i don't know if this should be used

Since only passing though the ssh dir doesn't work, the host would be polluted by all the other hosts writing to etc

doc/src/anleitung/microvm.md

@@ -44,6 +44,9 @@ sudo mkdir -p /var/lib/microvms/durruti/{var,etc}
 # alternatively u can run the vm in interactive mode (maybe stop the microvm@durruti.service first)
 microvm -r durruti
 
+#if you get an error like "Error booting VM: VmBoot(DeviceManager(CreateVirtioFs(VhostUserConnect)))", try starting the virtio service manually
+sudo systemctl start microvm-virtiofsd@{host}.service
+
 # after u made changes to the microvm update and restart the vm 
 microvm -uR durruti
 

machines/.sops.yaml

@@ -66,3 +66,10 @@ creation_rules:
       - *admin_kalipso_dsktp
       age:
       - *admin_atlan
+  - path_regex: bakunin/disk.key
+    key_groups:
+    - pgp:
+      - *admin_kalipso
+      - *admin_kalipso_dsktp
+      age:
+      - *admin_atlan

machines/bakunin/configuration.nix

@@ -1,5 +1,8 @@
-{ config, pkgs, ... }:
+{ config, pkgs, inputs, ... }:
 
+let
+  sshKeys = import ../ssh_keys.nix;
+in
 {
   imports =
     [ # Include the results of the hardware scan.
@@ -9,6 +12,8 @@
       ../modules/sshd.nix
       ../modules/minimal_tools.nix
       ../modules/autoupdate.nix
+      inputs.self.nixosModules.malobeo.disko
+      inputs.self.nixosModules.malobeo.initssh
     ];
 
   malobeo.autoUpdate = {
@@ -19,7 +24,19 @@
     cacheurl = "https://cache.dynamicdiscord.de";
   };
 
-  boot.loader.systemd-boot.enable = true;
+  malobeo.disks = {
+    enable = true;
+    hostId = "a3c3102f";
+    root = {
+      disk0 = "disk/by-id/ata-HITACHI_HTS725016A9A364_110308PCKB04VNHX9XTJ";
+    };
+  };
+
+  malobeo.initssh = {
+    enable = true;
+    authorizedKeys = sshKeys.admins;
+    ethernetDrivers = ["r8169"];
+  };
 
