feat(167.233.1.14): migrate all containers here

2023-03-08 19:13:59 +01:00 · 2023-03-08 19:13:59 +01:00 · 7a10782170
commit 7a10782170
parent 855c463a93
28 changed files with 310 additions and 1022 deletions
--- a/nix/os/devices/167.233.1.14/README.md
+++ b/nix/os/devices/167.233.1.14/README.md
@ -0,0 +1,18 @@
+## bootstrapping
+
+```
+systemctl stop dhcpcd
+ip a add 167.233.1.14/29 dev ens18
+ip l set mtu 1400 dev ens18
+ip r add default via 167.233.1.9
+echo "nameserver 1.1.1.1" >> /etc/resolv.conf
+mkdir ~/.ssh
+```
+
+### ssh key
+
+run locally:
+
+```
+ssh-add -L | tr \\n \\r | xdotool selectwindow windowfocus type --delay 50 --window %@ --file -
+```
--- a/nix/os/devices/167.233.1.14/configuration.nix
+++ b/nix/os/devices/167.233.1.14/configuration.nix
@ -1,7 +1,8 @@
-{...}: {
-  disabledModules = [];
+{ ... }: {
+  disabledModules = [ ];
  imports = [
    ../../profiles/common/configuration.nix
+    ../../modules/opinionatedDisk.nix

    ./system.nix
    ./hw.nix
--- a/nix/os/devices/167.233.1.14/hw.nix
+++ b/nix/os/devices/167.233.1.14/hw.nix
@ -1,4 +1,5 @@
-{...}: let
+{ ... }:
+let
  stage1Modules = [
    "virtio_balloon"
    "virtio_scsi"
@ -10,36 +11,17 @@

    "virtio_blk"
    "virtio_ring"
-    "bochs_drm"
    "ata_piix"
    "pata_acpi"
    "ata_generic"
  ];
-in {
-  fileSystems."/boot" = {
-    device = "/dev/disk/by-uuid/354fb107-2f4a-42ad-80dd-9dddb61bfd02";
-    fsType = "ext4";
+in
+{
+  hardware.opinionatedDisk = {
+    enable = true;
+    encrypted = false;
+    diskId = "virtio-virtio-paeNi8Fof9Oe";
  };

-  fileSystems."/" = {
-    device = "/dev/disk/by-uuid/993cce35-cc1f-40cc-b07a-5ea58b99fb5b";
-    fsType = "btrfs";
-    options = ["subvol=root"];
-    neededForBoot = true;
-  };
-
-  fileSystems."/home" = {
-    device = "/dev/disk/by-uuid/993cce35-cc1f-40cc-b07a-5ea58b99fb5b";
-    fsType = "btrfs";
-    options = ["subvol=home"];
-    neededForBoot = true;
-  };
-
-  swapDevices = [{device = "/dev/disk/by-uuid/d16b5f4a-f38c-41c6-8aae-1625be815f9d";}];
-
-  boot.loader.grub = {device = "/dev/vda";};
-
-  boot.initrd.availableKernelModules = stage1Modules;
  boot.initrd.kernelModules = stage1Modules;
-  boot.extraModprobeConfig = "";
 }
--- a/nix/os/devices/167.233.1.14/pkg.nix
+++ b/nix/os/devices/167.233.1.14/pkg.nix
@ -1,16 +1,14 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
+{ config
+, pkgs
+, lib
+, ...
 }: {
  nixpkgs.config.packageOverrides = pkgs:
    with pkgs; {
      nixPath =
        (import ../../../default.nix {
          versionsPath = ./versions.nix;
-        })
-        .nixPath;
+        }).nixPath;
    };
  home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix {
    inherit pkgs;
@ -23,13 +21,4 @@
      pkgs.xclip
    ];
  };
-
-  nix.buildMachines = [
-    {
-      hostName = "localhost";
-      system = "x86_64-linux";
-      supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
-      maxJobs = 4;
-    }
-  ];
 }
--- a/nix/os/devices/167.233.1.14/system.nix
+++ b/nix/os/devices/167.233.1.14/system.nix
@ -1,20 +1,14 @@
-{
-  pkgs,
-  lib,
-  config,
-  ...
-}: let
+{ pkgs
+, lib
+, config
+, ...
+}:
+let
  keys = import ../../../variables/keys.nix;
-in {
-  nix.binaryCaches = ["https://cache.holo.host"];
-
-  nix.binaryCachePublicKeys = [
-    "cache.holo.host-1:lNXIXtJgS9Iuw4Cu6X0HINLu9sTfcjEntnrgwMQIMcE="
-    "cache.holo.host-2:ZJCkX3AUYZ8soxTLfTb60g+F3MkWD7hkH9y8CgqwhDQ="
-  ];
-
+in
+{
  # TASK: new device
-  networking.hostName = "sj-pvehtz-0"; # Define your hostname.
+  networking.hostName = "sj-pvehtz0"; # Define your hostname.
  # networking.domain =  "";

  networking.firewall.enable = true;
@ -26,6 +20,8 @@ in {

  networking.usePredictableInterfaceNames = false;

