Compare commits
9 Commits
gitea
...
9b88fa6315
| Author | SHA1 | Date | |
|---|---|---|---|
| 9b88fa6315 | |||
| 5eaceb77a1 | |||
|
d958f3efc0 | ||
| f5d36e666d | |||
| c8d7112f58 | |||
| 2a8fa5fb20 | |||
|
|
88c08d1346 | ||
|
|
7458b66c52 | ||
|
|
fae8035597 |
@@ -13,5 +13,4 @@
|
||||
- [TODO](./todo.md)
|
||||
- [How-to]()
|
||||
- [Updates](./anleitung/updates.md)
|
||||
- [Rollbacks](./anleitung/rollback.md)
|
||||
- [MicroVM](./anleitung/microvm.md)
|
||||
- [Rollbacks](./anleitung/rollback.md)
|
||||
@@ -1,39 +0,0 @@
|
||||
### Declaring a MicroVM
|
||||
|
||||
The hosts nixosSystems modules should be declared using the ```makeMicroVM``` helper function.
|
||||
Use durruti as orientation:
|
||||
``` nix
|
||||
modules = makeMicroVM "durruti" "10.0.0.5" [
|
||||
./durruti/configuration.nix
|
||||
];
|
||||
```
|
||||
|
||||
"durruti" is the hostname.
|
||||
"10.0.0.5" is the IP assigned to its tap interface.
|
||||
|
||||
### Testing MicroVMs locally
|
||||
MicroVMs can be built and run easily on your local host.
|
||||
For durruti this is done by:
|
||||
``` bash
|
||||
sudo nix run .\#nixosConfigurations.durruti.config.microvm.declaredRunner
|
||||
```
|
||||
|
||||
It seems to be necessary to run this as root so that the according tap interface can be created.
|
||||
To be able to ping the VM or give Internet Access to the VM your host needs to be setup as described below.
|
||||
|
||||
### Host Setup
|
||||
To provide network access to the VMs a bridge interface needs to be created on your host.
|
||||
For that:
|
||||
- Add the infrastructure flake as input to your hosts flake
|
||||
- Add ```inputs.malobeo.nixosModules.malobeo``` to your hosts imports
|
||||
- enable the host bridge: ```services.malobeo.microvm.enableHostBridge = true;```
|
||||
|
||||
If you want to provide Internet access to the VM it is necessary to create a nat.
|
||||
This could be done like this:
|
||||
``` nix
|
||||
networking.nat = {
|
||||
enable = true;
|
||||
internalInterfaces = [ "microvm" ];
|
||||
externalInterface = "eth0"; #change to your interface name
|
||||
};
|
||||
```
|
||||
104
flake.lock
generated
104
flake.lock
generated
@@ -21,24 +21,6 @@
|
||||
"url": "https://git.dynamicdiscord.de/kalipso/ep3-bs.nix"
|
||||
}
|
||||
},
|
||||
"flake-utils": {
|
||||
"inputs": {
|
||||
"systems": "systems_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1726560853,
|
||||
"narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -79,28 +61,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"microvm": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"spectrum": "spectrum"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1731240174,
|
||||
"narHash": "sha256-HYu+bPoV3UILhwc4Ar5iQ7aF+DuQWHXl4mljN6Bwq6A=",
|
||||
"owner": "astro",
|
||||
"repo": "microvm.nix",
|
||||
"rev": "dd89404e1885b8d7033106f3898eaef8db660cb2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "astro",
|
||||
"repo": "microvm.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixlib": {
|
||||
"locked": {
|
||||
"lastModified": 1729386149,
|
||||
@@ -139,11 +99,11 @@
|
||||
},
|
||||
"nixos-hardware": {
|
||||
"locked": {
|
||||
"lastModified": 1730919458,
|
||||
"narHash": "sha256-yMO0T0QJlmT/x4HEyvrCyigGrdYfIXX3e5gWqB64wLg=",
|
||||
"lastModified": 1729742320,
|
||||
"narHash": "sha256-u3Of8xRkN//me8PU+RucKA59/6RNy4B2jcGAF36P4jI=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "e1cc1f6483393634aee94514186d21a4871e78d7",
|
||||
"rev": "e8a2f6d5513fe7b7d15701b2d05404ffdc3b6dda",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -171,11 +131,11 @@
|
||||
},
|
||||
"nixpkgs-stable": {
|
||||
"locked": {
|
||||
"lastModified": 1730602179,
|
||||
"narHash": "sha256-efgLzQAWSzJuCLiCaQUCDu4NudNlHdg2NzGLX5GYaEY=",
|
||||
"lastModified": 1729357638,
|
||||
