From 574137b8aeb0de239a083a61c285dfc0345e05b3 Mon Sep 17 00:00:00 2001 From: Franck Cuny Date: Tue, 12 Aug 2025 09:35:09 -0700 Subject: move each machine configuration to a folder This will give me a bit more flexibility to configure things per machine in the future. --- machines/nixos/x86_64-linux/digitalocean.nix | 119 --------------------- machines/nixos/x86_64-linux/do-rproxy/default.nix | 119 +++++++++++++++++++++ .../nixos/x86_64-linux/synology-vm/default.nix | 110 +++++++++++++++++++ machines/nixos/x86_64-linux/vm-synology.nix | 110 ------------------- 4 files changed, 229 insertions(+), 229 deletions(-) delete mode 100644 machines/nixos/x86_64-linux/digitalocean.nix create mode 100644 machines/nixos/x86_64-linux/do-rproxy/default.nix create mode 100644 machines/nixos/x86_64-linux/synology-vm/default.nix delete mode 100644 machines/nixos/x86_64-linux/vm-synology.nix (limited to 'machines/nixos/x86_64-linux') diff --git a/machines/nixos/x86_64-linux/digitalocean.nix b/machines/nixos/x86_64-linux/digitalocean.nix deleted file mode 100644 index 1a011e1..0000000 --- a/machines/nixos/x86_64-linux/digitalocean.nix +++ /dev/null @@ -1,119 +0,0 @@ -{ - adminUser, - config, - lib, - modulesPath, - self, - ... -}: -{ - age = { - secrets = { - wireguard = { - file = "${self}/secrets/do/wireguard.age"; - }; - }; - }; - - imports = [ - (modulesPath + "/profiles/qemu-guest.nix") - (modulesPath + "/virtualisation/digital-ocean-config.nix") - "${self}/profiles/home-manager.nix" - "${self}/profiles/admin-user/user.nix" - "${self}/profiles/admin-user/home-manager.nix" - "${self}/profiles/disk/vm.nix" - "${self}/profiles/server.nix" - ]; - - disko.devices.disk.disk1.device = "/dev/vda"; - - # do not use DHCP, as DigitalOcean provisions IPs using cloud-init - networking.useDHCP = lib.mkForce false; - - networking.hostName = "do-jump"; - - boot.loader.grub = { - efiSupport = true; - efiInstallAsRemovable = true; - }; - - home-manager.users.${adminUser.name} = { - imports = [ - "${self}/home/profiles/minimal.nix" - ]; - }; - - # this one seems to always be broken - systemd.services.growpart.enable = false; - - # in order to get networking setup we need to enable it in cloud-init - # Disables all modules that do not work with NixOS - # Based on https://github.com/nix-community/nixos-anywhere-examples/blob/7f945ff0ae676c0eb77360b892add91328dd1f17/digitalocean.nix - services.cloud-init = { - enable = true; - network.enable = true; - settings = { - datasource_list = [ - "ConfigDrive" - "Digitalocean" - ]; - datasource.ConfigDrive = { }; - datasource.Digitalocean = { }; - # Based on https://github.com/canonical/cloud-init/blob/main/config/cloud.cfg.tmpl - cloud_init_modules = [ - "seed_random" - "bootcmd" - "write_files" - "growpart" - "resizefs" - "set_hostname" - "update_hostname" - "set_password" - ]; - cloud_config_modules = [ - "ssh-import-id" - "keyboard" - "runcmd" - "disable_ec2_metadata" - ]; - cloud_final_modules = [ - "write_files_deferred" - "puppet" - "chef" - "ansible" - "mcollective" - "salt_minion" - "reset_rmc" - "scripts_per_once" - "scripts_per_boot" - "scripts_user" - "ssh_authkey_fingerprints" - "keys_to_console" - "install_hotplug" - "phone_home" - "final_message" - ]; - }; - }; - - networking.wireguard = { - enable = true; - interfaces.wg0 = { - ips = [ "10.100.0.50/32" ]; - listenPort = 51871; - privateKeyFile = config.age.secrets.wireguard.path; - peers = [ - { - publicKey = "bJZyQoemudGJQox8Iegebm23c4BNVIxRPy1kmI2l904="; - allowedIPs = [ "10.100.0.0/24" ]; - persistentKeepalive = 25; - } - ]; - }; - }; - - networking.firewall.trustedInterfaces = [ "wg0" ]; - networking.firewall.allowedUDPPorts = [ 51871 ]; - - system.stateVersion = "25.05"; # Did you read the comment? -} diff --git a/machines/nixos/x86_64-linux/do-rproxy/default.nix b/machines/nixos/x86_64-linux/do-rproxy/default.nix new file mode 100644 index 0000000..1a011e1 --- /dev/null +++ b/machines/nixos/x86_64-linux/do-rproxy/default.nix @@ -0,0 +1,119 @@ +{ + adminUser, + config, + lib, + modulesPath, + self, + ... +}: +{ + age = { + secrets = { + wireguard = { + file = "${self}/secrets/do/wireguard.age"; + }; + }; + }; + + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + (modulesPath + "/virtualisation/digital-ocean-config.nix") + "${self}/profiles/home-manager.nix" + "${self}/profiles/admin-user/user.nix" + "${self}/profiles/admin-user/home-manager.nix" + "${self}/profiles/disk/vm.nix" + "${self}/profiles/server.nix" + ]; + + disko.devices.disk.disk1.device = "/dev/vda"; + + # do not use DHCP, as DigitalOcean provisions IPs using cloud-init + networking.useDHCP = lib.mkForce false; + + networking.hostName = "do-jump"; + + boot.loader.grub = { + efiSupport = true; + efiInstallAsRemovable = true; + }; + + home-manager.users.${adminUser.name} = { + imports = [ + "${self}/home/profiles/minimal.nix" + ]; + }; + + # this one seems to always be broken + systemd.services.growpart.enable = false; + + # in order to get networking setup we need to enable it in cloud-init + # Disables all modules that do not work with NixOS + # Based on https://github.com/nix-community/nixos-anywhere-examples/blob/7f945ff0ae676c0eb77360b892add91328dd1f17/digitalocean.nix + services.cloud-init = { + enable = true; + network.enable = true; + settings = { + datasource_list = [ + "ConfigDrive" + "Digitalocean" + ]; + datasource.ConfigDrive = { }; + datasource.Digitalocean = { }; + # Based on https://github.com/canonical/cloud-init/blob/main/config/cloud.cfg.tmpl + cloud_init_modules = [ + "seed_random" + "bootcmd" + "write_files" + "growpart" + "resizefs" + "set_hostname" + "update_hostname" + "set_password" + ]; + cloud_config_modules = [ + "ssh-import-id" + "keyboard" + "runcmd" + "disable_ec2_metadata" + ]; + cloud_final_modules = [ + "write_files_deferred" + "puppet" + "chef" + "ansible" + "mcollective" + "salt_minion" + "reset_rmc" + "scripts_per_once" + "scripts_per_boot" + "scripts_user" + "ssh_authkey_fingerprints" + "keys_to_console" + "install_hotplug" + "phone_home" + "final_message" + ]; + }; + }; + + networking.wireguard = { + enable = true; + interfaces.wg0 = { + ips = [ "10.100.0.50/32" ]; + listenPort = 51871; + privateKeyFile = config.age.secrets.wireguard.path; + peers = [ + { + publicKey = "bJZyQoemudGJQox8Iegebm23c4BNVIxRPy1kmI2l904="; + allowedIPs = [ "10.100.0.0/24" ]; + persistentKeepalive = 25; + } + ]; + }; + }; + + networking.firewall.trustedInterfaces = [ "wg0" ]; + networking.firewall.allowedUDPPorts = [ 51871 ]; + + system.stateVersion = "25.05"; # Did you read the comment? +} diff --git a/machines/nixos/x86_64-linux/synology-vm/default.nix b/machines/nixos/x86_64-linux/synology-vm/default.nix new file mode 100644 index 0000000..05d4d8c --- /dev/null +++ b/machines/nixos/x86_64-linux/synology-vm/default.nix @@ -0,0 +1,110 @@ +{ + lib, + adminUser, + config, + self, + ... +}: +{ + age = { + secrets = { + restic_gcs_credentials = { + file = "${self}/secrets/restic_gcs_credentials.age"; + }; + restic_password = { + file = "${self}/secrets/restic_password.age"; + }; + cloudflared-tunnel = { + file = "${self}/secrets/cloudflared_cragmont.age"; + }; + cloudflared-cert = { + file = "${self}/secrets/cloudflared_cert.age"; + }; + nas_client_credentials = { + file = "${self}/secrets/nas_client.age"; + }; + wireguard = { + file = "${self}/secrets/vm-synology/wireguard.age"; + }; + }; + }; + + imports = [ + "${self}/profiles/home-manager.nix" + "${self}/profiles/admin-user/user.nix" + "${self}/profiles/admin-user/home-manager.nix" + "${self}/profiles/hardware/synology.nix" + "${self}/profiles/disk/vm.nix" + "${self}/profiles/server.nix" + "${self}/profiles/git-server.nix" + ]; + + # Use the systemd-boot EFI boot loader. + boot.loader.efi.canTouchEfiVariables = true; + boot.loader.systemd-boot.enable = true; + + networking.hostName = "vm-synology"; + networking.useDHCP = lib.mkDefault true; + systemd.network.wait-online.anyInterface = lib.mkDefault config.networking.useDHCP; + + home-manager.users.