remove hel1-a

README.md

@@ -5,7 +5,7 @@ Flakes:
 
     $ deploy --interactive '#vno1-oh2'
 
-    $ nix build .#deploy.nodes.hel1-a.profiles.system.path
+    $ nix build .#deploy.nodes.fra1-a.profiles.system.path
 
 Other:
 

data.nix

@@ -55,13 +55,6 @@ rec {
       publicIP = "168.119.184.134";
       jakstIP = "100.89.176.5";
     };
-    "hel1-a.servers.jakst" = rec {
-      extraHostNames = ["hel1-a.jakstys.lt" publicIP jakstIP];
-      publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF6Wd2lKrpP2Gqul10obMo2dc1xKaaLv0I4FAnfIaFKu";
-      initrdPubKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEzt0eaSRTAfM2295x4vACEd5VFqVeYJPV/N9ZUq+voP";
-      publicIP = "65.21.7.119";
-      jakstIP = "100.89.176.3";
-    };
     "fwmine.motiejus.jakst" = {
       publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIPi4N6NhUjAwZNSbi/Eb9zliZtrCzNEHmKb4UGRsJqF";
       jakstIP = "100.89.176.6";
@@ -88,7 +81,6 @@ rec {
   };
 
   jakstysLTZone = let
-    hel1a = hosts."hel1-a.servers.jakst".publicIP;
     fra1a = hosts."fra1-a.servers.jakst".publicIP;
     vno1 = hosts."vno1-oh2.servers.jakst".publicIP;
   in ''
@@ -105,8 +97,6 @@ rec {
     git                              A     ${vno1}
     auth                             A     ${vno1}
     dl                               A     ${vno1}
-    fwmine                           A     ${hel1a}
-    hel1-a                           A     ${hel1a}
     fra1-a                           A     ${fra1a}
     vno1                             A     ${vno1}
 

flake.nix

@@ -44,31 +44,6 @@
       #  specialArgs = {inherit myData;} // inputs;
       #};
 
-      nixosConfigurations.hel1-a = nixpkgs.lib.nixosSystem {
-        system = "x86_64-linux";
-        modules = [
-          ./hosts/hel1-a/configuration.nix
-          ./hosts/hel1-a/hardware-configuration.nix
-          ./hosts/hel1-a/zfs.nix
-
-          ./modules
-
-          agenix.nixosModules.default
-          home-manager.nixosModules.home-manager
-
-          {
-            age.secrets.motiejus-passwd-hash.file = ./secrets/motiejus_passwd_hash.age;
-            age.secrets.root-passwd-hash.file = ./secrets/root_passwd_hash.age;
-            age.secrets.zfs-passphrase-vno1-oh2.file = ./secrets/vno1-oh2/zfs-passphrase.age;
-
-            age.secrets.borgbackup-password.file = ./secrets/hel1-a/borgbackup/password.age;
-            age.secrets.sasl-passwd.file = ./secrets/postfix_sasl_passwd.age;
-          }
-        ];
-
-        specialArgs = {inherit myData;} // inputs;
-      };
-
       nixosConfigurations.vno1-oh2 = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
         modules = [
@@ -82,7 +57,6 @@
           {
             age.secrets.motiejus-passwd-hash.file = ./secrets/motiejus_passwd_hash.age;
             age.secrets.root-passwd-hash.file = ./secrets/root_passwd_hash.age;
-            age.secrets.zfs-passphrase-hel1-a.file = ./secrets/hel1-a/zfs-passphrase.age;
             age.secrets.zfs-passphrase-fra1-a.file = ./secrets/fra1-a/zfs-passphrase.age;
 
             age.secrets.headscale-client-oidc.file = ./secrets/headscale/oidc_client_secret2.age;
@@ -139,18 +113,6 @@
         specialArgs = {inherit myData;} // inputs;
       };
 
