake-utils, ... }:
|
||||
outputs = inputs @ {
|
||||
nixpkgs,
|
||||
flake-utils,
|
||||
...
|
||||
}:
|
||||
flake-utils.lib.meld inputs [
|
||||
./scripts
|
||||
./deploy.nix
|
||||
|
|
@ -58,7 +67,6 @@
|
|||
./shell.nix
|
||||
./utils
|
||||
./machines
|
||||
] // (flake-utils.lib.eachDefaultSystem (system: {
|
||||
formatter = nixpkgs.legacyPackages.${system}.nixfmt;
|
||||
}));
|
||||
./formatter.nix
|
||||
];
|
||||
}
|
||||
|
|
|
|||
14
formatter.nix
Normal file
14
formatter.nix
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
nixpkgs,
|
||||
treefmt-nix,
|
||||
flake-utils,
|
||||
...
|
||||
}:
|
||||
flake-utils.lib.eachDefaultSystem (
|
||||
system: let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
treefmtEval = treefmt-nix.lib.evalModule pkgs ./treefmt.nix;
|
||||
in {
|
||||
formatter = treefmtEval.config.build.wrapper;
|
||||
}
|
||||
)
|
||||
|
|
@ -1,9 +1,13 @@
|
|||
{ nixpkgs, flake-utils, ... }: flake-utils.lib.eachDefaultSystem (system:
|
||||
let
|
||||
{
|
||||
nixpkgs,
|
||||
flake-utils,
|
||||
...
|
||||
}:
|
||||
flake-utils.lib.eachDefaultSystem (system: let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
lib = pkgs.lib;
|
||||
|
||||
machineOpts = { config, ... }: {
|
||||
machineOpts = {config, ...}: {
|
||||
options = {
|
||||
arch = lib.mkOption {
|
||||
default = null;
|
||||
|
|
@ -19,7 +23,7 @@ let
|
|||
};
|
||||
|
||||
nixosModule = lib.mkOption {
|
||||
default = { ... }: { };
|
||||
default = {...}: {};
|
||||
type = lib.types.anything;
|
||||
description = ''
|
||||
Customized configuration for this machine in the form of a NixOS module.
|
||||
|
|
@ -43,9 +47,9 @@ let
|
|||
};
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
machines = (lib.modules.evalModules {
|
||||
in {
|
||||
machines =
|
||||
(lib.modules.evalModules {
|
||||
modules = [
|
||||
allOpts
|
||||
./warwick.nix
|
||||
|
|
@ -55,5 +59,7 @@ in
|
|||
# ./talos.nix
|
||||
# ./pikvm.nix
|
||||
];
|
||||
}).config.machines;
|
||||
})
|
||||
.config
|
||||
.machines;
|
||||
})
|
||||
|
|
|
|||
|
|
@ -3,7 +3,12 @@
|
|||
arch = "aarch64-linux";
|
||||
isRaspberryPi = true;
|
||||
|
||||
nixosModule = { config, inputs, lib, ... }: {
|
||||
nixosModule = {
|
||||
config,
|
||||
inputs,
|
||||
lib,
|
||||
...
|
||||
}: {
|
||||
# imports = [ "${inputs.nixpkgs}/nixos/modules/installer/sd-card/sd-image-aarch64.nix" ];
|
||||
lab = {
|
||||
storage.profile = "pi";
|
||||
|
|
@ -17,7 +22,7 @@
|
|||
v4l-utils
|
||||
];
|
||||
|
||||
boot.extraModulePackages = with config.boot.kernelPackages; [ v4l2loopback ];
|
||||
boot.extraModulePackages = with config.boot.kernelPackages; [v4l2loopback];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -2,7 +2,7 @@
|
|||
machines.talos = {
|
||||
arch = "x86_64-linux";
|
||||
|
||||
nixosModule = { lib, ... }: {
|
||||
nixosModule = {lib, ...}: {
|
||||
lab.storage.profile = "normal";
|
||||
|
||||
# boot.loader.systemd-boot.enable = lib.mkForce false;
|
||||
|
|
|
|||
|
|
@ -1,12 +1,16 @@
|
|||
{ pkgs, lib, config, ... }:
|
||||
let
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.lab.backups;
|
||||
|
||||
borgmaticConfig = pkgs.writeTextFile {
|
||||
name = "borgmatic-config.yaml";
|
||||
|
||||
text = lib.generators.toYAML { } {
|
||||
source_directories = [ "/mnt/longhorn/persistent/longhorn-backup" ];
|
||||
text = lib.generators.toYAML {} {
|
||||
source_directories = ["/mnt/longhorn/persistent/longhorn-backup"];
|
||||
|
||||
repositories = [
|
||||
{
|
||||
|
|
@ -27,8 +31,7 @@ let
|
|||
encryption_passcommand = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."borg/borgPassphrase".path}";
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.lab.backups = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
|
|
@ -48,13 +51,13 @@ in
|
|||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
environment.systemPackages = with pkgs; [ borgbackup ];
|
||||
environment.systemPackages = with pkgs; [borgbackup];
|
||||
# Converted from:
|
||||
# https://github.com/borgmatic-collective/borgmatic/tree/84823dfb912db650936e3492f6ead7e0e0d32a0f/sample/systemd
|
||||
systemd.services.borgmatic = {
|
||||
description = "borgmatic backup";
|
||||
wants = [ "network-online.target" ];
|
||||
after = [ "network-online.target" ];
|
||||
wants = ["network-online.target"];
|
||||
after = ["network-online.target"];
|
||||
unitConfig.ConditionACPower = true;
|
||||
preStart = "${pkgs.coreutils}/bin/sleep 10s";
|
||||
|
||||
|
|
@ -75,7 +78,7 @@ in
|
|||
|
||||
systemd.timers.borgmatic = {
|
||||
description = "Run borgmatic backup";
|
||||
wantedBy = [ "timers.target" ];
|
||||
wantedBy = ["timers.target"];
|
||||
timerConfig = {
|
||||
OnCalendar = "*-*-* 3:00:00";
|
||||
Persistent = true;
|
||||
|
|
@ -84,8 +87,8 @@ in
|
|||
};
|
||||
|
||||
sops.secrets = {
|
||||
"borg/borgPassphrase" = { };
|
||||
"borg/borgbasePrivateKey" = { };
|
||||
"borg/borgPassphrase" = {};
|
||||
"borg/borgbasePrivateKey" = {};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
{ lib, config, ... }:
|
||||
let
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.lab.data-sharing;
|
||||
|
||||
nfsShares = [
|
||||
|
|
@ -13,13 +16,12 @@ let
|
|||
|
||||
nfsExports = lib.strings.concatLines (
|
||||
builtins.map
|
||||
(share:
|
||||
"${share} 192.168.30.0/16(rw,sync,no_subtree_check,no_root_squash) 127.0.0.1/8(rw,sync,no_subtree_check,no_root_squash) 10.0.0.0/8(rw,sync,no_subtree_check,no_root_squash)"
|
||||
(
|
||||
share: "${share} 192.168.30.0/16(rw,sync,no_subtree_check,no_root_squash) 127.0.0.1/8(rw,sync,no_subtree_check,no_root_squash) 10.0.0.0/8(rw,sync,no_subtree_check,no_root_squash)"
|
||||
)
|
||||
nfsShares
|
||||
);
|
||||
in
|
||||
{
|
||||
in {
|
||||
options.lab.data-sharing = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
|
|
|
|||
|
|
@ -1,5 +1,14 @@
|
|||
{ self, pkgs, config, lib, inputs, machine, ... }: {
|
||||
imports = [
|
||||
{
|
||||
self,
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
inputs,
|
||||
machine,
|
||||
...