"narHash": "sha256-66RHecx+zohbZwJVEPF7uuwHeqf8rykZTMCTqIrOew4=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "3c2f1c4ca372622cb2f9de8016c9a0b1cbd0f37c",
|
||||
"rev": "bb8c2cf7ea0dd2e18a52746b2c3a5b0c73b93c22",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -187,11 +147,11 @@
|
||||
},
|
||||
"nixpkgs-unstable": {
|
||||
"locked": {
|
||||
"lastModified": 1730785428,
|
||||
"narHash": "sha256-Zwl8YgTVJTEum+L+0zVAWvXAGbWAuXHax3KzuejaDyo=",
|
||||
"lastModified": 1729665710,
|
||||
"narHash": "sha256-AlcmCXJZPIlO5dmFzV3V2XF6x/OpNWUV8Y/FMPGd8Z4=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "4aa36568d413aca0ea84a1684d2d46f55dbabad7",
|
||||
"rev": "2768c7d042a37de65bb1b5b3268fc987e534c49d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -203,11 +163,11 @@
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1730883749,
|
||||
"narHash": "sha256-mwrFF0vElHJP8X3pFCByJR365Q2463ATp2qGIrDUdlE=",
|
||||
"lastModified": 1729449015,
|
||||
"narHash": "sha256-Gf04dXB0n4q0A9G5nTGH3zuMGr6jtJppqdeljxua1fo=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "dba414932936fde69f0606b4f1d87c5bc0003ede",
|
||||
"rev": "89172919243df199fe237ba0f776c3e3e3d72367",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -222,7 +182,6 @@
|
||||
"ep3-bs": "ep3-bs",
|
||||
"home-manager": "home-manager",
|
||||
"mfsync": "mfsync",
|
||||
"microvm": "microvm",
|
||||
"nixos-generators": "nixos-generators",
|
||||
"nixos-hardware": "nixos-hardware",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
@@ -240,11 +199,11 @@
|
||||
"nixpkgs-stable": "nixpkgs-stable"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1731047660,
|
||||
"narHash": "sha256-iyp51lPWEQz4c5VH9bVbAuBcFP4crETU2QJYh5V0NYA=",
|
||||
"lastModified": 1729695320,
|
||||
"narHash": "sha256-Fm4cGAlaDwekQvYX0e6t0VjT6YJs3fRXtkyuE4/NzzU=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "60e1bce1999f126e3b16ef45f89f72f0c3f8d16f",
|
||||
"rev": "d089e742fb79259b9c4dd9f18e9de1dd4fa3c1ec",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -253,22 +212,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"spectrum": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1729945407,
|
||||
"narHash": "sha256-iGNMamNOAnVTETnIVqDWd6fl74J8fLEi1ejdZiNjEtY=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "f1d94ee7029af18637dbd5fdf4749621533693fa",
|
||||
"revCount": 764,
|
||||
"type": "git",
|
||||
"url": "https://spectrum-os.org/git/spectrum"
|
||||
},
|
||||
"original": {
|
||||
"type": "git",
|
||||
"url": "https://spectrum-os.org/git/spectrum"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
@@ -314,21 +257,6 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_4": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"tasklist": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
@@ -387,7 +315,7 @@
|
||||
},
|
||||
"utils_3": {
|
||||
"inputs": {
|
||||
"systems": "systems_4"
|
||||
"systems": "systems_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1726560853,
|
||||
|
||||
@@ -8,8 +8,6 @@
|
||||
sops-nix.url = "github:Mic92/sops-nix";
|
||||
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
|
||||
mfsync.url = "github:k4lipso/mfsync";
|
||||
microvm.url = "github:astro/microvm.nix";
|
||||
microvm.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
utils = {
|
||||
url = "github:numtide/flake-utils";
|
||||
|
||||
@@ -40,36 +40,16 @@ let
|
||||
}
|
||||
];
|
||||
defaultModules = baseModules;
|
||||
|
||||
makeMicroVM = hostName: ipv4Addr: modules: [
|
||||
inputs.microvm.nixosModules.microvm
|
||||
{
|
||||
microvm = {
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-${hostName}";
|
||||
mac = "02:00:00:00:00:01";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
systemd.network.enable = true;
|
||||
|
||||
systemd.network.networks."20-lan" = {
|
||||
matchConfig.Type = "ether";
|
||||
networkConfig = {
|
||||
