cluster/services/frangiclave: some cluster stuff

cluster/lib/inject-nixos-config.nix

@@ -2,9 +2,9 @@
 with lib;
 
 {
-  options.out.injectNixosConfig = mkOption {
+  options.out = mkOption {
-    description = "NixOS configuration to inject into the given host.";
+    description = "Output functions.";
-    type = with types; functionTo raw;
+    type = with types; lazyAttrsOf (functionTo raw);
     default = const [];
   };
 }

cluster/lib/services.nix

@@ -39,7 +39,11 @@ in
     default = {};
   };
 
-  config.out.injectNixosConfig = hostName: (lib.flatten (lib.mapAttrsToList (getHostConfigurations hostName) config.services)) ++ [
+  config.out = {
-    introspectionModule
+    injectNixosConfigForServices = services: hostName: (lib.flatten (lib.mapAttrsToList (getHostConfigurations hostName) (lib.getAttrs services config.services))) ++ [
-  ];
+      introspectionModule
+    ];
+
+    injectNixosConfig = config.out.injectNixosConfigForServices (lib.attrNames config.services);
+  };
 }

cluster/services/bitwarden/default.nix

@@ -1,5 +1,10 @@
 { depot, ... }:
 
 {
+  services.bitwarden = {
+    nodes.host = [ "VEGAS" ];
+    nixos.host = ./host.nix;
+  };
+
   dns.records.keychain.target = [ depot.hours.VEGAS.interfaces.primary.addrPublic ];
 }

cluster/services/fbi/default.nix

@@ -1,6 +1,11 @@
 { depot, ... }:
 
 {
+  services.fbi = {
+    nodes.host = [ "VEGAS" ];
+    nixos.host = ./host.nix;
+  };
+
   dns.records = let
     fbiAddr = [ depot.hours.VEGAS.interfaces.primary.addrPublic ];
   in {

cluster/services/frangiclave/default.nix

@@ -0,0 +1,22 @@
+{ config, ... }:
+
+{
+  services.frangiclave = {
+    nodes = {
+      server = [ "VEGAS" "grail" "prophet" ];
+      cluster = config.services.frangiclave.nodes.server;
+      agent = []; # all nodes, for vault-agent, secret templates, etc.
+    };
+    meshLinks = {
+      server.link.protocol = "http";
+      cluster.link.protocol = "http";
+    };
+    nixos = {
+      server = [
+        ./server.nix
+      ];
+      cluster = [];
+      agent = [];
+    };
+  };
+}

cluster/services/frangiclave/server.nix

@@ -0,0 +1,23 @@
+{ cluster, config, depot, ... }:
+
+let
+  apiLink = cluster.config.hostLinks.${config.networking.hostName}.frangiclave-server;
+  clusterLink = cluster.config.hostLinks.${config.networking.hostName}.frangiclave-cluster;
+in
+
+{
+  services.vault = {
+    enable = true;
+    package = depot.packages.openbao;
+    address = apiLink.tuple;
+    extraConfig = /*hcl*/ ''
+      api_addr = "${apiLink.url}"
+      cluster_addr = "${clusterLink.url}"
+    '';
+
+    storageBackend = "raft";
+    storageConfig = /*hcl*/ ''
+      node_id = "x${builtins.hashString "sha256" "frangiclave-node-${config.networking.hostName}"}"
+    '';
+  };
+}

cluster/services/gitlab/default.nix

@@ -1,5 +1,10 @@
 { depot, ... }:
 
 {
+  services.gitlab = {
+    nodes.host = [ "VEGAS" ];
+    nixos.host = ./host.nix;
+  };
+
   dns.records.git.target = [ depot.hours.VEGAS.interfaces.primary.addrPublic ];
 }

cluster/services/reflex/default.nix

@@ -1,5 +1,10 @@
 { depot, ... }:
 
 {
+  services.reflex = {
+    nodes.host = [ "VEGAS" ];
+    nixos.host = ./host.nix;
+  };
+
   dns.records.reflex.target = [ depot.hours.VEGAS.interfaces.primary.addrPublic ];
 }

cluster/services/soda/default.nix

@@ -1,6 +1,11 @@
 { depot, ... }:
 