|
||||
}: {
|
||||
imports =
|
||||
[
|
||||
./storage.nix
|
||||
./backups.nix
|
||||
./networking
|
||||
|
|
@ -11,7 +20,8 @@
|
|||
inputs.disko.nixosModules.disko
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
inputs.nix-snapshotter.nixosModules.nix-snapshotter
|
||||
] ++ lib.lists.optional (machine.isRaspberryPi) inputs.nixos-hardware.nixosModules.raspberry-pi-4;
|
||||
]
|
||||
++ lib.lists.optional (machine.isRaspberryPi) inputs.nixos-hardware.nixosModules.raspberry-pi-4;
|
||||
|
||||
config = {
|
||||
time.timeZone = "Europe/Amsterdam";
|
||||
|
|
@ -31,7 +41,9 @@
|
|||
i18n = {
|
||||
defaultLocale = "en_US.UTF-8";
|
||||
|
||||
extraLocaleSettings = let extraLocale = "nl_NL.UTF-8"; in {
|
||||
extraLocaleSettings = let
|
||||
extraLocale = "nl_NL.UTF-8";
|
||||
in {
|
||||
LC_ADDRESS = extraLocale;
|
||||
LC_IDENTIFICATION = extraLocale;
|
||||
LC_MEASUREMENT = extraLocale;
|
||||
|
|
@ -97,12 +109,12 @@
|
|||
];
|
||||
|
||||
boot = lib.mkIf (! machine.isRaspberryPi) {
|
||||
kernelModules = [ "kvm-intel" ];
|
||||
extraModulePackages = [ ];
|
||||
kernelModules = ["kvm-intel"];
|
||||
extraModulePackages = [];
|
||||
kernel.sysctl."fs.inotify.max_user_instances" = 256;
|
||||
|
||||
initrd = {
|
||||
kernelModules = [ ];
|
||||
kernelModules = [];
|
||||
|
||||
availableKernelModules = [
|
||||
"ahci"
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{ kubenix, ... }: {
|
||||
imports = [ kubenix.modules.k8s ];
|
||||
{kubenix, ...}: {
|
||||
imports = [kubenix.modules.k8s];
|
||||
kubernetes.resources.clusterRoleBindings.cluster-admins = {
|
||||
roleRef = {
|
||||
apiGroup = "rbac.authorization.k8s.io";
|
||||
|
|
|
|||
|
|
@ -1,8 +1,13 @@
|
|||
{ self, inputs, pkgs, lib, config, ... }:
|
||||
let
|
||||
cfg = config.lab.k3s;
|
||||
in
|
||||
{
|
||||
self,
|
||||
inputs,
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.lab.k3s;
|
||||
in {
|
||||
options.lab.k3s = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
|
|
@ -62,8 +67,7 @@ in
|
|||
address = "/run/nix-snapshotter/nix-snapshotter.sock";
|
||||
};
|
||||
|
||||
plugins =
|
||||
let
|
||||
plugins = let
|
||||
k3s-cni-plugins = pkgs.buildEnv {
|
||||
name = "k3s-cni-plugins";
|
||||
paths = with pkgs; [
|
||||
|
|
@ -71,8 +75,7 @@ in
|
|||
cni-plugin-flannel
|
||||
];
|
||||
};
|
||||
in
|
||||
{
|
||||
in {
|
||||
"io.containerd.grpc.v1.cri" = {
|
||||
stream_server_address = "127.0.0.1";
|
||||
stream_server_port = "10010";
|
||||
|
|
@ -91,10 +94,12 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
"io.containerd.transfer.v1.local".unpack_config = [{
|
||||
"io.containerd.transfer.v1.local".unpack_config = [
|
||||
{
|
||||
platform = "linux/amd64";
|
||||
snapshotter = "nix";
|
||||
}];
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -102,8 +107,7 @@ in
|
|||
services = {
|
||||
nix-snapshotter.enable = true;
|
||||
|
||||
k3s =
|
||||
let
|
||||
k3s = let
|
||||
serverFlagList = [
|
||||
"--image-service-endpoint=unix:///run/nix-snapshotter/nix-snapshotter.sock"
|
||||
"--snapshotter=overlayfs"
|
||||
|
|
@ -115,8 +119,7 @@ in
|
|||
];
|
||||
|
||||
serverFlags = builtins.concatStringsSep " " serverFlagList;
|
||||
in
|
||||
{
|
||||
in {
|
||||
enable = true;
|
||||
role = cfg.role;
|
||||
tokenFile = config.sops.secrets."k3s/serverToken".path;
|
||||
|
|
@ -143,11 +146,14 @@ in
|
|||
k3s-bootstrap = lib.mkIf (cfg.role == "server") {
|
||||
text = (
|
||||
let
|
||||
k3sBootstrapFile = (inputs.kubenix.evalModules.x86_64-linux {
|
||||
k3sBootstrapFile =
|
||||
(inputs.kubenix.evalModules.x86_64-linux {
|
||||
module = import ./bootstrap.nix;
|
||||
}).config.kubernetes.result;
|
||||
in
|
||||
''
|
||||
})
|
||||
.config
|
||||
.kubernetes
|
||||
.result;
|
||||
in ''
|
||||
mkdir -p /var/lib/rancher/k3s/server/manifests
|
||||
ln -sf ${k3sBootstrapFile} /var/lib/rancher/k3s/server/manifests/k3s-bootstrap.json
|
||||
''
|
||||
|
|
@ -166,12 +172,10 @@ in
|
|||
};
|
||||
};
|
||||
|
||||
sops.secrets =
|
||||
let
|
||||
sops.secrets = let
|
||||
keyPathBase = "/var/lib/rancher/k3s/server/tls";
|
||||
in
|
||||
{
|
||||
"k3s/serverToken" = { };
|
||||
in {
|
||||
"k3s/serverToken" = {};
|
||||
"k3s/keys/clientCAKey".path = "${keyPathBase}/client-ca.key";
|
||||
"k3s/keys/requestHeaderCAKey".path = "${keyPathBase}/request-header-ca.key";
|
||||
"k3s/keys/serverCAKey".path = "${keyPathBase}/server-ca.key";
|
||||
|
|
|
|||
|
|
@ -1,8 +1,11 @@
|
|||
{ lib, config, machines, ... }:
|
||||
let
|
||||
cfg = config.lab.monitoring;
|
||||
in
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
machines,
|
||||
...
