rename l001->2
This commit is contained in:
RingOfStorms (Joshua Bell)
parent
737b51da0b
commit
6fa1cec887
9 changed files with 34 additions and 16 deletions
7
hosts/linode/l002/configuration.nix
Normal file
7
hosts/linode/l002/configuration.nix
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
{
|
||||
...
|
||||
}:
|
||||
{
|
||||
boot.loader.grub.enable = true;
|
||||
system.stateVersion = "24.11";
|
||||
}
|
||||
245
hosts/linode/l002/flake.lock
generated
Normal file
245
hosts/linode/l002/flake.lock
generated
Normal file
|
|
@ -0,0 +1,245 @@
|
|||
{
|
||||
"nodes": {
|
||||
"deploy-rs": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"utils": "utils"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1727447169,
|
||||
"narHash": "sha256-3KyjMPUKHkiWhwR91J1YchF6zb6gvckCAY1jOE+ne0U=",
|
||||
"owner": "serokell",
|
||||
"repo": "deploy-rs",
|
||||
"rev": "aa07eb05537d4cd025e2310397a6adcedfe72c76",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "serokell",
|
||||
"repo": "deploy-rs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1696426674,
|
||||
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "edolstra",
|
||||
"repo": "flake-compat",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"mod_common": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1736191002,
|
||||
"narHash": "sha256-t39PCeJFgIXzniqjUIIFnbv6AE15WyoPTCE3k3Xuyz0=",
|
||||
"ref": "mod_common",
|
||||
"rev": "ac3c0c2422842edba1887279bddd02b895ec5ed2",
|
||||
"revCount": 4,
|
||||
"type": "git",
|
||||
"url": "https://git.joshuabell.xyz/dotfiles"
|
||||
},
|
||||
"original": {
|
||||
"ref": "mod_common",
|
||||
"type": "git",
|
||||
"url": "https://git.joshuabell.xyz/dotfiles"
|
||||
}
|
||||
},
|
||||
"mod_nebula": {
|
||||
"locked": {
|
||||
"lastModified": 1735839301,
|
||||
"narHash": "sha256-f2JlNaCrA3BA8fPT0uThiuiIZX5ehDe0lPlSLL/QMgY=",
|
||||
"ref": "mod_nebula",
|
||||
"rev": "38c50b65c66740566b39529bbd91624b01b6ea2a",
|
||||
"revCount": 3,
|
||||
"type": "git",
|
||||
"url": "https://git.joshuabell.xyz/dotfiles"
|
||||
},
|
||||
"original": {
|
||||
"ref": "mod_nebula",
|
||||
"type": "git",
|
||||
"url": "https://git.joshuabell.xyz/dotfiles"
|
||||
}
|
||||
},
|
||||
"mod_ros_stormd": {
|
||||
"inputs": {
|
||||
"ringofstorms-stormd": "ringofstorms-stormd"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1735796563,
|
||||
"narHash": "sha256-YjXJu/5Hcl7YpcpiHLd5wqCFUlJp39MM9CfQKhdpkk8=",
|
||||
"ref": "mod_stormd",
|
||||
"rev": "a184895fd3f32051499dfad8eb2cb18faaec4188",
|
||||
"revCount": 1,
|
||||
"type": "git",
|
||||
"url": "https://git.joshuabell.xyz/dotfiles"
|
||||
},
|
||||
"original": {
|
||||
"ref": "mod_stormd",
|
||||
"type": "git",
|
||||
"url": "https://git.joshuabell.xyz/dotfiles"
|
||||
}
|
||||
},
|
||||
"nix-filter": {
|
||||
"locked": {
|
||||
"lastModified": 1710156097,
|
||||
"narHash": "sha256-1Wvk8UP7PXdf8bCCaEoMnOT1qe5/Duqgj+rL8sRQsSM=",
|
||||
"owner": "numtide",
|
||||
"repo": "nix-filter",
|
||||
"rev": "3342559a24e85fc164b295c3444e8a139924675b",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "nix-filter",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1702272962,