-      deploy.nodes.hel1-a = {
-        hostname = myData.hosts."hel1-a.servers.jakst".jakstIP;
-        profiles = {
-          system = {
-            sshUser = "motiejus";
-            path =
-              deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.hel1-a;
-            user = "root";
-          };
-        };
-      };
-
       deploy.nodes.vno1-oh2 = {
         hostname = myData.hosts."vno1-oh2.servers.jakst".jakstIP;
         profiles = {

hosts/fra1-a/configuration.nix

@@ -22,7 +22,6 @@
         authorizedKeys =
           (builtins.attrValues myData.people_pubkeys)
           ++ [
-            myData.hosts."hel1-a.servers.jakst".publicKey
             myData.hosts."vno1-oh2.servers.jakst".publicKey
           ];
       };

hosts/hel1-a/configuration.nix

@@ -1,144 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  agenix,
-  myData,
-  ...
-}: {
-  imports = [
-    ./hardware-configuration.nix
-    ./zfs.nix
-  ];
-
-  mj = {
-    stateVersion = "22.11";
-    timeZone = "UTC";
-
-    base = {
-      zfs.enable = true;
-
-      users.passwd = {
-        root.passwordFile = config.age.secrets.root-passwd-hash.path;
-        motiejus.passwordFile = config.age.secrets.motiejus-passwd-hash.path;
-      };
-
-      initrd = {
-        enable = true;
-        authorizedKeys =
-          (builtins.attrValues myData.people_pubkeys)
-          ++ [myData.hosts."vno1-oh2.servers.jakst".publicKey];
-        hostKeys = ["/etc/secrets/initrd/ssh_host_ed25519_key"];
-      };
-      snapshot = {
-        enable = true;
-        mountpoints = ["/var/lib" "/var/log"];
-      };
-
-      zfsborg = {
-        enable = true;
-        passwordPath = config.age.secrets.borgbackup-password.path;
-        mountpoints = {
-          "/var/lib" = {
-            repo = "zh2769@zh2769.rsync.net:hel1-a.servers.jakst-var_lib";
-            paths = [
-              "/var/lib/.snapshot-latest/headscale"
-            ];
-            backup_at = "*-*-* 00:05:00";
-          };
-        };
-      };
-
-      unitstatus = {
-        enable = true;
-        email = "motiejus+alerts@jakstys.lt";
-      };
-    };
-
-    services = {
-      node_exporter.enable = true;
-
-      headscale = {
-        enable = false;
-        clientOidcPath = config.age.secrets.headscale-client-oidc.path;
-        subnetCIDR = myData.tailscale_subnet.cidr;
-      };
-      deployerbot = {
-        follower = {
-          enable = true;
-          uidgid = myData.uidgid.updaterbot-deployee;
-          publicKey = myData.hosts."vno1-oh2.servers.jakst".publicKey;
-        };
-      };
-      postfix = {
-        enable = true;
-        saslPasswdPath = config.age.secrets.sasl-passwd.path;
-      };
-
-      zfsunlock = {
-        enable = true;
-        targets."vno1-oh2.servers.jakst" = let
-          host = myData.hosts."vno1-oh2.servers.jakst";
-        in {
-          sshEndpoint = host.publicIP;
-          pingEndpoint = host.jakstIP;
-          remotePubkey = host.initrdPubKey;
-          pwFile = config.age.secrets.zfs-passphrase-vno1-oh2.path;
-          startAt = "*-*-* *:00/5:00";
-        };
-      };
-    };
-  };
-
-  environment.systemPackages = with pkgs; [
-    nixos-option
-    graphicsmagick
-  ];
-
-  services = {
-    tailscale.enable = true;
-
-    nsd = {
-      enable = true;
-      interfaces = ["0.0.0.0" "::"];
-      zones = {
-        "jakstys.lt.".data = myData.jakstysLTZone;
-      };
-    };
-
-    logrotate = {
-      settings = {
-        "/var/log/caddy/access-jakstys.lt.log" = {
-          rotate = -1;
-          frequency = "daily";
-          dateext = true;
-          dateyesterday = true;
-          compress = true;
-          compresscmd = "${pkgs.zstd}/bin/zstd";
-          compressext = ".zst";
-          compressoptions = "--long -19";
-          uncompresscmd = "${pkgs.zstd}/bin/unzstd";
-          postrotate = "${pkgs.systemd}/bin/systemctl restart caddy";
-        };
-      };
-    };
-  };
-
-  networking = {
-    hostName = "hel1-a";
-    domain = "servers.jakst";
-    firewall = {
-      allowedTCPPorts = [
-        53
-        80
-        443
-      ];
-      allowedUDPPorts = [
-        53
-        443
-        41641 # tailscale
-      ];
-      checkReversePath = "loose"; # for tailscale
-    };
-  };
-}