 {
+  services.soda = {
+    nodes.host = [ "VEGAS" ];
+    nixos.host = ./host.nix;
+  };
+
   monitoring.blackbox.targets.soda-machine = {
     address = "soda.int.${depot.lib.meta.domain}:22";
     module = "sshConnect";

cluster/services/soda/host.nix

@@ -0,0 +1,26 @@
+{ depot, ... }:
+
+{
+  containers.soda = {
+    path = depot.nixosConfigurations.soda.config.system.build.toplevel;
+    privateNetwork = true;
+    hostBridge = "vmdefault";
+    localAddress = "${depot.hours.soda.interfaces.primary.addr}/24";
+    autoStart = true;
+    bindMounts.sodaDir = {
+      hostPath = "/srv/storage/www/soda";
+      mountPoint = "/soda";
+      isReadOnly = false;
+    };
+  };
+
+  systemd.services."container@soda".after = [ "libvirtd.service" "sys-devices-virtual-net-vmdefault.device" ];
+
+  networking.nat.forwardPorts = [
+    {
+      sourcePort = 52222;
+      destination = "${depot.hours.soda.interfaces.primary.addr}:22";
+      proto = "tcp";
+    }
+  ];
+}

cluster/services/sso/default.nix

@@ -1,6 +1,11 @@
 { depot, ... }:
 
 {
+  services.sso = {
+    nodes.host = [ "VEGAS" ];
+    nixos.host = ./host.nix;
+  };
+
   dns.records = let
     ssoAddr = [ depot.hours.VEGAS.interfaces.primary.addrPublic ];
   in {

hosts/VEGAS/services/backbone-routing/default.nix

@@ -3,10 +3,6 @@ let
   inherit (config.reflection) interfaces;
 in
 {
-  imports = [
-    ./port-forward.nix
-  ];
-
   networking.nat = {
     enable = true;
     externalInterface = interfaces.primary.link;

hosts/VEGAS/services/backbone-routing/port-forward.nix

@@ -1,11 +0,0 @@
-{ depot, ... }:
-
-{
-  networking.nat.forwardPorts = [
-    {
-      sourcePort = 52222;
-      destination = "${depot.hours.soda.interfaces.primary.addr}:22";
-      proto = "tcp";
-    }
-  ];
-}

hosts/VEGAS/system.nix

@@ -16,15 +16,10 @@
 
       # Services
       ./services/backbone-routing
-      ./services/bitwarden
       ./services/cdn-shield
-      ./services/fbi
-      ./services/gitlab
       ./services/jokes
       ./services/mail
       ./services/minecraft
-      ./services/reflex
-      ./services/sso
       ./services/websites
       ./services/wireguard-server
       depot.nixosModules.hyprspace
@@ -90,18 +85,4 @@
 
   system.stateVersion = "21.05";
   services.openssh.settings.PasswordAuthentication = false;
-
-  containers.soda = {
-    path = depot.nixosConfigurations.soda.config.system.build.toplevel;
-    privateNetwork = true;
-    hostBridge = "vmdefault";
-    localAddress = "${depot.hours.soda.interfaces.primary.addr}/24";
-    autoStart = true;
-    bindMounts.sodaDir = {
-      hostPath = "/srv/storage/www/soda";
-      mountPoint = "/soda";
-      isReadOnly = false;
-    };
-  };
-  systemd.services."container@soda".after = [ "libvirtd.service" "sys-devices-virtual-net-vmdefault.device" ];
 }

packages/checks/default.nix

@@ -1,4 +1,4 @@
-{ config, lib, self, ... }:
+{ config, lib, self, extendModules, ... }:
 
 let
   timeMachine = {
@@ -7,6 +7,7 @@ let
 in
 
 {
+  debug = lib.warn "debug mode is enabled" true;
   perSystem = { filters, pkgs, self', system, ... }: {
     checks = lib.mkIf (system == "x86_64-linux") {
       ascensions = pkgs.callPackage ./ascensions.nix {
@@ -49,6 +50,10 @@ in
       searxng = pkgs.callPackage ./searxng.nix {
         inherit (self'.packages) searxng;
       };
+
+      simulacrum = pkgs.callPackage ./simulacrum.nix {
+        inherit config extendModules;
+      };
     };
   };
 }

packages/checks/modules/nixos/external-storage.nix

@@ -0,0 +1,12 @@
+{ config, lib, ... }:
+
+{
+  systemd.tmpfiles.settings."00-testing-external-storage-underlays" = lib.mapAttrs' (name: cfg: {
+    name = cfg.mountpoint;
+    value.d = {
+      user = toString cfg.uid;
+      group = toString cfg.gid;
+      mode = "0700";
+    };
+  }) config.services.external-storage.underlays;
+}