Address = [ "${ipv4Addr}/24" ];
|
||||
Gateway = "10.0.0.1";
|
||||
DNS = ["1.1.1.1"];
|
||||
DHCP = "no";
|
||||
};
|
||||
};
|
||||
}
|
||||
] ++ defaultModules ++ modules;
|
||||
in
|
||||
{
|
||||
moderatio = nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs.inputs = inputs;
|
||||
modules = defaultModules ++ [
|
||||
./moderatio/configuration.nix
|
||||
];
|
||||
};
|
||||
|
||||
louise = nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs.inputs = inputs;
|
||||
@@ -81,7 +61,7 @@ in
|
||||
durruti = nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs.inputs = inputs;
|
||||
modules = makeMicroVM "durruti" "10.0.0.5" [
|
||||
modules = defaultModules ++ [
|
||||
./durruti/configuration.nix
|
||||
];
|
||||
};
|
||||
@@ -94,12 +74,4 @@ in
|
||||
./lucia/hardware_configuration.nix
|
||||
];
|
||||
};
|
||||
|
||||
gitea = nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs.inputs = inputs;
|
||||
modules = makeMicroVM "gitea" "10.0.0.6" [
|
||||
./gitea/configuration.nix
|
||||
];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -5,6 +5,7 @@ with lib;
|
||||
{
|
||||
sops.defaultSopsFile = ./secrets.yaml;
|
||||
|
||||
boot.isContainer = true;
|
||||
networking = {
|
||||
hostName = mkDefault "durruti";
|
||||
useDHCP = false;
|
||||
|
||||
@@ -44,5 +44,6 @@ in
|
||||
enableACME= true;
|
||||
locations."/".proxyPass = "http://${cfg.host_ip}:80";
|
||||
};
|
||||
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,37 +0,0 @@
|
||||
{ config, lib, pkgs, inputs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
{
|
||||
#sops.defaultSopsFile = ./secrets.yaml;
|
||||
|
||||
networking = {
|
||||
hostName = mkDefault "gitea";
|
||||
useDHCP = false;
|
||||
nameservers = [ "1.1.1.1" ];
|
||||
};
|
||||
|
||||
imports = [
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
../modules/minimal_tools.nix
|
||||
../modules/autoupdate.nix
|
||||
];
|
||||
|
||||
services.gitea = {
|
||||
enable = true;
|
||||
appName = "malobeo git instance";
|
||||
|
||||
settings.server = {
|
||||
DOMAIN = "git.malobeo.org";
|
||||
HTTP_PORT = 3001;
|
||||
SSH_PORT = 22;
|
||||
ROOT_URL = "https://git.malobeo.org/";
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 3001 ];
|
||||
|
||||
system.stateVersion = "22.11"; # Did you read the comment?
|
||||
}
|
||||
|
||||
@@ -14,7 +14,7 @@ in
|
||||
|
||||
services.openssh.enable = true;
|
||||
services.openssh.ports = [ 22 ];
|
||||
services.openssh.settings.PasswordAuthentication = false;
|
||||
services.openssh.passwordAuthentication = false;
|
||||
services.openssh.settings.PermitRootLogin = "prohibit-password";
|
||||
users.users.root.openssh.authorizedKeys.keys = sshKeys.admins;
|
||||
|
||||
@@ -198,7 +198,7 @@ in
|
||||
|
||||
services.avahi = {
|
||||
enable = true;
|
||||
nssmdns4 = true;
|
||||
nssmdns = true;
|
||||
publish = {
|
||||
enable = true;
|
||||
addresses = true;
|
||||
|
||||
92
machines/moderatio/configuration.nix
Normal file
92
machines/moderatio/configuration.nix
Normal file
@@ -0,0 +1,92 @@
|
||||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
services.acpid.enable = true;
|
||||
|
||||
boot.kernelPackages = pkgs.linuxPackages_5_4;
|
||||
services.xserver.videoDrivers = [ "intel" ];
|
||||
services.xserver.deviceSection = ''
|
||||
Option "DRI" "2"
|
||||
Option "TearFree" "true"
|
||||
'';
|
||||
|
||||
zramSwap.enable = true;
|
||||
zramSwap.memoryPercent = 150;
|
||||
|
||||
imports =
|
||||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
./zfs.nix
|
||||
|
||||
../modules/xserver.nix
|
||||
../modules/malobeo_user.nix
|
||||
../modules/sshd.nix
|
||||
../modules/minimal_tools.nix
|
||||
];
|
||||
|
||||
users.users.malobeo = {
|
||||
packages = with pkgs; [
|
||||
firefox
|
||||
thunderbird
|
||||
];
|
||||
};
|
||||
|
||||
networking.hostName = "moderatio"; # Define your hostname.