   hardware.sane.enable = true; #scanner support
 

machines/bakunin/disk.key

@@ -0,0 +1,31 @@
+{
+	"data": "ENC[AES256_GCM,data:2/tfkG7SwWNpnqgkFkmUqbAJBF2eN/lfZCK/9VsZag==,iv:Sps+ZIQGveS/zumjVE8VFfVTlNwQJ093eMDndlne2nU=,tag:lW8xcz43jj1XPV6M/0e11g==,type:str]",
+	"sops": {
+		"kms": null,
+		"gcp_kms": null,
+		"azure_kv": null,
+		"hc_vault": null,
+		"age": [
+			{
+				"recipient": "age1ljpdczmg5ctqyeezn739hv589fwhssjjnuqf7276fqun6kc62v3qmhkd0c",
+				"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRU003cys0d0d4MXFmVVVH\ndDg1eHZpVjFMeDBGL3JQcjB5a0luSVRaSWtnCmxNOEUyZ2oybkNLdm12ZTVmNUpo\nVCtUem44bXA2dGhURGdyRWxKdUF6OVkKLS0tIDdVbUt2eGVHMHBzOEt6QnRpOXZF\nVWFEUFloRXpIUGJxblpaNUNuTjlLbDQKQii2qUIl72d02D3P0oTDHZQT1srSk6jS\n89XSBy6ND9vP0tGXcZ4a7jghO0Q1OVNe1fm6Ez41lKOuUu77hgOAWg==\n-----END AGE ENCRYPTED FILE-----\n"
+			}
+		],
+		"lastmodified": "2025-01-14T16:40:57Z",
+		"mac": "ENC[AES256_GCM,data:M8l4a2SbBikF/tEtGx4ZY13eK3ffM70aUCDYo4ljgTAtQEbGLx1SJM/mrFW325LycFMNOerWhXyipbXPZPw2VfnSJ9dz+bQ53xK7Mpf/bOZs5aQZJpJ1/MJh6lkmR/zPeQXhE08WsyJ1rCRqAfygau2CqdV8ujY5li3jIIDQMcQ=,iv:lJZhTjJAxSky9MrzYldkJOG0dCIzkv4IE3ZKzxgUxvo=,tag:t/grczWX+0sDcsHC5SCd/A==,type:str]",
+		"pgp": [
+			{
+				"created_at": "2025-01-14T16:40:08Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQGMA5HdvEwzh/H7AQv/S6LvVBsznEqLZbT/UAom1KmfmA3swxAJnQ5tl/vnnix6\nvzs4KSFGZMOQZihEKC/M/og8qTCvlUFBAUMkYLgX+8ehZeZwnnH9V8EDGDIyoWXE\n6AIHP9Ur6yk62gHqmfHlMxFG2A9/A4a+mOvxyKKPDK/AYG0PBaSVMkM6cp7efWwe\n7C6m4BpPRU+3NsNKy/4FkWt9xoFy82K89FqUGC8oZOQW1q+fS7ZIhmnTzzApwILy\n5Y77yBnpPECDYNZdH097bZli6KGWob7aXJ431gyw2OMVQHFb0DlQbKxemo9eWpIr\nnXu2FYrY2D7YxXBGQvXTuNQD3BuvrccOgWAmmi852C1gVVKV+egeOBRq2RYPl6+j\n8TBaNzl0rcvaoWeTJGR142pR9ht9B3aGzXcvCsciZo3SjYyt31J0huzPfv4Dakfn\nyY8BvOaNfugjx0aS6BOZgZiOPlBer86/0FKX469QQAnqL0LRoPyjn53JYUdPdI+s\nCI2WuVynSl7ItiwoKkJK0lgBm0oMhpSiGOC4Z2Bkk2xdpiuXUdMcP6m8OlG9ldCs\n0KrWubh9Ne6CP7etvTkwqWvMuSpCuheToIQ0rp8j21/YdCFX5LpxA3+em0t9M7Is\nV4ZoLnqA2KjI\n=4+Yl\n-----END PGP MESSAGE-----",
+				"fp": "c4639370c41133a738f643a591ddbc4c3387f1fb"
+			},
+			{
+				"created_at": "2025-01-14T16:40:08Z",
+				"enc": "-----BEGIN PGP MESSAGE-----\n\nhQIMA98TrrsQEbXUAQ//c/UkuZRpJM5sH1snP8Kidek6nHgC11hUaY1G15a5ap1D\nn9cMIn4xUdfCAN/DoNiE14NzeTDQyawmIV1ZmrYZzItFdNgunf1r9jQNa3EqcWfE\norJS2RwWDrsw7tmx0wyenr9BLefMGJYaJ6Rd7J3j8sXL7aT+SbNw27mmVbYrJiFJ\nYh2usIsxDu2C+dCeTb3J9sKK6F96IbNnj/2Sx8AGYsIQvcpwloCRrnjiEa+hrEBn\nj1I6U4B/NjRGv20PAR1OnQ2OhKVL5UgTJgNKWCLdvGVOQnqJgDNUrrNEBY19wDQL\nQzJEzL21aiyF+8BB3IrtQlntmAIMcUUHTpqIols9rpVJl54yiK1mQ3UqTQPQ2+gd\nu2gtjXXk3FMnVzaI33ZMcxENGHy/+ZdZMfY70/EwJpRvneHTsLr3Z/bHUxavSYdL\nQqbeWLUm7a2/pnOl5JKa9asKYaNBNdmzO/YVgQNhLQzFtHJ9riVN7Ro+S2bocN9Z\npHGCCISAdMDyuFC7aSngnZEwE4NACbQEc8Udu+YCAUIeeBaPI/QWu3n61fZrkxR7\nmik9uJdXnMzKpmNGVQbPurifykDA6Bsqakn69AZQIPyxMtEDBV+pDX0yy3tI5D12\nhksuXSC7fpV/4BsZWKczK9fpDUJMDTFajSSVrSKb4nr2hk49IAZX9rhgbiHmT1LS\nWAHa5YGYUMkVQc59J3uhAjuSckWA/7R7oMhIrL5e/vnnHVR5zFW/auHkDytzZ0d0\nbGdrIRZh81C+yxB1pSJvlUnIWbYnpqhaH3xL+8yARpGZMNi595x0EJM=\n=8puy\n-----END PGP MESSAGE-----",
+				"fp": "aef8d6c7e4761fc297cda833df13aebb1011b5d4"
+			}
+		],
+		"unencrypted_suffix": "_unencrypted",
+		"version": "3.9.2"
+	}
+}

