Strip down nostromo for nixops deploy & new config
This commit is contained in:
parent
353936d509
commit
735b44eb7a
@ -46,11 +46,6 @@
|
||||
interface = "eno1";
|
||||
mode = "bridge";
|
||||
};
|
||||
|
||||
extif0 = {
|
||||
interface = "eno2";
|
||||
mode = "bridge";
|
||||
};
|
||||
};
|
||||
|
||||
interfaces = {
|
||||
@ -58,11 +53,6 @@
|
||||
# output of: echo nostromo-intif0|md5sum|sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:\1:\2:\3:\4:\5/'
|
||||
macAddress = "02:14:25:55:ee:5a";
|
||||
};
|
||||
|
||||
extif0 = {
|
||||
# echo nostromo-extif0|md5sum|sed 's/^\(..\)\(..\)\(..\)\(..\)\(..\).*$/02:\1:\2:\3:\4:\5/'
|
||||
macAddress = "02:cf:d7:de:f9:ad";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@ -163,6 +163,8 @@ in {
|
||||
|
||||
security.acme.certs."sea-camera.fudo.link".email = "niten@fudo.org";
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
services = {
|
||||
nginx = {
|
||||
enable = true;
|
||||
|
||||
@ -1,41 +1,8 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
primary-ip = "10.0.0.1";
|
||||
dns-proxy-ip = "10.0.0.5";
|
||||
|
||||
in {
|
||||
fudo.local-network = let
|
||||
hostname = config.instance.hostname;
|
||||
site-name = config.fudo.hosts.${hostname}.site;
|
||||
site = config.fudo.site.${site-name};
|
||||
|
||||
in {
|
||||
enable = true;
|
||||
dns-servers = site.dns-servers;
|
||||
gateway = site.gateway;
|
||||
dhcp-interfaces = [ "intif0" ];
|
||||
dns-serve-ips = [ primary-ip "127.0.0.1" "127.0.1.1" "::1" ];
|
||||
recursive-resolver = "${primary-ip} port 5353";
|
||||
server-ip = primary-ip;
|
||||
};
|
||||
|
||||
fudo.slynk.enable = true;
|
||||
|
||||
# systemd.network.networks.eno2 = {
|
||||
# extraConfig = {
|
||||
# IPv6AcceptRA = true;
|
||||
# IPv6PrefixDelegation = "dhcpv6";
|
||||
# };
|
||||
# };
|
||||
with lib; {
|
||||
|
||||
networking = {
|
||||
# dhcpd.extraConfig = ''
|
||||
# interface eno2
|
||||
# ia_na 1
|
||||
# ia_pd 2 eno2/0
|
||||
# '';
|
||||
|
||||
eno1.useDHCP = false;
|
||||
eno2.useDHCP = false;
|
||||
eno3.useDHCP = false;
|
||||
@ -45,125 +12,32 @@ in {
|
||||
enp9s0f0.useDHCP = false;
|
||||
enp9s0f1.useDHCP = false;
|
||||
|
||||
intif0 = {
|
||||
useDHCP = false;
|
||||
ipv4.addresses = [
|
||||
{
|
||||
address = primary-ip;
|
||||
prefixLength = 22;
|
||||
}
|
||||
{
|
||||
address = dns-proxy-ip;
|
||||
prefixLength = 32;
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
extif0 = { useDHCP = true; };
|
||||
|
||||
nat = {
|
||||
enable = true;
|
||||
externalInterface = "extif0";
|
||||
internalInterfaces = [ "intif0" ];
|
||||
};
|
||||
intif0 = { useDHCP = true; };
|
||||
};
|
||||
|
||||
fudo = {
|
||||
secrets.backplane-client-nostromo-passwd = {
|
||||
source-file = /srv/secrets/backplane-client/nostromo.passwd;
|
||||
target-file = "/srv/backplane/dns/client.passwd";
|
||||
target-host = "nostromo";
|
||||
user = config.fudo.client.dns.user;
|
||||
};
|
||||
|
||||
client.dns = {
|
||||
enable = true;
|
||||
ipv4 = true;
|
||||
ipv4 = false;
|
||||
ipv6 = true;
|
||||
user = "fudo-client";
|
||||
external-interface = "extif0";
|
||||
password-file = "/srv/client/secure/client.passwd";
|
||||
};
|
||||
|
||||
secure-dns-proxy = {
|
||||
enable = true;
|
||||
port = 3535;
|
||||
upstream-dns =
|
||||
[ "https://1.1.1.1/dns-query" "https://1.0.0.1/dns-query" ];
|
||||
bootstrap-dns = "1.1.1.1";
|
||||
listen-ips = [ dns-proxy-ip ];
|
||||
};
|
||||
};
|
||||
|
||||
virtualization = {
|
||||
docker = {
|
||||
enable = true;
|
||||
autoPrune.enable = true;
|
||||
enableOnBoot = true;
|
||||
};
|
||||
|
||||
libvirtd = {
|
||||
enable = true;
|
||||
qemuPackage = pkgs.qemu_kvm;
|
||||
onShutdown = "shutdown";
|
||||
};
|
||||
};
|
||||
|
||||
docker-containers = {
|
||||
pihole = {
|
||||
image = "pihole/pihole:4.3.2-1";
|
||||
ports = [ "5353:53/tcp" "5353:53/udp" "3080:80/tcp" ];
|
||||
environment = {
|
||||
ServerIP = primary-ip;
|
||||
VIRTUAL_HOST = "dns-hole.sea.fudo.org";
|
||||
DNS1 = dns-proxy-ip;
|
||||
};
|
||||
volumes = [
|
||||
"/srv/pihole/etc-pihole/:/etc/pihole/"
|
||||
"/srv/pihole/etc-dnsmasq.d/:/etc/dnsmasq.d/"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
security.acme.certs = {
|
||||
"sea-camera.fudo.link".email = "niten@fudo.org";
|
||||
"sea-camera-od.fudo.link".email = "niten@fudo.org";
|
||||
};
|
||||
|
||||
services = {
|
||||
nginx = {
|
||||
enable = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedProxySettings = true;
|
||||
|
||||
virtualHosts = {
|
||||
"sea-camera.fudo.link" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://panopticon.sea.fudo.org/";
|
||||
extraConfig = ''
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "Upgrade";
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# Supposed to be for object detection...
