nix/nixos-config
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'nixops' of ssh://git.fudo.org:2222/fudosys/NixOS into nixops

Browse Source
This commit is contained in:
root@procul
2021-07-28 13:55:46 -05:00
parent caa1a9be7c b4ce03333a
commit 7539aa0bfc
26 changed files with 7618 additions and 183 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/hardware/lambda.nix
+38 -13
View File
@@ -1,8 +1,13 @@
{ config, lib, pkgs, ... }:
{
with lib;
let
in {
imports = [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> ];
system.stateVersion = "21.05";
boot = {
initrd = {
availableKernelModules = [
@@ -18,35 +23,55 @@
kernelModules = [ ];
};
kernelModules = [ "kvm-amd" ];
kernelPackages = pkgs.linuxPackages_latest;
kernelModules = [ "kvm-intel" ];
supportedFilesystems = [ "zfs" ];
loader.grub = {
enable = true;
version = 2;
device = "/dev/disk/by-label/nixos-root";
device = "/dev/disk/by-id/wwn-0x600508b1001cecf6b880f591f9b18b29";
};
};
fileSystems = {
"/" = {
device = "/dev/disk/by-label/nixos-root";
fsType = "btrfs";
"/boot" = {
device = "/dev/disk/by-label/lambda-boot";
fsType = "ext4";
options = [ "noexec" ];
};
"/boot" = {
device = "/dev/disk/by-label/nixos-boot";
fsType = "ext4";
"/" = {
device = "none";
fsType = "tmpfs";
options = [ "noexec" "mode=755" ];
};
"/nix" = {
device = "lambda/transient/nix";
fsType = "zfs";
};
"/var/log" = {
device = "lambda/transient/logs";
fsType = "zfs";
neededForBoot = true;
options = [ "noexec" ];
};
"/state" = {
device = "lambda/persistent/state";
fsType = "zfs";
options = [ "noexec" ];
};
};
swapDevices = [{ device = "/dev/disk/by-label/nixos-swap"; }];
swapDevices = [{ device = "/dev/disk/by-label/lambda-swap"; }];
nix.maxJobs = lib.mkDefault 12;
hardware.bluetooth.enable = false;
networking = {
hostId = substring 0 8 (fileContents /etc/machine-id);
macvlans = {
intif0 = {
interface = "enp3s0f1";
config/hardware/limina.nix
+1 -1
View File
@@ -19,7 +19,7 @@ with lib; {
};
supportedFilesystems = [ "zfs" ];
kernelPackages = pkgs.linuxPackages_latest;
# kernelPackages = pkgs.linuxPackages_latest;
};
fileSystems = {
config/hardware/plato.nix
+2 -3
View File
@@ -1,7 +1,6 @@
{ config, lib, pkgs, ... }:
with lib;
{
with lib; {
imports = [ <nixpkgs/nixos/modules/installer/scan/not-detected.nix> ];
boot = {
@@ -18,7 +17,7 @@ with lib;
};
supportedFilesystems = [ "zfs" ];
kernelPackages = pkgs.linuxPackages_latest;
# kernelPackages = pkgs.linuxPackages.zfs;
};
fileSystems = {
config/host-config/lambda.nix
+143 -78
View File
@@ -3,14 +3,10 @@
let
shinobi-port = "7080";
shinobi-od-port = "7082";
state-dir = "/state"; # This must be a string!
