steveej/infra
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

feat(167.233.1.14): migrate all containers here

Browse source
This commit is contained in:
steveej 2023-03-08 19:13:59 +01:00
parent 855c463a93
commit 7a10782170
28 changed files with 310 additions and 1022 deletions
Download patch file Download diff file Expand all files Collapse all files

65
nix/ops/nano/configuration.nix
View file

@ -1,65 +0,0 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’).
{
n,
pkgs,
...
}: {
imports = [
# Include the results of the hardware scan.
./hardware-configuration.nix
];
# Use the GRUB 2 boot loader.
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
# Define on which hard drive you want to install Grub.
boot.loader.grub.device = "/dev/sdb";
networking.hostName = "nano${toString n}"; # Define your hostname.
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
# Select internationalisation properties.
# i18n = {
# consoleFont = "Lat2-Terminus16";
# consoleKeyMap = "us";
# defaultLocale = "en_US.UTF-8";
# };
# Set your time zone.
# time.timeZone = "Europe/Amsterdam";
# List packages installed in system profile. To search by name, run:
# $ nix-env -qaP | grep wget
# environment.systemPackages = with pkgs; [
# wget
# ];
# List services that you want to enable:
# Enable the OpenSSH daemon.
services.openssh.enable = true;
services.openssh.permitRootLogin = "yes";
# Enable CUPS to print documents.
services.printing.enable = false;
# Enable the X11 windowing system.
services.xserver.enable = false;
# services.xserver.layout = "us";
# services.xserver.xkbOptions = "eurosign:e";
# Enable the KDE Desktop Environment.
# services.xserver.displayManager.kdm.enable = true;
# services.xserver.desktopManager.kde4.enable = true;
# Define a user account. Don't forget to set a password with ‘passwd’.
# users.extraUsers.guest = {
# isNormalUser = true;
# uid = 1000;
# };
# The NixOS release to be compatible with for stateful data such as databases.
system.stateVersion = "16.03";
}

24
nix/ops/nano/hardware-configuration.nix
View file

@ -1,24 +0,0 @@
# Do not modify this file! It was generated by ‘nixos-generate-config’
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{
config,
lib,
pkgs,
...
}: {
imports = [<nixpkgs/nixos/modules/installer/scan/not-detected.nix>];
boot.initrd.availableKernelModules = ["xhci_pci" "ehci_pci" "ahci" "usb_storage" "usbhid" "sd_mod"];
boot.kernelModules = ["kvm-intel"];
boot.extraModulePackages = [];
fileSystems."/" = {
device = "/dev/disk/by-uuid/e02a410e-5044-440f-90e9-b573e51f1315";
fsType = "ext4";
};
swapDevices = [];
nix.maxJobs = 2;
}

25
nix/ops/nanos@kn.nix
View file

@ -1,25 +0,0 @@
{
nixpkgs ? import <nixpkgs> {},
nrNanos ? 1, # Number of nanos
}: let
pkgs = nixpkgs;
webserver = {
services.httpd.enable = true;
services.httpd.adminAddr = "mail@stefanjunker.de";
services.httpd.documentRoot = "${pkgs.nixops}/share/doc/nixops/";
networking.firewall.allowedTCPPorts = [80];
};
mkNano = {n}: {
imports = [
(import ./nano/configuration.nix {inherit pkgs n;})
../configuration/common/user/root.nix
];
deployment.targetEnv = "none";
deployment.targetHost = "nano${toString n}";
};
mkNanos = n:
nixpkgs.lib.nameValuePair "nano${toString n}" (mkNano {inherit n;});
in
nixpkgs.lib.listToAttrs (map mkNanos (nixpkgs.lib.range 0 (nrNanos - 1)))

