nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Initial, broken

Browse Source
This commit is contained in:
niten
2021-09-29 17:55:13 -07:00
parent b072fed747
commit 3dc5986134
38 changed files with 302 additions and 95 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/default.nix
+2
View File
@@ -11,6 +11,7 @@ with lib; {
./fudo/backplane
./fudo/chat.nix
./fudo/client/dns.nix
./fudo/distributed-builds.nix
./fudo/dns.nix
./fudo/domains.nix
./fudo/garbage-collector.nix
@@ -35,6 +36,7 @@ with lib; {
./fudo/secure-dns-proxy.nix
./fudo/sites.nix
./fudo/slynk.nix
./fudo/ssh.nix
./fudo/system.nix
./fudo/system-networking.nix
./fudo/users.nix
lib/fudo/deploy.nix
+14
View File
@@ -0,0 +1,14 @@
{ config, lib, pkgs, ... }:
with lib;
let
sys = callPackage ./system.nix {};
site-cfg = config.fudo.sites.${sys.local-site};
in {
config = {
users.usersroot.openssh.authorizedKeys.keys = mkIf (site-cfg.deploy-pubkeys != null)
site-cfg.deploy-pubkeys;
};
}
lib/fudo/distributed-builds.nix
+47
View File
@@ -0,0 +1,47 @@
{ config, lib, pkgs, ... }:
with lib;
let
sys = callPackage ../system.nix {};
site-cfg = config.fudo.sites.${sys.local-site};
has-build-servers = (length (attrNames site-cfg.build-servers)) > 0;
build-keypair = config.fudo.secrets.host-secrets.${hostname}.build-keypair;
enable-distributed-builds =
site-cfg.enable-distributed-builds && has-build-servers && build-keypair != null;
local-build-cfg =
mkIf (hasKey site-cfg.build-servers hostname)
site-cfg.build-servers.hostname;
in {
config = {
nix = mkIf enable-distributed-builds {
buildMachines = mapAttrsToList (hostname: buildOpts: {
hostName = "${hostname}.${domain-name}";
maxJobs = buildOpts.max-jobs;
speedFactor = buildOpts.speed-factor;
supportedFeatures = buildOpts.supportedFeatures;
sshKey = build-keypair.private-key;
sshUser = buildOpts.user;
}) site-cfg.build-servers;
distributedBuilds = true;
trustedUsers = mkIf (local-build-cfg != null) [
local-build-host.build-user
];
};
users.users = mkIf (local-build-cfg != null) {
${local-build-cfg.build-user} = {
isSystemUser = true;
openssh.authorizedKeys.keyFiles =
foldr (a: b: a ++ b) []
mapAttrsToList (host: hostOpts: hostOpts.build-pubkeys) sys.local-hosts;
};
};
};
}
lib/fudo/hosts.nix
+24 -37
View File
@@ -39,8 +39,7 @@ let
};
profile = mkOption {
# FIXME: get this list from profiles directly
type = listof (enum "desktop" "laptop" "server");
type = listOf (enumOf (attrNames config.fudo.profiles));
description =
"The profile to be applied to the host, determining what software is included.";
};
@@ -109,11 +108,11 @@ let
default = [ "ssh" "host" ];
};
ssh-pubkey = mkOption {
type = nullOr str;
ssh-pubkeys = mkOption {
type = listOf str;
description =
"SSH key of the host. Find with `ssh-keyscan`. Skip the hostname, just type and key.";
default = null;
"SSH keys of the host. Find with `ssh-keyscan`. Skip the hostname, just type and key.";
default = [];
};
build-pubkeys = mkOption {
@@ -207,22 +206,22 @@ in {
mode = "0444";
};
fudo.hosts.${hostname}.build-pubkeys =
map builtins.readFile
(map (build-key-path: "${build-key-path}/${hostname}.key.pub")
(optional (site.build-key-path != null) site.build-key-path));
# fudo.hosts.${hostname}.build-pubkeys =
# map builtins.readFile
# (map (build-key-path: "${build-key-path}/${hostname}.key.pub")
# (optional (site.build-key-path != null) site.build-key-path));
nix = mkIf
(has-build-servers && has-build-keys && site.enable-distributed-builds) {
buildMachines = mapAttrsToList (hostname: buildOpts: {
hostName = "${hostname}.${domain-name}";
maxJobs = buildOpts.max-jobs;
speedFactor = buildOpts.speed-factor;
supportedFeatures = buildOpts.supported-features;
sshKey = config.fudo.secrets.host-secrets.${hostname}.build-private-key.target-file;
}) site.build-servers;
distributedBuilds = true;
};
# nix = mkIf
# (has-build-servers && has-build-keys && site.enable-distributed-builds) {
# buildMachines = mapAttrsToList (hostname: buildOpts: {
# hostName = "${hostname}.${domain-name}";
# maxJobs = buildOpts.max-jobs;
# speedFactor = buildOpts.speed-factor;
# supportedFeatures = buildOpts.supported-features;
# sshKey = config.fudo.secrets.host-secrets.${hostname}.build-private-key.target-file;
# }) site.build-servers;
# distributedBuilds = true;
# };
time.timeZone = site.timezone;
@@ -242,26 +241,14 @@ in {
boot.tmpOnTmpfs = host-cfg.tmp-on-tmpfs;
fudo.secrets.host-secrets.${hostname} = {
host-keytab = let
keytab-file = mapOptional (keytab-path:
if (pathExists keytab-path) then
/. + builtins.toPath keytab-path
else
null) (mapOptional (keytab-dir: "${keytab-dir}/${hostname}.keytab")
site.keytab-path);
in mkIf (keytab-file != null) {
source-file = /. + builtins.toPath keytab-file;
