hosts: restructure and modularize
This commit is contained in:
parent
be919cb2b3
commit
004af67a0e
31 changed files with 356 additions and 168 deletions
78
flake.nix
78
flake.nix
|
@ -7,86 +7,14 @@
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = { self, nixpkgs, flake-parts, ... }@inputs:
|
outputs = { self, nixpkgs, flake-parts, ... }@inputs:
|
||||||
let
|
flake-parts.lib.mkFlake { inherit inputs; } {
|
||||||
systems = [ "x86_64-linux" "aarch64-linux" ];
|
systems = [ "x86_64-linux" "aarch64-linux" ];
|
||||||
|
|
||||||
nixpkgsFor = nixpkgs.legacyPackages;
|
|
||||||
|
|
||||||
inherit (nixpkgs) lib;
|
|
||||||
|
|
||||||
hosts = import ./hosts;
|
|
||||||
|
|
||||||
nixosHosts' = lib.filterAttrs (_: host: host ? nixos) hosts;
|
|
||||||
|
|
||||||
nixosHosts = lib.attrNames nixosHosts';
|
|
||||||
|
|
||||||
deployableNixosHosts' = lib.filterAttrs (_: host: host ? container -> !host.container) nixosHosts';
|
|
||||||
|
|
||||||
deployableNixosHosts = lib.attrNames deployableNixosHosts';
|
|
||||||
|
|
||||||
meta = import ./tools/meta.nix;
|
|
||||||
|
|
||||||
specialArgs = {
|
|
||||||
inherit inputs hosts;
|
|
||||||
depot = inputs.self;
|
|
||||||
toolsets = import ./tools;
|
|
||||||
};
|
|
||||||
mkNixOS' = lib: name: let host = hosts.${name}; in lib.nixosSystem {
|
|
||||||
inherit specialArgs;
|
|
||||||
system = "${host.arch}-linux";
|
|
||||||
modules = [ host.nixos ./tools/inject.nix (import ./cluster/inject.nix name) ];
|
|
||||||
};
|
|
||||||
mkNixOS = mkNixOS' lib;
|
|
||||||
|
|
||||||
mkDeployEffect = branch: name: host: let
|
|
||||||
subdomain = host.enterprise.subdomain or "services";
|
|
||||||
hostname = "${lib.toLower name}.${subdomain}.${meta.domain}";
|
|
||||||
in effects.runIf (branch == "master" || branch == "staging") (effects.runNixOS {
|
|
||||||
requiredSystemFeatures = [ "hci-deploy-agent-nixos" ];
|
|
||||||
inherit (self.nixosConfigurations.${name}) config;
|
|
||||||
secretsMap.ssh = "deploy-ssh";
|
|
||||||
|
|
||||||
userSetupScript = ''
|
|
||||||
writeSSHKey ssh
|
|
||||||
cat >>~/.ssh/known_hosts <<EOF
|
|
||||||
${hostname} ${host.ssh.id.publicKey}
|
|
||||||
EOF
|
|
||||||
'';
|
|
||||||
ssh.destination = "root@${hostname}";
|
|
||||||
});
|
|
||||||
|
|
||||||
mkDeployEffects = branch: hostnames: lib.genAttrs hostnames
|
|
||||||
(name: mkDeployEffect branch name hosts.${name});
|
|
||||||
|
|
||||||
mkDeploy = name: let
|
|
||||||
host = hosts.${name};
|
|
||||||
subdomain = host.enterprise.subdomain or "services";
|
|
||||||
deploy-rs = inputs.deploy-rs.lib."${host.arch}-linux";
|
|
||||||
in {
|
|
||||||
hostname = "${lib.toLower name}.${subdomain}.${meta.domain}";
|
|
||||||
profiles.system = {
|
|
||||||
user = "root";
|
|
||||||
sshUser = "deploy";
|
|
||||||
path = deploy-rs.activate.nixos self.nixosConfigurations.${name};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
mkDeployments = hosts: overrides: lib.genAttrs hosts
|
|
||||||
(host: mkDeploy host // (overrides.${host} or {}) );
|
|
||||||
|
|
||||||
effects = inputs.hercules-ci-effects.lib.withPkgs nixpkgsFor.x86_64-linux;
|
|
||||||
in flake-parts.lib.mkFlake { inherit inputs; } {
|
|
||||||
inherit systems;
|
|
||||||
flake = {
|
|
||||||
nixosConfigurations = lib.genAttrs nixosHosts mkNixOS;
|
|
||||||
|
|
||||||
deploy.nodes = mkDeployments deployableNixosHosts {};
|
|
||||||
|
|
||||||
effects = { branch, ... }: mkDeployEffects branch deployableNixosHosts;
|
|
||||||
};
|
|
||||||
imports = [
|
imports = [
|
||||||
|
inputs.hercules-ci-effects.flakeModule
|
||||||
inputs.drv-parts.flakeModule
|
inputs.drv-parts.flakeModule
|
||||||
inputs.dream2nix.flakeModuleBeta
|
inputs.dream2nix.flakeModuleBeta
|
||||||
|
./hosts/part.nix
|
||||||
./modules/part.nix
|
./modules/part.nix
|
||||||
./packages/part.nix
|
./packages/part.nix
|
||||||
];
|
];
|
||||||
|
|
|
@ -1,4 +1,5 @@
|
||||||
tools: {
|
tools: {
|
||||||
|
ssh.enable = true;
|
||||||
ssh.id = with tools.dns; {
|
ssh.id = with tools.dns; {
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICz2nGA+Y4OxhMKsV6vKIns3hOoBkK557712h7FfWXcE";
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICz2nGA+Y4OxhMKsV6vKIns3hOoBkK557712h7FfWXcE";
|
||||||
hostNames = subResolve "vegas" "backbone";
|