170
nix/os/containers/ipxe.nix
View file

@ -1,170 +0,0 @@
{
hostAddress,
localAddress,
httpPort ? 80,
httpsPort ? 443,
}: let
passwords = import ../../variables/passwords.crypt.nix;
in {
config = {
config,
pkgs,
lib,
...
}: {
imports = [../profiles/containers/configuration.nix];
networking.firewall.enable = false;
services.ddclientovh = {
enable = true;
domain = "www.stefanjunker.de";
};
security.acme = {
acceptTerms = true;
certs."www.stefanjunker.de".email = "mail@stefanjunker.de";
preliminarySelfsigned = true;
# can be used for debugging
# server = "https://acme-staging-v02.api.letsencrypt.org/directory";
};
services.nginx.enable = true;
services.nginx.recommendedProxySettings = true;
services.nginx.virtualHosts."www.stefanjunker.de" = {
default = true;
addSSL = true;
listen = [
{
addr = "0.0.0.0";
port = httpPort;
ssl = false;
}
{
addr = "0.0.0.0";
port = httpsPort;
ssl = true;
}
];
root = "/var/www/stefanjunker.de/htdocs";
enableACME = true;
# serverAliases = [
# "www.stefanjunker.de"
# ];
# sslCertificate = "/etc/secrets/stefanjunker.de/nginx/nginx.crt";
# sslCertificateKey = "/etc/secrets/stefanjunker.de/nginx/nginx.key";
locations."/fi" = {index = "index.php";};
locations."~ ^(.+.php)(.*)$".extraConfig = ''
fastcgi_split_path_info ^(.+\.php)(.*)$;
fastcgi_pass unix:${config.services.phpfpm.pools.mypool.socket};
fastcgi_index index.php;
'';
locations."/hedgedoc/" = {proxyPass = "http://127.0.0.1:3000/";};
locations."/hedgedoc/socket.io/" = {
proxyPass = "http://127.0.0.1:3000/socket.io/";
proxyWebsockets = true;
};
};
services.phpfpm.pools.mypool = {
user = "nobody";
phpPackage = pkgs.php5;
settings = {
"listen.owner" = config.services.nginx.user;
"pm" = "dynamic";
"pm.max_children" = 5;
"pm.start_servers" = 2;
"pm.min_spare_servers" = 1;
"pm.max_spare_servers" = 3;
"pm.max_requests" = 500;
"php_admin_value[error_reporting]" = "E_ALL & ~E_NOTICE & ~E_WARNING & ~E_STRICT & ~E_DEPRECATED";
};
};
# the custom php5 we're using here has no fpm-systemd, so the default `Type = "notify"` won't work
systemd.services."phpfpm-mypool" = {
serviceConfig = {Type = lib.mkForce "simple";};
};
services.mysql = {
enable = true;
package = pkgs.mariadb;
};
services.hedgedoc = {
enable = true;
configuration = {
domain = "www.stefanjunker.de";
urlPath = "hedgedoc";
protocolUseSSL = true;
db = {
dialect = "sqlite";
storage = "/var/lib/codimd/db.codimd.sqlite";
};
allowAnonymous = false;
allowAnonymousEdits = false;
allowGravatar = false;
allowFreeURL = false;
defaultPermission = "private";
allowEmailRegister = false;
# oauth2 provider config
inherit (passwords.www_stefanjunker_de_hedgedoc) dropbox;
uploadsPath = "/var/lib/codimd/uploads";
};
};
};
autoStart = true;
bindMounts = {
"/etc/secrets/" = {
hostPath = "/var/lib/container-volumes/webserver/etc-secrets";
isReadOnly = true;
};
"/var/www" = {
hostPath = "/var/lib/container-volumes/webserver/var-www";
isReadOnly = false;
};
"/var/lib/mysql" = {
hostPath = "/var/lib/container-volumes/webserver/var-lib-mysql";
isReadOnly = false;
};
"/var/lib/codimd" = {
hostPath = "/var/lib/container-volumes/webserver/var-lib-codimd";
isReadOnly = false;
};
};
privateNetwork = true;
forwardPorts = [
{
# http
containerPort = 80;
hostPort = httpPort;
protocol = "tcp";
}
{
# https
containerPort = 443;
hostPort = httpsPort;
protocol = "tcp";
}
];
inherit hostAddress localAddress;
}

27
nix/os/containers/syncthing.nix
View file

@ -1,14 +1,14 @@
{ { hostAddress
hostAddress, , localAddress
localAddress, , syncthingPort ? 22000
syncthingPort ? 22000, , syncthingLocalAnnouncePort ? 21027
syncthingLocalAnnouncePort ? 21027, , autoStart ? false
autoStart ? false, ,
}: { }: {
config = { config =
config, { config
pkgs, , pkgs
... , ...
}: { }: {
system.stateVersion = "20.05"; # Did you read the comment? system.stateVersion = "20.05"; # Did you read the comment?
@ -45,10 +45,15 @@
hostPort = syncthingPort; hostPort = syncthingPort;
protocol = "tcp"; protocol = "tcp";
} }
{
containerPort = 22000;
hostPort = syncthingPort;
protocol = "udp";
}
{ {
containerPort = 21027; containerPort = 21027;
hostPort = syncthingLocalAnnouncePort; hostPort = syncthingLocalAnnouncePort;
protocol = "tcp"; protocol = "udp";
} }
]; ];

76
nix/os/containers/webserver.nix
View file

@ -1,17 +1,19 @@
{ { hostAddress
hostAddress, , localAddress
localAddress, , httpPort ? 80
httpPort ? 80, , httpsPort ? 443
httpsPort ? 443, , autoStart ? false
autoStart ? false, ,
}: let }:
let
passwords = import ../../variables/passwords.crypt.nix; passwords = import ../../variables/passwords.crypt.nix;
in { in
config = { {
config, config =
pkgs, { config
lib, , pkgs
... , lib
, ...
}: { }: {
system.stateVersion = "22.05"; # Did you read the comment? system.stateVersion = "22.05"; # Did you read the comment?
@ -54,58 +56,18 @@ in {
root = "/var/www/stefanjunker.de/htdocs"; root = "/var/www/stefanjunker.de/htdocs";
enableACME = true; enableACME = true;
# serverAliases = [
# "www.stefanjunker.de"
# ];
# sslCertificate = "/etc/secrets/stefanjunker.de/nginx/nginx.crt";
# sslCertificateKey = "/etc/secrets/stefanjunker.de/nginx/nginx.key";
locations."/fi" = {index = "index.php";}; locations."/hedgedoc/" = { proxyPass = "http://[::1]:3000/"; };
locations."~ ^(.+.php)(.*)$".extraConfig = ''
fastcgi_split_path_info ^(.+\.php)(.*)$;
fastcgi_pass unix:${config.services.phpfpm.pools.mypool.socket};
fastcgi_index index.php;
'';
locations."/hedgedoc/" = {proxyPass = "http://127.0.0.1:3000/";};
locations."/hedgedoc/socket.io/" = { locations."/hedgedoc/socket.io/" = {
proxyPass = "http://127.0.0.1:3000/socket.io/"; proxyPass = "http://[::1]:3000/socket.io/";
proxyWebsockets = true; proxyWebsockets = true;
}; };
}; };
services.phpfpm.pools.mypool = {
user = "nobody";
phpPackage = pkgs.php5;
settings = {
"listen.owner" = config.services.nginx.user;
"pm" = "dynamic";
"pm.max_children" = 5;
"pm.start_servers" = 2;
"pm.min_spare_servers" = 1;
"pm.max_spare_servers" = 3;
"pm.max_requests" = 500;
"php_admin_value[error_reporting]" = "E_ALL & ~E_NOTICE & ~E_WARNING & ~E_STRICT & ~E_DEPRECATED";
};
};
# the custom php5 we're using here has no fpm-systemd, so the default `Type = "notify"` won't work
systemd.services."phpfpm-mypool" = {
serviceConfig = {Type = lib.mkForce "simple";};
};
services.mysql = {
enable = true;
package = pkgs.mariadb_104;
};
services.hedgedoc = { services.hedgedoc = {
enable = true; enable = true;
configuration = { settings = {
domain = "www.stefanjunker.de"; domain = "www.stefanjunker.de";
urlPath = "hedgedoc"; urlPath = "hedgedoc";
protocolUseSSL = true; protocolUseSSL = true;
@ -124,7 +86,7 @@ in {
# oauth2 provider config # oauth2 provider config
inherit (passwords.www_stefanjunker_de_hedgedoc) dropbox; inherit (passwords.www_stefanjunker_de_hedgedoc) dropbox;
uploadsPath = "/var/lib/codimd/uploads"; uploadsPath = "/var/lib/hedgedoc/uploads";
}; };
}; };
}; };