machines/configuration.nix

@@ -56,11 +56,11 @@ let
             socket = "store.socket";
           }
           {
-            source = "/var/lib/microvms/${hostName}/etc";
+            source = "/var/lib/microvms/test/etc/";
             mountPoint = "/etc";
-            tag = "etc";
+            tag = "etcssh";
             proto = "virtiofs";
-            socket = "etc.socket";
+            socket = "etcssh.socket";
           }
           {
             source = "/var/lib/microvms/${hostName}/var";
@@ -93,6 +93,8 @@ let
       };
     }
   ] ++ defaultModules ++ modules;
+
+  inputsMod = inputs // { malobeo = self; };
 in
 {
   louise = nixosSystem {
@@ -109,13 +111,21 @@ in
     modules = defaultModules ++ [
       ./bakunin/configuration.nix
       inputs.disko.nixosModules.disko
-      ./modules/disko/btrfs-laptop.nix
+    ];
+  };
+
+  lucia = nixosSystem {
+    system = "aarch64-linux";
+    specialArgs.inputs = inputs;
+    modules = defaultModules ++ [
+      ./lucia/configuration.nix
+      ./lucia/hardware_configuration.nix
     ];
   };
 
   fanny = nixosSystem {
     system = "x86_64-linux";
-    specialArgs.inputs = inputs;
+    specialArgs.inputs = inputsMod;
     modules = defaultModules ++ [
       self.nixosModules.malobeo.vpn
       ./fanny/configuration.nix
@@ -141,12 +151,22 @@ in
     ];
   };
 
-  lucia = nixosSystem {
+  infradocs = nixosSystem {
-    system = "aarch64-linux";
+    system = "x86_64-linux";
     specialArgs.inputs = inputs;
-    modules = defaultModules ++ [
+    specialArgs.self = self;
-      ./lucia/configuration.nix
+    modules = makeMicroVM "infradocs" "10.0.0.11" "D0:E5:CA:F0:D7:E7" [
-      ./lucia/hardware_configuration.nix
+      self.nixosModules.malobeo.vpn
+      ./infradocs/configuration.nix
+    ];
+  };
+
+  uptimekuma = nixosSystem {
+    system = "x86_64-linux";
+    specialArgs.inputs = inputs;
+    specialArgs.self = self;
+    modules = makeMicroVM "uptimekuma" "10.0.0.12" "D0:E5:CA:F0:D7:E8" [
+      ./uptimekuma/configuration.nix
     ];
   };
 

machines/durruti/documentation.nix

@@ -8,6 +8,15 @@
         { addr = "0.0.0.0"; port = 9000; } 
       ];
       root = "${self.packages.x86_64-linux.docs}/share/doc";
+      extraConfig = ''
+        proxy_buffering off;
+        proxy_cache off;
+        proxy_http_version 1.1; 
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+      '';
     };
   };
 

machines/durruti/host_config.nix

@@ -36,7 +36,21 @@ in
     services.nginx.virtualHosts."docs.malobeo.org" = {
       forceSSL = true;
       enableACME= true;
-      locations."/".proxyPass = "http://${cfg.host_ip}:9000";
+      locations."/" = {
+        proxyPass = "http://10.0.0.10";
+        extraConfig = ''
+        '';
+      };
+    };
+
+    services.nginx.virtualHosts."status.malobeo.org" = {
+      forceSSL = true;
+      enableACME= true;
+      locations."/" = {
+        proxyPass = "http://10.0.0.12";
+        extraConfig = ''
+        '';
+      };
     };
 
     services.nginx.virtualHosts."tasklist.malobeo.org" = {

machines/fanny/configuration.nix

@@ -15,6 +15,7 @@ in
       ../modules/autoupdate.nix
       inputs.self.nixosModules.malobeo.initssh
       inputs.self.nixosModules.malobeo.disko
+      inputs.self.nixosModules.malobeo.microvm
     ];
 
   malobeo.autoUpdate = {
@@ -47,10 +48,30 @@ in
 
   services.malobeo.vpn = {
     enable = true;
-    name = "vpn";
+    name = "fanny";
     privateKeyFile = config.sops.secrets.wg_private.path;
   };
 
