This commit is contained in:
Motiejus Jakštys 2024-07-29 15:39:54 +03:00
parent 3da42ead11
commit 9ea80639a3
51 changed files with 2040 additions and 1758 deletions

216
data.nix
View File

@ -65,32 +65,45 @@ rec {
jakstIP = "100.89.176.4";
};
"vno3-rp3b.servers.jakst" = rec {
extraHostNames = [jakstIP];
extraHostNames = [ jakstIP ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBudUFFEBpUVdr26vLJup8Hk6wj1iDbOPPQnJbv6GUGC";
jakstIP = "100.89.176.2";
};
"fra1-a.servers.jakst" = rec {
extraHostNames = ["fra1-a.jakstys.lt" publicIP jakstIP];
extraHostNames = [
"fra1-a.jakstys.lt"
publicIP
jakstIP
];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFj9Ktw9SZQlHe/Pl5MI7PRUcCyTgZgZ0SsvWUmO0wBM";
initrdPubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGtYwVhfmdHRK8YcaRQ3JGSIOK55lEMNSPh33Z0iI+pO";
publicIP = "168.119.184.134";
jakstIP = "100.89.176.5";
system = "aarch64-linux";
supportedFeatures = ["nixos-test" "benchmark" "big-parallel" "kvm" "gccarch-armv8-a"];
supportedFeatures = [
"nixos-test"
"benchmark"
"big-parallel"
"kvm"
"gccarch-armv8-a"
];
};
"fwminex.motiejus.jakst" = rec {
extraHostNames = [jakstIP vno1IP];
extraHostNames = [
jakstIP
vno1IP
];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHlWSZ/H6DR5i5aCrlrEQLVF9MXNvls/pjlLPLaav3f+";
jakstIP = "100.89.176.6";
vno1IP = "192.168.189.10";
};
"mtworx.motiejus.jakst" = rec {
extraHostNames = [jakstIP];
extraHostNames = [ jakstIP ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDRrsOkKkpJ9ZJYhEdxjwrmdVYoPcGDGtcGfBkkpVF6l";
jakstIP = "100.89.176.20";
};
"vno1-vinc.vincentas.jakst" = rec {
extraHostNames = [jakstIP];
extraHostNames = [ jakstIP ];
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJIwK7et5NBM+vaffiwpKLSAJwKfwMhCZwl1JyXo79uL";
jakstIP = "100.89.176.7";
};
@ -118,15 +131,14 @@ rec {
range = "100.89.176.0-100.89.191.255";
sshPattern = "100.89.176.*"; # until we have more hosts
};
motiejus.cidrs = let
mHosts =
attrVals [
motiejus.cidrs =
let
mHosts = attrVals [
"mxp10.motiejus.jakst"
"mtworx.motiejus.jakst"
"fwminex.motiejus.jakst"
]
hosts;
in
] hosts;
in
builtins.catAttrs "jakstIP" mHosts;
vno1 = {
@ -136,99 +148,103 @@ rec {
vno3.cidr = "192.168.100.0/24";
};
e11syncZone = let
vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
fra1a = hosts."fra1-a.servers.jakst".publicIP;
in ''
$ORIGIN 11sync.net.
$TTL 3600
@ SOA ns1.11sync.net. motiejus.11sync.net. (2024011500 86400 86400 86400 86400)
@ NS ns1.11sync.net.
@ NS ns2.11sync.net.
@ A ${vno1}
@ TXT google-site-verification=nvUYd7_ShhPKvTn_Xbw-vPFONOhPeaYQsGp34DbV-80
@ TXT "hosted-email-verify=qeuysotu"
@ MX 10 aspmx1.migadu.com.
@ MX 20 aspmx2.migadu.com.
@ TXT "v=spf1 include:spf.migadu.com -all"
ns1 A ${vno1}
ns2 A ${fra1a}
www A ${vno1}
admin A ${hosts."fra1-a.servers.jakst".jakstIP}
key1._domainkey CNAME key1.11sync.net._domainkey.migadu.com.
key2._domainkey CNAME key2.11sync.net._domainkey.migadu.com.
key3._domainkey CNAME key3.11sync.net._domainkey.migadu.com.
_dmarc TXT "v=DMARC1; p=quarantine;"
autoconfig CNAME autoconfig.migadu.com.
_autodiscover._tcp SRV 0 1 443 autodiscover.migadu.com.
_submissions._tcp SRV 0 1 465 smtp.migadu.com.
_imaps._tcp SRV 0 1 993 imap.migadu.com.
_pop3s._tcp SRV 0 1 995 pop.migadu.com.
_github-challenge-11sync-org TXT "ff5e813c58"
'';
e11syncZone =
let
vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
fra1a = hosts."fra1-a.servers.jakst".publicIP;
in
''
$ORIGIN 11sync.net.
