133 lines
3.3 KiB
Nix
133 lines
3.3 KiB
Nix
{ inputs, config, ... }:
|
|
let
|
|
sshKeys = import ../ssh_keys.nix;
|
|
peers = import ../modules/malobeo/peers.nix;
|
|
hosts = import ../hosts.nix {};
|
|
in
|
|
{
|
|
sops.defaultSopsFile = ./secrets.yaml;
|
|
sops.secrets.njala_api_key = {};
|
|
|
|
imports =
|
|
[ # Include the results of the hardware scan.
|
|
#./hardware-configuration.nix
|
|
../modules/sshd.nix
|
|
../modules/minimal_tools.nix
|
|
../modules/autoupdate.nix
|
|
inputs.self.nixosModules.malobeo.vpn
|
|
inputs.self.nixosModules.malobeo.initssh
|
|
inputs.self.nixosModules.malobeo.disko
|
|
inputs.self.nixosModules.malobeo.microvm
|
|
inputs.self.nixosModules.malobeo.metrics
|
|
inputs.self.nixosModules.malobeo.users
|
|
inputs.self.nixosModules.malobeo.backup
|
|
];
|
|
|
|
virtualisation.vmVariantWithDisko = {
|
|
virtualisation = {
|
|
memorySize = 4096;
|
|
cores = 3;
|
|
};
|
|
};
|
|
virtualisation.vmVariant.virtualisation.graphics = false;
|
|
|
|
malobeo.metrics = {
|
|
enable = true;
|
|
enablePromtail = true;
|
|
logNginx = true;
|
|
lokiHost = hosts.malobeo.hosts.overwatch.network.address;
|
|
};
|
|
|
|
malobeo.autoUpdate = {
|
|
enable = true;
|
|
url = "https://hydra.dynamicdiscord.de";
|
|
project = "malobeo";
|
|
jobset = "infrastructure";
|
|
cacheurl = "https://cache.dynamicdiscord.de";
|
|
}; #Autoupdate auf dem update server??
|
|
|
|
nix = {
|
|
settings.experimental-features = [ "nix-command" "flakes" ];
|
|
#always update microvms
|
|
extraOptions = ''
|
|
tarball-ttl = 0
|
|
'';
|
|
};
|
|
|
|
malobeo.users = {
|
|
malobeo = true;
|
|
admin = true;
|
|
backup = true;
|
|
};
|
|
|
|
malobeo.disks = {
|
|
enable = true;
|
|
hostId = "a3c31011";
|
|
root = {
|
|
disk0 = "disk/by-id/[insert-name-here]";
|
|
};
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
];
|
|
|
|
malobeo.initssh = {
|
|
enable = true;
|
|
authorizedKeys = sshKeys.admins;
|
|
ethernetDrivers = ["r8169"];
|
|
};
|
|
|
|
boot.initrd = {
|
|
availableKernelModules = [ "wireguard" ];
|
|
# postMountCommands = ''
|
|
# ip address flush dev wg-initrd
|
|
# ip link set dev wg-initrd down
|
|
# '';
|
|
systemd = {
|
|
enable = true;
|
|
network = {
|
|
enable = true;
|
|
netdevs."30-wg-initrd" = {
|
|
netdevConfig = {
|
|
Kind = "wireguard";
|
|
Name = "wg-initrd";
|
|
};
|
|
wireguardConfig = { PrivateKeyFile = "/etc/secrets/30-wg-initrd.key"; };
|
|
wireguardPeers = [{
|
|
AllowedIPs = peers.vpn.allowedIPs;
|
|
PublicKey = peers.vpn.publicKey;
|
|
Endpoint = "${peers.vpn.publicIp}:${builtins.toString(peers.vpn.listenPort)}";
|
|
PersistentKeepalive = 25;
|
|
}];
|
|
};
|
|
networks."30-wg-initrd" = {
|
|
name = "wg-initrd";
|
|
addresses = [{ Address = "${peers.albert-initrd.address}/24"; }]; #noch nicht existent... TODO
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
boot.initrd.secrets."/etc/secrets/30-wg-initrd.key" = "/etc/wireguard/wg.private";
|
|
|
|
services.malobeo.vpn = {
|
|
enable = true;
|
|
name = "albert";
|
|
privateKeyFile = config.sops.secrets.wg_private.path;
|
|
};
|
|
|
|
networking = {
|
|
firewall = {
|
|
allowedTCPPorts = [ 80 443 ];
|
|
};
|
|
};
|
|
nixpkgs.config.allowUnfree = true;
|
|
|
|
services.acpid.enable = true;
|
|
networking.hostName = "albert";
|
|
networking.networkmanager.enable = true;
|
|
time.timeZone = "Europe/Berlin";
|
|
system.stateVersion = "23.05"; # Do.. Not.. Change..
|
|
}
|
|
|