kalipso/infrastructure
1
1
Fork 1
Code Issues 42 Pull Requests 2 Actions Projects 2 Releases Wiki Activity

[nixpkgs] 24.05 -> 24.11 #42

Closed
kalipso wants to merge 14 commits from staging into master
pull from: staging
merge into: kalipso:master
Conversation 3 Commits 14 Files Changed 14 +437 -109
14 changed files with 437 additions and 109 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
doc/src/anleitung/create.md
View File

@@ -42,6 +42,25 @@ sudo nix --extra-experimental-features "flakes nix-command" run 'github:nix-comm
# failed with no space left on device.
# problem is lots of data is written to the local /nix/store which is mounted on tmpfs in ram
# it seems that a workaround could be modifying the bootable stick to contain a swap partition to extend tmpfs storage
```
# Testing Disko
Testing disko partitioning is working quite well. Just run the following and check the datasets in the vm:
```bash
nix run -L .\#nixosConfigurations.fanny.config.system.build.vmWithDisko
```
Only problem is that encryption is not working, so it needs to be commented out. For testing host fanny the following parts in ```./machines/modules/disko/fanny.nix``` need to be commented out(for both pools!):
```nix
datasets = {
encrypted = {
options = {
encryption = "aes-256-gcm"; #THIS ONE
keyformat = "passphrase"; #THIS ONE
keylocation = "file:///tmp/root.key"; #THIS ONE
};
# use this to read the key during boot
postCreateHook = '' #THIS ONE
zfs set keylocation="prompt" "zroot/$name"; #THIS ONE
''; #THIS ONE
```

41
doc/src/anleitung/microvm.md
View File

@@ -12,14 +12,44 @@ Use durruti as orientation:
"10.0.0.5" is the IP assigned to its tap interface.
### Testing MicroVMs locally
MicroVMs can be built and run easily on your local host.
For durruti this is done by:
MicroVMs can be built and run easily on your local host, but they are not persistent!
For durruti for example this is done by:
``` bash
sudo nix run .\#nixosConfigurations.durruti.config.microvm.declaredRunner
nix run .\#durruti-vm
```
### Testing persistent microvms
In order to test persistent microvms locally we need to create them using the ```microvm``` command.
This is necessary to be able to mount persistent /etc and /var volumes on those hosts.
Do the following:
```bash
# go into our repo and start the default dev shell (or us direnv)
nix develop .#
# create a microvm on your host (on the example of durruti)
sudo microvm -c durruti -f git+file:///home/username/path/to/infrastructure/repo
# start the vm
sudo systemctl start microvm@durruti.serivce
# this may fail, if so we most probably need to create /var /etc manually, then restart
sudo mkdir /var/lib/microvms/durruti/{var, etc}
# now you can for example get the rsa host key from /var/lib/microvms/durruti/etc/ssh/
# alternatively u can run the vm in interactive mode (maybe stop the microvm@durruti.service first)
microvm -r durruti
# after u made changes to the microvm update and restart the vm
microvm -uR durruti
# deleting the vm again:
sudo systemctl stop microvm@durruti.service
sudo systemctl stop microvm-virtiofsd@durruti.service
sudo rm -rf /var/lib/microvms/durruti
```
It seems to be necessary to run this as root so that the according tap interface can be created.
To be able to ping the VM or give Internet Access to the VM your host needs to be setup as described below.