|
||||
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Berlin";
|
||||
|
||||
# Select internationalisation properties.
|
||||
# i18n.defaultLocale = "en_US.UTF-8";
|
||||
# console = {
|
||||
# font = "Lat2-Terminus16";
|
||||
# keyMap = "us";
|
||||
# useXkbConfig = true; # use xkbOptions in tty.
|
||||
# };
|
||||
|
||||
# Enable CUPS to print documents.
|
||||
# services.printing.enable = true;
|
||||
|
||||
# Enable sound.
|
||||
sound.enable = true;
|
||||
hardware.pulseaudio.enable = true;
|
||||
|
||||
# Some programs need SUID wrappers, can be configured further or are
|
||||
# started in user sessions.
|
||||
# programs.mtr.enable = true;
|
||||
# programs.gnupg.agent = {
|
||||
# enable = true;
|
||||
# enableSSHSupport = true;
|
||||
# };
|
||||
|
||||
# List services that you want to enable:
|
||||
|
||||
# Enable the OpenSSH daemon.
|
||||
# services.openssh.enable = true;
|
||||
|
||||
# Open ports in the firewall.
|
||||
# networking.firewall.allowedTCPPorts = [ ... ];
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
# networking.firewall.enable = false;
|
||||
|
||||
# Copy the NixOS configuration file and link it from the resulting system
|
||||
# (/run/current-system/configuration.nix). This is useful in case you
|
||||
# accidentally delete configuration.nix.
|
||||
# system.copySystemConfiguration = true;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "22.05"; # Did you read the comment?
|
||||
|
||||
}
|
||||
|
||||
53
machines/moderatio/hardware-configuration.nix
Normal file
53
machines/moderatio/hardware-configuration.nix
Normal file
@@ -0,0 +1,53 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "ahci" "usb_storage" "ums_realtek" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "rpool/nixos/root";
|
||||
fsType = "zfs"; options = [ "zfsutil" "X-mount.mkdir" ];
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{ device = "rpool/nixos/home";
|
||||
fsType = "zfs"; options = [ "zfsutil" "X-mount.mkdir" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "bpool/nixos/root";
|
||||
fsType = "zfs"; options = [ "zfsutil" "X-mount.mkdir" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot/efis/ata-ST250LT003-9YG14C_W041QXCA-part1" =
|
||||
{ device = "/dev/disk/by-uuid/A0D1-00C1";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
fileSystems."/boot/efi" =
|
||||
{ device = "/boot/efis/ata-ST250LT003-9YG14C_W041QXCA-part1";
|
||||
fsType = "none";
|
||||
options = [ "bind" ];
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlo1.useDHCP = lib.mkDefault true;
|
||||
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
34
machines/moderatio/zfs.nix
Normal file
34
machines/moderatio/zfs.nix
Normal file
@@ -0,0 +1,34 @@
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{ boot.supportedFilesystems = [ "zfs" ];
|
||||
networking.hostId = "ae749b82";
|
||||
#boot.kernelPackages = config.boot.zfs.package.latestCompatibleLinuxPackages;
|
||||
boot.loader.efi.efiSysMountPoint = "/boot/efi";
|
||||
boot.loader.efi.canTouchEfiVariables = false;
|
||||
boot.loader.generationsDir.copyKernels = true;
|
||||
boot.loader.grub.efiInstallAsRemovable = true;
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.version = 2;
|
||||
boot.loader.grub.copyKernels = true;
|
||||
boot.loader.grub.efiSupport = true;
|
||||
boot.loader.grub.zfsSupport = true;
|
||||
boot.loader.grub.extraPrepareConfig = ''
|
||||
mkdir -p /boot/efis
|
||||
for i in /boot/efis/*; do mount $i ; done
|
||||
|
||||
mkdir -p /boot/efi
|
||||
mount /boot/efi
|
||||
'';
|
||||
boot.loader.grub.extraInstallCommands = ''
|
||||
ESP_MIRROR=$(mktemp -d)
|
||||
cp -r /boot/efi/EFI $ESP_MIRROR
|
||||
for i in /boot/efis/*; do