+  networking.dhcpcd.enable = false;
+
  networking.interfaces.eth0 = {
    mtu = 1400;
    useDHCP = false;
@ -35,7 +31,7 @@ in {
        "prefixLength" = 29;
      }
    ];
-    ipv6.addresses = [];
+    ipv6.addresses = [ ];
  };

  networking.defaultGateway = {
@ -48,11 +44,11 @@ in {
    interface = "eth0";
  };

-  networking.nameservers = ["1.1.1.1"];
+  networking.nameservers = [ "1.1.1.1" ];

  networking.nat = {
    enable = true;
-    internalInterfaces = ["ve-+"];
+    internalInterfaces = [ "ve-+" ];
    externalInterface = "eth0";
  };

@ -60,45 +56,54 @@ in {
  # services.kubernetes.roles = ["master" "node"];

  # virtualization
-  virtualisation = {docker.enable = true;};
+  virtualisation = { docker.enable = true; };

  services.spice-vdagentd.enable = true;
  services.qemuGuest.enable = true;

-  systemd.services."sshd-status" = {
-    enable = true;
-    description = "sshd-status service";
-    path = [pkgs.systemd];
-    script = ''
-      systemctl status sshd | grep -i tasks
-    '';
-  };
+  nix.gc = { automatic = true; };

-  systemd.services.sshd.serviceConfig = {TasksMax = 32;};
-
-  systemd.timers."sshd-status" = {
-    description = "Timer to trigger sshd-status periodically";
-    enable = true;
-    wantedBy = ["timer.target" "multi-user.target"];
-    timerConfig = {
-      OnActiveSec = "360s";
-      OnUnitActiveSec = "360s";
-      AccuracySec = "1s";
-      Unit = "sshd-status.service";
-    };
-  };
-
-  nix.gc = {automatic = true;};
-
-  networking.useHostResolvConf = true;
+  # networking.useHostResolvConf = true;

  services.openssh.forwardX11 = true;

