config/hosts/vno1-oh2/configuration.nix

331 lines
9.0 KiB
Nix
Raw Normal View History

2023-07-22 16:05:44 +03:00
{
config,
pkgs,
myData,
...
}: {
zfs-root = {
boot = {
enable = true;
devNodes = "/dev/disk/by-id/";
bootDevices = ["nvme-Samsung_SSD_970_EVO_Plus_2TB_S6P1NX0TA00913P"];
immutable = false;
availableKernelModules = ["ahci" "xhci_pci" "nvme" "usbhid" "sdhci_pci" "r8169"];
removableEfi = true;
kernelParams = [
"ip=192.168.189.1::192.168.189.4:255.255.255.0:vno1-oh2.jakstys.lt:enp3s0:off"
];
sshUnlock = {
enable = true;
2023-07-23 15:23:09 +03:00
authorizedKeys =
(builtins.attrValues myData.people_pubkeys)
++ [myData.hosts."hel1-a.servers.jakst".publicKey];
2023-07-22 16:05:44 +03:00
};
};
};
boot.binfmt.emulatedSystems = ["aarch64-linux"];
2023-07-22 16:05:44 +03:00
mj = {
stateVersion = "23.05";
timeZone = "Europe/Vilnius";
base = {
zfs.enable = true;
2023-08-18 16:39:03 +03:00
users = {
2023-08-18 18:50:39 +03:00
devEnvironment = true;
2023-08-18 16:39:03 +03:00
passwd = {
root.passwordFile = config.age.secrets.root-passwd-hash.path;
motiejus.passwordFile = config.age.secrets.motiejus-passwd-hash.path;
};
2023-07-22 16:05:44 +03:00
};
2023-07-26 13:09:40 +03:00
snapshot = {
enable = true;
mountpoints = ["/home" "/var/lib"];
2023-07-26 13:09:40 +03:00
};
2023-07-26 14:23:12 +03:00
zfsborg = {
enable = true;
passwordPath = config.age.secrets.borgbackup-password.path;
2023-07-26 14:39:34 +03:00
sshKeyPath = "/etc/ssh/ssh_host_ed25519_key";
2023-07-26 14:23:12 +03:00
mountpoints = {
"/var/lib" = {
repo = "zh2769@zh2769.rsync.net:${config.networking.hostName}.${config.networking.domain}-var_lib";
paths = [
"/var/lib/.snapshot-latest/private/soju"
"/var/lib/.snapshot-latest/grafana"
];
backup_at = "*-*-* 00:01:00";
};
2023-07-26 14:23:12 +03:00
"/home" = {
repo = "zh2769@zh2769.rsync.net:${config.networking.hostName}.${config.networking.domain}-home-motiejus-annex2";
paths = [
"/home/.snapshot-latest/motiejus/annex2"
2023-07-26 15:31:05 +03:00
"/home/.snapshot-latest/motiejus/.config/syncthing"
2023-07-26 14:23:12 +03:00
];
2023-07-30 06:41:13 +03:00
backup_at = "*-*-* 00:05:00 UTC";
2023-07-26 14:23:12 +03:00
};
};
};
unitstatus = {
enable = true;
email = "motiejus+alerts@jakstys.lt";
};
2023-07-22 16:05:44 +03:00
};
2023-07-24 09:23:20 +03:00
2023-07-26 13:26:11 +03:00
services = {
2023-08-06 00:47:32 +03:00
friendlyport.vpn.ports = [
80
443
2023-08-06 00:15:13 +03:00
myData.ports.grafana
myData.ports.prometheus
2023-08-22 14:26:47 +03:00
myData.ports.soju
2023-08-06 00:15:13 +03:00
];
2023-08-05 18:28:59 +03:00
2023-08-18 09:31:19 +03:00
node_exporter.enable = true;
2023-08-09 14:24:43 +03:00
nsd-acme = {
enable = true;
2023-08-10 00:26:16 +03:00
zones."grafana.jakstys.lt" = {
2023-08-09 14:24:43 +03:00
accountKey = config.age.secrets.letsencrypt-account-key.path;
2023-08-10 00:26:16 +03:00
staging = false;
2023-08-09 14:24:43 +03:00
};
2023-08-22 14:26:47 +03:00
zones."irc.jakstys.lt" = {
accountKey = config.age.secrets.letsencrypt-account-key.path;
staging = false;
2023-08-22 14:26:47 +03:00
};
2023-08-09 14:24:43 +03:00
};
2023-07-30 05:49:54 +03:00
deployerbot = {
main = {