+  services.malobeo.microvm.enableHostBridge = true;
+  services.malobeo.microvm.deployHosts = [ "infradocs" ];
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [ 80 ];
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."docs.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://10.0.0.11:9000";
+        extraConfig = ''
+        '';
+      };
+    };
+  };
+
   services.tor = {
     enable = true;
     client.enable = true;

machines/infradocs/configuration.nix

@@ -0,0 +1,20 @@
+{ config, lib, pkgs, inputs, ... }:
+
+with lib;
+
+{
+  networking = {
+    hostName = mkDefault "infradocs";
+    useDHCP = false;
+    nameservers = [ "1.1.1.1" ];
+  };
+
+  imports = [
+    ../durruti/documentation.nix
+    ../modules/malobeo_user.nix
+    ../modules/sshd.nix
+  ];
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+

machines/modules/malobeo/peers.nix

@@ -6,33 +6,34 @@
     allowedIPs = [ "10.100.0.0/24" ];
     listenPort = 51821;
     publicKey = "hF9H10Y8Ar7zvZXFoNM8LSoaYFgPCXv30c54SSEucX4=";
+    persistentKeepalive = 25;
   };
 
   "celine" = {
     role = "client";
     address = [ "10.100.0.2/24" ];
-    allowedIPs = [ "10.100.0.0/24" ];
+    allowedIPs = [ "10.100.0.2/32" ];
     publicKey = "Jgx82tSOmZJS4sm1o8Eci9ahaQdQir2PLq9dBqsWZw4=";
   };
 
   "desktop" = {
     role = "client";
     address = [ "10.100.0.3/24" ];
-    allowedIPs = [ "10.100.0.0/24" ];
+    allowedIPs = [ "10.100.0.3/32" ];
     publicKey = "FtY2lcdWcw+nvtydOOUDyaeh/xkaqHA8y9GXzqU0Am0=";
   };
 
   "atlan-pc" = {
     role = "client";
     address = [ "10.100.0.5/24" ];
-    allowedIPs = [ "10.100.0.0/24" ];
+    allowedIPs = [ "10.100.0.5/32" ];
     publicKey = "TrJ4UAF//zXdaLwZudI78L+rTC36zEDodTDOWNS4Y1Y=";
   };
 
   "fanny" = {
     role = "client";
     address = [ "10.100.0.101/24" ];
-    allowedIPs = [ "10.100.0.0/24" ];
+    allowedIPs = [ "10.100.0.101/32" ];
     publicKey = "3U59F6T1s/1LaZBIa6wB0qsVuO6pRR9jfYZJIH2piAU=";
   };
 }

machines/modules/malobeo/wireguard.nix

@@ -64,9 +64,12 @@ in
       }
     ];
     
+    boot.kernel.sysctl."net.ipv4.ip_forward" = mkIf (myPeer.role == "server") 1;
+
     networking.wg-quick = {
       interfaces = {
         malovpn = {
+          mtu = 1340; #seems to be necessary to proxypass nginx traffic through vpn
           address = myPeer.address;
           autostart = cfg.autostart;
           listenPort = mkIf (myPeer.role == "server") myPeer.listenPort;

machines/uptimekuma/configuration.nix

@@ -0,0 +1,37 @@
+{ config, lib, pkgs, inputs, ... }:
+
+with lib;
+
+{
+  networking = {
+    hostName = mkDefault "uptimekuma";
+    useDHCP = false;
+    nameservers = [ "1.1.1.1" ];
+  };
+
+  imports = [
+    ../modules/malobeo_user.nix
+    ../modules/sshd.nix
+  ];
+
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."status.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:3001";
+        extraConfig = ''
+        '';
+      };
+
+    };
+  };
+
+  services.uptime-kuma = {
+    enable = true;
+  };
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+

machines/vpn/configuration.nix

@@ -12,6 +12,7 @@ with lib;
     nameservers = [ "1.1.1.1" ];
     firewall = {
       allowedUDPPorts = [ 51821 ];
+      allowedTCPPorts = [ 80 ];
     };
   };
 
@@ -27,6 +28,18 @@ with lib;
     privateKeyFile = config.sops.secrets.wg_private.path;
   };
 
+  services.nginx = {
+    enable = true;
+    virtualHosts."docs.malobeo.org" = {
+      locations."/" = {
+        proxyPass = "http://10.100.0.101";
+        extraConfig = ''
+        '';
+      };
+
+    };
+  };
+
   system.stateVersion = "22.11"; # Did you read the comment?
 }