|
||||
}: let
|
||||
cfg = config.lab.monitoring;
|
||||
in {
|
||||
options = {
|
||||
lab.monitoring = {
|
||||
enable = lib.mkOption {
|
||||
|
|
@ -18,8 +21,9 @@ in
|
|||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
networking.firewall.allowedTCPPorts = [ config.services.prometheus.exporters.node.port ]
|
||||
++ lib.lists.optionals cfg.server.enable [ 80 ];
|
||||
networking.firewall.allowedTCPPorts =
|
||||
[config.services.prometheus.exporters.node.port]
|
||||
++ lib.lists.optionals cfg.server.enable [80];
|
||||
|
||||
services.prometheus = {
|
||||
enable = cfg.server.enable;
|
||||
|
|
@ -32,12 +36,15 @@ in
|
|||
|
||||
scrapeConfigs = lib.mkIf cfg.server.enable (
|
||||
let
|
||||
generated = lib.attrsets.mapAttrsToList
|
||||
generated =
|
||||
lib.attrsets.mapAttrsToList
|
||||
(name: machine: {
|
||||
job_name = name;
|
||||
static_configs = [{
|
||||
targets = [ "${name}.dmz:${toString config.services.prometheus.exporters.node.port}" ];
|
||||
}];
|
||||
static_configs = [
|
||||
{
|
||||
targets = ["${name}.dmz:${toString config.services.prometheus.exporters.node.port}"];
|
||||
}
|
||||
];
|
||||
})
|
||||
machines;
|
||||
|
||||
|
|
@ -53,12 +60,14 @@ in
|
|||
password = "admin";
|
||||
};
|
||||
|
||||
static_configs = [{
|
||||
targets = [ "pikvm.dmz" ];
|
||||
}];
|
||||
static_configs = [
|
||||
{
|
||||
targets = ["pikvm.dmz"];
|
||||
}
|
||||
];
|
||||
};
|
||||
in
|
||||
generated ++ [ pikvm ]
|
||||
generated ++ [pikvm]
|
||||
);
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,8 @@
|
|||
{ lib, machine, ... }: {
|
||||
{
|
||||
lib,
|
||||
machine,
|
||||
...
|
||||
}: {
|
||||
config = {
|
||||
networking = {
|
||||
domain = "dmz";
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
{ lib, config, ... }:
|
||||
let
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.lab.storage;
|
||||
modules = [
|
||||
{
|
||||
|
|
@ -7,7 +10,7 @@ let
|
|||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-label/NIXOS_SD";
|
||||
fsType = "ext4";
|
||||
options = [ "noatime" ];
|
||||
options = ["noatime"];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -87,7 +90,7 @@ let
|
|||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
mountOptions = [ "defaults" ];
|
||||
mountOptions = ["defaults"];
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -145,7 +148,7 @@ let
|
|||
type = "filesystem";
|
||||
format = "ext4";
|
||||
mountpoint = "/";
|
||||
mountOptions = [ "defaults" ];
|
||||
mountOptions = ["defaults"];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
@ -155,8 +158,7 @@ let
|
|||
};
|
||||
}
|
||||
];
|
||||
in
|
||||
{
|
||||
in {
|
||||
imports = modules;
|
||||
|
||||
options.lab.storage = {
|
||||
|
|
|
|||
|
|
@ -1,8 +1,10 @@
|
|||
{ lib, config, ... }:
|
||||
let
|
||||
cfg = config.lab.tailscale;
|
||||
in
|
||||
{
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: let
|
||||
cfg = config.lab.tailscale;
|
||||
in {
|
||||
options = {
|
||||
lab.tailscale = {
|
||||
enable = lib.mkEnableOption "tailscale";
|
||||
|
|
@ -21,15 +23,17 @@ in
|
|||
useRoutingFeatures = "server";
|
||||
openFirewall = true;
|
||||
|
||||
extraUpFlags = [
|
||||
extraUpFlags =
|
||||
[
|
||||
"--accept-dns=false"
|
||||
"--hostname=${config.networking.hostName}"
|
||||
] ++ lib.lists.optional cfg.advertiseExitNode "--advertise-exit-node"
|
||||
]
|
||||
++ lib.lists.optional cfg.advertiseExitNode "--advertise-exit-node"
|
||||
++ lib.lists.optional cfg.advertiseExitNode "--advertise-routes=192.168.30.0/24";
|
||||
};
|
||||
|
||||
sops.secrets."tailscale/authKey" = { };
|
||||
sops.secrets."tailscale/authKey" = {};
|
||||
|
||||
systemd.network.wait-online.ignoredInterfaces = [ "tailscale0" ];
|
||||
systemd.network.wait-online.ignoredInterfaces = ["tailscale0"];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
17
nixos.nix
17
nixos.nix
|
|
@ -1,23 +1,26 @@
|
|||
{ self, nixpkgs, ... }@inputs:
|
||||
let
|
||||
{
|
||||
self,
|
||||
nixpkgs,
|
||||
...
|
||||
} @ inputs: let
|
||||
deployArch = "x86_64-linux";
|
||||
machines = self.machines.${deployArch};
|
||||
mkNixosSystems = systemDef:
|
||||
builtins.mapAttrs
|
||||
(name: machine:
|
||||
(
|
||||
name: machine:
|
||||
nixpkgs.lib.nixosSystem (systemDef name machine)
|
||||
)
|
||||
machines;
|
||||
in
|
||||
{
|
||||
in {
|
||||
nixosConfigurations = mkNixosSystems (name: machine: {
|
||||
system = machine.arch;
|
||||
|
||||
specialArgs = { inherit self inputs machine machines; };
|
||||
specialArgs = {inherit self inputs machine machines;};
|
||||
|
||||
modules = [
|
||||
"${self}/modules"
|
||||
{ networking.hostName = name; }
|
||||
{networking.hostName = name;}
|
||||
];
|
||||
});
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,23 +1,31 @@
|
|||
{ nixpkgs, flake-utils, ... }: flake-utils.lib.eachDefaultSystem (system:
|
||||
let
|
||||
{
|
||||
nixpkgs,
|
||||
flake-utils,
|
||||
...
|
||||
}:
|
||||
flake-utils.lib.eachDefaultSystem (system: let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
createScript = { name, runtimeInputs, scriptPath, extraWrapperFlags ? "", ... }:
|
||||
let
|
||||
createScript = {
|
||||
name,
|
||||
runtimeInputs,
|
||||
scriptPath,
|
||||
extraWrapperFlags ? "",
|
||||
...
|
||||
}: let
|
||||
script = (pkgs.writeScriptBin name (builtins.readFile scriptPath)).overrideAttrs (old: {
|
||||
buildCommand = "${old.buildCommand}\n patchShebangs $out";
|
||||
});
|
||||
in
|
||||
pkgs.symlinkJoin {
|
||||
inherit name;
|
||||
paths = [ script ] ++ runtimeInputs;
|
||||
buildInputs = [ pkgs.makeWrapper ];
|
||||
paths = [script] ++ runtimeInputs;
|
||||
buildInputs = [pkgs.makeWrapper];
|
||||
postBuild = "wrapProgram $out/bin/${name} --set PATH $out/bin ${extraWrapperFlags}";
|
||||
};
|
||||
in
|
||||
{
|
||||
in {
|
||||
packages.bootstrap = createScript {
|
||||
name = "bootstrap";
|
||||
runtimeInputs = with pkgs; [ sops coreutils nixos-anywhere ];
|
||||
runtimeInputs = with pkgs; [sops coreutils nixos-anywhere];
|
||||
scriptPath = ./bootstrap.sh;
|
||||
};
|
||||
})
|
||||
|
|
|
|||
13
shell.nix
13
shell.nix
|
|
@ -1,9 +1,12 @@
|
|||
{ flake-utils, nixpkgs, ... }: flake-utils.lib.eachDefaultSystem (system:
|
||||
let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
in
|
||||
{
|
||||
flake-utils,
|
||||
nixpkgs,
|
||||
...