packages/checks/simulacrum.nix

@@ -0,0 +1,119 @@
+{ testers, config, extendModules, lib, system }:
+
+let
+  lift = config;
+
+  snakeoil = {
+    ssh = {
+      public = lib.fileContents ./snakeoil/ssh/snakeoil-key.pub;
+      private = ./snakeoil/ssh/snakeoil-key;
+    };
+    wireguard = {
+      public = lib.genAttrs nodes (node: lib.fileContents ./snakeoil/wireguard/public-key-${toString digits.${node}});
+      private = lib.genAttrs nodes (node: ./snakeoil/wireguard/private-key-${toString digits.${node}});
+    };
+  };
+
+  nodes = lib.attrNames config.gods.fromLight;
+  digits = lib.attrsets.listToAttrs (lib.zipListsWith lib.nameValuePair nodes (lib.range 1 255));
+  depot' = extendModules {
+    modules = [
+      ({ config, ... }: {
+        gods.fromLight = lib.mapAttrs (name: cfg: {
+          interfaces.primary = {
+            link = lib.mkForce "vprimary";
+          };
+          ssh.id.publicKey = lib.mkForce snakeoil.ssh.public;
+        }) lift.gods.fromLight;
+
+        cluster = lib.mkForce (lift.cluster.extendModules {
+          specialArgs.depot = config;
+          modules = [
+            {
+              hostLinks = lib.genAttrs nodes (node: {
+                mesh.extra = lib.mkForce (lift.cluster.config.hostLinks.${node}.mesh.extra // {
+                  pubKey = snakeoil.wireguard.public.${node};
+                });
+              });
+            }
+          ];
+        });
+      })
+    ];
+  };
+  specialArgs = depot'.config.lib.summon system lib.id;
+in
+
+testers.runNixOSTest {
+  name = "simulacrum";
+
+  node = { inherit specialArgs; };
+  nodes = lib.genAttrs nodes (node: let
+    hour = depot'.config.hours.${node};
+  in {
+    imports = [
+      specialArgs.depot.hours.${node}.nixos
+      ./modules/nixos/age-dummy-secrets
+      ./modules/nixos/external-storage.nix
+    ] ++ depot'.config.cluster.config.out.injectNixosConfigForServices [ "consul" "certificates" "nginx" "wireguard" "frangiclave" ] node;
+
+    boot.kernel.sysctl."net.ipv4.ip_forward" = "1";
+    networking = {
+      interfaces = {
+        ${hour.interfaces.primary.link} = {
+          useDHCP = lib.mkForce false;
+          virtual = true;
+          ipv4.addresses = lib.mkForce [
+            {
+              address = hour.interfaces.primary.addr;
+              prefixLength = 32;
+            }
+          ];
+        };
+        eth1.ipv4.routes = lib.pipe nodes [
+          (lib.filter (n: n != node))
+          (map (n: let
+            hour = depot'.config.hours.${n};
+          in {
+            address = hour.interfaces.primary.addrPublic;
+            prefixLength = 32;
+            via = "192.168.1.${toString digits.${n}}";
+          }))
+        ];
+      };
+
+      firewall.extraCommands = lib.mkAfter (lib.optionalString (hour.interfaces.primary.isNat) ''
+        # self-nat
+        iptables -t nat -A PREROUTING -d ${hour.interfaces.primary.addrPublic} -j DNAT --to-destination ${hour.interfaces.primary.addr}
+        iptables -t nat -A POSTROUTING -s ${hour.interfaces.primary.addr} -j SNAT --to-source ${hour.interfaces.primary.addrPublic}
+      '');
+    };
+
+    systemd.services = {
+      hyprspace.enable = false;
+      cachix-agent.enable = false;
+    };
+
+    environment.etc = {
+      "ssh/ssh_host_ed25519_key" = {
+        source = snakeoil.ssh.private;
+        mode = "0400";
+      };
+      "dummy-secrets/cluster-wireguard-meshPrivateKey".source = lib.mkForce snakeoil.wireguard.private.${node};
+      "dummy-secrets/grafana-agent-blackbox-secret-monitoring".text = lib.mkForce ''
+        SECRET_MONITORING_BLACKBOX_TARGET_1_NAME=example-external-service
+        SECRET_MONITORING_BLACKBOX_TARGET_1_MODULE=http2xx
+        SECRET_MONITORING_BLACKBOX_TARGET_1_ADDRESS=http://127.0.0.1:1
+      '';
+      "dummy-secrets/garageRpcSecret".text = lib.mkForce "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa";
+    };
+    virtualisation = {
+      cores = 2;
+      memorySize = 4096;
+    };
+  });
+
+  testScript = ''
+    grail.succeed("false")
+  '';
+}

