Compare commits

..

No commits in common. "145d2aee96ab39d0028a16d05da3e62688f84890" and "22d8749f7ae707bdd89fb70b1d2ba27eda8d2e0a" have entirely different histories.

15 changed files with 189 additions and 297 deletions

2
.gitignore vendored
View file

@ -2,4 +2,4 @@
# Ignore build outputs from performing a nix-build or `nix build` command # Ignore build outputs from performing a nix-build or `nix build` command
result result
result-* result-*
.pre-commit-config.yaml

View file

@ -170,10 +170,6 @@ In your hardware
configuration you should basically only write you filesystem layout and your hostPlatform. The bootloading stuff configuration you should basically only write you filesystem layout and your hostPlatform. The bootloading stuff
is already taken care of by `../../roles`. is already taken care of by `../../roles`.
The `flake-inputs` argument is optional, but you can use it if you need to get a hold of the flake inputs,
else this is a complete normal nixos system configuration module (with a lot of settings already imorted
from `../../roles`).
As of moment of writing `network.nix` should contain ip, nameserver and default gateway setup. As parts of As of moment of writing `network.nix` should contain ip, nameserver and default gateway setup. As parts of
this is constant across all systems and will undergo refactor soon. this is constant across all systems and will undergo refactor soon.

View file

@ -1,48 +1,28 @@
{inputs, ...}: { {inputs, ...}:
{
# debug = true; # debug = true;
# We only define machines config in this flake yet, so we only include # We only define machines config in this flake yet, so we only include
# the module that builds these. This file might get fuller, if we need to # the module that builds these. This file might get fuller, if we need to
# build our own packages, that are not flakes. # build our own packages, that are not flakes.
imports = [ imports = [ ./nixos/flake-module.nix
./nixos/flake-module.nix # To import a flake module
inputs.pre-commit-hooks.flakeModule # 1. Add foo to inputs
# To import a flake module # 2. Add foo as a parameter to the outputs function
# 1. Add foo to inputs # 3. Add here: foo.flakeModule
# 2. Add foo as a parameter to the outputs function
# 3. Add here: foo.flakeModule
]; ];
systems = ["x86_64-linux"]; systems = [ "x86_64-linux"];
perSystem = { # perSystem = { config, self', inputs', pkgs, system, ... }: {
config, # Per-system attributes can be defined here. The self' and inputs'
inputs', # module parameters provide easy access to attributes of the same
pkgs, # system.
...
}: {
devShells.default = pkgs.mkShell {
shellHook = config.pre-commit.installationScript;
};
pre-commit = {
check.enable = true;
pkgs = inputs'.nixpkgs.legacyPackages;
settings.hooks = {
nil.enable = true;
statix.enable = true;
deadnix.enable = true;
alejandra.enable = true;
};
};
# Per-system attributes can be defined here. The self' and inputs'
# module parameters provide easy access to attributes of the same
# system.
};
# Equivalent to inputs'.nixpkgs.legacyPackages.hello; # Equivalent to inputs'.nixpkgs.legacyPackages.hello;
# flake = { # };
# The usual flake attributes can be defined here, including system- # flake = {
# agnostic ones like nixosModule and system-enumerating ones, although # The usual flake attributes can be defined here, including system-
# those are more easily expressed in perSystem. # agnostic ones like nixosModule and system-enumerating ones, although
# those are more easily expressed in perSystem.
# }; # };
} }