in {
# TODO: remove?
nixpkgs.config.permittedInsecurePackages = [
"openssh-with-gssapi-8.4p1" # CVE-2021-28041
];
fudo.slynk.enable = true;
boot.loader.grub.copyKernels = true;
networking = {
interfaces = {
@@ -19,89 +15,158 @@ in {
enp4s0f0.useDHCP = false;
enp4s0f1.useDHCP = false;
intif0 = { useDHCP = true; };
intif0.useDHCP = true;
};
};
fudo.secrets.host-secrets.lambda = {
host-keytab = {
source-file = /state/secrets/kerberos/lambda.keytab;
target-file = "/etc/krb5.keytab";
fudo.secrets = {
host-secrets.lambda = {
host-keytab = {
source-file = /state/secrets/kerberos/lambda.keytab;
target-file = "/etc/krb5.keytab";
user = "root";
};
};
secret-group = "fudo-secrets";
secret-users = [ "niten" ];
secret-paths = [ "/state/secrets" ];
};
systemd.tmpfiles.rules = [
"L /root/.gnupg - - - - ${state-dir}/user/root/gnupg"
# "L /root/.emacs.d - - - - ${state-dir}/user/root/emacs.d"
"L /root/.ssh/id_rsa - - - - ${state-dir}/user/root/ssh/id_rsa"
"L /root/.ssh/id_rsa.pub - - - - ${state-dir}/user/root/ssh/id_rsa.pub"
"L /root/.ssh/known_hosts - - - - ${state-dir}/user/root/ssh/known_hosts"
# "L /etc/ssh/ssh_host_rsa_key - - - - ${state-dir}/ssh/ssh_host_rsa_key"
# "L /etc/ssh/ssh_host_rsa_key.pub - - - - ${state-dir}/ssh/ssh_host_rsa_key.pub"
# "L /etc/ssh/ssh_host_ed25519_key - - - - ${state-dir}/ssh/ssh_host_ed25519_key"
# "L /etc/ssh/ssh_host_ed25519_key.pub - - - - ${state-dir}/ssh/ssh_host_ed25519_key.pub"
];
services.openssh.hostKeys = [
{
path = "${state-dir}/ssh/ssh_host_rsa_key";
type = "rsa";
bits = 4096;
}
{
path = "${state-dir}/ssh/ssh_host_ed25519_key";
type = "ed25519";
bits = 4096;
}
];
environment.etc = {
"ssh/ssh_host_rsa_key" = {
source = "${state-dir}/ssh/ssh_host_rsa_key";
user = "root";
group = "root";
mode = "0400";
};
"ssh/ssh_host_rsa_key.pub" = {
source = "${state-dir}/ssh/ssh_host_rsa_key.pub";
user = "root";
group = "root";
mode = "0444";
};
"ssh/ssh_host_ed25519_key" = {
source = "${state-dir}/ssh/ssh_host_ed25519_key";
user = "root";
group = "root";
mode = "0400";
};
"ssh/ssh_host_ed25519_key.pub" = {
source = "${state-dir}/ssh/ssh_host_ed25519_key.pub";
user = "root";
group = "root";
mode = "0444";
};
nixos.source = "/etc/nixos-live";
"machine-id".source = "${state-dir}/host/machine-id";
"host-config.nix".source = "/state/host/host-config.nix";
adjtime.source = "/state/host/adjtime";
NIXOS.source = "/state/host/NIXOS";
};
fudo.ipfs = {
enable = true;
users = [ "niten" ];
api-address = "/ip4/0.0.0.0/tcp/5001";
};
security.sudo.extraConfig = ''
# Due to rollback, sudo will lecture after every reboot
Defaults lecture = never
'';
virtualisation = {
docker = {
enable = true;
enableOnBoot = true;
autoPrune = { enable = true; };
};
# virtualisation = {
# docker = {
# enable = true;
# enableOnBoot = true;
# autoPrune = { enable = true; };
# };
oci-containers = {
containers = {
shinobi = {
image = "shinobisystems/shinobi:latest";
ports = [ "${shinobi-port}:8080" ];
volumes = [
"/srv/shinobi/plugins:/home/Shinobi/plugins"
"/srv/shinobi/config:/home/Shinobi/config"
"/srv/shinobi/videos:/home/Shinobi/videos"
"/srv/shinobi/db-data:/var/lib/mysql"
"/etc/localtime:/etc/localtime:ro"
];
};
# oci-containers = {
# containers = {
# shinobi = {
# image = "shinobisystems/shinobi:latest";
# ports = [ "${shinobi-port}:8080" ];
# volumes = [
# "/state/shinobi/plugins:/home/Shinobi/plugins"
# "/state/shinobi/config:/home/Shinobi/config"
# "/state/shinobi/videos:/home/Shinobi/videos"
# "/state/shinobi/db-data:/var/lib/mysql"
# "/etc/localtime:/etc/localtime:ro"
# ];
# };
# shinobi-od = {
# image = "shinobisystems/shinobi-tensorflow:latest";
# volumes =
# [ "/srv/shinobi/od-config:/home/Shinobi/docker-plugins/tensorflow" ];
# ports = [ "${shinobi-od-port}:8082" ];
# environment = {
# PLUGIN_HOST = "panopticon.sea.fudo.org";
# PLUGIN_PORT = shinobi-port;
# PLUGIN_KEY = "30sWllylOxsDcE4vQXEPaXNfe5DiB3";
# };
# };
# # shinobi-od = {
# # image = "shinobisystems/shinobi-tensorflow:latest";
# # volumes =
# # [ "/srv/shinobi/od-config:/home/Shinobi/docker-plugins/tensorflow" ];
# # ports = [ "${shinobi-od-port}:8082" ];
# # environment = {
# # PLUGIN_HOST = "panopticon.sea.fudo.org";
# # PLUGIN_PORT = shinobi-port;
# # PLUGIN_KEY = "30sWllylOxsDcE4vQXEPaXNfe5DiB3";
# # };
# # };
# photoprism = { image = "photoprism/photoprism"; };
};