hostNames = subResolve "vegas" "backbone";
|
||||||
|
@ -15,7 +16,8 @@ tools: {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
hypr = {
|
hyprspace = {
|
||||||
|
enable = true;
|
||||||
id = "QmYs4xNBby2fTs8RnzfXEk161KD4mftBfCiR8yXtgGPj4J";
|
id = "QmYs4xNBby2fTs8RnzfXEk161KD4mftBfCiR8yXtgGPj4J";
|
||||||
addr = "10.100.3.5";
|
addr = "10.100.3.5";
|
||||||
listenPort = 995;
|
listenPort = 995;
|
||||||
|
@ -29,6 +31,6 @@ tools: {
|
||||||
subdomain = "backbone";
|
subdomain = "backbone";
|
||||||
};
|
};
|
||||||
|
|
||||||
arch = "x86_64";
|
system = "x86_64-linux";
|
||||||
nixos = import ./system.nix;
|
nixos = ./system.nix;
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,6 +1,6 @@
|
||||||
{ config, hosts, ... }:
|
{ config, depot, ... }:
|
||||||
let
|
let
|
||||||
inherit (hosts.${config.networking.hostName}) interfaces;
|
inherit (depot.reflection) interfaces;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports = [
|
imports = [
|
||||||
|
|
|
@ -1,10 +1,10 @@
|
||||||
{ hosts, ... }:
|
{ depot, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
networking.nat.forwardPorts = [
|
networking.nat.forwardPorts = [
|
||||||
{
|
{
|
||||||
sourcePort = 52222;
|
sourcePort = 52222;
|
||||||
destination = "${hosts.soda.interfaces.primary.addr}:22";
|
destination = "${depot.config.hours.soda.interfaces.primary.addr}:22";
|
||||||
proto = "tcp";
|
proto = "tcp";
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, hosts, tools, ... }:
|
{ config, depot, tools, ... }:
|
||||||
let
|
let
|
||||||
inherit (tools.meta) domain;
|
inherit (tools.meta) domain;
|
||||||
certDir = config.security.acme.certs."mail.${domain}".directory;
|
certDir = config.security.acme.certs."mail.${domain}".directory;
|
||||||
|
@ -10,7 +10,7 @@ let
|
||||||
lmtpSocket = "lmtp:unix:/run/dovecot2/lmtp";
|
lmtpSocket = "lmtp:unix:/run/dovecot2/lmtp";
|
||||||
postfixLdapMailboxes = "ldap:${config.age.secrets."postfix-ldap-mailboxes.cf".path}";
|
postfixLdapMailboxes = "ldap:${config.age.secrets."postfix-ldap-mailboxes.cf".path}";
|
||||||
|
|
||||||
inherit (hosts.${config.networking.hostName}) interfaces;
|
inherit (depot.reflection) interfaces;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
age.secrets."postfix-ldap-mailboxes.cf" = {
|
age.secrets."postfix-ldap-mailboxes.cf" = {
|
||||||
|
|
|
@ -1,7 +1,7 @@
|
||||||
{ inputs, lib, pkgs, tools, ... }:
|
{ depot, lib, pkgs, tools, ... }:
|
||||||
let
|
let
|
||||||
inherit (tools.nginx) domain vhosts;
|
inherit (tools.nginx) domain vhosts;
|
||||||
inherit (inputs.self.packages.${pkgs.system}) cinny;
|
inherit (depot.packages) cinny;
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
services.nginx.virtualHosts."chat.${domain}" = lib.recursiveUpdate
|
services.nginx.virtualHosts."chat.${domain}" = lib.recursiveUpdate
|
||||||
|
|
|
@ -1,9 +1,6 @@
|
||||||
{ config, lib, hosts, tools, ... }:
|
{ config, lib, depot, tools, ... }:
|
||||||
let
|
let
|
||||||
host = hosts.${config.networking.hostName};
|
inherit (depot.reflection) interfaces;
|
||||||
inherit (host) interfaces;
|
|
||||||
|
|
||||||
isNAT = interfaces.primary ? addrPublic;
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
services.jitsi-meet = {
|
services.jitsi-meet = {
|
||||||
|
@ -30,7 +27,7 @@ in
|
||||||
{ type = "colibri"; }
|
{ type = "colibri"; }
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
nat = lib.optionalAttrs isNAT {
|
nat = lib.optionalAttrs interfaces.primary.isNat {
|
||||||
localAddress = interfaces.primary.addr;
|
localAddress = interfaces.primary.addr;
|
||||||
publicAddress = interfaces.primary.addrPublic;
|
publicAddress = interfaces.primary.addrPublic;
|
||||||
};
|
};
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ cluster, config, inputs, lib, pkgs, tools, ... }:
|
{ cluster, config, depot, lib, tools, ... }:
|
||||||
let
|
let
|
||||||
inherit (tools.meta) domain;
|
inherit (tools.meta) domain;
|
||||||
|
|
||||||
|
@ -29,7 +29,7 @@ in
|
||||||
};
|
};
|
||||||
services.grafana = {
|
services.grafana = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = inputs.self.packages.${pkgs.system}.grafana;
|
package = depot.packages.grafana;
|
||||||
dataDir = "/srv/storage/private/grafana";
|
dataDir = "/srv/storage/private/grafana";
|
||||||