### Host Setup
@@ -49,4 +79,3 @@ The following example would init and autostart durruti and gitea:
``` nix
malobeo.microvm.deployHosts = [ "durruti" "gitea" ];
```

66
flake.lock generated
View File

@@ -47,11 +47,11 @@
"systems": "systems_3"
},
"locked": {
"lastModified": 1726560853,
"narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
"lastModified": 1731533236,
"narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
"rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
"type": "github"
},
"original": {
@@ -67,16 +67,16 @@
]
},
"locked": {
"lastModified": 1726989464,
"narHash": "sha256-Vl+WVTJwutXkimwGprnEtXc/s/s8sMuXzqXaspIGlwM=",
"lastModified": 1733951536,
"narHash": "sha256-Zb5ZCa7Xj+0gy5XVXINTSr71fCfAv+IKtmIXNrykT54=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "2f23fa308a7c067e52dfcc30a0758f47043ec176",
"rev": "1318c3f3b068cdcea922fa7c1a0a1f0c96c22f5f",
"type": "github"
},
"original": {
"owner": "nix-community",
"ref": "release-24.05",
"ref": "release-24.11",
"repo": "home-manager",
"type": "github"
}
@@ -109,11 +109,11 @@
"spectrum": "spectrum"
},
"locked": {
"lastModified": 1732122592,
"narHash": "sha256-lF54irx92m8ddNDQDtOUjKsZAnsGyPL3QTO7byjlxNg=",
"lastModified": 1734041466,
"narHash": "sha256-51bhaMe8BZuNAStUHvo07nDO72wmw8PAqkSYH4U31Yo=",
"owner": "astro",
"repo": "microvm.nix",
"rev": "19650774c23df84d0b8f315d2527274563497cad",
"rev": "3910e65c3d92c82ea41ab295c66df4c0b4f9e7b3",
"type": "github"
},
"original": {
@@ -124,11 +124,11 @@
},
"nixlib": {
"locked": {
"lastModified": 1731805462,
"narHash": "sha256-yhEMW4MBi+IAyEJyiKbnFvY1uARyMKJpLUhkczI49wk=",
"lastModified": 1733620091,
"narHash": "sha256-5WoMeCkaXqTZwwCNLRzyLxEJn8ISwjx4cNqLgqKwg9s=",
"owner": "nix-community",
"repo": "nixpkgs.lib",
"rev": "b9f04e3cf71c23bea21d2768051e6b3068d44734",
"rev": "f4dc9a6c02e5e14d91d158522f69f6ab4194eb5b",
"type": "github"
},
"original": {
@@ -145,11 +145,11 @@
]
},
"locked": {
"lastModified": 1732151224,
"narHash": "sha256-5IgpueM8SGLOadzUJK6Gk37zEBXGd56BkNOtoWmnZos=",
"lastModified": 1733965598,
"narHash": "sha256-0tlZU8xfQGPcBOdXZee7P3vJLyPjTrXw7WbIgXD34gM=",
"owner": "nix-community",
"repo": "nixos-generators",
"rev": "3280fdde8c8f0276c9f5286ad5c0f433dfa5d56c",
"rev": "d162ffdf0a30f3d19e67df5091d6744ab8b9229f",
"type": "github"
},
"original": {
@@ -160,11 +160,11 @@
},
"nixos-hardware": {
"locked": {
"lastModified": 1731797098,
"narHash": "sha256-UhWmEZhwJZmVZ1jfHZFzCg+ZLO9Tb/v3Y6LC0UNyeTo=",
"lastModified": 1733861262,
"narHash": "sha256-+jjPup/ByS0LEVIrBbt7FnGugJgLeG9oc+ivFASYn2U=",
"owner": "NixOS",
"repo": "nixos-hardware",
"rev": "672ac2ac86f7dff2f6f3406405bddecf960e0db6",
"rev": "cf737e2eba82b603f54f71b10cb8fd09d22ce3f5",
"type": "github"
},
"original": {
@@ -192,11 +192,11 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1732014248,
"narHash": "sha256-y/MEyuJ5oBWrWAic/14LaIr/u5E0wRVzyYsouYY3W6w=",
"lastModified": 1733759999,
"narHash": "sha256-463SNPWmz46iLzJKRzO3Q2b0Aurff3U1n0nYItxq7jU=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "23e89b7da85c3640bbc2173fe04f4bd114342367",
"rev": "a73246e2eef4c6ed172979932bc80e1404ba2d56",
"type": "github"
},
"original": {
@@ -208,16 +208,16 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1731797254,
"narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=",
"lastModified": 1733808091,
"narHash": "sha256-KWwINTQelKOoQgrXftxoqxmKFZb9pLVfnRvK270nkVk=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59",
"rev": "a0f3e10d94359665dba45b71b4227b0aeb851f8e",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-24.05",
"ref": "nixos-24.11",
"repo": "nixpkgs",
"type": "github"
}
@@ -245,11 +245,11 @@
]
},
"locked": {