};
};
# # photoprism = { image = "photoprism/photoprism"; };
# };
# };
# };
services.nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
# services.nginx = {
# enable = true;
# recommendedGzipSettings = true;
# recommendedOptimisation = true;
# recommendedProxySettings = true;
virtualHosts = {
"panopticon.sea.fudo.org" = {
locations."/" = {
proxyPass = "http://localhost:${shinobi-port}";
extraConfig = ''
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";
'';
};
};
# "panopticon-od.sea.fudo.org" = {
# locations."/" = {
# proxyPass = "http://localhost:${shinobi-od-port}";
# extraConfig = ''
# proxy_http_version 1.1;
# proxy_set_header Upgrade $http_upgrade;
# proxy_set_header Connection "Upgrade";
# '';
# };
# };
};
};
# virtualHosts = {
# "panopticon.sea.fudo.org" = {
# locations."/" = {
# proxyPass = "http://localhost:${shinobi-port}";
# extraConfig = ''
# proxy_http_version 1.1;
# proxy_set_header Upgrade $http_upgrade;
# proxy_set_header Connection "Upgrade";
# proxy_set_header Host $host;
# proxy_set_header X-Real-IP $remote_addr;
# proxy_set_header X-Forwarded-By $server_addr:$server_port;
# proxy_set_header X-Forwarded-For $remote_addr;
# proxy_set_header X-Forwarded-Proto $scheme;
# '';
# };
# };
# # "panopticon-od.sea.fudo.org" = {
# # locations."/" = {
# # proxyPass = "http://localhost:${shinobi-od-port}";
# # extraConfig = ''
# # proxy_http_version 1.1;
# # proxy_set_header Upgrade $http_upgrade;
# # proxy_set_header Connection "Upgrade";
# # '';
# # };
# # };
# };
# };
}
config/host-config/limina.nix
+8 -5
View File
@@ -15,6 +15,8 @@ let
in {
config = {
boot.zfs.enableUnstable = true;
networking = {
interfaces = {
enp1s0 = { useDHCP = true; };
@@ -137,11 +139,12 @@ in {
NIXOS.source = "/state/etc/NIXOS";
machine-id.source = "/state/etc/machine-id";
"host-config.nix".source = "/state/etc/host-config.nix";
"krb5.keytab" = {
source = "/state/etc/limina.keytab";
user = "root";
mode = "0400";
};
## This should be handled by nixops deploy
# "krb5.keytab" = {
# source = "/state/etc/limina.keytab";
# user = "root";
# mode = "0400";
# };
};
boot.initrd.postDeviceCommands = lib.mkAfter ''
config/host-config/nostromo.nix
+6
View File
@@ -37,6 +37,12 @@ in {
# };
# };
fudo.ipfs = {
enable = true;
users = [ "niten" ];
api-address = "/ip4/0.0.0.0/tcp/5001";
};
virtualisation = {
libvirtd = {
enable = true;
config/host-config/plato.nix
+4
View File
@@ -6,6 +6,10 @@ let primary-ip = "10.0.0.21";
in {
config = {
boot.kernelParams = [ "nomodeset" ];
console.font = "VGA";
fudo.secrets = {
host-secrets.plato = {
host-keytab = {
config/hosts/lambda.nix
+7 -6
View File
@@ -1,11 +1,11 @@
{
description = "sea.fudo.org experiment server.";
docker-server = true;
docker-server = false;
ssh-fingerprints = [
"1 1 128919958a358d44d1c8d76d29b1fa1514f9ad35"
"1 2 cd0ae0bb7e65f4058efdb2d7073de97ac403b1ef6f1527a23c60390d9a6bad88"
"4 1 a689caa9f1e75c6378efed592bc0d623e4b7d199"
"4 2 5856ae661077203fba74a226dd77a17d69d6fda8ab960bfeb22a14c253f4472f"
"1 1 01c67478e2cc7a386a2468adb9d4627a53d69af5"
"1 2 750bc70f88a6c774077f20603a143b9f07436d9d074af78875850ae4df8971eb"
"4 1 fdb3da40dc48540a3f5644e360db9225a584f64e"
"4 2 310115023c1f98ae88ac94eb38dd529352f3036048d72c87e87c0ab53f186438"
];
rp = "niten";
admin-email = "niten@fudo.org";
@@ -13,5 +13,6 @@
site = "seattle";
profile = "server";