settings = {
|
settings = {
|
||||||
server = {
|
server = {
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, inputs, pkgs, tools, ... }:
|
{ config, depot, tools, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
mkNarServe = NAR_CACHE_URL: PORT: {
|
mkNarServe = NAR_CACHE_URL: PORT: {
|
||||||
|
@ -6,7 +6,7 @@
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = [ "multi-user.target" ];
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
DynamicUser = true;
|
DynamicUser = true;
|
||||||
ExecStart = "${inputs.nar-serve.defaultPackage."${pkgs.system}"}/bin/nar-serve";
|
ExecStart = "${depot.inputs.nar-serve.packages.nar-serve}/bin/nar-serve";
|
||||||
};
|
};
|
||||||
environment = { inherit NAR_CACHE_URL PORT; };
|
environment = { inherit NAR_CACHE_URL PORT; };
|
||||||
};
|
};
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, inputs, pkgs, tools, ... }:
|
{ config, depot, tools, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
links.nixIpfs.protocol = "http";
|
links.nixIpfs.protocol = "http";
|
||||||
|
@ -6,7 +6,7 @@
|
||||||
systemd.services.nix-ipfs-cache = {
|
systemd.services.nix-ipfs-cache = {
|
||||||
wantedBy = [ "multi-user.target" ];
|
wantedBy = [ "multi-user.target" ];
|
||||||
serviceConfig = {
|
serviceConfig = {
|
||||||
ExecStart = "${inputs.self.packages.${pkgs.system}.reflex-cache}/bin/reflex";
|
ExecStart = "${depot.packages.reflex-cache}/bin/reflex";
|
||||||
DynamicUser = true;
|
DynamicUser = true;
|
||||||
SupplementaryGroups = [ "ipfs" ];
|
SupplementaryGroups = [ "ipfs" ];
|
||||||
CacheDirectory = "nix-ipfs-cache";
|
CacheDirectory = "nix-ipfs-cache";
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, inputs, lib, pkgs, tools, ... }:
|
{ config, depot, lib, tools, ... }:
|
||||||
let
|
let
|
||||||
inherit (config) links;
|
inherit (config) links;
|
||||||
in
|
in
|
||||||
|
@ -9,7 +9,7 @@ in
|
||||||
services.searx = {
|
services.searx = {
|
||||||
enable = true;
|
enable = true;
|
||||||
runInUwsgi = true;
|
runInUwsgi = true;
|
||||||
package = inputs.self.packages.${pkgs.system}.searxng;
|
package = depot.packages.searxng;
|
||||||
environmentFile = config.age.secrets.searxng-secrets.path;
|
environmentFile = config.age.secrets.searxng-secrets.path;
|
||||||
settings = {
|
settings = {
|
||||||
server = {
|
server = {
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ cluster, config, inputs, lib, pkgs, tools, ... }:
|
{ cluster, config, depot, lib, tools, ... }:
|
||||||
with tools.nginx;
|
with tools.nginx;
|
||||||
let
|
let
|
||||||
login = "login.${tools.meta.domain}";
|
login = "login.${tools.meta.domain}";
|
||||||
|
@ -32,7 +32,7 @@ in
|
||||||
};
|
};
|
||||||
services.keycloak = {
|
services.keycloak = {
|
||||||
enable = true;
|
enable = true;
|
||||||
package = inputs.self.packages.${pkgs.system}.keycloak;
|
package = depot.packages.keycloak;
|
||||||
database = {
|
database = {
|
||||||
createLocally = false;
|
createLocally = false;
|
||||||
type = "postgresql";
|
type = "postgresql";
|
||||||
|
@ -52,7 +52,7 @@ in
|
||||||
};
|
};
|
||||||
systemd.services.keycloak.environment = {
|
systemd.services.keycloak.environment = {
|
||||||
JAVA_OPTS = builtins.concatStringsSep " " [
|
JAVA_OPTS = builtins.concatStringsSep " " [
|
||||||
"-javaagent:${inputs.self.packages.${pkgs.system}.opentelemetry-java-agent-bin}"
|
"-javaagent:${depot.packages.opentelemetry-java-agent-bin}"
|
||||||
"-Dotel.resource.attributes=service.name=keycloak"
|
"-Dotel.resource.attributes=service.name=keycloak"
|
||||||
"-Dotel.traces.exporter=otlp"
|
"-Dotel.traces.exporter=otlp"
|
||||||
];
|
];
|
||||||
|
|
|
@ -1,10 +1,8 @@
|
||||||
{ config, inputs, lib, pkgs, tools, ... }:
|
{ config, depot, lib, tools, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
inherit (tools.meta) domain;
|
inherit (tools.meta) domain;
|
||||||
|
|
||||||
flakePkgs = inputs.self.packages.${pkgs.system};
|
|
||||||
|
|
||||||
link = config.links.uptime-kuma;
|
link = config.links.uptime-kuma;
|
||||||
|
|
||||||
dataDir = "/srv/storage/private/uptime-kuma";
|
dataDir = "/srv/storage/private/uptime-kuma";
|
||||||
|
@ -55,7 +53,7 @@ in
|
||||||
ProtectKernelModules = true;
|
ProtectKernelModules = true;
|
||||||
ProtectKernelTunables = true;
|
ProtectKernelTunables = true;