|
||||
}:
|
||||
flake-utils.lib.eachDefaultSystem (system: let
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
in {
|
||||
devShells.default = pkgs.mkShell {
|
||||
buildInputs = with pkgs; [ ansible ];
|
||||
buildInputs = with pkgs; [ansible];
|
||||
};
|
||||
})
|
||||
|
|
|
|||
4
treefmt.nix
Normal file
4
treefmt.nix
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
{...}: {
|
||||
projectRootFile = "flake.nix";
|
||||
programs.alejandra.enable = true;
|
||||
}
|
||||
|
|
@ -1,12 +1,12 @@
|
|||
{ nixpkgs, flake-utils, ... }:
|
||||
|
||||
let
|
||||
systemAttrs = flake-utils.lib.eachDefaultSystem (system:
|
||||
let
|
||||
{
|
||||
nixpkgs,
|
||||
flake-utils,
|
||||
...
|
||||
}: let
|
||||
systemAttrs = flake-utils.lib.eachDefaultSystem (system: let
|
||||
pkgs = nixpkgs.legacypackages.${system};
|
||||
lib = pkgs.lib;
|
||||
in
|
||||
{
|
||||
in {
|
||||
net = import ./net.nix lib;
|
||||
});
|
||||
|
||||
|
|
@ -16,4 +16,4 @@ let
|
|||
|
||||
allAttrs = systemAttrs // nonSystemAttrs;
|
||||
in
|
||||
allAttrs
|
||||
allAttrs
|
||||
|
|
|
|||
391
utils/net.nix
391
utils/net.nix
|
|
@ -1,13 +1,9 @@
|
|||
# IP address arithmetic and validation in Nix by @duairc:
|
||||
# https://gist.github.com/duairc/5c9bb3c922e5d501a1edb9e7b3b845ba
|
||||
|
||||
lib:
|
||||
|
||||
let
|
||||
|
||||
net = {
|
||||
lib: let
|
||||
net =
|
||||
{
|
||||
ip = {
|
||||
|
||||
# add :: (ip | mac | integer) -> ip -> ip
|
||||
#
|
||||
# Examples:
|
||||
|
|
@ -39,8 +35,7 @@ let
|
|||
# Adding MAC to IPv6:
|
||||
# > net.ip.add "fe:ed:fa:ce:f0:0d" "dead:cafe:beef::"
|
||||
# "dead:cafe:beef::feed:face:f00d"
|
||||
add = delta: ip:
|
||||
let
|
||||
add = delta: ip: let
|
||||
function = "net.ip.add";
|
||||
delta' = typechecks.numeric function "delta" delta;
|
||||
ip' = typechecks.ip function "ip" ip;
|
||||
|
|
@ -61,8 +56,7 @@ let
|
|||
# and you just want to calculate the offset between them — a result
|
||||
# like "0.0.0.10" is not very useful (which is what you would get
|
||||
# from net.ip.subtract).
|
||||
diff = minuend: subtrahend:
|
||||
let
|
||||
diff = minuend: subtrahend: let
|
||||
function = "net.ip.diff";
|
||||
minuend' = typechecks.ip function "minuend" minuend;
|
||||
subtrahend' = typechecks.ip function "subtrahend" subtrahend;
|
||||
|
|
@ -84,8 +78,7 @@ let
|
|||
# parameter. Its implementation takes the "delta" parameter,
|
||||
# coerces it to be the same type as the "ip" paramter, negates it
|
||||
# (using two's complement), and then adds it to "ip".
|
||||
subtract = delta: ip:
|
||||
let
|
||||
subtract = delta: ip: let
|
||||
function = "net.ip.subtract";
|
||||
delta' = typechecks.numeric function "delta" delta;
|
||||
ip' = typechecks.ip function "ip" ip;
|
||||
|
|
@ -94,7 +87,6 @@ let
|
|||
};
|
||||
|
||||
mac = {
|
||||
|
||||
# add :: (ip | mac | integer) -> mac -> mac
|
||||
#
|
||||
# Examples:
|
||||
|
|
@ -114,8 +106,7 @@ let
|
|||
# Adding MAC to MAC:
|
||||
# > net.mac.add "fe:ed:fa:00:00:00" "00:00:00:ce:f0:0d"
|
||||
# "fe:ed:fa:ce:f0:0d"
|
||||
add = delta: mac:
|
||||
let
|
||||
add = delta: mac: let
|
||||
function = "net.mac.add";
|
||||
delta' = typechecks.numeric function "delta" delta;
|
||||
mac' = typechecks.mac function "mac" mac;
|
||||
|
|
@ -131,8 +122,7 @@ let
|
|||
#
|
||||
# The difference between net.mac.diff and net.mac.subtract is that
|
||||
# net.mac.diff will always return an integer.
|
||||
diff = minuend: subtrahend:
|
||||
let
|
||||
diff = minuend: subtrahend: let
|
||||
function = "net.mac.diff";
|
||||
minuend' = typechecks.mac function "minuend" minuend;
|
||||
subtrahend' = typechecks.mac function "subtrahend" subtrahend;