18
nix/os/devices/167.233.1.14/README.md Normal file
View file

@ -0,0 +1,18 @@
## bootstrapping
```
systemctl stop dhcpcd
ip a add 167.233.1.14/29 dev ens18
ip l set mtu 1400 dev ens18
ip r add default via 167.233.1.9
echo "nameserver 1.1.1.1" >> /etc/resolv.conf
mkdir ~/.ssh
```
### ssh key
run locally:
```
ssh-add -L | tr \\n \\r | xdotool selectwindow windowfocus type --delay 50 --window %@ --file -
```

1
nix/os/devices/167.233.1.14/configuration.nix
View file

@ -2,6 +2,7 @@
disabledModules = [ ]; disabledModules = [ ];
imports = [ imports = [
../../profiles/common/configuration.nix ../../profiles/common/configuration.nix
../../modules/opinionatedDisk.nix
./system.nix ./system.nix
./hw.nix ./hw.nix

34
nix/os/devices/167.233.1.14/hw.nix
View file

@ -1,4 +1,5 @@
{...}: let { ... }:
let
stage1Modules = [ stage1Modules = [
"virtio_balloon" "virtio_balloon"
"virtio_scsi" "virtio_scsi"
@ -10,36 +11,17 @@
"virtio_blk" "virtio_blk"
"virtio_ring" "virtio_ring"
"bochs_drm"
"ata_piix" "ata_piix"
"pata_acpi" "pata_acpi"
"ata_generic" "ata_generic"
]; ];
in { in
fileSystems."/boot" = { {
device = "/dev/disk/by-uuid/354fb107-2f4a-42ad-80dd-9dddb61bfd02"; hardware.opinionatedDisk = {
fsType = "ext4"; enable = true;
encrypted = false;
diskId = "virtio-virtio-paeNi8Fof9Oe";
}; };
fileSystems."/" = {
device = "/dev/disk/by-uuid/993cce35-cc1f-40cc-b07a-5ea58b99fb5b";
fsType = "btrfs";
options = ["subvol=root"];
neededForBoot = true;
};
fileSystems."/home" = {
device = "/dev/disk/by-uuid/993cce35-cc1f-40cc-b07a-5ea58b99fb5b";
fsType = "btrfs";
options = ["subvol=home"];
neededForBoot = true;
};
swapDevices = [{device = "/dev/disk/by-uuid/d16b5f4a-f38c-41c6-8aae-1625be815f9d";}];
boot.loader.grub = {device = "/dev/vda";};
boot.initrd.availableKernelModules = stage1Modules;
boot.initrd.kernelModules = stage1Modules; boot.initrd.kernelModules = stage1Modules;
boot.extraModprobeConfig = "";
} }

21
nix/os/devices/167.233.1.14/pkg.nix
View file

@ -1,16 +1,14 @@
{ { config
config, , pkgs
pkgs, , lib
lib, , ...
...
}: { }: {
nixpkgs.config.packageOverrides = pkgs: nixpkgs.config.packageOverrides = pkgs:
with pkgs; { with pkgs; {
nixPath = nixPath =
(import ../../../default.nix { (import ../../../default.nix {
versionsPath = ./versions.nix; versionsPath = ./versions.nix;
}) }).nixPath;
.nixPath;
}; };
home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix { home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix {
inherit pkgs; inherit pkgs;
@ -23,13 +21,4 @@
pkgs.xclip pkgs.xclip
]; ];
}; };
nix.buildMachines = [
{
hostName = "localhost";
system = "x86_64-linux";
supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
maxJobs = 4;
}
];
} }