|
||||||
|
|
||||||
ExecStart = flakePkgs.uptime-kuma + /bin/uptime-kuma;
|
ExecStart = depot.packages.uptime-kuma + /bin/uptime-kuma;
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -1,9 +1,9 @@
|
||||||
{ inputs, pkgs, tools, ... }:
|
{ depot, tools, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
importWebsites = expr: import expr {
|
importWebsites = expr: import expr {
|
||||||
tools = tools.nginx;
|
tools = tools.nginx;
|
||||||
packages = inputs.self.packages.${pkgs.system};
|
inherit (depot) packages;
|
||||||
};
|
};
|
||||||
|
|
||||||
websites = tools.nginx.mappers.mapSubdomains (importWebsites ./websites.nix);
|
websites = tools.nginx.mappers.mapSubdomains (importWebsites ./websites.nix);
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, depot, hosts, inputs, tools, ... }:
|
{ config, depot, tools, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
imports =
|
imports =
|
||||||
|
@ -11,8 +11,8 @@
|
||||||
./modules/oauth2-proxy
|
./modules/oauth2-proxy
|
||||||
./modules/redis
|
./modules/redis
|
||||||
./modules/virtualisation
|
./modules/virtualisation
|
||||||
inputs.agenix.nixosModules.age
|
depot.inputs.agenix.nixosModules.age
|
||||||
inputs.mms.module
|
depot.inputs.mms.module
|
||||||
|
|
||||||
# Services
|
# Services
|
||||||
./services/api
|
./services/api
|
||||||
|
@ -91,7 +91,7 @@
|
||||||
"fe80::/10"
|
"fe80::/10"
|
||||||
];
|
];
|
||||||
|
|
||||||
mkRules = ipt: ranges: map (x: "${ipt} -I nixos-fw 1 -d ${x} -o ${hosts.${config.networking.hostName}.interfaces.primary.link} -j DROP") ranges;
|
mkRules = ipt: ranges: map (x: "${ipt} -I nixos-fw 1 -d ${x} -o ${depot.reflection.interfaces.primary.link} -j DROP") ranges;
|
||||||
|
|
||||||
rules4 = mkRules "iptables" privateIp4Ranges;
|
rules4 = mkRules "iptables" privateIp4Ranges;
|
||||||
|
|
||||||
|
@ -103,10 +103,10 @@
|
||||||
services.openssh.passwordAuthentication = false;
|
services.openssh.passwordAuthentication = false;
|
||||||
|
|
||||||
containers.soda = {
|
containers.soda = {
|
||||||
path = inputs.self.nixosConfigurations.soda.config.system.build.toplevel;
|
path = depot.nixosConfigurations.soda.config.system.build.toplevel;
|
||||||
privateNetwork = true;
|
privateNetwork = true;
|
||||||
hostBridge = "vmdefault";
|
hostBridge = "vmdefault";
|
||||||
localAddress = "${hosts.soda.interfaces.primary.addr}/24";
|
localAddress = "${depot.config.hours.soda.interfaces.primary.addr}/24";
|
||||||
autoStart = true;
|
autoStart = true;
|
||||||
bindMounts.sodaDir = {
|
bindMounts.sodaDir = {
|
||||||
hostPath = "/srv/storage/www/soda";
|
hostPath = "/srv/storage/www/soda";
|
||||||
|
|
|
@ -1,4 +1,5 @@
|
||||||
tools: {
|
tools: {
|
||||||
|
ssh.enable = true;
|
||||||
ssh.id = with tools.dns; {
|
ssh.id = with tools.dns; {
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINImnMfEzUBU5qiuu05DMPrddTGypOtr+cL1/yQN2GFn";
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINImnMfEzUBU5qiuu05DMPrddTGypOtr+cL1/yQN2GFn";
|
||||||
hostNames = subResolve "checkmate" "node";
|
hostNames = subResolve "checkmate" "node";
|
||||||
|
@ -12,7 +13,8 @@ tools: {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
hypr = {
|
hyprspace = {
|
||||||
|
enable = true;
|
||||||
id = "12D3KooWL84sAtq1QTYwb7gVbhSNX5ZUfVt4kgYKz8pdif1zpGUh";
|
id = "12D3KooWL84sAtq1QTYwb7gVbhSNX5ZUfVt4kgYKz8pdif1zpGUh";
|
||||||
addr = "10.100.3.32";
|
addr = "10.100.3.32";
|
||||||
listenPort = 995;
|
listenPort = 995;
|
||||||
|
@ -22,6 +24,6 @@ tools: {
|
||||||
subdomain = "node";
|
subdomain = "node";
|
||||||
};
|
};
|
||||||
|
|
||||||
arch = "x86_64";
|
system = "x86_64-linux";
|
||||||
nixos = import ./system.nix;
|
nixos = ./system.nix;
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ aspect, inputs, hosts, ... }:
|
{ depot, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
imports =
|
imports =
|
||||||
|
@ -6,19 +6,19 @@
|
||||||
# Hardware
|
# Hardware
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
|
|
||||||
inputs.agenix.nixosModules.age
|
depot.inputs.agenix.nixosModules.age
|
||||||
|
|
||||||
aspect.modules.hyprspace
|
depot.nixosModules.hyprspace
|
||||||
aspect.modules.sss
|
depot.nixosModules.sss
|
||||||
]
|
depot.nixosModules.serverBase
|
||||||
++ aspect.sets.server;
|
];