ssh-pubkey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILvgQsinDcoBZzneroy0QsCJUdiT8KdcI0YKWbSc++w8";
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPB5JY6jnHCRLxjqWKYkK8Xpmfyq2nA+0noPazYGd9a+";
enable-gui = false;
}
config/profile-config/common-ui.nix
+13 -6
View File
@@ -18,13 +18,14 @@ in {
];
};
system = { autoUpgrade.enable = true; };
# We're deploying via nixops, this is just annoying
system = { autoUpgrade.enable = false; };
services = {
xserver = mkIf enable-gui {
enable = true;
desktopManager.gnome3.enable = true;
desktopManager.gnome.enable = true;
displayManager.gdm = {
enable = true;
@@ -56,26 +57,32 @@ in {
bluetooth.enable = true;
opengl = mkIf enable-gui {
enable = true;
driSupport = true;
driSupport32Bit = true;
};
};
sound.enable = true;
hardware.pulseaudio.enable = true;
hardware.pulseaudio = {
enable = true;
support32Bit = config.hardware.pulseaudio.enable;
};
console.font =
lib.mkDefault "${pkgs.terminus_font}/share/consolefonts/ter-g18n.psf.gz";
services.gnome3 = mkIf enable-gui {
services.gnome = mkIf enable-gui {
evolution-data-server.enable = mkForce false;
gnome-user-share.enable = mkForce false;
};
programs.steam.enable = enable-gui;
services.flatpak.enable = enable-gui;
# programs.steam.enable = enable-gui;
fonts = mkIf enable-gui {
enableFontDir = true;
fontDir.enable = true;
fontconfig.enable = true;
#fontconfig.antialias = true;
#fontconfig.penultimate.enable = true;
config/profile-config/common.nix
+2 -3
View File
@@ -15,7 +15,7 @@ let
in {
environment = {
etc.current-nixos-config.source = ../../.;
etc.nixos-live.source = ../../.;
systemPackages = global-packages;
@@ -28,6 +28,7 @@ in {
# TODO: remove?
nixpkgs.config.permittedInsecurePackages = [
"openssh-with-gssapi-8.4p1" # CVE-2021-28041
"zfs-kernel"
];
nixpkgs.config.allowUnfree = true;
@@ -135,6 +136,4 @@ in {
};
};
};
services.dbus.socketActivated = true;
}
config/profile-config/server.nix
-2
View File
@@ -50,8 +50,6 @@ in {
system.autoUpgrade.enable = false;
security = { hideProcessInformation = true; };
networking.networkmanager.enable = mkForce false;
services = {
config/site-config/seattle.nix
+15 -10
View File
@@ -1,24 +1,27 @@
{ config, lib, pkgs, ... }:
let
local-domain = "sea.fudo.org";
let local-domain = "sea.fudo.org";
in {
fileSystems = {
"/mnt/documents" = {
device = "whitedwarf.${local-domain}:/volume1/Documents";
fsType = "nfs4";
options = [ "comment=systemd.automount" ];
};
"/mnt/downloads" = {
device = "whitedwarf.${local-domain}:/volume1/Downloads";
fsType = "nfs4";
options = [ "comment=systemd.automount" ];
};
"/mnt/music" = {
device = "doraemon.${local-domain}:/volume1/Music";
fsType = "nfs4";
options = [ "comment=systemd.automount" ];
};
"/mnt/video" = {
device = "doraemon.${local-domain}:/volume1/Video";
fsType = "nfs4";
options = [ "comment=systemd.automount" ];
};
# fileSystems."/mnt/security" = {
# device = "panopticon.${local-domain}:/srv/kerberos/data";
@@ -27,24 +30,26 @@ in {
"/mnt/cargo_video" = {
device = "cargo.${local-domain}:/volume1/video";
fsType = "nfs4";
options = [ "comment=systemd.automount" ];
};
"/mnt/photo" = {
device = "cargo.${local-domain}:/volume1/pictures";
fsType = "nfs4";
options = [ "comment=systemd.automount" ];
};
};
services.printing = {
enable = true;
drivers = [
pkgs.brlaser
pkgs.brgenml1lpr
pkgs.brgenml1cupswrapper
pkgs.hll2380dw-cups
# pkgs.brlaser
# pkgs.brgenml1lpr
# pkgs.brgenml1cupswrapper
# pkgs.hll2380dw-cups
# pkgs.hll2380dw-lpr
];
};
environment.systemPackages = with pkgs; [
hll2380dw-cups
];
environment.systemPackages = with pkgs; [ hll2380dw-cups ];
}
config/sites.nix
+1 -1
View File
@@ -21,7 +21,7 @@
speed-factor = 2;
};
};
enable-distributed-builds = true;
enable-distributed-builds = false;
keytab-directory = "/state/secrets/kerberos";
# FIXME: good idea?
# network-mounts = {