$TTL 3600
@ SOA ns1.11sync.net. motiejus.11sync.net. (2024011500 86400 86400 86400 86400)
@ NS ns1.11sync.net.
@ NS ns2.11sync.net.
@ A ${vno1}
@ TXT google-site-verification=nvUYd7_ShhPKvTn_Xbw-vPFONOhPeaYQsGp34DbV-80
@ TXT "hosted-email-verify=qeuysotu"
@ MX 10 aspmx1.migadu.com.
@ MX 20 aspmx2.migadu.com.
@ TXT "v=spf1 include:spf.migadu.com -all"
ns1 A ${vno1}
ns2 A ${fra1a}
www A ${vno1}
admin A ${hosts."fra1-a.servers.jakst".jakstIP}
key1._domainkey CNAME key1.11sync.net._domainkey.migadu.com.
key2._domainkey CNAME key2.11sync.net._domainkey.migadu.com.
key3._domainkey CNAME key3.11sync.net._domainkey.migadu.com.
_dmarc TXT "v=DMARC1; p=quarantine;"
autoconfig CNAME autoconfig.migadu.com.
_autodiscover._tcp SRV 0 1 443 autodiscover.migadu.com.
_submissions._tcp SRV 0 1 465 smtp.migadu.com.
_imaps._tcp SRV 0 1 993 imap.migadu.com.
_pop3s._tcp SRV 0 1 995 pop.migadu.com.
_github-challenge-11sync-org TXT "ff5e813c58"
'';
jakstysLTZone = let
fra1a = hosts."fra1-a.servers.jakst".publicIP;
vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
in ''
$ORIGIN jakstys.lt.
$TTL 86400
@ SOA ns1.jakstys.lt. motiejus.jakstys.lt. (2023100800 86400 86400 86400 86400)
@ NS ns1.jakstys.lt.
@ NS ns2.jakstys.lt.
@ A ${vno1}
www A ${vno1}
ns1 A ${vno1}
ns2 A ${fra1a}
vpn A ${vno1}
git A ${vno1}
auth A ${vno1}
dl A ${vno1}
fra1-a A ${fra1a}
vno1 A ${vno1}
jakstysLTZone =
let
fra1a = hosts."fra1-a.servers.jakst".publicIP;
vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
in
''
$ORIGIN jakstys.lt.
$TTL 86400
@ SOA ns1.jakstys.lt. motiejus.jakstys.lt. (2023100800 86400 86400 86400 86400)
@ NS ns1.jakstys.lt.
@ NS ns2.jakstys.lt.
@ A ${vno1}
www A ${vno1}
ns1 A ${vno1}
ns2 A ${fra1a}
vpn A ${vno1}
git A ${vno1}
auth A ${vno1}
dl A ${vno1}
fra1-a A ${fra1a}
vno1 A ${vno1}
@ TXT google-site-verification=sU99fmO8gEJF-0lbOY-IzkovC6MXsP3Gozqrs8BR5OM
@ TXT hosted-email-verify=rvyd6h64
@ MX 10 aspmx1.migadu.com.
@ MX 20 aspmx2.migadu.com.
* MX 10 aspmx1.migadu.com.
* MX 20 aspmx2.migadu.com.
key1._domainkey CNAME key1.jakstys.lt._domainkey.migadu.com.
key2._domainkey CNAME key2.jakstys.lt._domainkey.migadu.com.
key3._domainkey CNAME key3.jakstys.lt._domainkey.migadu.com.
@ TXT "v=spf1 include:spf.migadu.com -all"
_dmarc TXT "v=DMARC1; p=quarantine;"
* MX 10 aspmx1.migadu.com.
* MX 20 aspmx2.migadu.com.
autoconfig CNAME autoconfig.migadu.com.
_autodiscover._tcp SRV 0 1 443 autodiscover.migadu.com.
_submissions._tcp SRV 0 1 465 smtp.migadu.com.
_imaps._tcp SRV 0 1 993 imap.migadu.com.
_pop3s._tcp SRV 0 1 995 imap.migadu.com.
@ TXT google-site-verification=sU99fmO8gEJF-0lbOY-IzkovC6MXsP3Gozqrs8BR5OM
@ TXT hosted-email-verify=rvyd6h64
@ MX 10 aspmx1.migadu.com.
@ MX 20 aspmx2.migadu.com.
* MX 10 aspmx1.migadu.com.
* MX 20 aspmx2.migadu.com.
key1._domainkey CNAME key1.jakstys.lt._domainkey.migadu.com.
key2._domainkey CNAME key2.jakstys.lt._domainkey.migadu.com.
key3._domainkey CNAME key3.jakstys.lt._domainkey.migadu.com.