hosts/hel1-a/hardware-configuration.nix

@@ -1,69 +0,0 @@
-# Do not modify this file!  It was generated by ‘nixos-generate-config’
-# and may be overwritten by future invocations.  Please make changes
-# to /etc/nixos/configuration.nix instead.
-{
-  config,
-  lib,
-  pkgs,
-  modulesPath,
-  ...
-}: {
-  imports = [(modulesPath + "/profiles/qemu-guest.nix")];
-  boot.initrd.availableKernelModules = ["ata_piix" "virtio_pci" "virtio_scsi" "xhci_pci" "sd_mod" "sr_mod"];
-  boot.initrd.kernelModules = [];
-  boot.kernelModules = [];
-  boot.extraModulePackages = [];
-
-  fileSystems."/" = {
-    device = "rpool/nixos/root";
-    fsType = "zfs";
-    options = ["zfsutil" "X-mount.mkdir"];
-  };
-
-  fileSystems."/home" = {
-    device = "rpool/nixos/home";
-    fsType = "zfs";
-    options = ["zfsutil" "X-mount.mkdir"];
-  };
-
-  fileSystems."/var/lib" = {
-    device = "rpool/nixos/var/lib";
-    fsType = "zfs";
-    options = ["zfsutil" "X-mount.mkdir"];
-  };
-
-  fileSystems."/var/log" = {
-    device = "rpool/nixos/var/log";
-    fsType = "zfs";
-    options = ["zfsutil" "X-mount.mkdir"];
-  };
-
-  fileSystems."/boot" = {
-    device = "bpool/nixos/root";
-    fsType = "zfs";
-    options = ["zfsutil" "X-mount.mkdir"];
-  };
-
-  fileSystems."/boot/efis/scsi-0QEMU_QEMU_HARDDISK_9233346-part1" = {
-    device = "/dev/disk/by-uuid/B6D7-D52E";
-    fsType = "vfat";
-  };
-
-  #fileSystems."/boot/efi" =
-  #  { device = "/boot/efis/scsi-0QEMU_QEMU_HARDDISK_9233346-part1";
-  #    fsType = "none";
-  #    options = [ "bind" ];
-  #  };
-
-  swapDevices = [{device = "/dev/disk/by-uuid/03ebe703-aa24-4ee5-a7c3-f8614ee779b0";}];
-
-  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
-  # (the default) this is the recommended approach. When using systemd-networkd it's
-  # still possible to use this option, but it's recommended to use it in conjunction
-  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
-  networking.useDHCP = lib.mkDefault true;
-  # networking.interfaces.ens3.useDHCP = lib.mkDefault true;
-
-  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
-  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
-}

hosts/hel1-a/zfs.nix

@@ -1,35 +0,0 @@
-{
-  config,
-  pkgs,
-  ...
-}: {
-  boot.supportedFilesystems = ["zfs"];
-  networking.hostId = "cd1a441c";
-  boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
-  boot.loader.efi.efiSysMountPoint = "/boot/efi";
-  boot.loader.efi.canTouchEfiVariables = false;
-  boot.loader.generationsDir.copyKernels = true;
-  boot.loader.grub.efiInstallAsRemovable = true;
-  boot.loader.grub.enable = true;
-  boot.loader.grub.copyKernels = true;
-  boot.loader.grub.efiSupport = true;
-  boot.loader.grub.zfsSupport = true;
-  #boot.loader.grub.extraPrepareConfig = ''
-  #  mkdir -p /boot/efis
-  #  for i in  /boot/efis/*; do mount $i ; done
-  #
-  #  mkdir -p /boot/efi
-  #  mount /boot/efi
-  #'';
-  #boot.loader.grub.extraInstallCommands = ''
-  #ESP_MIRROR=$(mktemp -d)
-  #cp -r /boot/efi/EFI $ESP_MIRROR
-  #for i in /boot/efis/*; do
-  # cp -r $ESP_MIRROR/EFI $i
-  #done
-  #rm -rf $ESP_MIRROR
-  #'';
-  boot.loader.grub.devices = [
-    "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_9233346"
-  ];
-}

hosts/vno1-oh2/configuration.nix

@@ -19,7 +19,7 @@
         enable = true;
         authorizedKeys =
           (builtins.attrValues myData.people_pubkeys)
-          ++ [myData.hosts."hel1-a.servers.jakst".publicKey];
+          ++ [myData.hosts."fra1-a.servers.jakst".publicKey];
       };
     };
   };
@@ -125,7 +125,6 @@
           repo = "git@git.jakstys.lt:motiejus/config";
           deployDerivations = [
             ".#vno1-oh2"
-            ".#hel1-a"
             ".#vno1-rp3b"
             ".#fra1-a"
           ];
@@ -159,15 +158,6 @@
 