|
||||
"narHash": "sha256-D+zHwkwPc6oYQ4G3A1HuadopqRwUY/JkMwHz1YF7j4Q=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "e97b3e4186bcadf0ef1b6be22b8558eab1cdeb5d",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1728888510,
|
||||
"narHash": "sha256-nsNdSldaAyu6PE3YUA+YQLqUDJh+gRbBooMMekZJwvI=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a3c0b3b21515f74fd2665903d4ce6bc4dc81c77c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1736200483,
|
||||
"narHash": "sha256-JO+lFN2HsCwSLMUWXHeOad6QUxOuwe9UOAF/iSl1J4I=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "3f0a8ac25fb674611b98089ca3a5dd6480175751",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nixos",
|
||||
"ref": "nixos-24.11",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"ringofstorms-stormd": {
|
||||
"inputs": {
|
||||
"nix-filter": "nix-filter",
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"rust-overlay": "rust-overlay"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1735420577,
|
||||
"narHash": "sha256-2HWEALz0PVJCiP/2iZuDMj4qyukXR5IxNKFxT1NAMlQ=",
|
||||
"ref": "refs/heads/master",
|
||||
"rev": "7edf6888a460708889fabea2c762d4dfed4fa64f",
|
||||
"revCount": 51,
|
||||
"type": "git",
|
||||
"url": "ssh://git.joshuabell.xyz:3032/stormd"
|
||||
},
|
||||
"original": {
|
||||
"type": "git",
|
||||
"url": "ssh://git.joshuabell.xyz:3032/stormd"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"deploy-rs": "deploy-rs",
|
||||
"mod_common": "mod_common",
|
||||
"mod_nebula": "mod_nebula",
|
||||
"mod_ros_stormd": "mod_ros_stormd",
|
||||
"nixpkgs": "nixpkgs_3"
|
||||
}
|
||||
},
|
||||
"rust-overlay": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
"mod_ros_stormd",
|
||||
"ringofstorms-stormd",
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1729218602,
|
||||
"narHash": "sha256-KDmYxpkFWa0Go0WnOpkgQOypVaQxbwgpEutET5ey1VQ=",
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"rev": "9051466c82b9b3a6ba9e06be99621ad25423ec94",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "oxalica",
|
||||
"repo": "rust-overlay",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"utils": {
|
||||
"inputs": {
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1701680307,
|
||||
"narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "4022d587cbbfd70fe950c1e2083a02621806a725",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
96
hosts/linode/l002/flake.nix
Normal file
96
hosts/linode/l002/flake.nix
Normal file
|
|
@ -0,0 +1,96 @@
|
|||
{
|
||||
inputs = {
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-24.11";
|
||||
deploy-rs.url = "github:serokell/deploy-rs";
|
||||
|
||||
mod_common.url = "git+https://git.joshuabell.xyz/dotfiles?ref=mod_common";
|
||||
mod_common.inputs.nixpkgs.follows = "nixpkgs";
|
||||
mod_ros_stormd.url = "git+https://git.joshuabell.xyz/dotfiles?ref=mod_stormd";
|
||||
mod_nebula.url = "git+https://git.joshuabell.xyz/dotfiles?ref=mod_nebula";
|
||||
};
|
||||
|
||||
outputs =
|
||||
{
|
||||
self,
|
||||
nixpkgs,
|
||||
deploy-rs,
|
||||
...