@ TXT "v=spf1 include:spf.migadu.com -all"
_dmarc TXT "v=DMARC1; p=quarantine;"
* MX 10 aspmx1.migadu.com.
* MX 20 aspmx2.migadu.com.
autoconfig CNAME autoconfig.migadu.com.
_autodiscover._tcp SRV 0 1 443 autodiscover.migadu.com.
_submissions._tcp SRV 0 1 465 smtp.migadu.com.
_imaps._tcp SRV 0 1 993 imap.migadu.com.
_pop3s._tcp SRV 0 1 995 imap.migadu.com.
grafana A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.grafana CNAME _acme-endpoint.grafana
_acme-endpoint.grafana NS ns._acme-endpoint.grafana
ns._acme-endpoint.grafana A ${vno1}
grafana A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.grafana CNAME _acme-endpoint.grafana
_acme-endpoint.grafana NS ns._acme-endpoint.grafana
ns._acme-endpoint.grafana A ${vno1}
irc A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.irc CNAME _acme-endpoint.irc
_acme-endpoint.irc NS ns._acme-endpoint.irc
ns._acme-endpoint.irc A ${vno1}
irc A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.irc CNAME _acme-endpoint.irc
_acme-endpoint.irc NS ns._acme-endpoint.irc
ns._acme-endpoint.irc A ${vno1}
hass A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.hass CNAME _acme-endpoint.hass
_acme-endpoint.hass NS ns._acme-endpoint.hass
ns._acme-endpoint.hass A ${vno1}
hass A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.hass CNAME _acme-endpoint.hass
_acme-endpoint.hass NS ns._acme-endpoint.hass
ns._acme-endpoint.hass A ${vno1}
bitwarden A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.bitwarden CNAME _acme-endpoint.bitwarden
_acme-endpoint.bitwarden NS ns._acme-endpoint.bitwarden
ns._acme-endpoint.bitwarden A ${vno1}
bitwarden A ${hosts."vno1-oh2.servers.jakst".jakstIP}
_acme-challenge.bitwarden CNAME _acme-endpoint.bitwarden
_acme-endpoint.bitwarden NS ns._acme-endpoint.bitwarden
ns._acme-endpoint.bitwarden A ${vno1}
hdd A ${hosts."vno3-rp3b.servers.jakst".jakstIP}
_acme-challenge.hdd CNAME _acme-endpoint.hdd
_acme-endpoint.hdd NS ns._acme-endpoint.hdd
ns._acme-endpoint.hdd A ${vno1}
'';
hdd A ${hosts."vno3-rp3b.servers.jakst".jakstIP}
_acme-challenge.hdd CNAME _acme-endpoint.hdd
_acme-endpoint.hdd NS ns._acme-endpoint.hdd
ns._acme-endpoint.hdd A ${vno1}
'';
}

235
flake.nix
View File

@ -61,65 +61,68 @@
extra-experimental-features = "nix-command flakes";
};
outputs = {
self,
nixpkgs,
nixpkgs-unstable,
agenix,
deploy-rs,
flake-utils,
home-manager,
nixos-hardware,
nix-index-database,
pre-commit-hooks,
nur,
nixgl,
...
} @ inputs: let
myData = import ./data.nix;
outputs =
{
self,
nixpkgs,
nixpkgs-unstable,
agenix,
deploy-rs,
flake-utils,
home-manager,
nixos-hardware,
nix-index-database,
pre-commit-hooks,
nur,
nixgl,
...