+  containers = {
+    mailserver = import ../../containers/mailserver.nix {
+      autoStart = true;
+
+      hostAddress = "192.168.100.10";
+      localAddress = "192.168.100.11";
+
+      imapsPort = 993;
+      sievePort = 4190;
+    };
+
+    webserver = import ../../containers/webserver.nix
+      {
+        autoStart = true;
+
+        hostAddress = "192.168.100.12";
+        localAddress = "192.168.100.13";
+
+        httpPort = 80;
+        httpsPort = 443;
+      };
+
+    syncthing = import ../../containers/syncthing.nix {
+      autoStart = true;
+
+      hostAddress = "192.168.100.14";
+      localAddress = "192.168.100.15";
+
+      syncthingPort = 22000;
+    };
+  };
+
  # This value determines the NixOS release from which the default
  # settings for stateful data, like file locations and database versions
  # on your system were taken. It‘s perfectly fine and recommended to leave
  # this value at the release version of the first install of this system.
  # Before changing this value read the documentation for this option
  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
-  system.stateVersion = "20.09"; # Did you read the comment?
+  system.stateVersion = "22.11"; # Did you read the comment?
 }
--- a/nix/os/devices/167.233.1.14/versions.nix
+++ b/nix/os/devices/167.233.1.14/versions.nix
@ -1,45 +1,37 @@
 let
  nixpkgs = {
    url = "https://github.com/NixOS/nixpkgs/";
-    ref = "nixos-21.11";
-    rev = "e34c5379866833f41e2a36f309912fa675d687c7";
+    ref = "nixos-22.11";
+    rev = ''
+      a7cc81913bb3cd1ef05ed0ece048b773e1839e51'';
  };
-in {
+in
+{
  inherit nixpkgs;
+  nixos = nixpkgs // { suffix = "/nixos"; };
  "channels-nixos-stable" = nixpkgs;
-  "channels-nixos-21.05" = {
-    url = "https://github.com/NixOS/nixpkgs/";
-    ref = "nixos-21.05";
-    rev = "";
-  };
-  "channels-nixos-20.09" = {
-    url = "https://github.com/NixOS/nixpkgs/";
-    ref = "nixos-20.09";
-    rev = "1c1f5649bb9c1b0d98637c8c365228f57126f361";
-  };
-  "channels-nixos-20.03" = {
-    url = "https://github.com/NixOS/nixpkgs/";
-    ref = "nixos-20.03";
-    rev = "1db42b7fe3878f3f5f7a4f2dc210772fd080e205";
-  };
-  "channels-nixos-19.09" = {
-    url = "https://github.com/NixOS/nixpkgs/";
-    ref = "nixos-19.09";
-    rev = "75f4ba05c63be3f147bcc2f7bd4ba1f029cedcb1";
-  };
  "channels-nixos-unstable" = {
    url = "https://github.com/NixOS/nixpkgs/";
    ref = "nixos-unstable";
-    rev = "c71f061c68ba8ce53471b767d5049cbd0f3d8490";
+    rev = ''
+      c707238dc262923da5a53a5a11914117caac07a2'';
+  };
+  "channels-nixos-unstable-small" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-unstable-small";
+    rev = ''
+      09c509a5075931382582dee69f3e44bf1535c092'';
  };
  "nixpkgs-master" = {
    url = "https://github.com/NixOS/nixpkgs/";
    ref = "master";
-    rev = "fb881b80f64d1b672135533a8c2fbc86e6ed8898";
+    rev = ''
+      3d57138bd9abe31bae25704cebaab7527010cc5e'';
  };
  "home-manager-module" = {
    url = "https://github.com/nix-community/home-manager";
-    ref = "release-21.05";
-    rev = "7329ffc6e911106494183557fc249180d5422929";
+    ref = "release-22.11";
+    rev = ''
+      b0be47978de5cfd729a79c3f57ace4c86364ff45'';
  };
 }
--- a/nix/os/devices/167.233.1.14/versions.tmpl.nix
+++ b/nix/os/devices/167.233.1.14/versions.tmpl.nix
@ -1,42 +1,16 @@
 let
  nixpkgs = {
    url = "https://github.com/NixOS/nixpkgs/";
-    ref = "nixos-21.11";
+    ref = "nixos-22.11";
    rev = ''
-      <% git ls-remote https://github.com/nixos/nixpkgs nixos-21.11 | awk '{ print $1 }' | tr -d '
+      <% git ls-remote https://github.com/nixos/nixpkgs nixos-22.11 | awk '{ print $1 }' | tr -d '
      ' -%>'';
  };
-in {
+in
+{
  inherit nixpkgs;
+  nixos = nixpkgs // { suffix = "/nixos"; };
  "channels-nixos-stable" = nixpkgs;
-  "channels-nixos-21.05" = {
-    url = "https://github.com/NixOS/nixpkgs/";
-    ref = "nixos-21.05";
-    rev = ''
-      <% git ls-remote https://github.com/nixos/nixpkgs nixos-20.05 | awk '{ print $1 }' | tr -d '
-      ' -%>'';
-  };
-  "channels-nixos-20.09" = {
-    url = "https://github.com/NixOS/nixpkgs/";
-    ref = "nixos-20.09";
-    rev = ''
-      <% git ls-remote https://github.com/nixos/nixpkgs nixos-20.09 | awk '{ print $1 }' | tr -d '
-      ' -%>'';
-  };
-  "channels-nixos-20.03" = {
-    url = "https://github.com/NixOS/nixpkgs/";
-    ref = "nixos-20.03";
-    rev = ''
-      <% git ls-remote https://github.com/nixos/nixpkgs nixos-20.03 | awk '{ print $1 }' | tr -d '
-      ' -%>'';
-  };
-  "channels-nixos-19.09" = {
-    url = "https://github.com/NixOS/nixpkgs/";
-    ref = "nixos-19.09";
-    rev = ''
-      <% git ls-remote https://github.com/nixos/nixpkgs nixos-19.09 | awk '{ print $1 }' | tr -d '
-      ' -%>'';
-  };
  "channels-nixos-unstable" = {
    url = "https://github.com/NixOS/nixpkgs/";
    ref = "nixos-unstable";
@ -44,6 +18,13 @@ in {
      <% git ls-remote https://github.com/nixos/nixpkgs nixos-unstable | awk '{ print $1 }' | tr -d '
      ' -%>'';
  };
+  "channels-nixos-unstable-small" = {
+    url = "https://github.com/NixOS/nixpkgs/";
+    ref = "nixos-unstable-small";
+    rev = ''
+      <% git ls-remote https://github.com/nixos/nixpkgs nixos-unstable-small | awk '{ print $1 }' | tr -d '
+      ' -%>'';
+  };
  "nixpkgs-master" = {
    url = "https://github.com/NixOS/nixpkgs/";
    ref = "master";
@ -53,9 +34,9 @@ in {
  };
  "home-manager-module" = {
    url = "https://github.com/nix-community/home-manager";
-    ref = "release-21.05";
+    ref = "release-22.11";
    rev = ''
-      <% git ls-remote https://github.com/nix-community/home-manager.git release-21.05 | awk '{ print $1 }' | tr -d '
+      <% git ls-remote https://github.com/nix-community/home-manager.git release-22.11 | awk '{ print $1 }' | tr -d '
      ' -%>'';
  };
 }