steveej/infra
1
0
Fork 0
Code Issues 2 Pull requests Projects Releases Packages Wiki Activity Actions

workaround elctron issues, fix firewall for syncthing, set uphostkey0 as builder to steveej-t14

Browse source
This commit is contained in:
steveej 2023-12-17 23:25:24 +01:00
parent 70280c38f0
commit fd6077c476
8 changed files with 78 additions and 43 deletions
Download patch file Download diff file Expand all files Collapse all files

28
nix/os/devices/sj-bm-hostkey0/configuration.nix
View file

@ -11,11 +11,11 @@
...
}: {
disabledModules = [
# "services/networking/hostapd.nix"
];
imports = [
nodeFlake.inputs.disko.nixosModules.disko
nodeFlake.inputs.srvos.nixosModules.roles-nix-remote-builder
repoFlake.inputs.sops-nix.nixosModules.sops
../../profiles/common/user.nix
@ -35,8 +35,19 @@
inherit pkgs;
};
home-manager.users.steveej = import ../../../home-manager/configuration/text-minimal.nix {
inherit pkgs;
home-manager.users.steveej = { pkgs, ... }: {
imports = [
../../../home-manager/configuration/text-minimal.nix
];
home.packages = [
pkgs.nil
pkgs.rnix-lsp
pkgs.nixd
pkgs.nixpkgs-fmt
pkgs.alejandra
pkgs.nixfmt
];
};
programs.zsh.enable = true;
@ -45,6 +56,11 @@
}
];
roles.nix-remote-builder.schedulerPublicKeys = [
# TODO: make this a reference to the private key's secret
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC8FHuK0k86iBWq41+NAhVwJqH1ZpGJe+q01m7iLviz6 root@steveej-t14"
];
services.openssh.enable = true;
services.openssh.settings.PermitRootLogin = "yes";
@ -141,4 +157,10 @@
# home.packages = with pkgs; [
# ];
# };
virtualisation.libvirtd.enable = true;
boot.binfmt.emulatedSystems = [
"aarch64-linux"
];
}

9
nix/os/devices/sj-bm-hostkey0/flake.nix
View file

@ -59,15 +59,6 @@
native = mkNixosConfiguration {
inherit system;
};
# cross = mkNixosConfiguration {
# extraModules = [
# {
# nixpkgs.buildPlatform.system = "x86_64-linux";
# nixpkgs.hostPlatform.system = system;
# }
# ];
# };
};
};
}

57
nix/os/devices/steveej-t14/system.nix
View file

@ -7,6 +7,23 @@
...
}: let
passwords = import ../../../variables/passwords.crypt.nix;
localTcpPorts = [
22
# syncthing
22000
# iperf3
5201
];
localUdpPorts = [
# syncthing
22000
21027
];
in {
imports = [
../../snippets/nix-settings-holo-chain.nix
@ -19,6 +36,20 @@ in {
];
};
nix.distributedBuilds = true;
nix.buildMachines = [
{
hostName = repoFlake.colmena.sj-bm-hostkey0.deployment.targetHost;
# TODO: make this a reference
sshUser = "nix-remote-builder";
protocol = "ssh-ng";
system = "x86_64-linux";
maxJobs = 24;
speedFactor = 100;
supportedFeatures = repoFlake.nixosConfigurations.router0-dmz0.config.nix.settings.system-features ++ [];
}
];
networking.extraHosts = ''
'';
@ -37,28 +68,10 @@ in {
services.openssh.openFirewall = false;
# TODO: upstream feature for inverse rule to work: `! --in-interface zt+`
networking.firewall.interfaces."eth+".allowedTCPPorts = [
22
# syncthing
22000
# iperf3
5201
# used on holochain hackathon for cache reverse proxy
80
];
networking.firewall.interfaces."eth+".allowedUDPPorts = [
# syncthing
22000
21027
];
networking.firewall.interfaces."wlan+".allowedTCPPorts = [
# used on holochain hackathon for cache reverse proxy
80
];
networking.firewall.interfaces."eth+".allowedTCPPorts = localTcpPorts;
networking.firewall.interfaces."eth+".allowedUDPPorts = localUdpPorts;
networking.firewall.interfaces."wlan+".allowedTCPPorts = localTcpPorts;
networking.firewall.interfaces."wlan+".allowedUDPPorts = localUdpPorts;
networking.firewall.logRefusedConnections = false;
networking.usePredictableInterfaceNames = false;