|
||||||
|
|
||||||
# Use the systemd-boot EFI boot loader.
|
# Use the systemd-boot EFI boot loader.
|
||||||
boot.loader.systemd-boot.enable = true;
|
boot.loader.systemd-boot.enable = true;
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
||||||
networking.hostName = "checkmate";
|
networking.hostName = "checkmate";
|
||||||
networking.nameservers = [ hosts.VEGAS.interfaces.vstub.addr ];
|
networking.nameservers = [ depot.config.hours.VEGAS.interfaces.vstub.addr ];
|
||||||
|
|
||||||
time.timeZone = "Europe/Zurich";
|
time.timeZone = "Europe/Zurich";
|
||||||
|
|
||||||
|
|
|
@ -1,31 +0,0 @@
|
||||||
let
|
|
||||||
tools = import ./tools.nix;
|
|
||||||
in with tools.dns; {
|
|
||||||
|
|
||||||
# NixOS machines
|
|
||||||
VEGAS = import ./VEGAS tools;
|
|
||||||
prophet = import ./prophet tools;
|
|
||||||
soda = import ./soda tools;
|
|
||||||
checkmate = import ./checkmate tools;
|
|
||||||
|
|
||||||
# Non-NixOS machine metadata
|
|
||||||
AnimusAlpha = let hostNames = [ "alpha.animus.com" "animus.com" ]; in {
|
|
||||||
ssh.id = {
|
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGpFR47Ev+W+bdng6IrDVpl8rlKBBHSr1v5lwJmZcEFH";
|
|
||||||
hostNames = portMap 69 hostNames;
|
|
||||||
};
|
|
||||||
ssh.extraConfig = tools.ssh.extraConfig hostNames [ "Port 69" ];
|
|
||||||
};
|
|
||||||
|
|
||||||
# peering
|
|
||||||
|
|
||||||
# max
|
|
||||||
TITAN.hypr = {
|
|
||||||
id = "QmfJ5Tv2z9jFv9Aocevyn6QqRcfm9eYQZhvYvmAVfACfuM";
|
|
||||||
addr = "10.100.3.7";
|
|
||||||
};
|
|
||||||
jericho.hypr = {
|
|
||||||
id = "QmccBLgGP3HR36tTkwSYZX3KDv2EXb1MvYwGVs6PbpbHv9";
|
|
||||||
addr = "10.100.3.13";
|
|
||||||
};
|
|
||||||
}
|
|
57
hosts/deploy.nix
Normal file
57
hosts/deploy.nix
Normal file
|
@ -0,0 +1,57 @@
|
||||||
|
{ config, inputs, lib, self, withSystem, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
inherit (lib) elem mapAttrs toLower;
|
||||||
|
inherit (config) gods cluster defaultEffectSystem;
|
||||||
|
inherit (config.herculesCI) branch;
|
||||||
|
inherit (self) nixosConfigurations;
|
||||||
|
|
||||||
|
chosenHours = gods.fromLight;
|
||||||
|
|
||||||
|
withEffectSystem = withSystem defaultEffectSystem;
|
||||||
|
|
||||||
|
callUpon = name: host: withEffectSystem ({ hci-effects, ... }: let
|
||||||
|
inherit (hci-effects) runIf runNixOS;
|
||||||
|
inherit (host.enterprise) subdomain;
|
||||||
|
|
||||||
|
hostname = "${toLower name}.${subdomain}.${cluster.domain}";
|
||||||
|
|
||||||
|
deploy-rs = inputs.deploy-rs.lib."${host.system}";
|
||||||
|
in {
|
||||||
|
effect = runIf (elem branch [ "master" "staging" ]) (runNixOS {
|
||||||
|
requiredSystemFeatures = [ "hci-deploy-agent-nixos" ];
|
||||||
|
|
||||||
|
inherit (nixosConfigurations.${name}) config;
|
||||||
|
|
||||||
|
secretsMap.ssh = "deploy-ssh";
|
||||||
|
|
||||||
|
userSetupScript = ''
|
||||||
|
writeSSHKey ssh
|
||||||
|
cat >>~/.ssh/known_hosts <<EOF
|
||||||
|
${hostname} ${host.ssh.id.publicKey}
|
||||||
|
EOF
|
||||||
|
'';
|
||||||
|
|
||||||
|
ssh.destination = "root@${hostname}";
|
||||||
|
});
|
||||||
|
|
||||||
|
deploy = {
|
||||||
|
inherit hostname;
|
||||||
|
profiles.system = {
|
||||||
|
user = "root";
|
||||||
|
sshUser = "deploy";
|
||||||
|
path = deploy-rs.activate.nixos self.nixosConfigurations.${name};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
});
|
||||||
|
|
||||||
|
calledUponHours = mapAttrs callUpon chosenHours;
|
||||||
|
|
||||||
|
pick = format: _: calledUponHour: calledUponHour.${format};
|
||||||
|
in
|
||||||
|
|
||||||
|
{
|
||||||
|
flake.effects = mapAttrs (pick "effect") calledUponHours;
|
||||||
|
|
||||||
|
flake.deploy.nodes = mapAttrs (pick "deploy") calledUponHours;
|
||||||
|
}
|
24
hosts/nixos.nix
Normal file
24
hosts/nixos.nix
Normal file
|
@ -0,0 +1,24 @@
|
||||||
|