packages/checks/snakeoil/ssh/snakeoil-key

@@ -0,0 +1,7 @@
+-----BEGIN OPENSSH PRIVATE KEY-----
+b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAMwAAAAtzc2gtZW
+QyNTUxOQAAACAOx03X+LtW0aN8ejdN4IJgDPrTZgVwe7WbXhhBvqVwgwAAAJAS78fWEu/H
+1gAAAAtzc2gtZWQyNTUxOQAAACAOx03X+LtW0aN8ejdN4IJgDPrTZgVwe7WbXhhBvqVwgw
+AAAEAUtGOZZIZdzGP6g85JuXBjDtciNQ9bLHNxSN5Gbwvb2Q7HTdf4u1bRo3x6N03ggmAM
++tNmBXB7tZteGEG+pXCDAAAACW1heEBUSVRBTgECAwQ=
+-----END OPENSSH PRIVATE KEY-----

packages/checks/snakeoil/ssh/snakeoil-key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA7HTdf4u1bRo3x6N03ggmAM+tNmBXB7tZteGEG+pXCD

packages/checks/snakeoil/wireguard/private-key-1

@@ -0,0 +1 @@
+YHzP8rBP6qiXs6ZdnvHop9KnCYRADIEejwZzAzvj8m4=

packages/checks/snakeoil/wireguard/private-key-2

@@ -0,0 +1 @@
+uD7X5E6N9d0sN+xPr/bWnehSa3bAok741GO7Z4I+Z3I=

packages/checks/snakeoil/wireguard/private-key-3

@@ -0,0 +1 @@
+YLl+hkWaCWx/5PpWs3cQ+bKqYdJef/qZ+FMTsM9ammM=

packages/checks/snakeoil/wireguard/private-key-4

@@ -0,0 +1 @@
+MNvWpMluuzQvPyGTp7jtyPSyz6n9lIly/WX1gW2NAHg=

packages/checks/snakeoil/wireguard/private-key-5

@@ -0,0 +1 @@
+QHyIJ3HoKGGFN28qOrQP4UyoQMP5bM7Idn2MzayKzEM=

packages/checks/snakeoil/wireguard/public-key-1

@@ -0,0 +1 @@
+TESTtbFybW5YREwtd18a1A4StS4YAIUS5/M1Lv0jHjA=

packages/checks/snakeoil/wireguard/public-key-2

@@ -0,0 +1 @@
+TEsTh7bthkaDh9A1CpqDi/F121ao5lRZqIJznLH8mB4=

packages/checks/snakeoil/wireguard/public-key-3

@@ -0,0 +1 @@
+tEST6afFmVN18o+EiWNFx+ax3MJwdQIeNfJSGEpffXw=

packages/checks/snakeoil/wireguard/public-key-4

@@ -0,0 +1 @@
+tEsT6s7VtM5C20eJBaq6UlQydAha8ATlmrTRe9T5jnM=

packages/checks/snakeoil/wireguard/public-key-5

@@ -0,0 +1 @@
+TEstYyb5IoqSL53HbSQwMhTaR16sxcWcMmXIBPd+1gE=

packages/websites/stop-using-nix-env/project.nix

@@ -3,7 +3,7 @@
     packages.stop-using-nix-env = let
       site = with pkgs; stdenvNoCC.mkDerivation rec {
         pname = "stop-using-nix-env";
-        version = "1.2.0";
+        version = "1.2.1";
         src = ./src;
         buildCommand = ''
           install -Dm644 $src/* -t $out/share/www/${pname}

packages/websites/stop-using-nix-env/src/index.html

@@ -218,7 +218,7 @@
     Do you often run into a situation where you need a particular command
     for a one-off thing, but don't feel like it should reside on your system
     at all times?
-    <a href="https://nixos.org/guides/ad-hoc-developer-environments.html">Ephemeral shells</a>
+    <a href="https://nix.dev/tutorials/first-steps/ad-hoc-shell-environments.html">Ephemeral shells</a>
     allow you to <i>gain temporary access</i> to a command and after you exit
     out of the shell, it's as if the package was never installed.
     If you're using Flakes,