host-keytab = mkIf (fudo.secrets.files.host-keytabs.${hostname} != null) {
source-file = fudo.secrets.files.host-keytabs.${hostname};
target-file = "/etc/krb5.keytab";
user = "root";
};
build-private-key = let
build-key-file = mapOptional
(build-key-file: if (pathExists build-key-file) then (/. + builtins.toPath build-key-file) else null)
(mapOptional (build-key-path: "${build-key-path}/${hostname}.key")
site.build-key-path);
in mkIf (build-key-file != null) {
source-file = build-key-file;
build-private-key = mkIf (fudo.secrets.files.build-keypairs.${hostname} != null) {
source-file = fudo.secrets.files.build-keypairs.${hostname}.private-key;
target-file = "/var/run/nix-build/host.key";
user = "root";
};
lib/fudo/local-network.nix
+7 -2
View File
@@ -83,6 +83,11 @@ in {
description = "Definition of network to be served by local server.";
default = { };
};
timestamp = mkOption {
type = int;
description = "Timestamp of build, to be used as a serial.";
};
};
config = mkIf cfg.enable {
@@ -144,7 +149,7 @@ in {
$TTL 1h
@ IN SOA ns1.${cfg.domain}. hostmaster.${cfg.domain}. (
${toString builtins.currentTime}
${toString cfg.timestamp}
1800
900
604800
@@ -201,7 +206,7 @@ in {
name = cfg.domain;
file = pkgs.writeText "${cfg.domain}-zone" ''
@ IN SOA ns1.${cfg.domain}. hostmaster.${cfg.domain}. (
${toString builtins.currentTime}
${toString cfg.timestamp}
5m
2m
6w
lib/fudo/sites.nix
+2 -5
View File
@@ -108,7 +108,7 @@ let
dropbear-ssh-port = mkOption {
type = port;
description = "Port to be used for the deploy SSH server.";
description = "Port to be used for the backup SSH server.";
default = 2112;
};
@@ -206,16 +206,13 @@ in {
config = {
users.users = {
root.openssh.authorizedKeys.keys =
mkIf (site-cfg.deploy-pubkeys != null) site-cfg.deploy-pubkeys;
${site-cfg.build-user} = mkIf
(any (build-host: build-host == config.instance.hostname)
(attrNames site-cfg.build-servers)) {
isSystemUser = true;
openssh.authorizedKeys.keys =
concatMap (hostOpts: hostOpts.build-pubkeys)
(attrValues site-hosts);
(attrValues site-hosts);
shell = pkgs.bash;
};
};
lib/fudo/ssh.nix
+64
View File
@@ -0,0 +1,64 @@
{ config, lib, pkgs, ... }:
with lib;
let
hostname = config.fudo.instance.hostname;
has-attrs = set: length (attrNames set) > 0;
host-keypairs = config.fudo.secrets.files.host-ssh-keypairs.${hostname};
sshfp-filename = host: keypair: "ssh-${host}-${keypair.key-type}.sshfp-record";
dns-sshfp-records = host: keypair: let
filename = sshfp-filename host keypair;
in mkDerivation {
buildInputs = with pkgs; [ openssh ];
buildPhase = ''
ssh-keygen -r REMOVEME -f ${keypair.public-key} | sed 's/^REMOVEME IN SSHFP //' > ${filename}
'';
installPhase = ''
mv ${filename} $out/${filename}
'';
};
in {
config = {
fudo = {
secrets.host-secrets.${hostname} = mkIf (host-keypairs != [])
map (keypair: {
"host-${keypair.key-type}-private-key" = {
source-file = keypair.private-key;
target-file = "/var/run/ssh/private/host-${keypair.key-type}-private-key";
user = "root";
};
});
hosts = mapAttrs (hostname: keypairs: {
ssh-pubkeys = map (keypair: keypair.public-key) keypairs;
ssh-fingerprints = map (keypair:
let
fingerprint-derivation = dns-sshfp-records hostname keypair.public-key;
filename = sshfp-filename hostname keypair;
in builtins.readFile "${fingerprint-derivation}/${filename}") keypairs;
} config.fudo.secrets.files.host-ssh-keypairs);
};
services.openssh.hostKeys = mkIf (host-keypairs != [])
(map (keypair: {
path = "/var/run/ssh/private/host-${keypair.key-type}-private-key";
type = keypair.key-type;
}) host-keypairs);
programs.ssh.knownHosts = mapAttrs (hostname: keypairs: {
publicKeyFile = keypairs.public-key;
hostNames = let
host-cfg = config.fudo.hosts.${hostname};
domains = [host-cfg.domain] ++ host-cfg.extra-domains;
in [ hostname ] ++
(map (domain: "${hostname}.${domain}") domains);
});
};
}
lib/hosts.nix
+1 -1
View File
@@ -11,6 +11,6 @@ with lib;
host-files = attrNames (filterAttrs is-nix-file (filterAttrs is-regular-file (builtins.readDir host-path)));
hosts = map hostname-from-file host-files;
load-host-file = hostname: import (./. + "/hosts/${hostname}.nix");
load-host-file = hostname: import (host-path + "/${hostname}.nix");
in genAttrs hosts (hostname: load-host-file hostname);
}
lib/system.nix
+5 -1
View File
@@ -1,4 +1,4 @@
{ lib, ... }:
{ config, lib, ... }:
with lib;
let
@@ -24,6 +24,9 @@ let
getAttrs (host-group-list ++ domain-group-list ++ site-group-list)
config.fudo.groups;
local-hosts =
filterAttrs (host: hostOpts: hostOpts.site == local-site) config.fudo.hosts;
in {
local-host = local-host;
local-domain = local-domain;
@@ -31,4 +34,5 @@ in {
local-users = local-users;
local-admins = local-admins;
local-groups = local-groups;
local-hosts = local-hosts;
}