85
nix/os/devices/167.233.1.14/system.nix
View file

@ -1,20 +1,14 @@
{ { pkgs
pkgs, , lib
lib, , config
config, , ...
... }:
}: let let
keys = import ../../../variables/keys.nix; keys = import ../../../variables/keys.nix;
in { in
nix.binaryCaches = ["https://cache.holo.host"]; {
nix.binaryCachePublicKeys = [
"cache.holo.host-1:lNXIXtJgS9Iuw4Cu6X0HINLu9sTfcjEntnrgwMQIMcE="
"cache.holo.host-2:ZJCkX3AUYZ8soxTLfTb60g+F3MkWD7hkH9y8CgqwhDQ="
];
# TASK: new device # TASK: new device
networking.hostName = "sj-pvehtz-0"; # Define your hostname. networking.hostName = "sj-pvehtz0"; # Define your hostname.
# networking.domain = ""; # networking.domain = "";
networking.firewall.enable = true; networking.firewall.enable = true;
@ -26,6 +20,8 @@ in {
networking.usePredictableInterfaceNames = false; networking.usePredictableInterfaceNames = false;
networking.dhcpcd.enable = false;
networking.interfaces.eth0 = { networking.interfaces.eth0 = {
mtu = 1400; mtu = 1400;
useDHCP = false; useDHCP = false;
@ -65,40 +61,49 @@ in {
services.spice-vdagentd.enable = true; services.spice-vdagentd.enable = true;
services.qemuGuest.enable = true; services.qemuGuest.enable = true;
systemd.services."sshd-status" = {
enable = true;
description = "sshd-status service";
path = [pkgs.systemd];
script = ''
systemctl status sshd | grep -i tasks
'';
};
systemd.services.sshd.serviceConfig = {TasksMax = 32;};
systemd.timers."sshd-status" = {
description = "Timer to trigger sshd-status periodically";
enable = true;
wantedBy = ["timer.target" "multi-user.target"];
timerConfig = {
OnActiveSec = "360s";
OnUnitActiveSec = "360s";
AccuracySec = "1s";
Unit = "sshd-status.service";
};
};
nix.gc = { automatic = true; }; nix.gc = { automatic = true; };
networking.useHostResolvConf = true; # networking.useHostResolvConf = true;
services.openssh.forwardX11 = true; services.openssh.forwardX11 = true;
containers = {
mailserver = import ../../containers/mailserver.nix {
autoStart = true;
hostAddress = "192.168.100.10";
localAddress = "192.168.100.11";
imapsPort = 993;
sievePort = 4190;
};
webserver = import ../../containers/webserver.nix
{
autoStart = true;
hostAddress = "192.168.100.12";
localAddress = "192.168.100.13";
httpPort = 80;
httpsPort = 443;
};
syncthing = import ../../containers/syncthing.nix {
autoStart = true;
hostAddress = "192.168.100.14";
localAddress = "192.168.100.15";
syncthingPort = 22000;
};
};
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions # settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave # on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system. # this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option # Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "20.09"; # Did you read the comment? system.stateVersion = "22.11"; # Did you read the comment?
} }

46
nix/os/devices/167.233.1.14/versions.nix
View file

@ -1,45 +1,37 @@
let let
nixpkgs = { nixpkgs = {
url = "https://github.com/NixOS/nixpkgs/"; url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-21.11"; ref = "nixos-22.11";
rev = "e34c5379866833f41e2a36f309912fa675d687c7"; rev = ''
a7cc81913bb3cd1ef05ed0ece048b773e1839e51'';
}; };
in { in
{
inherit nixpkgs; inherit nixpkgs;
nixos = nixpkgs // { suffix = "/nixos"; };
"channels-nixos-stable" = nixpkgs; "channels-nixos-stable" = nixpkgs;
"channels-nixos-21.05" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-21.05";
rev = "";
};
"channels-nixos-20.09" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-20.09";
rev = "1c1f5649bb9c1b0d98637c8c365228f57126f361";
};
"channels-nixos-20.03" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-20.03";
rev = "1db42b7fe3878f3f5f7a4f2dc210772fd080e205";
};
"channels-nixos-19.09" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-19.09";
rev = "75f4ba05c63be3f147bcc2f7bd4ba1f029cedcb1";
};
"channels-nixos-unstable" = { "channels-nixos-unstable" = {
url = "https://github.com/NixOS/nixpkgs/"; url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-unstable"; ref = "nixos-unstable";
rev = "c71f061c68ba8ce53471b767d5049cbd0f3d8490"; rev = ''
c707238dc262923da5a53a5a11914117caac07a2'';
};
"channels-nixos-unstable-small" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-unstable-small";
rev = ''
09c509a5075931382582dee69f3e44bf1535c092'';
}; };
"nixpkgs-master" = { "nixpkgs-master" = {
url = "https://github.com/NixOS/nixpkgs/"; url = "https://github.com/NixOS/nixpkgs/";
ref = "master"; ref = "master";
rev = "fb881b80f64d1b672135533a8c2fbc86e6ed8898"; rev = ''
3d57138bd9abe31bae25704cebaab7527010cc5e'';
}; };
"home-manager-module" = { "home-manager-module" = {
url = "https://github.com/nix-community/home-manager"; url = "https://github.com/nix-community/home-manager";
ref = "release-21.05"; ref = "release-22.11";
rev = "7329ffc6e911106494183557fc249180d5422929"; rev = ''
b0be47978de5cfd729a79c3f57ace4c86364ff45'';
}; };
} }