View file

@ -33,24 +33,6 @@
"type": "indirect" "type": "indirect"
} }
}, },
"flake-utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1685518550,
"narHash": "sha256-o2d0KcvaXzTrPRIo0kOLV0/QXHhDQ5DTi+OxcjO8xqY=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "a1720a10a6cfe8234c0e93907ffe81be440f4cef",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"impermanence": { "impermanence": {
"locked": { "locked": {
"lastModified": 1694622745, "lastModified": 1694622745,
@ -153,35 +135,12 @@
"type": "github" "type": "github"
} }
}, },
"pre-commit-hooks": {
"inputs": {
"flake-compat": [],
"flake-utils": "flake-utils",
"gitignore": [],
"nixpkgs": [],
"nixpkgs-stable": []
},
"locked": {
"lastModified": 1699271226,
"narHash": "sha256-8Jt1KW3xTjolD6c6OjJm9USx/jmL+VVmbooADCkdDfU=",
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"rev": "ea758da1a6dcde6dc36db348ed690d09b9864128",
"type": "github"
},
"original": {
"owner": "cachix",
"repo": "pre-commit-hooks.nix",
"type": "github"
}
},
"root": { "root": {
"inputs": { "inputs": {
"flake-parts": "flake-parts", "flake-parts": "flake-parts",
"impermanence": "impermanence", "impermanence": "impermanence",
"nixos-mailserver": "nixos-mailserver", "nixos-mailserver": "nixos-mailserver",
"nixpkgs": "nixpkgs", "nixpkgs": "nixpkgs",
"pre-commit-hooks": "pre-commit-hooks",
"sops-nix": "sops-nix" "sops-nix": "sops-nix"
} }
}, },
@ -206,21 +165,6 @@
"type": "github" "type": "github"
} }
}, },
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
},
"utils": { "utils": {
"locked": { "locked": {
"lastModified": 1605370193, "lastModified": 1605370193,

View file

@ -17,17 +17,8 @@
impermanence = { impermanence = {
url = "github:nix-community/impermanence"; url = "github:nix-community/impermanence";
}; };
pre-commit-hooks = {
url = "github:cachix/pre-commit-hooks.nix";
inputs = {
flake-compat.follows = "";
gitignore.follows = "";
nixpkgs-stable.follows = "";
nixpkgs.follows = "";
};
};
}; };
outputs = inputs @ {flake-parts, ...}: outputs = inputs@{ flake-parts, ... }:
flake-parts.lib.mkFlake {inherit inputs;} (import ./flake-module.nix); flake-parts.lib.mkFlake { inherit inputs; } (import ./flake-module.nix);
} }

View file

@ -1,30 +1,20 @@
# copied and adopted from maralorns config # copied and adopted from maralorns config
# This automatically searches for nixos configs in ./machines/${name}/configuration.nix # This automatically searches for nixos configs in ./machines/${name}/configuration.nix
# and exposes them as outputs.nixosConfigurations.${name} # and exposes them as outputs.nixosConfigurations.${name}
{ { withSystem, lib, inputs, ... }: {
withSystem,
lib,
inputs,
...
}: {
flake = { flake = {
nixosConfigurations = withSystem "x86_64-linux" ({pkgs, ...}: let nixosConfigurations = withSystem "x86_64-linux" ({ pkgs, ... }:
let
machines = builtins.attrNames (builtins.readDir ./machines); machines = builtins.attrNames (builtins.readDir ./machines);
makeSystem = name: let makeSystem = name:
importedModule = import (./. + "/machines/${name}/configuration.nix");
configModule =
if lib.isFunction importedModule
then importedModule inputs
else importedModule;
in
pkgs.nixos { pkgs.nixos {
imports = [ imports = [
configModule (import (./. + "/machines/${name}/configuration.nix") inputs)
inputs.sops-nix.nixosModules.sops inputs.sops-nix.nixosModules.sops
inputs.impermanence.nixosModules.impermanence inputs.impermanence.nixosModules.impermanence
]; ];
}; };
in in lib.genAttrs machines makeSystem);
lib.genAttrs machines makeSystem);
}; };
} }

View file

@ -1,17 +1,19 @@
{ flake-inputs:
imports = [ {config, pkgs, lib, ... }: {
./hardware-configuration.nix
../../modules/jitsi.nix imports = [
../../roles ./hardware-configuration.nix
./network.nix ../../modules/jitsi.nix
]; ../../roles
./network.nix
];
services.mathebau-jitsi = { services.mathebau-jitsi = {
enable = true; enable = true;
hostName = "meet.mathebau.de"; hostName = "meet.mathebau.de";
}; };
# System configuration here # System configuration here
networking.hostName = "ghatanothoa"; networking.hostName = "ghatanothoa";
system.stateVersion = "23.11"; system.stateVersion = "23.11";
} }