"lastModified": 1732186149,
"narHash": "sha256-N9JGWe/T8BC0Tss2Cv30plvZUYoiRmykP7ZdY2on2b0=",
"lastModified": 1733965552,
"narHash": "sha256-GZ4YtqkfyTjJFVCub5yAFWsHknG1nS/zfk7MuHht4Fs=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "53c853fb1a7e4f25f68805ee25c83d5de18dc699",
"rev": "2d73fc6ac4eba4b9a83d3cb8275096fbb7ab4004",
"type": "github"
},
"original": {
@@ -261,11 +261,11 @@
"spectrum": {
"flake": false,
"locked": {
"lastModified": 1729945407,
"narHash": "sha256-iGNMamNOAnVTETnIVqDWd6fl74J8fLEi1ejdZiNjEtY=",
"lastModified": 1733308308,
"narHash": "sha256-+RcbMAjSxV1wW5UpS9abIG1lFZC8bITPiFIKNnE7RLs=",
"ref": "refs/heads/main",
"rev": "f1d94ee7029af18637dbd5fdf4749621533693fa",
"revCount": 764,
"rev": "80c9e9830d460c944c8f730065f18bb733bc7ee2",
"revCount": 792,
"type": "git",
"url": "https://spectrum-os.org/git/spectrum"
},

4
flake.nix
View File

@@ -3,7 +3,7 @@
inputs = {
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.11";
nixpkgs-unstable.url = "github:NixOS/nixpkgs/nixos-unstable";
sops-nix.url = "github:Mic92/sops-nix";
sops-nix.inputs.nixpkgs.follows = "nixpkgs";
@@ -33,7 +33,7 @@
};
home-manager= {
url = "github:nix-community/home-manager/release-24.05";
url = "github:nix-community/home-manager/release-24.11";
inputs = {
nixpkgs.follows = "nixpkgs";
};

16
machines/bakunin/configuration.nix
View File

@@ -67,17 +67,13 @@
networking.hostName = "bakunin";
networking.networkmanager.enable = true;
sound.enable = true;
hardware.pulseaudio = {
enable = true;
zeroconf.discovery.enable = true;
extraConfig = ''
load-module module-zeroconf-discover
'';
};
services.avahi = {
security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
systemWide = true;
};

43
machines/configuration.nix
View File

@@ -45,12 +45,32 @@ let
inputs.microvm.nixosModules.microvm
{
microvm = {
hypervisor = "qemu";
shares = [ {
tag = "ro-store";
source = "/nix/store";
mountPoint = "/nix/.ro-store";
} ];
hypervisor = "cloud-hypervisor";
mem = 2560;
shares = [
{
source = "/nix/store";
mountPoint = "/nix/.ro-store";
tag = "store";
proto = "virtiofs";
socket = "store.socket";
}
{
source = "/var/lib/microvms/${hostName}/etc";
mountPoint = "/etc";
tag = "etc";
proto = "virtiofs";
socket = "etc.socket";
}
{
source = "/var/lib/microvms/${hostName}/var";
mountPoint = "/var";
tag = "var";
proto = "virtiofs";
socket = "var.socket";
}
];
interfaces = [
{
type = "tap";
@@ -93,6 +113,17 @@ in
];
};
fanny = nixosSystem {
system = "x86_64-linux";
specialArgs.inputs = inputs;
modules = defaultModules ++ [
./fanny/configuration.nix
inputs.disko.nixosModules.disko
./modules/disko/fanny.nix
];
};
durruti = nixosSystem {
system = "x86_64-linux";
specialArgs.inputs = inputs;

44
machines/fanny/configuration.nix Normal file
View File

@@ -0,0 +1,44 @@
{ config, pkgs, ... }:
{
imports =
[ # Include the results of the hardware scan.
#./hardware-configuration.nix
../modules/malobeo_user.nix
../modules/sshd.nix
../modules/minimal_tools.nix
../modules/autoupdate.nix
];
malobeo.autoUpdate = {
enable = true;
url = "https://hydra.dynamicdiscord.de";
project = "malobeo";
jobset = "infrastructure";
cacheurl = "https://cache.dynamicdiscord.de";
};
boot.loader.systemd-boot.enable = true;
nix.settings.experimental-features = [ "nix-command" "flakes" ];
services.tor = {
enable = true;
client.enable = true;
};
# needed for printing drivers
nixpkgs.config.allowUnfree = true;
services.acpid.enable = true;
networking.hostName = "fanny";
networking.hostId = "1312acab";
networking.networkmanager.enable = true;
virtualisation.vmVariant.virtualisation.graphics = false;
time.timeZone = "Europe/Berlin";
system.stateVersion = "23.05"; # Do.. Not.. Change..
}

49
machines/fanny/hardware-configuration.nix Normal file
View File

@@ -0,0 +1,49 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" ];
boot.initrd.kernelModules = [ "dm-snapshot" ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
boot.initrd.luks.devices = {
root = {
device = "/dev/disk/by-uuid/35ae4fa2-1076-42ae-a04c-1752126b2aaf";
preLVM = true;
allowDiscards = true;
};
};
fileSystems."/" =
{ device = "/dev/disk/by-uuid/fe34ee57-9397-4311-94f2-a4fc0a3ef09c";
fsType = "btrfs";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/402B-2026";
fsType = "vfat";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/b4a28946-dcc4-437d-a1b9-08d36f4b6b27"; }
];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
# networking.interfaces.wlp4s0.useDHCP = lib.mkDefault true;
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
}

16
machines/louise/configuration.nix
View File

@@ -67,17 +67,13 @@
networking.hostName = "louise";
networking.networkmanager.enable = true;
sound.enable = true;
hardware.pulseaudio = {
enable = true;
zeroconf.discovery.enable = true;
extraConfig = ''
load-module module-zeroconf-discover
'';
};
services.avahi = {
security.rtkit.enable = true;
services.pipewire = {
enable = true;
alsa.enable = true;
alsa.support32Bit = true;
pulse.enable = true;
systemWide = true;
};

12
machines/lucia/configuration.nix
View File

@@ -20,14 +20,6 @@ in
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
boot.loader.grub.enable = false;
boot.loader.raspberryPi.enable = false;
boot.loader.raspberryPi.version = 3;
boot.loader.raspberryPi.uboot.enable = true;
boot.loader.raspberryPi.firmwareConfig = ''
dtparam=audio=on
hdmi_ignore_edid_audio=1
audio_pwm_mode=2
'';
# Enables the generation of /boot/extlinux/extlinux.conf
boot.loader.generic-extlinux-compatible.enable = true;
@@ -39,12 +31,8 @@ in
# Set your time zone.
time.timeZone = "Europe/Berlin";
# hardware audio support:
sound.enable = true;
services = {
dokuwiki.sites."wiki.malobeo.org" = {
enable = true;
#acl = "* @ALL 8"; # everyone can edit using this config

2
machines/modules/disko/btrfs-laptop.nix
View File

@@ -30,7 +30,7 @@
content = {
type = "luks";
name = "crypted";
passwordFile = "/tmp/secret.key"; # Interactive
passwordFile = /tmp/secret.key; # Interactive
content = {
type = "btrfs";
extraArgs = [ "-f" ];

141
machines/modules/disko/fanny.nix Normal file
View File

@@ -0,0 +1,141 @@
{
disko.devices = {
disk = {
ssd = {
type = "disk";
device = "/dev/sda";
content = {
type = "gpt";
partitions = {
ESP = {
size = "1024M";
type = "EF00";
content = {
type = "filesystem";
format = "vfat";
mountpoint = "/boot";
mountOptions = [ "umask=0077" ];
};
};
zfs = {
size = "100%";
content = {
type = "zfs";
pool = "zroot";
};
};
};
};
};
hdd0 = {
type = "disk";
device = "/dev/sdb";
content = {
type = "gpt";
partitions = {
zfs = {
size = "100%";
content = {
type = "zfs";
pool = "storage";
};
};
};
};
};
hdd1 = {
type = "disk";
device = "/dev/sdc";
content = {
type = "gpt";
partitions = {
zfs = {
size = "100%";
content = {
type = "zfs";
pool = "storage";
};
};
};
};
};
};
zpool = {
zroot = {
type = "zpool";
mode = "";
# Workaround: cannot import 'zroot': I/O error in disko tests
options.cachefile = "none";
rootFsOptions = {
compression = "zstd";
"com.sun:auto-snapshot" = "false";
};
datasets = {
encrypted = {
type = "zfs_fs";
options = {
mountpoint = "none";
encryption = "aes-256-gcm";
keyformat = "passphrase";
keylocation = "file:///tmp/root.key";
};
# use this to read the key during boot
postCreateHook = ''
zfs set keylocation="prompt" "zroot/$name";
'';
};
"encrypted/root" = {
type = "zfs_fs";
mountpoint = "/";
};
"encrypted/var" = {
type = "zfs_fs";
mountpoint = "/var";
};
"encrypted/etc" = {
type = "zfs_fs";
mountpoint = "/etc";
};
"encrypted/home" = {
type = "zfs_fs";
mountpoint = "/home";
};
"encrypted/nix" = {
type = "zfs_fs";
mountpoint = "/nix";
};
};
};
storage = {
type = "zpool";
mode = "mirror";
datasets = {
encrypted = {
type = "zfs_fs";
options = {
mountpoint = "none";
encryption = "aes-256-gcm";
keyformat = "passphrase";
keylocation = "file:///tmp/storage.key";
};
# use this to read the key during boot
postCreateHook = ''
zfs set keylocation="prompt" "zroot/$name";
'';
};
"encrypted/data" = {
type = "zfs_fs";
mountpoint = "/data";
};
};
};
};
};
}

65
outputs.nix
View File

@@ -4,6 +4,7 @@
, nixpkgs-unstable
, nixos-generators
, sops-nix
, microvm
, ...
} @inputs:
@@ -15,8 +16,27 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
pkgs = nixpkgs.legacyPackages."${system}";
in
{
devShells.default = pkgs.callPackage ./shell.nix {
inherit (sops-nix.packages."${pkgs.system}") sops-import-keys-hook ssh-to-pgp sops-init-gpg-key;
devShells.default =
let
sops = sops-nix.packages."${pkgs.system}";
microvmpkg = microvm.packages."${pkgs.system}";
in
pkgs.mkShell {
sopsPGPKeyDirs = [
"./machines/secrets/keys/hosts"
"./machines/secrets/keys/users"
];
nativeBuildInputs = [
sops.ssh-to-pgp
sops.sops-import-keys-hook
sops.sops-init-gpg-key
pkgs.sops
pkgs.age
pkgs.python310Packages.grip
pkgs.mdbook
microvmpkg.microvm
];
};
packages = {
@@ -36,7 +56,46 @@ in (utils.lib.eachSystem (builtins.filter filter_system utils.lib.defaultSystems
cp -r ./book/* $dest
'';
};
};
} //
builtins.foldl'
(result: host:
let
inherit (self.nixosConfigurations.${host}) config;
in
result // {
# boot any machine in a microvm
"${host}-vm" = (self.nixosConfigurations.${host}.extendModules {
modules = [{
microvm = {
mem = pkgs.lib.mkForce 4096;
hypervisor = pkgs.lib.mkForce "qemu";
socket = pkgs.lib.mkForce null;
shares = pkgs.lib.mkForce [{
tag = "ro-store";
source = "/nix/store";
mountPoint = "/nix/.ro-store";
}];
interfaces = pkgs.lib.mkForce [{
type = "user";
id = "eth0";
mac = "02:23:de:ad:be:ef";
}];
};
boot.isContainer = pkgs.lib.mkForce false;
users.users.root.password = "";
fileSystems."/".fsType = pkgs.lib.mkForce "tmpfs";
services.getty.helpLine = ''
Log in as "root" with an empty password.
Use "reboot" to shut qemu down.
'';
}] ++ pkgs.lib.optionals (! config ? microvm) [
microvm.nixosModules.microvm
];
}).config.microvm.declaredRunner;
})
{ }
(builtins.attrNames self.nixosConfigurations);
apps = {
docs = {

24
shell.nix
View File

@@ -1,24 +0,0 @@
{ mkShell
, sops-import-keys-hook
, ssh-to-pgp
, sops-init-gpg-key
, sops
, pkgs
}:
mkShell {
sopsPGPKeyDirs = [
"./machines/secrets/keys/hosts"
"./machines/secrets/keys/users"
];
nativeBuildInputs = [
ssh-to-pgp
sops-import-keys-hook
sops-init-gpg-key
sops
pkgs.age
pkgs.python310Packages.grip
pkgs.mdbook
];
}