|
||||
|
|
@ -148,8 +138,7 @@ let
|
|||
#
|
||||
# The difference between net.mac.subtract and net.mac.diff is that
|
||||
# net.mac.subtract will always return a MAC address.
|
||||
subtract = delta: mac:
|
||||
let
|
||||
subtract = delta: mac: let
|
||||
function = "net.mac.subtract";
|
||||
delta' = typechecks.numeric function "delta" delta;
|
||||
mac' = typechecks.mac function "mac" mac;
|
||||
|
|
@ -165,8 +154,7 @@ let
|
|||
#
|
||||
# > net.cidr.add (-2) "127.0.0.0/8"
|
||||
# "125.0.0.0/8"
|
||||
add = delta: cidr:
|
||||
let
|
||||
add = delta: cidr: let
|
||||
function = "net.cidr.add";
|
||||
delta' = typechecks.numeric function "delta" delta;
|
||||
cidr' = typechecks.cidr function "cidr" cidr;
|
||||
|
|
@ -180,8 +168,7 @@ let
|
|||
#
|
||||
# > net.cidr.child "127.0.0.0/8" "10.0.0.0/8"
|
||||
# false
|
||||
child = subcidr: cidr:
|
||||
let
|
||||
child = subcidr: cidr: let
|
||||
function = "net.cidr.child";
|
||||
subcidr' = typechecks.cidr function "subcidr" subcidr;
|
||||
cidr' = typechecks.cidr function "cidr" cidr;
|
||||
|
|
@ -195,8 +182,7 @@ let
|
|||
#
|
||||
# > net.cidr.contains "127.0.0.1" "192.168.0.0/16"
|
||||
# false
|
||||
contains = ip: cidr:
|
||||
let
|
||||
contains = ip: cidr: let
|
||||
function = "net.cidr.contains";
|
||||
ip' = typechecks.ip function "ip" ip;
|
||||
cidr' = typechecks.cidr function "cidr" cidr;
|
||||
|
|
@ -213,8 +199,7 @@ let
|
|||
#
|
||||
# > net.cidr.capacity "dead:cafe:beef::/48" (saturates to maxBound)
|
||||
# 9223372036854775807
|
||||
capacity = cidr:
|
||||
let
|
||||
capacity = cidr: let
|
||||
function = "net.cidr.capacity";
|
||||
cidr' = typechecks.cidr function "cidr" cidr;
|
||||
in
|
||||
|
|
@ -233,8 +218,7 @@ let
|
|||
#
|
||||
# Inpsired by:
|
||||
# https://www.terraform.io/docs/configuration/functions/cidrhost.html
|
||||
host = hostnum: cidr:
|
||||
let
|
||||
host = hostnum: cidr: let
|
||||
function = "net.cidr.host";
|
||||
hostnum' = typechecks.numeric function "hostnum" hostnum;
|
||||
cidr' = typechecks.cidr function "cidr" cidr;
|
||||
|
|
@ -248,8 +232,7 @@ let
|
|||
#
|
||||
# > net.cidr.prefix "dead:cafe:beef::/48"
|
||||
# 48
|
||||
length = cidr:
|
||||
let
|
||||
length = cidr: let
|
||||
function = "net.cidr.length";
|
||||
cidr' = typechecks.cidr function "cidr" cidr;
|
||||
in
|
||||
|
|
@ -262,8 +245,7 @@ let
|
|||
#
|
||||
# > net.cidr.make 40 "dead:cafe:beef::feed:face:f00d"
|
||||
# "dead:cafe:be00::/40"
|
||||
make = length: base:
|
||||
let
|
||||
make = length: base: let
|
||||
function = "net.cidr.make";
|
||||
length' = typechecks.int function "length" length;
|
||||
base' = typechecks.ip function "base" base;
|
||||
|
|
@ -277,8 +259,7 @@ let
|
|||
#
|
||||
# > net.cidr.netmask "dead:cafe:beef::/64"
|
||||
# "ffff:ffff:ffff:ffff::"
|
||||
netmask = cidr:
|
||||
let
|
||||
netmask = cidr: let
|
||||
function = "net.cidr.netmask";
|
||||
cidr' = typechecks.cidr function "cidr" cidr;
|
||||
in
|
||||
|
|
@ -291,8 +272,7 @@ let
|
|||
#
|
||||
# > net.cidr.prefix "dead:cafe:beef::/48"
|
||||
# 80
|
||||
size = cidr:
|
||||
let
|
||||
size = cidr: let
|
||||
function = "net.cidr.size";
|
||||
cidr' = typechecks.cidr function "cidr" cidr;
|
||||
in
|
||||
|
|
@ -311,23 +291,26 @@ let
|
|||
#
|
||||
# Inspired by:
|
||||
# https://www.terraform.io/docs/configuration/functions/cidrsubnet.html
|
||||
subnet = length: netnum: cidr:
|
||||
let
|
||||
subnet = length: netnum: cidr: let
|
||||
function = "net.cidr.subnet";
|
||||
length' = typechecks.int function "length" length;
|
||||
netnum' = typechecks.numeric function "netnum" netnum;
|
||||
cidr' = typechecks.cidr function "cidr" cidr;
|
||||
in
|
||||
builders.cidr (implementations.cidr.subnet length' netnum' cidr');
|
||||
|
||||
};
|
||||
} // ({
|
||||
types =
|
||||
let
|
||||
|
||||
mkParsedOptionType = { name, description, parser, builder }:
|
||||
let
|
||||
normalize = def: def // {
|
||||
}
|
||||
// {
|
||||
types = let
|
||||
mkParsedOptionType = {
|
||||
name,
|
||||
description,
|
||||
parser,
|
||||
builder,
|
||||
}: let
|
||||
normalize = def:
|
||||
def
|
||||
// {
|
||||
value = builder (parser def.value);
|
||||
};
|
||||
in
|
||||
|
|
@ -337,31 +320,28 @@ let
|
|||
merge = loc: defs: lib.mergeEqualOption loc (map normalize defs);
|
||||
};
|
||||
|
||||
dependent-ip = type: cidr:
|
||||
let
|
||||
dependent-ip = type: cidr: let
|
||||
cidrs =
|
||||
if builtins.isList cidr
|
||||
then cidr
|
||||
else [ cidr ];
|
||||
else [cidr];
|
||||
in
|
||||
lib.types.addCheck type (i: lib.any (net.cidr.contains i) cidrs) // {
|
||||
lib.types.addCheck type (i: lib.any (net.cidr.contains i) cidrs)
|
||||
// {
|
||||
description = type.description + " in ${builtins.concatStringsSep " or " cidrs}";
|
||||
};
|
||||
|
||||
dependent-cidr = type: cidr:
|
||||
let
|
||||
dependent-cidr = type: cidr: let
|
||||
cidrs =
|
||||
if builtins.isList cidr
|
||||
then cidr
|
||||
else [ cidr ];
|
||||
else [cidr];
|
||||
in
|
||||
lib.types.addCheck type (i: lib.any (net.cidr.child i) cidrs) // {
|
||||
lib.types.addCheck type (i: lib.any (net.cidr.child i) cidrs)
|
||||
// {
|
||||
description = type.description + " in ${builtins.concatStringsSep " or " cidrs}";
|
||||
};
|
||||
|
||||
in
|
||||
rec {
|
||||
|
||||
in rec {
|
||||
ip = mkParsedOptionType {
|
||||
name = "ip";
|
||||
description = "IPv4 or IPv6 address";
|
||||
|
|
@ -422,23 +402,22 @@ let
|
|||
parser = parsers.mac;
|
||||
builder = builders.mac;
|
||||
};
|
||||
|
||||
};
|
||||
}
|
||||