View file

@ -1,15 +1,15 @@
{lib, ...}: { {config, lib, pkgs, modulesPath, ...}: {
imports = []; imports = [ ];
fileSystems."/" = { fileSystems."/" = {
device = "gha-root"; device = "gha-root";
fsType = "tmpfs"; fsType = "tmpfs";
options = ["size=1G" "mode=755"]; options = [ "size=1G" "mode=755" ];
}; };
fileSystems."/persist" = { fileSystems."/persist" = {
device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136"; device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136";
fsType = "btrfs"; fsType = "btrfs";
options = ["subvol=persist"]; options = [ "subvol=persist" ];
neededForBoot = true; neededForBoot = true;
}; };
fileSystems."/boot" = { fileSystems."/boot" = {
@ -19,10 +19,11 @@
fileSystems."/nix" = { fileSystems."/nix" = {
device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136"; device = "/dev/disk/by-uuid/e0a160ef-7d46-4705-9152-a6b602898136";
fsType = "btrfs"; fsType = "btrfs";
options = ["subvol=nix"]; options = [ "subvol=nix" ];
}; };
swapDevices = [{device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a";}]; swapDevices =
[{ device = "/dev/disk/by-uuid/e6e3ba6b-c9f5-4960-b56d-f49760d76a4a"; }];
nix.settings.max-jobs = lib.mkDefault 4; nix.settings.max-jobs = lib.mkDefault 4;

View file

@ -1,16 +1,15 @@
# We sohuld put that config somewhere in roles and give it a parameter or something, # We sohuld put that config somewhere in roles and give it a parameter or something,
# everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways # everyone gets the same nameserver and the same prefixLength and address vs defaultGateway alsways
# depend on the same thing # depend on the same thing
{ {
imports = []; imports = [ ];
networking = { networking = {
interfaces.enX0.ipv4.addresses = [ interfaces.enX0.ipv4.addresses = [ {
{ address = "192.168.0.25";
address = "192.168.0.25"; prefixLength = 16;
prefixLength = 16; } ];
}
];
defaultGateway = "192.168.0.152"; defaultGateway = "192.168.0.152";
nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"]; nameservers = ["130.83.2.22" "130.83.56.60" "130.83.22.60" "130.82.22.63"];
}; };
} }

View file

@ -1,47 +1,47 @@
{ {lib, config, ...} :
lib,
config, let
... inherit (lib)
}: let
inherit
(lib)
mkEnableOption mkEnableOption
mkIf mkIf
mkOption mkOption
types types
; ;
cfg = config.impermanence; cfg = config.impermanence;
in { in
imports = [];
options.impermanence = { {
enable = mkEnableOption "impermanence"; imports = [ ];
storagePath = mkOption {
type = types.path;
default = "/persist";
description = "The path where persistent data is stored";
};
name = mkOption {
type = types.str;
default = "persist";
description = "the name of the persistent data store";
};
};
config = mkIf cfg.enable { options.impermanence = {
environment.persistence.${cfg.name} = { enable = mkEnableOption "impermanence";
persistentStoragePath = cfg.storagePath; storagePath = mkOption {
directories = [ type = types.path;
"/var/log" default = "/persist";
"/var/lib/nixos" description = "The path where persistent data is stored";
];
files = [
"/etc/ssh/ssh_host_ed25519_key"
"/etc/ssh/ssh_host_ed25519_key.pub"
"/etc/ssh/ssh_host_rsa_key"
"/etc/ssh/ssh_host_rsa_key.pub"
];
};
environment.etc.machine-id.source = "${cfg.storagePath}/machine-id";
}; };
name = mkOption {
type = types.str;
default = "persist";
description = "the name of the persistent data store";
};
};
config = mkIf cfg.enable {
environment.persistence.${cfg.name} = {
persistentStoragePath = cfg.storagePath;
directories = [
"/var/log"
"/var/lib/nixos"
];
files = [
"/etc/ssh/ssh_host_ed25519_key"
"/etc/ssh/ssh_host_ed25519_key.pub"
"/etc/ssh/ssh_host_rsa_key"
"/etc/ssh/ssh_host_rsa_key.pub"
];
};
environment.etc.machine-id.source = "${cfg.storagePath}/machine-id";
};
} }