}@inputs:
let
myData = import ./data.nix;
overlays = [
nur.overlay
nixgl.overlay
overlays = [
nur.overlay
nixgl.overlay
(_self: super: {deploy-rs-pkg = super.deploy-rs;})
deploy-rs.overlay
(_self: super: {
deploy-rs = {
deploy-rs = super.deploy-rs-pkg;
inherit (super.deploy-rs) lib;
(_self: super: { deploy-rs-pkg = super.deploy-rs; })
deploy-rs.overlay
(_self: super: {
deploy-rs = {
deploy-rs = super.deploy-rs-pkg;
inherit (super.deploy-rs) lib;
};
deploy-rs-pkg = null;
})
(_: super: {
compressDrv = super.callPackage ./pkgs/compress-drv { };
compressDrvWeb = super.callPackage ./pkgs/compress-drv/web.nix { };
tmuxbash = super.callPackage ./pkgs/tmuxbash.nix { };
btrfs-auto-snapshot = super.callPackage ./pkgs/btrfs-auto-snapshot.nix { };
nicer = super.callPackage ./pkgs/nicer.nix { };
pkgs-unstable = import nixpkgs-unstable { inherit (super) system; };
})
];
mkVM =
system:
nixpkgs.lib.nixosSystem {
inherit system;
modules = [
{ nixpkgs.overlays = overlays; }
./hosts/vm/configuration.nix
./modules
./modules/profiles/desktop
home-manager.nixosModules.home-manager
];
specialArgs = {
inherit myData;
} // inputs;
};
deploy-rs-pkg = null;
})
(_: super: {
compressDrv = super.callPackage ./pkgs/compress-drv {};
compressDrvWeb = super.callPackage ./pkgs/compress-drv/web.nix {};
tmuxbash = super.callPackage ./pkgs/tmuxbash.nix {};
btrfs-auto-snapshot = super.callPackage ./pkgs/btrfs-auto-snapshot.nix {};
nicer = super.callPackage ./pkgs/nicer.nix {};
pkgs-unstable = import nixpkgs-unstable {
inherit (super) system;
};
})
];
mkVM = system:
nixpkgs.lib.nixosSystem {
inherit system;
modules = [
{nixpkgs.overlays = overlays;}
./hosts/vm/configuration.nix
./modules
./modules/profiles/desktop
home-manager.nixosModules.home-manager
];
specialArgs = {inherit myData;} // inputs;
};
in
in
{
nixosConfigurations = {
vm-x86_64 = mkVM "x86_64-linux";
@ -128,7 +131,7 @@
mtworx = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
{nixpkgs.overlays = overlays;}
{ nixpkgs.overlays = overlays; }
./hosts/mtworx/configuration.nix
home-manager.nixosModules.home-manager
nixos-hardware.nixosModules.lenovo-thinkpad-x1-11th-gen
@ -147,13 +150,15 @@
}
];
specialArgs = {inherit myData;} // inputs;
specialArgs = {
inherit myData;
} // inputs;
};
vno1-oh2 = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
{nixpkgs.overlays = overlays;}
{ nixpkgs.overlays = overlays; }
./hosts/vno1-oh2/configuration.nix
./modules
@ -184,13 +189,15 @@
}
];
specialArgs = {inherit myData;} // inputs;
specialArgs = {
inherit myData;
} // inputs;
};
fwminex = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
{nixpkgs.overlays = overlays;}
{ nixpkgs.overlays = overlays; }
./hosts/fwminex/configuration.nix
home-manager.nixosModules.home-manager
nixos-hardware.nixosModules.framework-12th-gen-intel
@ -207,13 +214,15 @@
}
];
specialArgs = {inherit myData;} // inputs;
specialArgs = {
inherit myData;
} // inputs;
};
vno3-rp3b = nixpkgs.lib.nixosSystem {
system = "aarch64-linux";
modules = [
{nixpkgs.overlays = overlays;}
{ nixpkgs.overlays = overlays; }
./hosts/vno3-rp3b/configuration.nix
./modules
@ -232,13 +241,15 @@
}
];
specialArgs = {inherit myData;} // inputs;
specialArgs = {
inherit myData;
} // inputs;
};
fra1-a = nixpkgs.lib.nixosSystem {
system = "aarch64-linux";
modules = [
{nixpkgs.overlays = overlays;}
{ nixpkgs.overlays = overlays; }
agenix.nixosModules.default
home-manager.nixosModules.home-manager
@ -256,7 +267,9 @@
}
];
specialArgs = {inherit myData;} // inputs;
specialArgs = {
inherit myData;
} // inputs;
};
};
@ -266,8 +279,7 @@
profiles = {
system = {
sshUser = "motiejus";
path =
self.nixosConfigurations.vno1-oh2.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.vno1-oh2;
path = self.nixosConfigurations.vno1-oh2.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.vno1-oh2;
user = "root";
};
};
@ -278,8 +290,7 @@
profiles = {
system = {
sshUser = "motiejus";
path =
self.nixosConfigurations.fwminex.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.fwminex;
path = self.nixosConfigurations.fwminex.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.fwminex;
user = "root";
};
};
@ -290,8 +301,7 @@
profiles = {
system = {
sshUser = "motiejus";
path =
self.nixosConfigurations.mtworx.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.mtworx;
path = self.nixosConfigurations.mtworx.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.mtworx;
user = "root";
};
};
@ -302,8 +312,7 @@
profiles = {
system = {
sshUser = "motiejus";
path =