);
|
||||
};
|
||||
|
||||
list = {
|
||||
cons = a: b: [ a ] ++ b;
|
||||
cons = a: b: [a] ++ b;
|
||||
};
|
||||
|
||||
bit =
|
||||
let
|
||||
bit = let
|
||||
shift = n: x:
|
||||
if n < 0
|
||||
then x * math.pow 2 (-n)
|
||||
else
|
||||
let
|
||||
safeDiv = n: d: if d == 0 then 0 else n / d;
|
||||
else let
|
||||
safeDiv = n: d:
|
||||
if d == 0
|
||||
then 0
|
||||
else n / d;
|
||||
d = math.pow 2 n;
|
||||
in
|
||||
if x < 0
|
||||
|
|
@ -458,8 +437,7 @@ let
|
|||
not = xor (-1);
|
||||
|
||||
mask = n: and (left n 1 - 1);
|
||||
in
|
||||
{
|
||||
in {
|
||||
inherit left right and or xor not mask;
|
||||
};
|
||||
|
||||
|
|
@ -484,9 +462,7 @@ let
|
|||
else pow (x * x) (n / 2);
|
||||
};
|
||||
|
||||
parsers =
|
||||
let
|
||||
|
||||
parsers = let
|
||||
# fmap :: (a -> b) -> parser a -> parser b
|
||||
fmap = f: ma: bind ma (a: pure (f a));
|
||||
|
||||
|
|
@ -513,8 +489,7 @@ let
|
|||
empty = string: null;
|
||||
|
||||
# alt :: parser a -> parser a -> parser a
|
||||
alt = left: right: string:
|
||||
let
|
||||
alt = left: right: string: let
|
||||
result = left string;
|
||||
in
|
||||
if builtins.isNull result
|
||||
|
|
@ -522,7 +497,10 @@ let
|
|||
else result;
|
||||
|
||||
# guard :: bool -> parser {}
|
||||
guard = condition: if condition then pure { } else empty;
|
||||
guard = condition:
|
||||
if condition
|
||||
then pure {}
|
||||
else empty;
|
||||
|
||||
# mfilter :: (a -> bool) -> parser a -> parser a
|
||||
mfilter = f: parser: bind parser (a: then_ (guard (f a)) (pure a));
|
||||
|
|
@ -531,11 +509,10 @@ let
|
|||
some = v: liftA2 list.cons v (many v);
|
||||
|
||||
# many :: parser a -> parser [a]
|
||||
many = v: alt (some v) (pure [ ]);
|
||||
many = v: alt (some v) (pure []);
|
||||
|
||||
# bind :: parser a -> (a -> parser b) -> parser b
|
||||
bind = parser: f: string:
|
||||
let
|
||||
bind = parser: f: string: let
|
||||
a = parser string;
|
||||
in
|
||||
if builtins.isNull a
|
||||
|
|
@ -543,8 +520,7 @@ let
|
|||
else f a.result a.leftovers;
|
||||
|
||||
# run :: parser a -> string -> maybe a
|
||||
run = parser: string:
|
||||
let
|
||||
run = parser: string: let
|
||||
result = parser string;
|
||||
in
|
||||
if builtins.isNull result || result.leftovers != ""
|
||||
|
|
@ -560,13 +536,14 @@ let
|
|||
};
|
||||
|
||||
# Count how many characters were consumed by a parser
|
||||
count = parser: string:
|
||||
let
|
||||
count = parser: string: let
|
||||
result = parser string;
|
||||
in
|
||||
if builtins.isNull result
|
||||
then null
|
||||
else result // {
|
||||
else
|
||||
result
|
||||
// {
|
||||
result = {
|
||||
inherit (result) result;
|
||||
count = with result;
|
||||
|
|
@ -586,16 +563,17 @@ let
|
|||
|
||||
string = css:
|
||||
if css == ""
|
||||
then pure { }
|
||||
else
|
||||
let
|
||||
then pure {}
|
||||
else let
|
||||
c = builtins.substring 0 1 css;
|
||||
cs = builtins.substring 1 (-1) css;
|
||||
in
|
||||
then_ (char c) (string cs);
|
||||
|
||||
digit = set: bind next (
|
||||
c: then_
|
||||
digit = set:
|
||||
bind next (
|
||||
c:
|
||||
then_
|
||||
(guard (builtins.hasAttr c set))
|
||||
(pure (builtins.getAttr c set))
|
||||
);
|
||||
|
|
@ -613,7 +591,9 @@ let
|
|||
"9" = 9;
|
||||
};
|
||||
|
||||
hexadecimalDigits = decimalDigits // {
|
||||
hexadecimalDigits =
|
||||
decimalDigits
|
||||
// {
|
||||
"a" = 10;
|
||||
"b" = 11;
|
||||
"c" = 12;
|
||||
|
|
@ -644,8 +624,7 @@ let
|
|||
|
||||
hexadecimal = fmap fromHexadecimalDigits (some (digit hexadecimalDigits));
|
||||
|
||||
ipv4 =
|
||||
let
|
||||
ipv4 = let
|
||||
dot = char ".";
|
||||
|
||||
octet = mfilter (n: n < 256) decimal;
|
||||
|
|
@ -660,8 +639,7 @@ let
|
|||
|
||||
# This is more or less a literal translation of
|
||||
# https://hackage.haskell.org/package/ip/docs/src/Net.IPv6.html#parser
|
||||
ipv6 =
|
||||
let
|
||||
ipv6 = let
|
||||
colon = char ":";
|
||||
|
||||
hextet = limit 4 hexadecimal;
|
||||
|
|
@ -669,8 +647,7 @@ let
|
|||
fromHextets = hextets:
|
||||
if builtins.length hextets != 8
|
||||
then empty
|
||||
else
|
||||
let
|
||||
else let
|
||||
a = builtins.elemAt hextets 0;
|
||||
b = builtins.elemAt hextets 1;
|
||||
c = builtins.elemAt hextets 2;
|
||||
|
|
@ -689,21 +666,20 @@ let
|
|||
};
|
||||
};
|
||||
|
||||
ipv4' = fmap
|
||||
ipv4' =
|
||||
fmap
|
||||
(
|
||||
address:
|
||||
let
|
||||
address: let
|
||||
upper = bit.right 16 address.ipv4;
|
||||
lower = bit.mask 16 address.ipv4;
|
||||
in
|
||||
[ upper lower ]
|
||||
in [upper lower]
|
||||
)
|
||||
ipv4;
|
||||
|
||||
part = n:
|
||||
let
|
||||
part = n: let
|
||||
n' = n + 1;
|
||||
hex = liftA2 list.cons hextet
|
||||
hex =
|
||||
liftA2 list.cons hextet
|
||||
(
|
||||
then_ colon
|
||||
(
|
||||
|
|
@ -714,16 +690,14 @@ let
|
|||
);
|
||||
in
|
||||
if n == 7
|
||||
then fmap (a: [ a ]) hextet
|
||||
else
|
||||
if n == 6
|
||||
then fmap (a: [a]) hextet
|
||||
else if n == 6
|
||||
then alt ipv4' hex
|
||||
else hex;
|
||||
|
||||
doubleColon = n:
|
||||
bind (alt afterDoubleColon (pure [ ])) (
|
||||
rest:
|
||||
let
|
||||
bind (alt afterDoubleColon (pure [])) (
|
||||
rest: let
|
||||
missing = 8 - n - builtins.length rest;
|
||||
in
|
||||
if missing < 0
|
||||
|
|
@ -738,10 +712,9 @@ let
|
|||
(
|
||||
alt
|
||||
(then_ colon afterDoubleColon)
|
||||
(pure [ ])
|
||||
(pure [])
|
||||
)
|
||||
);
|
||||
|
||||
in
|
||||
bind
|
||||
(
|
||||
|
|
@ -767,8 +740,7 @@ let
|
|||
ipv6
|
||||
(then_ (char "/") (mfilter (n: n <= 128) decimal));
|
||||
|
||||
mac =
|
||||