47
nix/os/devices/167.233.1.14/versions.tmpl.nix
View file

@ -1,42 +1,16 @@
let let
nixpkgs = { nixpkgs = {
url = "https://github.com/NixOS/nixpkgs/"; url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-21.11"; ref = "nixos-22.11";
rev = '' rev = ''
<% git ls-remote https://github.com/nixos/nixpkgs nixos-21.11 | awk '{ print $1 }' | tr -d ' <% git ls-remote https://github.com/nixos/nixpkgs nixos-22.11 | awk '{ print $1 }' | tr -d '
' -%>''; ' -%>'';
}; };
in { in
{
inherit nixpkgs; inherit nixpkgs;
nixos = nixpkgs // { suffix = "/nixos"; };
"channels-nixos-stable" = nixpkgs; "channels-nixos-stable" = nixpkgs;
"channels-nixos-21.05" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-21.05";
rev = ''
<% git ls-remote https://github.com/nixos/nixpkgs nixos-20.05 | awk '{ print $1 }' | tr -d '
' -%>'';
};
"channels-nixos-20.09" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-20.09";
rev = ''
<% git ls-remote https://github.com/nixos/nixpkgs nixos-20.09 | awk '{ print $1 }' | tr -d '
' -%>'';
};
"channels-nixos-20.03" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-20.03";
rev = ''
<% git ls-remote https://github.com/nixos/nixpkgs nixos-20.03 | awk '{ print $1 }' | tr -d '
' -%>'';
};
"channels-nixos-19.09" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-19.09";
rev = ''
<% git ls-remote https://github.com/nixos/nixpkgs nixos-19.09 | awk '{ print $1 }' | tr -d '
' -%>'';
};
"channels-nixos-unstable" = { "channels-nixos-unstable" = {
url = "https://github.com/NixOS/nixpkgs/"; url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-unstable"; ref = "nixos-unstable";
@ -44,6 +18,13 @@ in {
<% git ls-remote https://github.com/nixos/nixpkgs nixos-unstable | awk '{ print $1 }' | tr -d ' <% git ls-remote https://github.com/nixos/nixpkgs nixos-unstable | awk '{ print $1 }' | tr -d '
' -%>''; ' -%>'';
}; };
"channels-nixos-unstable-small" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-unstable-small";
rev = ''
<% git ls-remote https://github.com/nixos/nixpkgs nixos-unstable-small | awk '{ print $1 }' | tr -d '
' -%>'';
};
"nixpkgs-master" = { "nixpkgs-master" = {
url = "https://github.com/NixOS/nixpkgs/"; url = "https://github.com/NixOS/nixpkgs/";
ref = "master"; ref = "master";
@ -53,9 +34,9 @@ in {
}; };
"home-manager-module" = { "home-manager-module" = {
url = "https://github.com/nix-community/home-manager"; url = "https://github.com/nix-community/home-manager";
ref = "release-21.05"; ref = "release-22.11";
rev = '' rev = ''
<% git ls-remote https://github.com/nix-community/home-manager.git release-21.05 | awk '{ print $1 }' | tr -d ' <% git ls-remote https://github.com/nix-community/home-manager.git release-22.11 | awk '{ print $1 }' | tr -d '
' -%>''; ' -%>'';
}; };
} }

44
nix/os/devices/vmd102066.contaboserver.net/system.nix
View file

@ -1,12 +1,13 @@
{ { pkgs
pkgs, , lib
lib, , config
config, , ...
... }:
}: let let
keys = import ../../../variables/keys.nix; keys = import ../../../variables/keys.nix;
passwords = import ../../../variables/passwords.crypt.nix; passwords = import ../../../variables/passwords.crypt.nix;
in { in
{
# TASK: new device # TASK: new device
networking.hostName = "vmd102066"; # Define your hostname. networking.hostName = "vmd102066"; # Define your hostname.
networking.domain = "contaboserver.net"; networking.domain = "contaboserver.net";
@ -103,35 +104,6 @@ in {
# networking.useHostResolvConf = true; # networking.useHostResolvConf = true;
containers = { containers = {
mailserver = import ../../containers/mailserver.nix {
autoStart = true;
hostAddress = "192.168.100.10";
localAddress = "192.168.100.11";
imapsPort = 993;
sievePort = 4190;
};
webserver = import ../../containers/webserver.nix {
autoStart = true;
hostAddress = "192.168.100.12";
localAddress = "192.168.100.13";
httpPort = 80;
httpsPort = 443;
};
syncthing = import ../../containers/syncthing.nix {
autoStart = true;
hostAddress = "192.168.100.14";
localAddress = "192.168.100.15";
syncthingPort = 22000;
};
backup = import ../../containers/backup.nix { backup = import ../../containers/backup.nix {
autoStart = false; autoStart = false;