self.nixosConfigurations.vno3-rp3b.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.vno3-rp3b;
path = self.nixosConfigurations.vno3-rp3b.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.vno3-rp3b;
user = "root";
};
};
@ -314,51 +323,55 @@
profiles = {
system = {
sshUser = "motiejus";
path =
self.nixosConfigurations.fra1-a.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.fra1-a;
path = self.nixosConfigurations.fra1-a.pkgs.deploy-rs.lib.activate.nixos self.nixosConfigurations.fra1-a;
user = "root";
};
};
};
};
checks =
builtins.mapAttrs (
system: deployLib:
deployLib.deployChecks self.deploy
// {
pre-commit-check = inputs.pre-commit-hooks.lib.${system}.run {
src = ./.;
hooks = {
alejandra.enable = true;
deadnix.enable = true;
statix.enable = true;
};
checks = builtins.mapAttrs (
system: deployLib:
let
pkgs = import nixpkgs { inherit system overlays; };
in
deployLib.deployChecks self.deploy
// {
pre-commit-check = inputs.pre-commit-hooks.lib.${system}.run {
src = ./.;
hooks = {
nixfmt = {
enable = true;
package = pkgs.nixfmt-rfc-style;
};
deadnix.enable = true;
statix.enable = true;
};
};
compress-drv-test = let
pkgs = import nixpkgs {inherit system overlays;};
in
pkgs.callPackage ./pkgs/compress-drv/test.nix {};
}
)
deploy-rs.lib;
compress-drv-test = pkgs.callPackage ./pkgs/compress-drv/test.nix { };
}
) deploy-rs.lib;
}
// flake-utils.lib.eachDefaultSystem (system: let
pkgs = import nixpkgs {inherit system overlays;};
in {
devShells.default = pkgs.mkShellNoCC {
GIT_AUTHOR_EMAIL = "motiejus@jakstys.lt";
packages = [
pkgs.nix-output-monitor
pkgs.rage
pkgs.age-plugin-yubikey
pkgs.deploy-rs.deploy-rs
agenix.packages.${system}.agenix
];
inherit (self.checks.${system}.pre-commit-check) shellHook;
};
// flake-utils.lib.eachDefaultSystem (
system:
let
pkgs = import nixpkgs { inherit system overlays; };
in
{
devShells.default = pkgs.mkShellNoCC {
GIT_AUTHOR_EMAIL = "motiejus@jakstys.lt";
packages = [
pkgs.nix-output-monitor
pkgs.rage
pkgs.age-plugin-yubikey
pkgs.deploy-rs.deploy-rs
agenix.packages.${system}.agenix
];
inherit (self.checks.${system}.pre-commit-check) shellHook;
};
formatter = pkgs.alejandra;
});
formatter = pkgs.nixfmt-rfc-style;
}
);
}

View File

@ -4,25 +4,31 @@
myData,
modulesPath,
...
}: {
imports = [(modulesPath + "/profiles/qemu-guest.nix")];
}:
{
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
zfs-root = {
boot = {
enable = true;
devNodes = "/dev/disk/by-id/";
bootDevices = ["scsi-0QEMU_QEMU_HARDDISK_36151096"];
bootDevices = [ "scsi-0QEMU_QEMU_HARDDISK_36151096" ];
immutable = false;
availableKernelModules = ["xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" "sr_mod" "virtio_gpu"];
availableKernelModules = [
"xhci_pci"
"virtio_pci"
"virtio_scsi"
"usbhid"
"sr_mod"
"virtio_gpu"
];
removableEfi = true;
kernelParams = ["console=tty"];
kernelParams = [ "console=tty" ];
sshUnlock = {
enable = true;
authorizedKeys =
(builtins.attrValues myData.people_pubkeys)
++ [
myData.hosts."vno1-oh2.servers.jakst".publicKey
];
authorizedKeys = (builtins.attrValues myData.people_pubkeys) ++ [
myData.hosts."vno1-oh2.servers.jakst".publicKey
];
};
};
};
@ -46,7 +52,7 @@
snapshot = {
enable = true;
mountpoints = ["/var/lib"];
mountpoints = [ "/var/lib" ];
};
};
@ -79,22 +85,24 @@
];
enable = true;
sshAllowSubnets = [myData.subnets.tailscale.sshPattern];
sshAllowSubnets = [ myData.subnets.tailscale.sshPattern ];
uidgid = myData.uidgid.updaterbot-deployee;
};
};
zfsunlock = {
enable = false;
targets."vno1-oh2.servers.jakst" = let
host = myData.hosts."vno1-oh2.servers.jakst";
in {
sshEndpoint = host.publicIP;
pingEndpoint = host.jakstIP;
remotePubkey = host.initrdPubKey;
pwFile = config.age.secrets.zfs-passphrase-vno1-oh2.path;
startAt = "*-*-* *:00/5:00";
};
targets."vno1-oh2.servers.jakst" =
let
host = myData.hosts."vno1-oh2.servers.jakst";
in
{
sshEndpoint = host.publicIP;
pingEndpoint = host.jakstIP;
remotePubkey = host.initrdPubKey;
pwFile = config.age.secrets.zfs-passphrase-vno1-oh2.path;
startAt = "*-*-* *:00/5:00";
};
};
};
};
@ -120,7 +128,10 @@
nsd = {
enable = true;
interfaces = ["0.0.0.0" "::"];
interfaces = [
"0.0.0.0"
"::"
];
zones = {
"jakstys.lt.".data = myData.jakstysLTZone;
"11sync.net.".data = myData.e11syncZone;
@ -134,8 +145,16 @@
domain = "servers.jakst";
useDHCP = true;
firewall = {
allowedUDPPorts = [53 443];
allowedTCPPorts = [22 53 80 443];
allowedUDPPorts = [
53
443
];
allowedTCPPorts = [
22
53
80
443
];
};
};

View File

@ -3,20 +3,28 @@
pkgs,
config,
...