View file

@ -1,21 +1,16 @@
{ {pkgs, config, lib, modulesPath, ...}:
config, let
lib, inherit (lib)
modulesPath,
...
}: let
inherit
(lib)
mkIf mkIf
mkEnableOption mkEnableOption
mkOption mkOption
head head;
;
inherit (lib.types) str; inherit (lib.types) str;
cfg = config.services.mathebau-jitsi; cfg = config.services.mathebau-jitsi;
in { in
{
imports = [(modulesPath + "/services/web-apps/jitsi-meet.nix")]; imports = [(modulesPath + "/services/web-apps/jitsi-meet.nix")];
options.services.mathebau-jitsi = { options.services.mathebau-jitsi = {
enable = mkEnableOption "mathebau jitsi service"; enable = mkEnableOption "mathebau jitsi service";
hostName = mkOption { hostName = mkOption {
@ -30,16 +25,16 @@ in {
config = mkIf cfg.enable { config = mkIf cfg.enable {
services.jitsi-meet = { services.jitsi-meet = {
enable = true; enable = true;
hostName = cfg.hostName;
config = { config = {
defaultLang = "de"; defaultLang = "de";
}; };
inherit (cfg) hostName;
}; };
services.jitsi-videobridge = { services.jitsi-videobridge = {
openFirewall = true; openFirewall = true;
nat = { nat = {
publicAddress = "130.83.2.184"; publicAddress = "130.83.2.184";
inherit (cfg) localAddress; localAddress = cfg.localAddress;
}; };
}; };
environment.persistence.${config.impermanence.name} = { environment.persistence.${config.impermanence.name} = {
@ -48,13 +43,13 @@ in {
"/var/lib/prosody" "/var/lib/prosody"
]; ];
}; };
#We are behind a reverse proxy that handles TLS #We are behind a reverse proxy that handles TLS
services.nginx.virtualHosts."${cfg.hostName}" = { services.nginx.virtualHosts."${cfg.hostName}" = {
enableACME = false; enableACME = false;
forceSSL = false; forceSSL = false;
}; };
#The network ports for HTTP(S) are not opened automatically #The network ports for HTTP(S) are not opened automatically
networking.firewall.allowedTCPPorts = [80 443]; networking.firewall.allowedTCPPorts = [ 80 443 ];
}; };
} }

View file

@ -1,34 +1,37 @@
{lib, ...}: {lib, ...} :
with lib; let with lib;
let
admins = { admins = {
nerf = { nerf = {
hashedPassword = "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7"; hashedPassword =
keys = [ "$y$j9T$SJcjUIcs3JYuM5oyxfEQa/$tUBQT07FK4cb9xm.A6ZKVnFIPNOYMOKC6Dt6hadCuJ7";
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2" keys = [
]; "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEdA4LpEGUUmN8esFyrNZXFb2GiBID9/S6zzhcnofQuP nerf@nerflap2"
];
}; };
gonne = { gonne = {
hashedPassword = "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/"; hashedPassword =
keys = [ "$6$EtGpHEcFkOi0yUWp$slXf0CvIUrhdqaoCrQ5YwtYu2IVuE1RGGst4fnDPRLWVm.lYx0ruvSAF2/vw/sLbW37ORJjlb0NHQ.kSG7cVY/";
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS" keys = [
]; "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFopCUadohY3wg9AoEup9TDRDMyEPSLsQoCnN4lsKCrr gonne@mathebau.de NixOS"
];
}; };
}; };
mkAdmin = name: { mkAdmin = name :
hashedPassword, {hashedPassword, keys}: {
keys,
}: {
"${name}" = { "${name}" = {
isNormalUser = true; isNormalUser = true;
createHome = true; createHome = true;
extraGroups = ["wheel"]; extraGroups = [ "wheel" ];
group = "users"; group = "users";
home = "/home/${name}"; home = "/home/${name}";
openssh.authorizedKeys = {inherit keys;}; openssh.authorizedKeys = { inherit keys; };
inherit hashedPassword; inherit hashedPassword;
}; };
}; };
in { in {
users.users = mkMerge (mapAttrsToList mkAdmin admins); users.users = mkMerge (mapAttrsToList mkAdmin admins);
} }