       zfsunlock = {
         enable = true;
-        targets."hel1-a.servers.jakst" = let
-          host = myData.hosts."hel1-a.servers.jakst";
-        in {
-          sshEndpoint = host.publicIP;
-          pingEndpoint = host.jakstIP;
-          remotePubkey = host.initrdPubKey;
-          pwFile = config.age.secrets.zfs-passphrase-hel1-a.path;
-          startAt = "*-*-* *:00/5:00";
-        };
         targets."fra1-a.servers.jakst" = let
           host = myData.hosts."fra1-a.servers.jakst";
         in {
@@ -312,10 +302,6 @@
           job_name = "fra1-a.servers.jakst";
           static_configs = [{targets = ["${myData.hosts."fra1-a.servers.jakst".jakstIP}:${port}"];}];
         }
-        {
-          job_name = "hel1-a.servers.jakst";
-          static_configs = [{targets = ["${myData.hosts."hel1-a.servers.jakst".jakstIP}:${port}"];}];
-        }
         {
           job_name = "vno1-rp3b.servers.jakst";
           static_configs = [{targets = ["${myData.hosts."vno1-rp3b.servers.jakst".jakstIP}:${port}"];}];

modules/base/default.nix

@@ -6,7 +6,6 @@
 }: {
   imports = [
     ./boot
-    ./initrd
     ./fileSystems
     ./snapshot
     ./sshd

modules/base/initrd/default.nix

@@ -1,38 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}: {
-  options.mj.base.initrd = {
-    enable = lib.mkEnableOption "Enable base initrd settings";
-
-    hostKeys = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      description = "ssh private key for use in initrd.";
-    };
-
-    authorizedKeys = lib.mkOption {
-      type = lib.types.listOf lib.types.str;
-      description = lib.mdDoc "Authorized keys for the root user on initrd.";
-    };
-  };
-
-  config = lib.mkIf config.mj.base.initrd.enable {
-    boot.initrd.network = {
-      enable = true;
-      ssh = {
-        enable = true;
-        port = 22;
-        authorizedKeys = config.mj.base.initrd.authorizedKeys;
-        hostKeys = config.mj.base.initrd.hostKeys;
-      };
-      postCommands = ''
-        tee -a /root/.profile >/dev/null <<EOF
-        if zfs load-key rpool/nixos; then
-           pkill zfs
-        fi
-        exit
-        EOF'';
-    };
-  };
-}

secrets.nix

@@ -4,11 +4,10 @@ let
   motiejus_bk1 = "age1kyehn8yr9tfu3w0z4d9p9qrj0tjjh92ljxmz2nyr6xnm7y8kpv5spwwc9n";
   motiejus = [motiejus_yk1 motiejus_yk2 motiejus_bk1];
 
-  hel1-a = (import ./data.nix).hosts."hel1-a.servers.jakst".publicKey;
   fra1-a = (import ./data.nix).hosts."fra1-a.servers.jakst".publicKey;
   vno1-oh2 = (import ./data.nix).hosts."vno1-oh2.servers.jakst".publicKey;
   vno1-rp3b = (import ./data.nix).hosts."vno1-rp3b.servers.jakst".publicKey;
-  systems = [hel1-a fra1-a vno1-oh2 vno1-rp3b];
+  systems = [fra1-a vno1-oh2 vno1-rp3b];
 
   mk = auth: keyNames:
     builtins.listToAttrs (
@@ -20,12 +19,8 @@ let
     );
 in
   {}
-  // mk ([hel1-a] ++ motiejus) [
-    "secrets/hel1-a/borgbackup/password.age"
-  ]
   // mk ([vno1-oh2] ++ motiejus) [
     "secrets/fra1-a/zfs-passphrase.age"
-    "secrets/hel1-a/zfs-passphrase.age"
     "secrets/vno1-oh2/borgbackup/password.age"
     "secrets/grafana.jakstys.lt/oidc.age"
     "secrets/letsencrypt/account.key.age"
@@ -36,7 +31,7 @@ in
     "secrets/synapse/macaroon_secret_key.age"
   ]
   # TODO make sure secrets don't repeat here.
-  // mk ([fra1-a hel1-a] ++ motiejus) [
+  // mk ([fra1-a] ++ motiejus) [
     "secrets/vno1-oh2/zfs-passphrase.age"
   ]
   // mk (systems ++ motiejus) [