{ config, inputs, lib, self, withSystem, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
inherit (lib) const mapAttrs nixosSystem;
|
||||||
|
inherit (config) gods;
|
||||||
|
|
||||||
|
mkSpecialArgs = system: hostName: withSystem system ({ inputs', self', ... }: {
|
||||||
|
depot = self // self' // {
|
||||||
|
inputs = mapAttrs (name: const (inputs.${name} // inputs'.${name})) inputs;
|
||||||
|
inherit config;
|
||||||
|
# peer into the Watchman's Glass
|
||||||
|
reflection = config.hours.${hostName};
|
||||||
|
};
|
||||||
|
toolsets = import ../tools;
|
||||||
|
});
|
||||||
|
|
||||||
|
mkNixOS = name: host: nixosSystem {
|
||||||
|
specialArgs = mkSpecialArgs host.system name;
|
||||||
|
inherit (host) system;
|
||||||
|
modules = [ host.nixos ../tools/inject.nix (import ../cluster/inject.nix name) ];
|
||||||
|
};
|
||||||
|
in {
|
||||||
|
flake.nixosConfigurations = mapAttrs mkNixOS (gods.fromLight // gods.fromFlesh);
|
||||||
|
}
|
34
hosts/options/default.nix
Normal file
34
hosts/options/default.nix
Normal file
|
@ -0,0 +1,34 @@
|
||||||
|
{ config, lib, ... }:
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
hourType = types.submodule {
|
||||||
|
imports = [
|
||||||
|
./hour/enterprise.nix
|
||||||
|
./hour/hyprspace.nix
|
||||||
|
./hour/interfaces.nix
|
||||||
|
./hour/nixos.nix
|
||||||
|
./hour/ssh.nix
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
mkHours = description: mkOption {
|
||||||
|
inherit description;
|
||||||
|
type = with types; attrsOf hourType;
|
||||||
|
default = {};
|
||||||
|
};
|
||||||
|
in
|
||||||
|
|
||||||
|
{
|
||||||
|
options = {
|
||||||
|
gods = {
|
||||||
|
fromLight = mkHours "Gods-from-Light: The emanations of The Glory";
|
||||||
|
fromFlesh = mkHours "Gods-from-Flesh: Mortals who penetrated the Mansus";
|
||||||
|
fromNowhere = mkHours "Gods-from-Nowhere: Lesser Hours";
|
||||||
|
};
|
||||||
|
hours = mkHours "Hours are the incarnate principles of the world." // {
|
||||||
|
readOnly = true;
|
||||||
|
default = with config.gods; fromLight // fromFlesh // fromNowhere;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
12
hosts/options/hour/enterprise.nix
Normal file
12
hosts/options/hour/enterprise.nix
Normal file
|
@ -0,0 +1,12 @@
|
||||||
|
{ lib, ... }:
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
{
|
||||||
|
options.enterprise = {
|
||||||
|
subdomain = mkOption {
|
||||||
|
description = "Host FQDN subdomain.";
|
||||||
|
type = types.str;
|
||||||
|
default = "services";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
30
hosts/options/hour/hyprspace.nix
Normal file
30
hosts/options/hour/hyprspace.nix
Normal file
|
@ -0,0 +1,30 @@
|
||||||
|
{ lib, ... }:
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
{
|
||||||
|
options.hyprspace = {
|
||||||
|
enable = mkEnableOption "Cross-host Hyprspace configuration";
|
||||||
|
|
||||||
|
id = mkOption {
|
||||||
|
description = "Hyprspace PeerID.";
|
||||||
|
type = types.str;
|
||||||
|
};
|
||||||
|
|
||||||
|
addr = mkOption {
|
||||||
|
description = "Hyprspace internal IP address.";
|
||||||
|
type = types.str;
|
||||||
|
};
|
||||||
|
|
||||||
|
routes = mkOption {
|
||||||
|
description = "Networks to export to Hyprspace.";
|
||||||
|
type = with types; listOf str;
|
||||||
|
default = [];
|
||||||
|
};
|
||||||
|
|
||||||
|
listenPort = mkOption {
|
||||||
|
description = "The port the Hyprspace daemon should listen on.";
|
||||||
|
type = types.port;
|
||||||
|
default = 8001;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
38
hosts/options/hour/interfaces.nix
Normal file
38
hosts/options/hour/interfaces.nix
Normal file
|
@ -0,0 +1,38 @@
|
||||||
|
{ lib, ... }:
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
let
|
||||||
|
interfaceType = types.submodule ({ config, name, ... }: {
|
||||||
|