16
nix/os/devices/vmd102066.contaboserver.net/versions.nix
View file

@ -1,20 +1,24 @@
let let
nixpkgs = { nixpkgs = {
url = "https://github.com/NixOS/nixpkgs/"; url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-22.05"; ref = "nixos-22.11";
rev = "b3a8f7ed267e0a7ed100eb7d716c9137ff120fe3"; rev = ''
a7cc81913bb3cd1ef05ed0ece048b773e1839e51'';
}; };
in { in
{
inherit nixpkgs; inherit nixpkgs;
"channels-nixos-stable" = nixpkgs; "channels-nixos-stable" = nixpkgs;
"nixpkgs-master" = { "nixpkgs-master" = {
url = "https://github.com/NixOS/nixpkgs/"; url = "https://github.com/NixOS/nixpkgs/";
ref = "master"; ref = "master";
rev = "6b10854c8194f1ebaa5bce623e71c6da1c008861"; rev = ''
3b12bfe6c4e11e91865f4d244d13fdc9860bd322'';
}; };
"home-manager-module" = { "home-manager-module" = {
url = "https://github.com/nix-community/home-manager"; url = "https://github.com/nix-community/home-manager";
ref = "release-22.05"; ref = "release-22.11";
rev = "f0ecd4b1db5e15103e955b18cb94bea4296e5c45"; rev = ''
b0be47978de5cfd729a79c3f57ace4c86364ff45'';
}; };
} }

11
nix/os/devices/vmd102066.contaboserver.net/versions.tmpl.nix
View file

@ -1,12 +1,13 @@
let let
nixpkgs = { nixpkgs = {
url = "https://github.com/NixOS/nixpkgs/"; url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-22.05"; ref = "nixos-22.11";
rev = '' rev = ''
<% git ls-remote https://github.com/nixos/nixpkgs nixos-22.05 | awk '{ print $1 }' | tr -d ' <% git ls-remote https://github.com/nixos/nixpkgs nixos-22.11 | awk '{ print $1 }' | tr -d '
' -%>''; ' -%>'';
}; };
in { in
{
inherit nixpkgs; inherit nixpkgs;
"channels-nixos-stable" = nixpkgs; "channels-nixos-stable" = nixpkgs;
"nixpkgs-master" = { "nixpkgs-master" = {
@ -18,9 +19,9 @@ in {
}; };
"home-manager-module" = { "home-manager-module" = {
url = "https://github.com/nix-community/home-manager"; url = "https://github.com/nix-community/home-manager";
ref = "release-22.05"; ref = "release-22.11";
rev = '' rev = ''
<% git ls-remote https://github.com/nix-community/home-manager.git release-22.05 | awk '{ print $1 }' | tr -d ' <% git ls-remote https://github.com/nix-community/home-manager.git release-22.11 | awk '{ print $1 }' | tr -d '
' -%>''; ' -%>'';
}; };
} }

4
nix/os/devices/vmd32387.contaboserver.net/boot.nix
View file

@ -1,4 +0,0 @@
{lib, ...}: {
boot.loader.grub.efiSupport = lib.mkForce false;
boot.extraModulePackages = [];
}

12
nix/os/devices/vmd32387.contaboserver.net/configuration.nix
View file

@ -1,12 +0,0 @@
{...}: {
disabledModules = [];
imports = [
../../profiles/common/configuration.nix
../../modules/opinionatedDisk.nix
./system.nix
./hw.nix
./pkg.nix
./boot.nix
];
}

25
nix/os/devices/vmd32387.contaboserver.net/hw.nix
View file

@ -1,25 +0,0 @@
{...}: let
stage1Modules = [
"aesni_intel"
"kvm-intel"
"virtio_balloon"
"virtio_scsi"
"virtio_net"
"virtio_pci"
"virtio_ring"
"virtio"
"scsi_mod"
];
in {
# TASK: new device
hardware.opinionatedDisk = {
enable = true;
encrypted = true;
diskId = "scsi-0QEMU_QEMU_HARDDISK_drive-scsi0";
};
boot.initrd.availableKernelModules = stage1Modules;
boot.initrd.kernelModules = stage1Modules;
boot.extraModprobeConfig = "";
}

54
nix/os/devices/vmd32387.contaboserver.net/pkg.nix
View file

@ -1,54 +0,0 @@
{
config,
pkgs,
lib,
...
}: {
nixpkgs.config.packageOverrides = pkgs:
with pkgs; {
nixPath =
(import ../../../default.nix {
versionsPath = ./versions.nix;
})
.nixPath;
};
home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix {
inherit pkgs;
};
nix.buildMachines = [
{
hostName = "localhost";
system = "x86_64-linux";
supportedFeatures = ["kvm" "nixos-test" "big-parallel" "benchmark"];
maxJobs = 4;
}
];
services.hydra = {
enable = false;
hydraURL = "http://localhost:3000"; # externally visible URL
notificationSender = "hydra@${config.networking.hostName}.stefanjunker.de"; # e-mail of hydra service
# a standalone hydra will require you to unset the buildMachinesFiles list to avoid using a nonexistant /etc/nix/machines
buildMachinesFiles = [];
# you will probably also want, otherwise *everything* will be built from scratch
useSubstitutes = true;
};
services.gitlab-runner = {
enable = false;
extraPackages = with pkgs; [bash gitlab-runner nix gitFull git-crypt];
concurrent = 2;
checkInterval = 0;
services = {
nixRunner = {
executor = "shell";
runUntagged = true;
registrationConfigFile = "/etc/secrets/gitlab-runner/nix-runner.registration";
tagList = ["nix"];
};
};
};
}