enable = true;
uidgid = myData.uidgid.updaterbot-deployer;
repo = "git@git.jakstys.lt:motiejus/config";
2023-08-16 16:49:45 +03:00
deployDerivations = [".#vno1-oh2" ".#hel1-a" ".#vno1-rp3b"];
2023-07-30 05:49:54 +03:00
};
follower = {
enable = true;
uidgid = myData.uidgid.updaterbot-deployee;
publicKey = myData.hosts."vno1-oh2.servers.jakst".publicKey;
};
2023-07-28 14:20:50 +03:00
};
2023-07-26 13:26:11 +03:00
postfix = {
enable = true;
saslPasswdPath = config.age.secrets.sasl-passwd.path;
};
2023-07-26 11:36:54 +03:00
2023-07-26 13:26:11 +03:00
syncthing = {
enable = true;
dataDir = "/home/motiejus/";
user = "motiejus";
group = "users";
};
zfsunlock = {
enable = true;
targets."hel1-a.servers.jakst" = let
host = myData.hosts."hel1-a.servers.jakst";
in {
sshEndpoint = host.publicIP;
pingEndpoint = host.jakstIP;
remotePubkey = host.initrdPubKey;
2023-07-26 13:26:11 +03:00
pwFile = config.age.secrets.zfs-passphrase-hel1-a.path;
startAt = "*-*-* *:00/5:00";
};
2023-07-24 09:23:20 +03:00
};
};
2023-07-22 16:05:44 +03:00
};
services = {
tailscale.enable = true;
caddy = {
enable = true;
acmeCA = null;
virtualHosts."grafana.jakstys.lt" = {
extraConfig = ''
reverse_proxy 127.0.0.1:3000
tls {$CREDENTIALS_DIRECTORY}/grafana.jakstys.lt-cert.pem {$CREDENTIALS_DIRECTORY}/grafana.jakstys.lt-key.pem
'';
};
};
2023-08-05 18:28:59 +03:00
grafana = {
enable = true;
2023-08-06 00:11:16 +03:00
provision = {
enable = true;
datasources.settings = {
apiVersion = 1;
2023-08-06 00:47:32 +03:00
datasources = [
{
name = "Prometheus";
type = "prometheus";
access = "proxy";
url = "http://127.0.0.1:${toString config.services.prometheus.port}";
}
];
2023-08-06 00:11:16 +03:00
};
};
2023-08-05 18:28:59 +03:00
settings = {
server = {
2023-08-14 15:27:55 +03:00
domain = "grafana.jakstys.lt";
root_url = "https://grafana.jakstys.lt";
enable_gzip = true;
2023-08-06 20:39:48 +03:00
http_addr = "0.0.0.0";
2023-08-05 18:28:59 +03:00
http_port = myData.ports.grafana;
};
2023-08-14 17:00:03 +03:00
users.auto_assign_org = true;
2023-08-14 17:10:11 +03:00
users.auto_assign_org_role = "Admin";
2023-08-14 17:05:44 +03:00
# https://github.com/grafana/grafana/issues/70203#issuecomment-1612823390
auth.oauth_allow_insecure_email_lookup = true;
2023-08-14 17:05:44 +03:00
"auth.generic_oauth" = {
enabled = true;
2023-08-14 17:10:11 +03:00
auto_login = true;
client_id = "5349c113-467d-4b95-a61b-264f2d844da8";
client_secret = "$__file{/run/grafana/oidc-secret}";
auth_url = "https://git.jakstys.lt/login/oauth/authorize";
api_url = "https://git.jakstys.lt/login/oauth/userinfo";
token_url = "https://git.jakstys.lt/login/oauth/access_token";
};
feature_toggles.accessTokenExpirationCheck = true;
2023-08-05 18:28:59 +03:00
};
};
prometheus = {
enable = true;
port = myData.ports.prometheus;
globalConfig = {
scrape_interval = "15s";
evaluation_interval = "15s";
};
2023-08-06 00:47:32 +03:00
scrapeConfigs = let
port = builtins.toString myData.ports.exporters.node;
in [
2023-08-05 18:28:59 +03:00
{
job_name = "${config.networking.hostName}.${config.networking.domain}";
2023-08-06 00:47:32 +03:00
static_configs = [{targets = ["127.0.0.1:${port}"];}];
}
{