|
||||
cp -r $ESP_MIRROR/EFI $i
|
||||
done
|
||||
rm -rf $ESP_MIRROR
|
||||
'';
|
||||
boot.loader.grub.devices = [
|
||||
"/dev/disk/by-id/ata-ST250LT003-9YG14C_W041QXCA"
|
||||
];
|
||||
users.users.root.initialHashedPassword = "$6$PmoyhSlGGT6SI0t0$.cFsLyhtO1ks1LUDhLjG0vT44/NjuWCBrv5vUSXqwrU5WpaBvvthnLp0Dfwfyd6Zcdx/4izDcjQAgEWs4QdzW0";
|
||||
}
|
||||
@@ -100,12 +100,11 @@ in
|
||||
nix = {
|
||||
# Show a diff when activating a new system except for microvms which handle this seperately
|
||||
#diffSystem = config.malobeo.deployment.server or "" == "";
|
||||
#TODO: THIS WIPES HOSTS NIX STORE FROM WITHIN NIXOS-CONTAINER
|
||||
#gc = lib.mkIf config.malobeo.autoUpdate.enable {
|
||||
# automatic = true;
|
||||
# randomizedDelaySec = "6h";
|
||||
# options = "--delete-older-than 21d";
|
||||
#};
|
||||
gc = lib.mkIf config.malobeo.autoUpdate.enable {
|
||||
automatic = true;
|
||||
randomizedDelaySec = "6h";
|
||||
options = "--delete-older-than 21d";
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = [ (
|
||||
|
||||
@@ -1,52 +0,0 @@
|
||||
{ config, lib, options, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.services.malobeo.microvm;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.malobeo.microvm = {
|
||||
enableHostBridge = mkOption {
|
||||
default = false;
|
||||
type = types.bool;
|
||||
description = lib.mdDoc "Setup bridge device for microvms.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkIf cfg.enableHostBridge
|
||||
{
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
# create a bride device that all the microvms will be connected to
|
||||
netdevs."10-microvm".netdevConfig = {
|
||||
Kind = "bridge";
|
||||
Name = "microvm";
|
||||
};
|
||||
|
||||
networks."10-microvm" = {
|
||||
matchConfig.Name = "microvm";
|
||||
networkConfig = {
|
||||
DHCPServer = true;
|
||||
IPv6SendRA = true;
|
||||
};
|
||||
addresses = [ {
|
||||
Address = "10.0.0.1/24";
|
||||
} {
|
||||
Address = "fd12:3456:789a::1/64";
|
||||
} ];
|
||||
ipv6Prefixes = [ {
|
||||
Prefix = "fd12:3456:789a::/64";
|
||||
} ];
|
||||
};
|
||||
|
||||
# connect the vms to the bridge
|
||||
networks."11-microvm" = {
|
||||
matchConfig.Name = "vm-*";
|
||||
networkConfig.Bridge = "microvm";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -6,7 +6,7 @@ in
|
||||
{
|
||||
services.openssh.enable = true;
|
||||
services.openssh.ports = [ 22 ];
|
||||
services.openssh.settings.PasswordAuthentication = false;
|
||||
services.openssh.passwordAuthentication = false;
|
||||
services.openssh.settings.PermitRootLogin = "no";
|
||||
users.users.root.openssh.authorizedKeys.keys = sshKeys.admins;
|
||||
}
|
||||
|
||||
@@ -7,6 +7,7 @@
|
||||
xterm.enable = false;
|
||||
cinnamon.enable = true;
|
||||
};
|
||||
|
||||
displayManager.defaultSession = "cinnamon";
|
||||
};
|
||||
services.displayManager.defaultSession = "cinnamon";
|
||||
}
|
||||
|
||||
@@ -41,7 +41,7 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
|
||||
apps = {
|
||||
docs = {
|
||||
type = "app";
|
||||
program = builtins.toString (pkgs.writeShellScript "docs" ''
|
||||
program = builtins.toString (pkgs.writeScript "docs" ''
|
||||
${pkgs.mdbook}/bin/mdbook serve --open ./doc
|
||||
'');
|
||||
};
|
||||
@@ -52,10 +52,7 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
|
||||
inherit inputs;
|
||||
});
|
||||
|
||||
nixosModules.malobeo.imports = [
|
||||
./machines/durruti/host_config.nix
|
||||
./machines/modules/malobeo/microvm_host.nix
|
||||
];
|
||||
nixosModules.malobeo = import ./machines/durruti/host_config.nix;
|
||||
|
||||
hydraJobs = nixpkgs.lib.mapAttrs (_: nixpkgs.lib.hydraJob) (
|
||||
let
|
||||
|
||||
Reference in New Issue
Block a user