114
nix/os/devices/vmd32387.contaboserver.net/system.nix
View file

@ -1,114 +0,0 @@
{
pkgs,
lib,
config,
...
}: let
keys = import ../../../variables/keys.nix;
passwords = import ../../../variables/passwords.crypt.nix;
in {
# TASK: new device
networking.hostName = "vmd32387"; # Define your hostname.
networking.domain = "contaboserver.net";
networking.firewall.enable = true;
networking.firewall.allowedTCPPorts = [
# iperf3
5201
];
networking.firewall.logRefusedConnections = false;
networking.usePredictableInterfaceNames = false;
networking.dhcpcd = {
enable = true;
persistent = true;
};
networking.interfaces.eth0 = {
useDHCP = true;
ipv6.addresses = [
{
address = "2a02:c207:3003:2387::1";
prefixLength = 64;
}
];
};
networking.defaultGateway6 = {
address = "fe80::1";
interface = "eth0";
};
networking.nat = {
enable = true;
internalInterfaces = ["ve-+"];
externalInterface = "eth0";
};
# Kubernetes
# services.kubernetes.roles = ["master" "node"];
# virtualization
virtualisation = {docker.enable = true;};
services.spice-vdagentd.enable = true;
services.qemuGuest.enable = true;
systemd.services."sshd-status" = {
enable = true;
description = "sshd-status service";
path = [pkgs.systemd];
script = ''
systemctl status sshd | grep -i tasks
'';
};
systemd.services.sshd.serviceConfig = {TasksMax = 32;};
systemd.timers."sshd-status" = {
description = "Timer to trigger sshd-status periodically";
enable = true;
wantedBy = ["timer.target" "multi-user.target"];
timerConfig = {
OnActiveSec = "5s";
OnUnitActiveSec = "5s";
AccuracySec = "1s";
Unit = "sshd-status.service";
};
};
nix.gc = {automatic = true;};
boot.initrd.network = {
enable = true;
udhcpc.extraArgs = ["-x hostname:${config.networking.hostName}"];
ssh = {
enable = true;
authorizedKeys = keys.users.steveej.openssh;
hostKeys = [
"/etc/secrets/initrd/ssh_host_rsa_key"
"/etc/secrets/initrd/ssh_host_ed25519_key"
];
};
};
boot.initrd.postMountCommands = ''
for iface in $(cd /sys/class/net && ls); do
echo "Bringing down $iface..."
ip address flush dev $iface
ip link set $iface down
done
'';
networking.useHostResolvConf = true;
containers = {};
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "20.03"; # Did you read the comment?
}

20
nix/os/devices/vmd32387.contaboserver.net/versions.nix
View file

@ -1,20 +0,0 @@
let
nixpkgs = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-22.05";
rev = "b3a8f7ed267e0a7ed100eb7d716c9137ff120fe3";
};
in {
inherit nixpkgs;
"channels-nixos-stable" = nixpkgs;
"nixpkgs-master" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "master";
rev = "6b10854c8194f1ebaa5bce623e71c6da1c008861";
};
"home-manager-module" = {
url = "https://github.com/nix-community/home-manager";
ref = "release-22.05";
rev = "f0ecd4b1db5e15103e955b18cb94bea4296e5c45";
};
}

26
nix/os/devices/vmd32387.contaboserver.net/versions.tmpl.nix
View file

@ -1,26 +0,0 @@
let
nixpkgs = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "nixos-22.05";
rev = ''
<% git ls-remote https://github.com/nixos/nixpkgs nixos-22.05 | awk '{ print $1 }' | tr -d '
' -%>'';
};
in {
inherit nixpkgs;
"channels-nixos-stable" = nixpkgs;
"nixpkgs-master" = {
url = "https://github.com/NixOS/nixpkgs/";
ref = "master";
rev = ''
<% git ls-remote https://github.com/NixOS/nixpkgs.git master | head -n1 | awk '{ print $1 }' | tr -d '
' -%>'';
};
"home-manager-module" = {
url = "https://github.com/nix-community/home-manager";
ref = "release-22.05";
rev = ''
<% git ls-remote https://github.com/nix-community/home-manager.git release-22.05 | awk '{ print $1 }' | tr -d '
' -%>'';
};
}

21
nix/os/profiles/common/system.nix
View file

@ -1,26 +1,25 @@
{ { config
config, , pkgs
pkgs, , lib
lib, , ...
...
}: { }: {
nix.binaryCachePublicKeys = [ nix.settings.trusted-public-keys = [
# "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs=" # "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs="
]; ];
nix.binaryCaches = [ nix.settings.substituters = [
"https://cache.nixos.org" "https://cache.nixos.org"
# "https://hydra.nixos.org" # "https://hydra.nixos.org"
]; ];
nix.trustedBinaryCaches = [ nix.settings.trusted-substituters = [
"https://cache.nixos.org" "https://cache.nixos.org"
# "https://hydra.nixos.org" # "https://hydra.nixos.org"
]; ];
nix.daemonCPUSchedPolicy = "idle"; nix.daemonCPUSchedPolicy = "idle";
nix.daemonIOSchedClass = "idle"; nix.daemonIOSchedClass = "idle";
nix.maxJobs = lib.mkDefault "auto"; nix.settings.max-jobs = lib.mkDefault "auto";
nix.buildCores = lib.mkDefault 0; nix.settings.cores = lib.mkDefault 0;
nix.useSandbox = true; nix.settings.sandbox = true;
environment.etc."lvm/lvm.conf".text = '' environment.etc."lvm/lvm.conf".text = ''
devices { devices {