|
||||
"sea-camera-od.fudo.link" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://panopticon-od.sea.fudo.org/";
|
||||
extraConfig = ''
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection "Upgrade";
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
"pihole.sea.fudo.org" = {
|
||||
serverAliases = [ "dns-hole.sea.fudo.org" "hole.sea.fudo.org" ];
|
||||
locations."/" = { proxyPass = "http://127.0.0.1:3000"; };
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
@ -71,13 +71,22 @@ in {
|
||||
fudo = {
|
||||
hosts.procul.external-interfaces = [ "extif0" ];
|
||||
|
||||
secrets = {
|
||||
backplane-client-limina-passwd = {
|
||||
source-file = /srv/secrets/backplane-client/procul.passwd;
|
||||
target-file = "/srv/backplane/dns/client.passwd";
|
||||
target-host = "procul";
|
||||
user = config.fudo.client.dns.user;
|
||||
};
|
||||
};
|
||||
|
||||
client.dns = {
|
||||
enable = true;
|
||||
ipv4 = true;
|
||||
ipv6 = true;
|
||||
user = "fudo-client";
|
||||
external-interface = "extif0";
|
||||
password-file = "/srv/client/secure/client.passwd";
|
||||
password-file = "/srv/backplane/dns/client.passwd";
|
||||
};
|
||||
|
||||
auth.kdc = {
|
||||
@ -152,27 +161,21 @@ in {
|
||||
};
|
||||
|
||||
# This should NOT include the primary domain
|
||||
local-domains = [
|
||||
host-fqdn
|
||||
"smtp.${domain}"
|
||||
];
|
||||
local-domains = [ host-fqdn "smtp.${domain}" ];
|
||||
|
||||
mail-directory = "/srv/mailserver/mail";
|
||||
state-directory = "/srv/mailserver/state";
|
||||
|
||||
trusted-networks = [
|
||||
"172.86.179.16/29"
|
||||
"127.0.0.0/16"
|
||||
];
|
||||
trusted-networks = [ "172.86.179.16/29" "127.0.0.0/16" ];
|
||||
|
||||
alias-users = {
|
||||
root = ["niten"];
|
||||
postmaster = ["niten"];
|
||||
hostmaster = ["niten"];
|
||||
webmaster = ["niten"];
|
||||
system = ["niten"];
|
||||
admin = ["niten"];
|
||||
dmarc-report = ["niten"];
|
||||
root = [ "niten" ];
|
||||
postmaster = [ "niten" ];
|
||||
hostmaster = [ "niten" ];
|
||||
webmaster = [ "niten" ];
|
||||
system = [ "niten" ];
|
||||
admin = [ "niten" ];
|
||||
dmarc-report = [ "niten" ];
|
||||
};
|
||||
};
|
||||
|
||||
@ -206,7 +209,6 @@ in {
|
||||
hostname = "git.informis.land";
|
||||
site-name = "informis git";
|
||||
user = "gituser";
|
||||
# admin-email = "viator@informis.land";
|
||||
repository-dir = /srv/git/repo;
|
||||
state-dir = /srv/git/state;
|
||||
database = {
|
||||
|
||||
@ -12,4 +12,6 @@
|
||||
domain = "sea.fudo.org";
|
||||
site = "seattle";
|
||||
profile = "server";
|
||||
ssh-pubkey =
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILvgQsinDcoBZzneroy0QsCJUdiT8KdcI0YKWbSc++w8";
|
||||
}
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
{
|
||||
description = "sea.fudo.org gateway box and primary server.";
|
||||
description = "sea.fudo.org primary server.";
|
||||
docker-server = true;
|
||||
ssh-fingerprints = [
|
||||
"1 1 075ee0ae86debffa6fd61436984b39e4699c93c6"
|
||||
|
||||
@ -35,12 +35,15 @@ let
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStartPre = pkgs.writeShellScript "prepare-secrets-dir.sh" ''
|
||||
ExecStartPre = pkgs.writeShellScript "prepare-${name}-secret-dir.sh" ''
|
||||
TARGET_DIR=$(dirname ${target-file})
|
||||
if [[ ! -d "$TARGET_DIR" ]]; then
|
||||
mkdir -p "$TARGET_DIR"
|
||||
fi
|
||||
'';
|
||||
ExecStop = pkgs.writeShellScript "clear-${name}-secret.sh" ''
|
||||
rm -f ${target-file}
|
||||
'';
|
||||
ExecStart = let
|
||||
decrypt-keys =
|
||||
filter (key: key.type == key-type) config.services.openssh.hostKeys;
|
||||
|
||||
@ -10,6 +10,7 @@ in {
|
||||
|
||||
limina = define-host "10.0.0.1" "limina";
|
||||
lambda = define-host "10.0.0.11" "lambda";
|
||||
nostromo = define-host "10.0.0.10" "nostromo";
|
||||
plato = define-host "10.0.0.21" "plato";
|
||||
spark = define-host "10.0.0.108" "spark";
|
||||
zbox = define-host "10.0.0.110" "zbox";
|
||||
|
||||
Loading…
Reference in New Issue
Block a user