options = {
|
||||||
|
addr = mkOption {
|
||||||
|
description = "Static IP address assigned to this interface.";
|
||||||
|
type = types.str;
|
||||||
|
};
|
||||||
|
|
||||||
|
addrPublic = mkOption {
|
||||||
|
description = "Static public IP address.";
|
||||||
|
type = types.str;
|
||||||
|
default = config.addr;
|
||||||
|
};
|
||||||
|
|
||||||
|
link = mkOption {
|
||||||
|
description = "Interface link name.";
|
||||||
|
type = types.str;
|
||||||
|
default = name;
|
||||||
|
};
|
||||||
|
|
||||||
|
isNat = mkOption {
|
||||||
|
description = "Whether the host is behind NAT.";
|
||||||
|
type = types.bool;
|
||||||
|
default = config.addr != config.addrPublic;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
});
|
||||||
|
in
|
||||||
|
|
||||||
|
{
|
||||||
|
options.interfaces = mkOption {
|
||||||
|
description = "Network interface information.";
|
||||||
|
type = with types; attrsOf interfaceType;
|
||||||
|
};
|
||||||
|
}
|
18
hosts/options/hour/nixos.nix
Normal file
18
hosts/options/hour/nixos.nix
Normal file
|
@ -0,0 +1,18 @@
|
||||||
|
{ lib, ... }:
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
{
|
||||||
|
options = {
|
||||||
|
system = mkOption {
|
||||||
|
description = "Nix system double for this NixOS host.";
|
||||||
|
type = types.enum systems.doubles.linux;
|
||||||
|
default = "x86_64-linux";
|
||||||
|
};
|
||||||
|
|
||||||
|
nixos = mkOption {
|
||||||
|
description = "NixOS configuration.";
|
||||||
|
type = with types; nullOr anything;
|
||||||
|
default = null;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
28
hosts/options/hour/ssh.nix
Normal file
28
hosts/options/hour/ssh.nix
Normal file
|
@ -0,0 +1,28 @@
|
||||||
|
{ lib, ... }:
|
||||||
|
with lib;
|
||||||
|
|
||||||
|
{
|
||||||
|
options.ssh = {
|
||||||
|
enable = mkEnableOption "Cross-host SSH configuration";
|
||||||
|
|
||||||
|
id = {
|
||||||
|
publicKey = mkOption {
|
||||||
|
description = "Host SSH public key.";
|
||||||
|
type = with types; nullOr str;
|
||||||
|
default = null;
|
||||||
|
};
|
||||||
|
|
||||||
|
hostNames = mkOption {
|
||||||
|
description = "Hostnames through which this host can be reached over SSH.";
|
||||||
|
type = with types; listOf str;
|
||||||
|
default = [];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
extraConfig = mkOption {
|
||||||
|
description = "Extra SSH client configuration used to connect to this host.";
|
||||||
|
type = types.lines;
|
||||||
|
default = "";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
49
hosts/part.nix
Normal file
49
hosts/part.nix
Normal file
|
@ -0,0 +1,49 @@
|
||||||
|
let
|
||||||
|
tools = import ./tools.nix;
|
||||||
|
in with tools.dns;
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
./deploy.nix
|
||||||
|
./nixos.nix
|
||||||
|
./options
|
||||||
|
];
|
||||||
|
gods = {
|
||||||
|
fromLight = {
|
||||||
|
checkmate = import ./checkmate tools;
|
||||||
|
|
||||||
|
VEGAS = import ./VEGAS tools;
|
||||||
|
|
||||||
|
prophet = import ./prophet tools;
|
||||||
|
};
|
||||||
|
|
||||||
|
fromFlesh = {
|
||||||
|
soda = import ./soda tools;
|
||||||
|
};
|
||||||
|
|
||||||
|
fromNowhere = {
|
||||||
|
AnimusAlpha = let hostNames = [ "alpha.animus.com" "animus.com" ]; in {
|
||||||
|
ssh.enable = true;
|
||||||
|
ssh.id = {
|
||||||
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGpFR47Ev+W+bdng6IrDVpl8rlKBBHSr1v5lwJmZcEFH";
|
||||||
|
hostNames = portMap 69 hostNames;
|
||||||
|
};
|
||||||
|
ssh.extraConfig = tools.ssh.extraConfig hostNames [ "Port 69" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
# peering
|
||||||
|
|
||||||
|
# max
|
||||||
|
TITAN.hyprspace = {
|
||||||
|
enable = true;
|
||||||
|
id = "QmfJ5Tv2z9jFv9Aocevyn6QqRcfm9eYQZhvYvmAVfACfuM";
|
||||||
|
addr = "10.100.3.7";
|
||||||
|
};
|
||||||
|
|
||||||
|