let
|
||||
mac = let
|
||||
colon = char ":";
|
||||
|
||||
octet = exactly 2 hexadecimal;
|
||||
|
|
@ -780,9 +752,7 @@ let
|
|||
};
|
||||
in
|
||||
liftA6 fromOctets octet octet' octet' octet' octet' octet';
|
||||
|
||||
in
|
||||
{
|
||||
in {
|
||||
ipv4 = run ipv4;
|
||||
ipv6 = run ipv6;
|
||||
ip = run (alt ipv4 ipv6);
|
||||
|
|
@ -793,11 +763,8 @@ let
|
|||
numeric = run (alt (alt ipv4 ipv6) mac);
|
||||
};
|
||||
|
||||
builders =
|
||||
let
|
||||
|
||||
ipv4 = address:
|
||||
let
|
||||
builders = let
|
||||
ipv4 = address: let
|
||||
abcd = address.ipv4;
|
||||
abc = bit.right 8 abcd;
|
||||
ab = bit.right 8 abc;
|
||||
|
|
@ -806,35 +773,27 @@ let
|
|||
c = bit.mask 8 abc;
|
||||
d = bit.mask 8 abcd;
|
||||
in
|
||||
builtins.concatStringsSep "." (map toString [ a b c d ]);
|
||||
builtins.concatStringsSep "." (map toString [a b c d]);
|
||||
|
||||
# This is more or less a literal translation of
|
||||
# https://hackage.haskell.org/package/ip/docs/src/Net.IPv6.html#encode
|
||||
ipv6 = address:
|
||||
let
|
||||
|
||||
ipv6 = address: let
|
||||
digits = "0123456789abcdef";
|
||||
|
||||
toHexString = n:
|
||||
let
|
||||
toHexString = n: let
|
||||
rest = bit.right 4 n;
|
||||
current = bit.mask 4 n;
|
||||
prefix =
|
||||
if rest == 0
|
||||
then ""
|
||||
else toHexString rest;
|
||||
in
|
||||
"${prefix}${builtins.substring current 1 digits}";
|
||||
|
||||
in "${prefix}${builtins.substring current 1 digits}";
|
||||
in
|
||||
if (with address.ipv6; a == 0 && b == 0 && c == 0 && d > 65535)
|
||||
then "::${ipv4 { ipv4 = address.ipv6.d; }}"
|
||||
else
|
||||
if (with address.ipv6; a == 0 && b == 0 && c == 65535)
|
||||
then "::ffff:${ipv4 { ipv4 = address.ipv6.d; }}"
|
||||
else
|
||||
let
|
||||
|
||||
then "::${ipv4 {ipv4 = address.ipv6.d;}}"
|
||||
else if (with address.ipv6; a == 0 && b == 0 && c == 65535)
|
||||
then "::ffff:${ipv4 {ipv4 = address.ipv6.d;}}"
|
||||
else let
|
||||
a = bit.right 16 address.ipv6.a;
|
||||
b = bit.mask 16 address.ipv6.a;
|
||||
c = bit.right 16 address.ipv6.b;
|
||||
|
|
@ -844,16 +803,14 @@ let
|
|||
g = bit.right 16 address.ipv6.d;
|
||||
h = bit.mask 16 address.ipv6.d;
|
||||
|
||||
hextets = [ a b c d e f g h ];
|
||||
hextets = [a b c d e f g h];
|
||||
|
||||
# calculate the position and size of the longest sequence of
|
||||
# zeroes within the list of hextets
|
||||
longest =
|
||||
let
|
||||
longest = let
|
||||
go = i: current: best:
|
||||
if i < builtins.length hextets
|
||||
then
|
||||
let
|
||||
then let
|
||||
n = builtins.elemAt hextets i;
|
||||
|
||||
current' =
|
||||
|
|
@ -864,7 +821,9 @@ let
|
|||
size = 1;
|
||||
position = i;
|
||||
}
|
||||
else current // {
|
||||
else
|
||||
current
|
||||
// {
|
||||
size = current.size + 1;
|
||||
}
|
||||
else null;
|
||||
|
|
@ -874,8 +833,7 @@ let
|
|||
then
|
||||
if builtins.isNull best
|
||||
then current'
|
||||
else
|
||||
if current'.size > best.size
|
||||
else if current'.size > best.size
|
||||
then current'
|
||||
else best
|
||||
else best;
|
||||
|
|
@ -890,8 +848,7 @@ let
|
|||
in
|
||||
if builtins.isNull longest
|
||||
then format hextets
|
||||
else
|
||||
let
|
||||
else let
|
||||
sublist = i: length: xs:
|
||||
map
|
||||
(builtins.elemAt xs)
|
||||
|
|
@ -902,52 +859,40 @@ let
|
|||
before = sublist 0 longest.position hextets;
|
||||
|
||||
after = sublist end (builtins.length hextets - end) hextets;
|
||||
in
|
||||
"${format before}::${format after}";
|
||||
in "${format before}::${format after}";
|
||||
|
||||
ip = address:
|
||||
if address ? ipv4
|
||||
then ipv4 address
|
||||
else ipv6 address;
|
||||
|
||||
cidrv4 = cidr:
|
||||
"${ipv4 cidr.base}/${toString cidr.length}";
|
||||
cidrv4 = cidr: "${ipv4 cidr.base}/${toString cidr.length}";
|
||||
|
||||
cidrv6 = cidr:
|
||||
"${ipv6 cidr.base}/${toString cidr.length}";
|
||||
cidrv6 = cidr: "${ipv6 cidr.base}/${toString cidr.length}";
|
||||
|
||||
cidr = cidr:
|
||||
"${ip cidr.base}/${toString cidr.length}";
|
||||
cidr = cidr: "${ip cidr.base}/${toString cidr.length}";
|
||||
|
||||
mac = address:
|
||||
let
|
||||
mac = address: let
|
||||
digits = "0123456789abcdef";
|
||||
octet = n:
|
||||
let
|
||||
octet = n: let
|
||||
upper = bit.right 4 n;
|
||||
lower = bit.mask 4 n;
|
||||
in
|
||||
"${builtins.substring upper 1 digits}${builtins.substring lower 1 digits}";
|
||||
in
|
||||
let
|
||||
in "${builtins.substring upper 1 digits}${builtins.substring lower 1 digits}";
|
||||
in let
|
||||
a = bit.mask 8 (bit.right 40 address.mac);
|
||||
b = bit.mask 8 (bit.right 32 address.mac);
|
||||
c = bit.mask 8 (bit.right 24 address.mac);
|
||||
d = bit.mask 8 (bit.right 16 address.mac);
|
||||
e = bit.mask 8 (bit.right 8 address.mac);
|
||||
f = bit.mask 8 (bit.right 0 address.mac);
|
||||
in
|
||||
"${octet a}:${octet b}:${octet c}:${octet d}:${octet e}:${octet f}";
|
||||
|
||||
in
|
||||
{
|
||||
in "${octet a}:${octet b}:${octet c}:${octet d}:${octet e}:${octet f}";
|
||||
in {
|
||||
inherit ipv4 ipv6 ip cidrv4 cidrv6 cidr mac;
|
||||
};
|
||||
|
||||
arithmetic = rec {
|
||||
# or :: (ip | mac | integer) -> (ip | mac | integer) -> (ip | mac | integer)
|
||||
or = a_: b:
|
||||
let
|
||||
or = a_: b: let
|
||||
a = coerce b a_;
|
||||
in
|
||||
if a ? ipv6
|
||||
|
|
@ -970,8 +915,7 @@ let
|
|||
else bit.or a b;
|
||||
|
||||
# and :: (ip | mac | integer) -> (ip | mac | integer) -> (ip | mac | integer)
|
||||
and = a_: b:
|
||||
let
|
||||
and = a_: b: let
|
||||
a = coerce b a_;
|
||||
in
|
||||
if a ? ipv6