}: let
}:
let
nvme = "/dev/disk/by-id/nvme-Samsung_SSD_970_EVO_Plus_2TB_S6P1NS0TA01331A_1";
in {
in
{
imports = [
../../modules
../../modules/profiles/btrfs
];
boot = {
kernelModules = ["kvm-intel"];
kernelModules = [ "kvm-intel" ];
loader.systemd-boot.enable = true;
initrd = {
kernelModules = ["usb_storage"];
availableKernelModules = ["xhci_pci" "thunderbolt" "nvme" "usbhid" "tpm_tis"];
kernelModules = [ "usb_storage" ];
availableKernelModules = [
"xhci_pci"
"thunderbolt"
"nvme"
"usbhid"
"tpm_tis"
];
systemd.enableTpm2 = true;
luks.devices = {
luksroot = {
@ -44,7 +52,7 @@ in {
"/" = {
device = "/dev/mapper/luksroot";
fsType = "btrfs";
options = ["compress=zstd"];
options = [ "compress=zstd" ];
};
"/boot" = {
device = "${nvme}-part1";
@ -86,18 +94,20 @@ in {
verboseLogs = false;
};
remote-builder.client = let
host = myData.hosts."fra1-a.servers.jakst";
in {
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
remote-builder.client =
let
host = myData.hosts."fra1-a.servers.jakst";
in
{
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
node_exporter = {
enable = true;
extraSubnets = [myData.subnets.vno1.cidr];
extraSubnets = [ myData.subnets.vno1.cidr ];
};
deployerbot = {
@ -127,7 +137,7 @@ in {
enable = true;
uidgid = myData.uidgid.updaterbot-deployee;
sshAllowSubnets = with myData.subnets; [tailscale.sshPattern];
sshAllowSubnets = with myData.subnets; [ tailscale.sshPattern ];
};
};

View File

@ -1,10 +1,8 @@
{
config,
myData,
...
}: let
{ config, myData, ... }:
let
nvme = "/dev/disk/by-id/nvme-WD_PC_SN810_SDCQNRY-1T00-1201_23234W800017";
in {
in
{
imports = [
../../shared/work
../../modules
@ -14,10 +12,16 @@ in {
];
boot = {
kernelModules = ["kvm-intel"];
kernelModules = [ "kvm-intel" ];
loader.systemd-boot.enable = true;
initrd = {
availableKernelModules = ["xhci_pci" "thunderbolt" "nvme" "usbhid" "tpm_tis"];
availableKernelModules = [
"xhci_pci"
"thunderbolt"
"nvme"
"usbhid"
"tpm_tis"
];
systemd = {
enableTpm2 = true;
emergencyAccess = true;
@ -26,7 +30,7 @@ in {
luksroot = {
device = "${nvme}-part3";
allowDiscards = true;
crypttabExtraOpts = ["tpm2-device=auto"];
crypttabExtraOpts = [ "tpm2-device=auto" ];
};
};
};
@ -43,7 +47,7 @@ in {
"/" = {
device = "/dev/mapper/luksroot";
fsType = "btrfs";
options = ["compress=zstd"];
options = [ "compress=zstd" ];
};
"/boot" = {
device = "${nvme}-part1";
@ -81,18 +85,20 @@ in {
toUser = config.mj.username;
};
remote-builder.client = let
host = myData.hosts."fra1-a.servers.jakst";
in {
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
remote-builder.client =
let
host = myData.hosts."fra1-a.servers.jakst";
in
{
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
node_exporter = {
enable = true;
extraSubnets = [myData.subnets.vno1.cidr];
extraSubnets = [ myData.subnets.vno1.cidr ];
};
deployerbot = {
@ -104,7 +110,7 @@ in {
enable = true;
uidgid = myData.uidgid.updaterbot-deployee;
sshAllowSubnets = with myData.subnets; [tailscale.sshPattern];
sshAllowSubnets = with myData.subnets; [ tailscale.sshPattern ];
};
};
@ -131,7 +137,7 @@ in {
};
};
users.extraGroups.vboxusers.members = ["motiejus"];
users.extraGroups.vboxusers.members = [ "motiejus" ];
security.tpm2.enable = true;

View File

@ -1,8 +1,5 @@
{ self, modulesPath, ... }:
{
self,
modulesPath,
...