jericho.hyprspace = {
|
||||||
|
enable = true;
|
||||||
|
id = "QmccBLgGP3HR36tTkwSYZX3KDv2EXb1MvYwGVs6PbpbHv9";
|
||||||
|
addr = "10.100.3.13";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
|
@ -1,4 +1,5 @@
|
||||||
tools: {
|
tools: {
|
||||||
|
ssh.enable = true;
|
||||||
ssh.id = with tools.dns; {
|
ssh.id = with tools.dns; {
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZ4FyGi69MksEn+UJZ87vw1APqiZmPNlEYIr0CbEoGv";
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJZ4FyGi69MksEn+UJZ87vw1APqiZmPNlEYIr0CbEoGv";
|
||||||
hostNames = subResolve "prophet" "node";
|
hostNames = subResolve "prophet" "node";
|
||||||
|
@ -12,7 +13,8 @@ tools: {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
hypr = {
|
hyprspace = {
|
||||||
|
enable = true;
|
||||||
id = "QmbrAHuh4RYcyN9fWePCZMVmQjbaNXtyvrDCWz4VrchbXh";
|
id = "QmbrAHuh4RYcyN9fWePCZMVmQjbaNXtyvrDCWz4VrchbXh";
|
||||||
addr = "10.100.3.9";
|
addr = "10.100.3.9";
|
||||||
listenPort = 995;
|
listenPort = 995;
|
||||||
|
@ -22,6 +24,6 @@ tools: {
|
||||||
subdomain = "node";
|
subdomain = "node";
|
||||||
};
|
};
|
||||||
|
|
||||||
arch = "aarch64";
|
system = "aarch64-linux";
|
||||||
nixos = import ./system.nix;
|
nixos = ./system.nix;
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ inputs, depot, hosts, ... }:
|
{ depot, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
imports =
|
imports =
|
||||||
|
@ -6,7 +6,7 @@
|
||||||
# Hardware
|
# Hardware
|
||||||
./hardware-configuration.nix
|
./hardware-configuration.nix
|
||||||
|
|
||||||
inputs.agenix.nixosModules.age
|
depot.inputs.agenix.nixosModules.age
|
||||||
|
|
||||||
depot.nixosModules.hyprspace
|
depot.nixosModules.hyprspace
|
||||||
depot.nixosModules.nix-builder
|
depot.nixosModules.nix-builder
|
||||||
|
@ -20,7 +20,7 @@
|
||||||
boot.loader.efi.canTouchEfiVariables = true;
|
boot.loader.efi.canTouchEfiVariables = true;
|
||||||
|
|
||||||
networking.hostName = "prophet";
|
networking.hostName = "prophet";
|
||||||
networking.nameservers = [ hosts.VEGAS.interfaces.vstub.addr ];
|
networking.nameservers = [ depot.config.hours.VEGAS.interfaces.vstub.addr ];
|
||||||
|
|
||||||
time.timeZone = "Europe/Zurich";
|
time.timeZone = "Europe/Zurich";
|
||||||
|
|
||||||
|
|
|
@ -1,4 +1,5 @@
|
||||||
tools: {
|
tools: {
|
||||||
|
ssh.enable = true;
|
||||||
ssh.id = with tools.dns; {
|
ssh.id = with tools.dns; {
|
||||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDShq3dbZy9SARsH8aSjfMQ+/eTW44eZuHVCLvgtDNKw";
|
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDShq3dbZy9SARsH8aSjfMQ+/eTW44eZuHVCLvgtDNKw";
|
||||||
hostNames = subResolve "soda" "int";
|
hostNames = subResolve "soda" "int";
|
||||||
|
@ -16,7 +17,6 @@ tools: {
|
||||||
subdomain = "int";
|
subdomain = "int";
|
||||||
};
|
};
|
||||||
|
|
||||||
arch = "x86_64";
|
system = "x86_64-linux";
|
||||||
nixos = import ./system.nix;
|
nixos = ./system.nix;
|
||||||
container = true;
|
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ depot, hosts, ... }:
|
{ depot, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
imports = with depot.nixosModules; [
|
imports = with depot.nixosModules; [
|
||||||
|
@ -14,9 +14,9 @@
|
||||||
|
|
||||||
networking.interfaces.eth0.useDHCP = true;
|
networking.interfaces.eth0.useDHCP = true;
|
||||||
|
|
||||||
networking.nameservers = [ hosts.VEGAS.interfaces.vstub.addr ];
|
networking.nameservers = [ depot.config.hours.VEGAS.interfaces.vstub.addr ];
|
||||||
|
|
||||||
networking.resolvconf.extraConfig = "local_nameservers='${hosts.VEGAS.interfaces.vstub.addr}'";
|
networking.resolvconf.extraConfig = "local_nameservers='${depot.config.hours.VEGAS.interfaces.vstub.addr}'";
|
||||||
|
|
||||||
networking.hostName = "soda";
|
networking.hostName = "soda";
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue