1 changed files with 132 additions and 0 deletions
@@ -0,0 +1,132 @@
+{ inputs, config, ... }:
+let
+  sshKeys = import ../ssh_keys.nix;
+  peers = import ../modules/malobeo/peers.nix;
+  hosts = import ../hosts.nix {};
+in
+{
+  sops.defaultSopsFile = ./secrets.yaml;
+  sops.secrets.njala_api_key = {};
+
+  imports =
+    [ # Include the results of the hardware scan.
+      #./hardware-configuration.nix
+      ../modules/sshd.nix
+      ../modules/minimal_tools.nix
+      ../modules/autoupdate.nix
+      inputs.self.nixosModules.malobeo.vpn
+      inputs.self.nixosModules.malobeo.initssh
+      inputs.self.nixosModules.malobeo.disko
+      inputs.self.nixosModules.malobeo.microvm
+      inputs.self.nixosModules.malobeo.metrics
+      inputs.self.nixosModules.malobeo.users
+      inputs.self.nixosModules.malobeo.backup
+    ];
+
+  virtualisation.vmVariantWithDisko = {
+    virtualisation = {
+      memorySize =  4096; 
+      cores = 3;
+    };
+  };
+  virtualisation.vmVariant.virtualisation.graphics = false;
+
+  malobeo.metrics = {
+    enable = true;
+    enablePromtail = true;
+    logNginx = true;
+    lokiHost = hosts.malobeo.hosts.overwatch.network.address;
+  };
+
+  malobeo.autoUpdate = {
+    enable = true;
+    url = "https://hydra.dynamicdiscord.de";
+    project = "malobeo";
+    jobset = "infrastructure";
+    cacheurl = "https://cache.dynamicdiscord.de";
+  }; #Autoupdate auf dem update server??
+
+  nix = {
+    settings.experimental-features = [ "nix-command" "flakes" ];
+    #always update microvms
+    extraOptions = ''
+      tarball-ttl = 0
+    '';
+  };
+
+  malobeo.users = {
+    malobeo = true;
+    admin = true;
+    backup = true;
+  };
+
+  malobeo.disks = {
+    enable = true;
+    hostId = "a3c31011";
+    root = {
+      disk0 = "disk/by-id/[insert-name-here]";
+    };
+  };
+
+  systemd.tmpfiles.rules = [ 
+    ];
+
+  malobeo.initssh = {
+    enable = true;
+    authorizedKeys = sshKeys.admins;
+    ethernetDrivers = ["r8169"];
+  };
+
+  boot.initrd = {
+    availableKernelModules = [ "wireguard" ];
+    # postMountCommands = ''
+    #   ip address flush dev wg-initrd
+    #   ip link set dev wg-initrd down
+    # '';
+    systemd = {
+      enable = true;
+      network = {
+        enable = true;
+        netdevs."30-wg-initrd" = {
+          netdevConfig = {
+            Kind = "wireguard";
+            Name = "wg-initrd";
+          };
+          wireguardConfig = { PrivateKeyFile = "/etc/secrets/30-wg-initrd.key"; };
+          wireguardPeers = [{
+            AllowedIPs = peers.vpn.allowedIPs;
+            PublicKey = peers.vpn.publicKey;
+            Endpoint = "${peers.vpn.publicIp}:${builtins.toString(peers.vpn.listenPort)}";
+            PersistentKeepalive = 25;
+          }];
+        };
+        networks."30-wg-initrd" = {
+          name = "wg-initrd";
+          addresses = [{ Address = "${peers.albert-initrd.address}/24"; }]; #noch nicht existent... TODO
+        };
+      };
+    };
+  };
+
+  boot.initrd.secrets."/etc/secrets/30-wg-initrd.key" = "/etc/wireguard/wg.private";
+
+  services.malobeo.vpn = {
+    enable = true;
+    name = "albert";
+    privateKeyFile = config.sops.secrets.wg_private.path;
+  };
+
+  networking = {
+    firewall = {
+      allowedTCPPorts = [ 80 443 ];
+    };
+  };
+  nixpkgs.config.allowUnfree = true; 
+
+  services.acpid.enable = true;
+  networking.hostName = "albert";
+  networking.networkmanager.enable = true;
+  time.timeZone = "Europe/Berlin";
+  system.stateVersion = "23.05"; # Do.. Not.. Change..
+}
+