}: {
imports = [
"${modulesPath}/profiles/all-hardware.nix"
"${modulesPath}/installer/cd-dvd/iso-image.nix"
@ -21,7 +18,10 @@
};
boot.loader.systemd-boot.enable = true;
boot.supportedFilesystems = ["zfs" "btrfs"];
boot.supportedFilesystems = [
"zfs"
"btrfs"
];
isoImage = {
isoName = "toolshed-${self.lastModifiedDate}.iso";
@ -31,7 +31,7 @@
makeUsbBootable = true; # USB booting
};
swapDevices = [];
swapDevices = [ ];
services = {
getty.autologinUser = "nixos";
@ -45,7 +45,7 @@
networking = {
hostName = "vm";
domain = "jakstys.lt";
firewall.allowedTCPPorts = [22];
firewall.allowedTCPPorts = [ 22 ];
hostId = "abefef01";
};
}

View File

@ -4,12 +4,13 @@
pkgs,
myData,
...
}: {
}:
{
zfs-root = {
boot = {
enable = true;
devNodes = "/dev/disk/by-id/";
bootDevices = ["nvme-Samsung_SSD_970_EVO_Plus_2TB_S6P1NX0TA00913P"];
bootDevices = [ "nvme-Samsung_SSD_970_EVO_Plus_2TB_S6P1NX0TA00913P" ];
immutable = false;
availableKernelModules = [
"ahci"
@ -26,14 +27,14 @@
];
sshUnlock = {
enable = true;
authorizedKeys =
(builtins.attrValues myData.people_pubkeys)
++ [myData.hosts."fra1-a.servers.jakst".publicKey];
authorizedKeys = (builtins.attrValues myData.people_pubkeys) ++ [
myData.hosts."fra1-a.servers.jakst".publicKey
];
};
};
};
boot.binfmt.emulatedSystems = ["aarch64-linux"];
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
mj = {
stateVersion = "23.05";
@ -50,7 +51,11 @@
snapshot = {
enable = true;
mountpoints = ["/home" "/var/lib" "/var/log"];
mountpoints = [
"/home"
"/var/lib"
"/var/log"
];
};
zfsborg = {
@ -73,9 +78,7 @@
"tailscale"
"private/soju"
];
patterns = [
"- gitea/data/repo-archive/"
];
patterns = [ "- gitea/data/repo-archive/" ];
backup_at = "*-*-* 01:00:00 UTC";
prune.keep = {
within = "1d";
@ -86,7 +89,9 @@
}
{
mountpoint = "/var/lib";
repo = "borgstor@${myData.hosts."vno3-rp3b.servers.jakst".jakstIP}:${config.networking.hostName}.${config.networking.domain}-var_lib";
repo = "borgstor@${
myData.hosts."vno3-rp3b.servers.jakst".jakstIP
}:${config.networking.hostName}.${config.networking.domain}-var_lib";
paths = [
"bitwarden_rs"
"caddy"
@ -98,9 +103,7 @@
"tailscale"
"private/soju"
];
patterns = [
"- gitea/data/repo-archive/"
];
patterns = [ "- gitea/data/repo-archive/" ];
backup_at = "*-*-* 01:00:00 UTC";
}
@ -108,7 +111,7 @@
{
mountpoint = "/var/log";
repo = "zh2769@zh2769.rsync.net:${config.networking.hostName}.${config.networking.domain}-var_log";
paths = ["caddy"];
paths = [ "caddy" ];
patterns = [
"+ caddy/access-jakstys.lt.log-*.zst"
"- *"
@ -117,8 +120,10 @@
}
{
mountpoint = "/var/log";
repo = "borgstor@${myData.hosts."vno3-rp3b.servers.jakst".jakstIP}:${config.networking.hostName}.${config.networking.domain}-var_log";
paths = ["caddy"];
repo = "borgstor@${
myData.hosts."vno3-rp3b.servers.jakst".jakstIP
}:${config.networking.hostName}.${config.networking.domain}-var_log";
paths = [ "caddy" ];
patterns = [
"+ caddy/access-jakstys.lt.log-*.zst"
"- *"
@ -138,7 +143,9 @@
}
{
mountpoint = "/home";
repo = "borgstor@${myData.hosts."vno3-rp3b.servers.jakst".jakstIP}:${config.networking.hostName}.${config.networking.domain}-home-motiejus-annex2";
repo = "borgstor@${
myData.hosts."vno3-rp3b.servers.jakst".jakstIP
}:${config.networking.hostName}.${config.networking.domain}-home-motiejus-annex2";
paths = [
"motiejus/annex2"
"motiejus/.config/syncthing"
@ -157,7 +164,7 @@
services = {
friendlyport.ports = [
{
subnets = [myData.subnets.tailscale.cidr];
subnets = [ myData.subnets.tailscale.cidr ];