${adminUser.name} = { + imports = [ + "${self}/home/profiles/minimal.nix" + ]; + }; + + my.modules.nas-client = { + enable = true; + volumes = { + data = { + server = "192.168.1.68"; + remotePath = "backups"; + mountPoint = "/data/backups"; + uid = adminUser.uid; + }; + }; + }; + + my.modules.backups = { + enable = true; + passwordFile = config.age.secrets.restic_password.path; + remote = { + googleProjectId = "fcuny-infra"; + googleCredentialsFile = config.age.secrets.restic_gcs_credentials.path; + }; + }; + + users.users.builder = { + openssh.authorizedKeys.keys = [ + # my personal key + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi" + # remote builder ssh key + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGFGxdplt9WwGjdhoYkmPe2opZMJShtpqnGCI+swrgvw" + ]; + isNormalUser = true; + group = "nogroup"; + }; + + nix.settings.trusted-users = [ "builder" ]; + + networking.wireguard = { + enable = true; + interfaces.wg0 = { + ips = [ "10.100.0.40/32" ]; + listenPort = 51871; + privateKeyFile = config.age.secrets.wireguard.path; + peers = [ + { + publicKey = "I+l/sWtfXcdunz2nZ05rlDexGew30ZuDxL0DVTTK318="; + allowedIPs = [ "10.100.0.0/24" ]; + endpoint = "165.232.158.110:51871"; + persistentKeepalive = 25; + } + ]; + }; + }; + + networking.firewall.allowedUDPPorts = [ 51871 ]; + + system.stateVersion = "23.11"; # Did you read the comment? +} diff --git a/machines/nixos/x86_64-linux/vm-synology.nix b/machines/nixos/x86_64-linux/vm-synology.nix deleted file mode 100644 index 05d4d8c..0000000 --- a/machines/nixos/x86_64-linux/vm-synology.nix +++ /dev/null @@ -1,110 +0,0 @@ -{ - lib, - adminUser, - config, - self, - ... -}: -{ - age = { - secrets = { - restic_gcs_credentials = { - file = "${self}/secrets/restic_gcs_credentials.age"; - }; - restic_password = { - file = "${self}/secrets/restic_password.age"; - }; - cloudflared-tunnel = { - file = "${self}/secrets/cloudflared_cragmont.age"; - }; - cloudflared-cert = { - file = "${self}/secrets/cloudflared_cert.age"; - }; - nas_client_credentials = { - file = "${self}/secrets/nas_client.age"; - }; - wireguard = { - file = "${self}/secrets/vm-synology/wireguard.age"; - }; - }; - }; - - imports = [ - "${self}/profiles/home-manager.nix" - "${self}/profiles/admin-user/user.nix" - "${self}/profiles/admin-user/home-manager.nix" - "${self}/profiles/hardware/synology.nix" - "${self}/profiles/disk/vm.nix" - "${self}/profiles/server.nix" - "${self}/profiles/git-server.nix" - ]; - - # Use the systemd-boot EFI boot loader. - boot.loader.efi.canTouchEfiVariables = true; - boot.loader.systemd-boot.enable = true; - - networking.hostName = "vm-synology"; - networking.useDHCP = lib.mkDefault true; - systemd.network.wait-online.anyInterface = lib.mkDefault config.networking.useDHCP; - - home-manager.users.${adminUser.name} = { - imports = [ - "${self}/home/profiles/minimal.nix" - ]; - }; - - my.modules.nas-client = { - enable = true; - volumes = { - data = { - server = "192.168.1.68"; - remotePath = "backups"; - mountPoint = "/data/backups"; - uid = adminUser.uid; - }; - }; - }; - - my.modules.backups = { - enable = true; - passwordFile = config.age.secrets.restic_password.path; - remote = { - googleProjectId = "fcuny-infra"; - googleCredentialsFile = config.age.secrets.restic_gcs_credentials.path; - }; - }; - - users.users.builder = { - openssh.authorizedKeys.keys = [ - # my personal key - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBkozy+X96u5ciX766bJ/AyQ3xm1tXZTIr5+4PVFZFi" - # remote builder ssh key - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGFGxdplt9WwGjdhoYkmPe2opZMJShtpqnGCI+swrgvw" - ]; - isNormalUser = true; - group = "nogroup"; - }; - - nix.settings.trusted-users = [ "builder" ]; - - networking.wireguard = { - enable = true; - interfaces.wg0 = { - ips = [ "10.100.0.40/32" ]; - listenPort = 51871; - privateKeyFile = config.age.secrets.wireguard.path; - peers = [ - { - publicKey = "I+l/sWtfXcdunz2nZ05rlDexGew30ZuDxL0DVTTK318="; - allowedIPs = [ "10.100.0.0/24" ]; - endpoint = "165.232.158.110:51871"; - persistentKeepalive = 25; - } - ]; - }; - }; - - networking.firewall.allowedUDPPorts = [ 51871 ]; - - system.stateVersion = "23.11"; # Did you read the comment? -} -- cgit v1.2.3