10
nix/overlays/overrides.nix
View file

@ -1,13 +1,13 @@
# This overlay is used for overriding upstream packages. # This overlay is used for overriding upstream packages.
self: super: let self: super:
let
sources = import ../../nix/sources.nix; sources = import ../../nix/sources.nix;
nixpkgs-master = import <nixpkgs-master> { inherit (super) config; }; nixpkgs-master = import <nixpkgs-master> { inherit (super) config; };
nixpkgs-unstable = nixpkgs-unstable =
import <channels-nixos-unstable> { inherit (super) config; }; import <channels-nixos-unstable> { inherit (super) config; };
pr-holochain-launcher-bin = in
import sources.pr-holochain-launcher-bin {inherit (super) config;}; {
in {
inherit nixpkgs-master; inherit nixpkgs-master;
inherit nixpkgs-unstable; inherit nixpkgs-unstable;
@ -32,7 +32,5 @@ in {
]); ]);
}); });
inherit (pr-holochain-launcher-bin) holochain-launcher;
# logseq = nixpkgs-staging-steveej.logseq; # logseq = nixpkgs-staging-steveej.logseq;
} }

73
nix/pkgs/default.nix
View file

@ -1,36 +1,8 @@
{pkgs}: let { pkgs }:
let
in rec { in rec {
nixpkgs-master = import <nixpkgs-master> { }; nixpkgs-master = import <nixpkgs-master> { };
linuxPackages_sgx_540rc3 = let
linux_sgx_pkg = {
fetchurl,
buildLinux,
...
} @ args:
buildLinux (args
// rec {
version = "5.4.0-rc3";
modDirVersion = version;
src = fetchurl {
url = "https://github.com/jsakkine-intel/linux-sgx/archive/v23.tar.gz";
sha256 = "11rwlwv7s071ia889dk1dgrxprxiwgi7djhg47vi56dj81jgib20";
};
kernelPatches = [];
extraConfig = ''
INTEL_SGX y
'';
extraMeta.branch = "5.4";
}
// (args.argsOverride or {}));
linux_sgx = pkgs.callPackage linux_sgx_pkg {};
in
pkgs.recurseIntoAttrs (pkgs.linuxPackagesFor linux_sgx);
linuxPackages_sgx_latest = linuxPackages_sgx_540rc3;
busyboxStatic = pkgs.busybox.override { busyboxStatic = pkgs.busybox.override {
enableStatic = true; enableStatic = true;
extraConfig = '' extraConfig = ''
@ -41,47 +13,6 @@ in rec {
}; };
dropbearStatic = pkgs.dropbear.override { enableStatic = true; }; dropbearStatic = pkgs.dropbear.override { enableStatic = true; };
php5 = let
nixpkgsWithPhp5 = pkgs.fetchFromGitHub {
owner = "nixos";
repo = "nixpkgs-channels";
rev = "846d8f8305192dcc3a63139102698b4ac6b9ef9f";
sha256 = "1qifgc1q2i4g0ivpfjnxp4jl2cc82gfjws08dsllgw7q7kw4b4rb";
};
php5 =
(pkgs.callPackage
"${nixpkgsWithPhp5}/pkgs/development/interpreters/php/default.nix"
{
config = pkgs.lib.attrsets.recursiveUpdate pkgs.config {
php = {
imap = false;
openssl = false;
curl = false;
ldap = false;
mcrypt = false;
};
};
stdenv = pkgs.llvmPackages_6.stdenv; # broken
icu = pkgs.icu60;
})
.php56;
in
php5.overrideAttrs (attrs: rec {
# See https://secure.php.net/ChangeLog-5.php
version = "5.6.40";
name = "php-${version}";
sha256 = "005s7w167dypl41wlrf51niryvwy1hfv53zxyyr3lm938v9jbl7z";
src = pkgs.fetchurl {
url = "http://www.php.net/distributions/php-${version}.tar.bz2";
inherit sha256;
};
configureFlags = attrs.configureFlags ++ ["--without-fpm-systemd"];
meta.license = null;
});
duplicacy = pkgs.callPackage ../pkgs/duplicacy { }; duplicacy = pkgs.callPackage ../pkgs/duplicacy { };
mfcl3770cdw = pkgs.callPackage ../pkgs/mfcl3770cdw.nix { }; mfcl3770cdw = pkgs.callPackage ../pkgs/mfcl3770cdw.nix { };
staruml = pkgs.callPackage ../pkgs/staruml.nix { staruml = pkgs.callPackage ../pkgs/staruml.nix {

12
nix/sources.json
View file

@ -10,17 +10,5 @@
"type": "tarball", "type": "tarball",
"url": "https://github.com/NixOS/nixpkgs/archive/26fe7618c7efbbfe28db9a52a21fb87e67ebaf06.tar.gz", "url": "https://github.com/NixOS/nixpkgs/archive/26fe7618c7efbbfe28db9a52a21fb87e67ebaf06.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz" "url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
},
"pr-holochain-launcher-bin": {
"branch": "pr-holochain-launcher-bin",
"description": "Nix Packages collection",
"homepage": null,
"owner": "steveeJ-forks",
"repo": "nixpkgs",
"rev": "11f978d53355759a47d60d688709921f2e0fb158",
"sha256": "03mdx63gjynj297b55wkjcnaicsm8n2chgpp2v80sx8ixgllmxiw",
"type": "tarball",
"url": "https://github.com/steveeJ-forks/nixpkgs/archive/11f978d53355759a47d60d688709921f2e0fb158.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
} }
} }

1
nix/tests/buildvmwithbootloader/result
View file

@ -1 +0,0 @@
/nix/store/xh6p394kh1bncmc3lr6l9fb81284ckhf-nixos-vm