View file

@ -1,72 +1,62 @@
{ {pkgs, config, lib, modulesPath, ...} : {
pkgs,
lib, imports = [
modulesPath, ./admins.nix
... ./nix_keys.nix
}: { ./prometheusNodeExporter.nix
imports = [ (modulesPath + "/virtualisation/xen-domU.nix")
./admins.nix ../modules/impermanence.nix
./nix_keys.nix
./prometheusNodeExporter.nix
(modulesPath + "/virtualisation/xen-domU.nix")
../modules/impermanence.nix
]; ];
nix = { nix = {
extraOptions = '' extraOptions = ''
experimental-features = nix-command flakes experimental-features = nix-command flakes
builders-use-substitutes = true builders-use-substitutes = true
''; '';
};
networking = {
firewall = { # these shoud be default, but better make sure!
enable = true;
allowPing = true;
};
nftables.enable = true;
useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
# hosts = # TODO write something to autogenerate ip adresses!
};
users = {
mutableUsers = false;
users.root.hashedPassword = "!";
};
impermanence.enable = true;
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
environment = {
systemPackages = builtins.attrValues {
inherit (pkgs)
htop lsof tmux btop;
};
};
services = {
journald.extraConfig = "SystemMaxUse=5G";
nginx = {
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedTlsSettings = true;
}; };
networking = { openssh = {
firewall = { enable = true;
# these shoud be default, but better make sure! settings = {
enable = true; PermitRootLogin = "no";
allowPing = true; PasswordAuthentication = false;
};
nftables.enable = true;
useDHCP = false; # We don't speak DHCP and even if we would, we should enable it per interface
# hosts = # TODO write something to autogenerate ip adresses!
};
users = {
mutableUsers = false;
users.root.hashedPassword = "!";
};
impermanence.enable = true;
sops.age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
environment = {
systemPackages = builtins.attrValues {
inherit
(pkgs)
htop
lsof
tmux
btop
;
}; };
}; };
#Prevent clock drift due to interaction problem with xen hardware clock
services = { timesyncd.enable = lib.mkForce true;
journald.extraConfig = "SystemMaxUse=5G"; };
nginx = {
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedTlsSettings = true;
};
openssh = {
enable = true;
settings = {
PermitRootLogin = "no";
PasswordAuthentication = false;
};
};
#Prevent clock drift due to interaction problem with xen hardware clock
timesyncd.enable = lib.mkForce true;
};
} }

View file

@ -1,5 +1,5 @@
{ {
imports = []; imports = [ ];
nix.settings.trusted-public-keys = [ nix.settings.trusted-public-keys = [
"nerflap2-1:pDZCg0oo9PxNQxwVSQSvycw7WXTl53PGvVeZWvxuqJc=" "nerflap2-1:pDZCg0oo9PxNQxwVSQSvycw7WXTl53PGvVeZWvxuqJc="
"gonne.mathebau.de-1:FsXFyFiBFE/JxC9MCkt/WuiXjx5dkRI9RXj0FxOQrV0=" "gonne.mathebau.de-1:FsXFyFiBFE/JxC9MCkt/WuiXjx5dkRI9RXj0FxOQrV0="

View file

@ -1,14 +1,15 @@
{config, ...}: { {config, ...}:
imports = []; {
imports = [ ];
services.prometheus.exporters.node = { services.prometheus.exporters.node = {
enable = true; enable = true;
port = 9100; port = 9100;
# Aligned with https://git.rwth-aachen.de/fsdmath/server/prometheus/-/blob/main/node_exporter/etc/default/prometheus-node-exporter # Aligned with https://git.rwth-aachen.de/fsdmath/server/prometheus/-/blob/main/node_exporter/etc/default/prometheus-node-exporter
# It was compiled along the following steps: # It was compiled along the following steps:
# 1. Does the current Debian release supports the collector? # 1. Does the current Debian release supports the collector?
# 2. Is the collector depracated in the latest release? # 2. Is the collector depracated in the latest release?
# 3. Could you probably use the collected metrics for monitoring or are they useless because they make no sense in our context # 3. Could you probably use the collected metrics for monitoring or are they useless because they make no sense in our context
# (e.g. power adapter inside a VM, use fibre port connection)? # (e.g. power adapter inside a VM, use fibre port connection)?
disabledCollectors = [ disabledCollectors = [
"arp" "arp"
"bcache" "bcache"
@ -34,6 +35,6 @@
"processes" "processes"
]; ];
}; };
networking.firewall.allowedTCPPorts = [9100]; networking.firewall.allowedTCPPorts = [ 9100 ];
environment.persistence.${config.impermanence.name}.directories = ["/var/lib/${config.services.prometheus.stateDir}"]; environment.persistence.${config.impermanence.name}.directories = [ "/var/lib/${config.services.prometheus.stateDir}" ];
} }