|
||||
}@inputs:
|
||||
let
|
||||
configuration_name = "l002";
|
||||
lib = nixpkgs.lib;
|
||||
in
|
||||
{
|
||||
deploy = {
|
||||
sshUser = "root";
|
||||
sshOpts = [
|
||||
"-i"
|
||||
"/run/agenix/nix2linode"
|
||||
];
|
||||
nodes.${configuration_name} = {
|
||||
hostname = "172.234.26.141";
|
||||
profiles.system = {
|
||||
user = "root";
|
||||
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.${configuration_name};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
nixosConfigurations = {
|
||||
nixos = self.nixosConfigurations.${configuration_name};
|
||||
"${configuration_name}" =
|
||||
let
|
||||
auto_modules = builtins.concatMap (
|
||||
input:
|
||||
lib.optionals
|
||||
(builtins.hasAttr "nixosModules" input && builtins.hasAttr "default" input.nixosModules)
|
||||
[
|
||||
input.nixosModules.default
|
||||
]
|
||||
) (builtins.attrValues inputs);
|
||||
in
|
||||
(lib.nixosSystem {
|
||||
modules = [
|
||||
./configuration.nix
|
||||
./hardware-configuration.nix
|
||||
./linode.nix
|
||||
./nginx.nix
|
||||
(
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
users.users.root.openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFLBVLiPbhVG+riNNpkvXnNtOioByV3CQwtY9gu8pstp nix2l002"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJuo6L6V52AzdQIK6fWW9s0aX1yKUUTXbPd8v8IU9p2o nix2linode"
|
||||
];
|
||||
mods = {
|
||||
common = {
|
||||
disableRemoteBuildsOnLio = true;
|
||||
systemName = configuration_name;
|
||||
allowUnfree = true;
|
||||
primaryUser = "luser";
|
||||
docker = true;
|
||||
users = {
|
||||
luser = {
|
||||
extraGroups = [
|
||||
"wheel"
|
||||
"networkmanager"
|
||||
];
|
||||
isNormalUser = true;
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFLBVLiPbhVG+riNNpkvXnNtOioByV3CQwtY9gu8pstp nix2l002"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJuo6L6V52AzdQIK6fWW9s0aX1yKUUTXbPd8v8IU9p2o nix2linode"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
)
|
||||
] ++ auto_modules;
|
||||
specialArgs = {
|
||||
inherit inputs;
|
||||
};
|
||||
});
|
||||
};
|
||||
};
|
||||
}
|
||||
34
hosts/linode/l002/hardware-configuration.nix
Normal file
34
hosts/linode/l002/hardware-configuration.nix
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "virtio_pci" "virtio_scsi" "ahci" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/3612d65e-719c-4b33-af08-561b790d6d33";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/f1408ea6-59a0-11ed-bc9d-525400000001"; }
|
||||
];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp0s5.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
}
|
||||
|
||||
33
hosts/linode/l002/linode.nix
Normal file
33
hosts/linode/l002/linode.nix
Normal file
|
|
@ -0,0 +1,33 @@
|
|||
{ config, pkgs, ... }:
|
||||
{
|
||||
# https://www.linode.com/docs/guides/install-nixos-on-linode/#configure-nixos
|
||||
boot.kernelParams = [ "console=ttyS0,19200n8" ];
|
||||
boot.loader.grub.extraConfig = ''
|
||||
serial --speed=19200 --unit=0 --word=8 --parity=no --stop=1;
|
||||
terminal_input serial;
|
||||
terminal_output serial
|
||||
'';
|
||||
|
||||
boot.loader.grub.forceInstall = true;
|
||||
boot.loader.grub.device = "nodev";
|
||||
boot.loader.timeout = 10;
|
||||
|
||||
# TODO disable after first startup with ssh keys
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
settings.PasswordAuthentication = false;
|
||||
};
|
||||
users.users.root.openssh.authorizedKeys.keys = config.users.users.luser.openssh.authorizedKeys.keys;
|
||||
|
||||
networking.usePredictableInterfaceNames = false;
|
||||
networking.useDHCP = false; # Disable DHCP globally as we will not need it.