tcp = with myData.ports; [
80
443
@ -181,18 +188,20 @@
subnetCIDR = myData.subnets.tailscale.cidr;
};
nsd-acme = let
accountKey = config.age.secrets.letsencrypt-account-key.path;
in {
enable = true;
zones = {
"irc.jakstys.lt".accountKey = accountKey;
"hdd.jakstys.lt".accountKey = accountKey;
"hass.jakstys.lt".accountKey = accountKey;
"grafana.jakstys.lt".accountKey = accountKey;
"bitwarden.jakstys.lt".accountKey = accountKey;
nsd-acme =
let
accountKey = config.age.secrets.letsencrypt-account-key.path;
in
{
enable = true;
zones = {
"irc.jakstys.lt".accountKey = accountKey;
"hdd.jakstys.lt".accountKey = accountKey;
"hass.jakstys.lt".accountKey = accountKey;
"grafana.jakstys.lt".accountKey = accountKey;
"bitwarden.jakstys.lt".accountKey = accountKey;
};
};
};
deployerbot = {
follower = {
@ -202,7 +211,7 @@
];
enable = true;
sshAllowSubnets = [myData.subnets.tailscale.sshPattern];
sshAllowSubnets = [ myData.subnets.tailscale.sshPattern ];
uidgid = myData.uidgid.updaterbot-deployee;
};
};
@ -228,25 +237,29 @@
zfsunlock = {
enable = true;
targets."fra1-a.servers.jakst" = let
host = myData.hosts."fra1-a.servers.jakst";
in {
sshEndpoint = host.publicIP;
pingEndpoint = host.jakstIP;
remotePubkey = host.initrdPubKey;
pwFile = config.age.secrets.zfs-passphrase-fra1-a.path;
startAt = "*-*-* *:00/5:00";
};
targets."fra1-a.servers.jakst" =
let
host = myData.hosts."fra1-a.servers.jakst";
in
{
sshEndpoint = host.publicIP;
pingEndpoint = host.jakstIP;
remotePubkey = host.initrdPubKey;
pwFile = config.age.secrets.zfs-passphrase-fra1-a.path;
startAt = "*-*-* *:00/5:00";
};
};
remote-builder.client = let
host = myData.hosts."fra1-a.servers.jakst";
in {
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
remote-builder.client =
let
host = myData.hosts."fra1-a.servers.jakst";
in
{
enable = true;
inherit (host) system supportedFeatures;
hostName = host.jakstIP;
sshKey = "/etc/ssh/ssh_host_ed25519_key";
};
};
};
@ -301,25 +314,27 @@
"www.jakstys.lt".extraConfig = ''
redir https://jakstys.lt
'';
"irc.jakstys.lt".extraConfig = let
gamja = pkgs.compressDrvWeb (pkgs.gamja.override {
gamjaConfig = {
server = {
url = "irc.jakstys.lt:6698";
nick = "motiejus";
"irc.jakstys.lt".extraConfig =
let
gamja = pkgs.compressDrvWeb (pkgs.gamja.override {
gamjaConfig = {
server = {
url = "irc.jakstys.lt:6698";
nick = "motiejus";
};
};
};
}) {};
in ''
@denied not remote_ip ${myData.subnets.tailscale.cidr}
abort @denied
tls {$CREDENTIALS_DIRECTORY}/irc.jakstys.lt-cert.pem {$CREDENTIALS_DIRECTORY}/irc.jakstys.lt-key.pem
}) { };
in
''
@denied not remote_ip ${myData.subnets.tailscale.cidr}
abort @denied
tls {$CREDENTIALS_DIRECTORY}/irc.jakstys.lt-cert.pem {$CREDENTIALS_DIRECTORY}/irc.jakstys.lt-key.pem
root * ${gamja}
file_server browse {
precompressed br gzip
}
'';
root * ${gamja}
file_server browse {
precompressed br gzip
}
'';
"dl.jakstys.lt".extraConfig = ''
root * /var/www/dl
file_server browse {
@ -452,47 +467,52 @@
evaluation_interval = "1m";
};
scrapeConfigs = let
port = builtins.toString myData.ports.exporters.node;
in [
{
job_name = "prometheus";
static_configs = [{targets = ["127.0.0.1:${toString myData.ports.prometheus}"];}];
}
{
job_name = "caddy";
static_configs = [{targets = ["127.0.0.1:${toString myData.ports.exporters.caddy}"];}];
}
{
job_name = "${config.networking.hostName}.${config.networking.domain}";
static_configs = [{targets = ["127.0.0.1:${port}"];}];
}
{
job_name = "fra1-a.servers.jakst";