|
||||
|
|
@ -1015,26 +959,22 @@ let
|
|||
else bit.not a;
|
||||
|
||||
# add :: (ip | mac | integer) -> (ip | mac | integer) -> (ip | mac | integer)
|
||||
add =
|
||||
let
|
||||
add = let
|
||||
split = a: {
|
||||
fst = bit.mask 32 (bit.right 32 a);
|
||||
snd = bit.mask 32 a;
|
||||
};
|
||||
in
|
||||
a_: b:
|
||||
let
|
||||
a_: b: let
|
||||
a = coerce b a_;
|
||||
in
|
||||
if a ? ipv6
|
||||
then
|
||||
let
|
||||
then let
|
||||
a' = split (a.ipv6.a + b.ipv6.a + b'.fst);
|
||||
b' = split (a.ipv6.b + b.ipv6.b + c'.fst);
|
||||
c' = split (a.ipv6.c + b.ipv6.c + d'.fst);
|
||||
d' = split (a.ipv6.d + b.ipv6.d);
|
||||
in
|
||||
{
|
||||
in {
|
||||
ipv6 = {
|
||||
a = a'.snd;
|
||||
b = b'.snd;
|
||||
|
|
@ -1056,9 +996,8 @@ let
|
|||
subtract = a: b: add (add 1 (not (coerce b a))) b;
|
||||
|
||||
# diff :: (ip | mac | integer) -> (ip | mac | integer) -> (ipv6 | integer)
|
||||
diff = a: b:
|
||||
let
|
||||
toIPv6 = coerce ({ ipv6.a = 0; });
|
||||
diff = a: b: let
|
||||
toIPv6 = coerce {ipv6.a = 0;};
|
||||
result = (subtract b (toIPv6 a)).ipv6;
|
||||
max32 = bit.left 32 1 - 1;
|
||||
in
|
||||
|
|
@ -1072,8 +1011,7 @@ let
|
|||
left = i: right (-i);
|
||||
|
||||
# right :: integer -> (ip | mac | integer) -> (ip | mac | integer)
|
||||
right =
|
||||
let
|
||||
right = let
|
||||
step = i: x: {
|
||||
_1 = bit.mask 32 (bit.right (i + 96) x);
|
||||
_2 = bit.mask 32 (bit.right (i + 64) x);
|
||||
|
|
@ -1087,19 +1025,17 @@ let
|
|||
in
|
||||
i: x:
|
||||
if x ? ipv6
|
||||
then
|
||||
let
|
||||
then let
|
||||
a' = step i x.ipv6.a;
|
||||
b' = step i x.ipv6.b;
|
||||
c' = step i x.ipv6.c;
|
||||
d' = step i x.ipv6.d;
|
||||
in
|
||||
{
|
||||
in {
|
||||
ipv6 = {
|
||||
a = ors [ a'._4 b'._3 c'._2 d'._1 ];
|
||||
b = ors [ a'._5 b'._4 c'._3 d'._2 ];
|
||||
c = ors [ a'._6 b'._5 c'._4 d'._3 ];
|
||||
d = ors [ a'._7 b'._6 c'._5 d'._4 ];
|
||||
a = ors [a'._4 b'._3 c'._2 d'._1];
|
||||
b = ors [a'._5 b'._4 c'._3 d'._2];
|
||||
c = ors [a'._6 b'._5 c'._4 d'._3];
|
||||
d = ors [a'._7 b'._6 c'._5 d'._4];
|
||||
};
|
||||
}
|
||||
else if x ? ipv4
|
||||
|
|
@ -1180,8 +1116,7 @@ let
|
|||
else {
|
||||
mac = bit.mask 48 value;
|
||||
}
|
||||
else
|
||||
if value ? ipv6
|
||||
else if value ? ipv6
|
||||
then
|
||||
builtins.foldl' bit.or 0
|
||||
[
|
||||
|
|
@ -1222,18 +1157,15 @@ let
|
|||
|
||||
cidr = rec {
|
||||
# add :: (ip | mac | integer) -> cidr -> cidr
|
||||
add = delta: cidr:
|
||||
let
|
||||
add = delta: cidr: let
|
||||
size' = size cidr;
|
||||
in
|
||||
{
|
||||
in {
|
||||
base = arithmetic.left size' (arithmetic.add delta (arithmetic.right size' cidr.base));
|
||||
inherit (cidr) length;
|
||||
};
|
||||
|
||||
# capacity :: cidr -> integer
|
||||
capacity = cidr:
|
||||
let
|
||||
capacity = cidr: let
|
||||
size' = size cidr;
|
||||
in
|
||||
if size' > 62
|
||||
|
|
@ -1248,8 +1180,7 @@ let
|
|||
contains = ip: cidr: host 0 (make cidr.length ip) == host 0 cidr;
|
||||
|
||||
# host :: (ip | mac | integer) -> cidr -> ip
|
||||
host = index: cidr:
|
||||
let
|
||||
host = index: cidr: let
|
||||
index' = arithmetic.coerce cidr.base index;
|
||||
in
|
||||
arithmetic.or (arithmetic.shadow cidr.length index') cidr.base;
|
||||
|
|
@ -1261,51 +1192,60 @@ let
|
|||
netmask = cidr: arithmetic.coshadow cidr.length (arithmetic.coerce cidr.base (-1));
|
||||
|
||||
# size :: cidr -> integer
|
||||
size = cidr: (if cidr.base ? ipv6 then 128 else 32) - cidr.length;
|
||||
size = cidr:
|
||||
(
|
||||
if cidr.base ? ipv6
|
||||
then 128
|
||||
else 32
|
||||
)
|
||||
- cidr.length;
|
||||
|
||||
# subnet :: integer -> (ip | mac | integer) -> cidr -> cidr
|
||||
subnet = length: index: cidr:
|
||||
let
|
||||
subnet = length: index: cidr: let
|
||||
length' = cidr.length + length;
|
||||
index' = arithmetic.coerce cidr.base index;
|
||||
size = (if cidr.base ? ipv6 then 128 else 32) - length';
|
||||
size =
|
||||
(
|
||||
if cidr.base ? ipv6
|
||||
then 128
|
||||
else 32
|
||||
)
|
||||
- length';
|
||||
in
|
||||
make length' (host (arithmetic.left size index') cidr);
|
||||
|
||||
# make :: integer -> ip -> cidr
|
||||
make = length: base:
|
||||
let
|
||||
length' = math.clamp 0 (if base ? ipv6 then 128 else 32) length;
|
||||
in
|
||||
{
|
||||
make = length: base: let
|
||||
length' =
|
||||
math.clamp 0 (
|
||||
if base ? ipv6
|
||||
then 128
|
||||
else 32
|
||||
)
|
||||
length;
|
||||
in {
|
||||
base = arithmetic.coshadow length' base;
|
||||
length = length';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
typechecks =
|
||||
let
|
||||
|
||||
typechecks = let
|
||||
fail = description: function: argument:
|
||||
builtins.throw "${function}: ${argument} parameter must be ${description}";
|
||||
|
||||
meta = parser: description: function: argument: input:
|
||||
let
|
||||
meta = parser: description: function: argument: input: let
|
||||
error = fail description function argument;
|
||||
in
|
||||
if !builtins.isString input
|
||||
then error
|
||||
else
|
||||
let
|
||||
else let
|
||||
result = parser input;
|
||||
in
|
||||
if builtins.isNull result
|
||||
then error
|
||||
else result;
|
||||
|
||||
in
|
||||
{
|
||||
in {
|
||||
int = function: argument: input:
|
||||
if builtins.isInt input
|
||||
then input
|
||||
|
|
@ -1318,6 +1258,5 @@ let
|
|||
then input
|
||||
else meta parsers.numeric "an integer or IPv4, IPv6 or MAC address" function argument input;
|
||||
};
|
||||
|
||||
in
|
||||
net
|
||||
net
|
||||
|
|
|
|||
Loading…
Reference in a new issue