|
||||
# required for ssh?
|
||||
networking.interfaces.eth0.useDHCP = true;
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
inetutils
|
||||
mtr
|
||||
sysstat
|
||||
];
|
||||
}
|
||||
167
hosts/linode/l002/nginx.nix
Normal file
167
hosts/linode/l002/nginx.nix
Normal file
|
|
@ -0,0 +1,167 @@
|
|||
{
|
||||
config,
|
||||
...
|
||||
}:
|
||||
{
|
||||
|
||||
# JUST A TEST TODO remove
|
||||
containers.wasabi = {
|
||||
ephemeral = true;
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = "192.168.100.2";
|
||||
localAddress = "192.168.100.11";
|
||||
config =
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
system.stateVersion = "24.11";
|
||||
services.httpd.enable = true;
|
||||
services.httpd.adminAddr = "foo@example.org";
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.oci-containers = {
|
||||
backend = "docker";
|
||||
# TODO remove test
|
||||
containers = {
|
||||
# Example of defining a container from the compose file
|
||||
"test_nginx" = {
|
||||
# autoStart = true; this is default true
|
||||
image = "nginx:latest";
|
||||
ports = [
|
||||
"127.0.0.1:8085:80"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
security.acme.acceptTerms = true;
|
||||
security.acme.email = "admin@joshuabell.xyz";
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
virtualHosts = {
|
||||
# PROXY HOSTS
|
||||
"chat.joshuabell.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyWebsockets = true;
|
||||
proxyPass = "http://10.20.40.104:3080";
|
||||
};
|
||||
};
|
||||
"gist.joshuabell.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://10.20.40.190:6157";
|
||||
};
|
||||
};
|
||||
"git.joshuabell.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://10.20.40.190:6610";
|
||||
};
|
||||
};
|
||||
"nexus.l002.joshuabell.xyz" = {
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:42291";
|
||||
};
|
||||
};
|
||||
"nexus.joshuabell.xyz" = {
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:42291";
|
||||
};
|
||||
};
|
||||
|
||||
# Redirect self IP to domain
|
||||
"172.234.26.141" = {
|
||||
locations."/" = {
|
||||
return = "301 https://joshuabell.xyz";
|
||||
};
|
||||
};
|
||||
"2600:3c06::f03c:95ff:fe2c:2806" = {
|
||||
locations."/" = {
|
||||
return = "301 https://joshuabell.xyz";
|
||||
};
|
||||
};
|
||||
|
||||
"www.joshuabell.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
return = "301 https://joshuabell.xyz";
|
||||
};
|
||||
};
|
||||
"joshuabell.xyz" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
# return = "200 '<html>Hello World</html>'";
|
||||
extraConfig = ''
|
||||
default_type text/html;
|
||||
return 200 '
|
||||
<html>
|
||||
<div style="display: flex;width:100vw;height:100vh;justify-content: center;align-items:center;text-align:center;overflow:hidden">
|
||||
In the void you roam,</br>
|
||||
A page that cannot be found-</br>
|
||||
Turn back, seek anew.
|
||||
</div>
|
||||
</html>
|
||||
';
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
"www.ellalala.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
return = "301 https://ellalala.com";
|
||||
};
|
||||
};
|
||||
"ellalala.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations."/" = {
|
||||
return = "444";
|
||||
};
|
||||
};
|
||||
|
||||
"_" = {
|
||||
default = true;
|
||||
locations."/" = {
|
||||
return = "444"; # 404 for not found or 444 for drop
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# STREAMS
|
||||
streamConfig = ''
|
||||
server {
|
||||
listen 3032;
|
||||
proxy_pass 10.20.40.190:6611;
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
80 # web http
|
||||
443 # web https
|
||||
3032 # git ssh stream
|
||||
];
|
||||
|
||||
networking.firewall.allowedUDPPorts = [
|
||||
4242 # nebula
|
||||
];
|
||||
}
|
||||
|
||||
# TODO
|
||||
Loading…
Add table
Add a link
Reference in a new issue