job_name = "hel1-a.servers.jakst";
static_configs = [{targets = ["${myData.hosts."hel1-a.servers.jakst".jakstIP}:${port}"];}];
2023-08-05 18:28:59 +03:00
}
2023-08-16 16:54:17 +03:00
{
job_name = "vno1-rp3b.servers.jakst";
static_configs = [{targets = ["${myData.hosts."vno1-rp3b.servers.jakst".jakstIP}:${port}"];}];
}
2023-08-05 18:28:59 +03:00
];
};
2023-08-05 18:00:43 +03:00
2023-07-22 16:05:44 +03:00
nsd = {
enable = true;
interfaces = ["0.0.0.0" "::"];
zones = {
"jakstys.lt.".data = myData.jakstysLTZone;
};
2023-08-07 01:23:41 +03:00
};
2023-08-22 14:28:59 +03:00
soju = {
enable = true;
2023-08-22 14:39:42 +03:00
listen = ["unix+admin://" ":${toString myData.ports.soju}"];
2023-08-22 14:28:59 +03:00
tlsCertificate = "/run/soju/cert.pem";
tlsCertificateKey = "/run/soju/key.pem";
hostName = "irc.jakstys.lt";
extraConfig = ''
2023-08-22 15:13:33 +03:00
message-store fs /var/lib/soju
2023-08-22 14:28:59 +03:00
'';
};
2023-08-07 01:23:41 +03:00
};
systemd.services = {
caddy = let
2023-08-22 14:26:47 +03:00
acme = config.mj.services.nsd-acme.zones."grafana.jakstys.lt";
in {
serviceConfig.LoadCredential = [
2023-08-22 14:26:47 +03:00
"grafana.jakstys.lt-cert.pem:${acme.certFile}"
"grafana.jakstys.lt-key.pem:${acme.keyFile}"
];
after = ["nsd-acme-grafana.jakstys.lt.service"];
requires = ["nsd-acme-grafana.jakstys.lt.service"];
};
2023-08-22 14:28:59 +03:00
soju = let
acme = config.mj.services.nsd-acme.zones."irc.jakstys.lt";
in {
serviceConfig = {
RuntimeDirectory = "soju";
LoadCredential = [
"irc.jakstys.lt-cert.pem:${acme.certFile}"
"irc.jakstys.lt-key.pem:${acme.keyFile}"
];
};
preStart = ''
ln -sf $CREDENTIALS_DIRECTORY/irc.jakstys.lt-cert.pem /run/soju/cert.pem
ln -sf $CREDENTIALS_DIRECTORY/irc.jakstys.lt-key.pem /run/soju/key.pem
'';
after = ["nsd-acme-irc.jakstys.lt.service"];
requires = ["nsd-acme-irc.jakstys.lt.service"];
2023-08-22 14:28:59 +03:00
};
grafana = {
preStart = "ln -sf $CREDENTIALS_DIRECTORY/oidc /run/grafana/oidc-secret";
serviceConfig = {
RuntimeDirectory = "grafana";
LoadCredential = ["oidc:${config.age.secrets.grafana-oidc.path}"];
};
};
cert-watcher = {
description = "Restart caddy when tls keys/certs change";
wantedBy = ["multi-user.target"];
unitConfig = {
StartLimitIntervalSec = 10;
StartLimitBurst = 5;
};
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.systemd}/bin/systemctl restart caddy.service";
};
};
};
systemd.paths = {
cert-watcher = {
wantedBy = ["multi-user.target"];
pathConfig = {
PathChanged = [
config.mj.services.nsd-acme.zones."grafana.jakstys.lt".certFile
];
Unit = "cert-watcher.service";
};
};
};
2023-07-22 16:05:44 +03:00
networking = {
hostId = "f9117e1b";
hostName = "vno1-oh2";
2023-07-26 11:36:54 +03:00
domain = "servers.jakst";
2023-07-22 16:05:44 +03:00
defaultGateway = "192.168.189.4";
nameservers = ["192.168.189.4"];
interfaces.enp3s0.ipv4.addresses = [
{
address = "192.168.189.1";
prefixLength = 24;
}
];
2023-08-07 00:33:37 +03:00
firewall = {
allowedUDPPorts = [53 80 443];
allowedTCPPorts = [53 80 443];
2023-08-07 00:33:37 +03:00
logRefusedConnections = false;
checkReversePath = "loose"; # for tailscale
};
2023-07-22 16:05:44 +03:00
};
}