Compare commits
No commits in common. "b6070d0f7589d6ae0cad246ca28178952acc045b" and "99308bfe24f3ee3b48d49f81879d1c9ff1df56aa" have entirely different histories.
b6070d0f75
...
99308bfe24
|
|
@ -1,19 +0,0 @@
|
||||||
```
|
|
||||||
export GARAGE_RPC_SECRET=<secret-in-keepass>
|
|
||||||
|
|
||||||
garage node id
|
|
||||||
|
|
||||||
garage node connect <node-id2>
|
|
||||||
garage node connect <node-id3>
|
|
||||||
|
|
||||||
garage status
|
|
||||||
|
|
||||||
#Zones
|
|
||||||
#DE-1 DE-2 NL-1
|
|
||||||
|
|
||||||
garage layout assign fdaa -z DE-1 -c 800G -t trinkgenossin
|
|
||||||
garage layout assign 8835 -z DE-2 -c 800G -t blue-shell
|
|
||||||
garage layout assign 73da -z NL-1 -c 800G -t delite
|
|
||||||
garage layout show
|
|
||||||
garage layout apply --version 1
|
|
||||||
```
|
|
||||||
|
|
@ -1,13 +0,0 @@
|
||||||
```
|
|
||||||
curl -L https://github.com/nix-community/nixos-images/releases/download/nixos-unstable/nixos-kexec-installer-noninteractive-x86_64-linux.tar.gz | tar -xzf- -C /root
|
|
||||||
/root/kexec/run
|
|
||||||
```
|
|
||||||
|
|
||||||
```
|
|
||||||
mkdir -p /etc/secrets/initrd
|
|
||||||
ssh-keygen -t ed25519 -f /etc/secrets/initrd/ssh_host_ed25519_key
|
|
||||||
```
|
|
||||||
|
|
||||||
```
|
|
||||||
nix run github:nix-community/nixos-anywhere -- --flake .#blue-shell root@194.13.83.205
|
|
||||||
```
|
|
||||||
21
flake.lock
21
flake.lock
|
|
@ -87,26 +87,6 @@
|
||||||
"type": "github"
|
"type": "github"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"disko": {
|
|
||||||
"inputs": {
|
|
||||||
"nixpkgs": [
|
|
||||||
"nixpkgs"
|
|
||||||
]
|
|
||||||
},
|
|
||||||
"locked": {
|
|
||||||
"lastModified": 1724349583,
|
|
||||||
"narHash": "sha256-zgB1Cfk46irIsto8666yLdKjqKdBrjR48Dd3lhQ0CnQ=",
|
|
||||||
"owner": "nix-community",
|
|
||||||
"repo": "disko",
|
|
||||||
"rev": "435737144be0259559ca3b43f7d72252b1fdcc1b",
|
|
||||||
"type": "github"
|
|
||||||
},
|
|
||||||
"original": {
|
|
||||||
"owner": "nix-community",
|
|
||||||
"repo": "disko",
|
|
||||||
"type": "github"
|
|
||||||
}
|
|
||||||
},
|
|
||||||
"element-stickers": {
|
"element-stickers": {
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"maunium-stickerpicker": [
|
"maunium-stickerpicker": [
|
||||||
|
|
@ -396,7 +376,6 @@
|
||||||
"inputs": {
|
"inputs": {
|
||||||
"agenix": "agenix",
|
"agenix": "agenix",
|
||||||
"deploy-rs": "deploy-rs",
|
"deploy-rs": "deploy-rs",
|
||||||
"disko": "disko",
|
|
||||||
"element-stickers": "element-stickers",
|
"element-stickers": "element-stickers",
|
||||||
"element-themes": "element-themes",
|
"element-themes": "element-themes",
|
||||||
"flake-parts": "flake-parts",
|
"flake-parts": "flake-parts",
|
||||||
|
|
|
||||||
15
flake.nix
15
flake.nix
|
|
@ -18,9 +18,6 @@
|
||||||
deploy-rs.url = "github:serokell/deploy-rs";
|
deploy-rs.url = "github:serokell/deploy-rs";
|
||||||
deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
|
deploy-rs.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
|
|
||||||
disko.url = "github:nix-community/disko";
|
|
||||||
disko.inputs.nixpkgs.follows = "nixpkgs";
|
|
||||||
|
|
||||||
agenix.url = "github:ryantm/agenix";
|
agenix.url = "github:ryantm/agenix";
|
||||||
agenix.inputs.nixpkgs.follows = "nixpkgs";
|
agenix.inputs.nixpkgs.follows = "nixpkgs";
|
||||||
agenix.inputs.darwin.follows = "nix-darwin";
|
agenix.inputs.darwin.follows = "nix-darwin";
|
||||||
|
|
@ -138,18 +135,6 @@
|
||||||
hostname = "tankstelle.wg.pub.solar";
|
hostname = "tankstelle.wg.pub.solar";
|
||||||
sshUser = username;
|
sshUser = username;
|
||||||
};
|
};
|
||||||
trinkgenossin = {
|
|
||||||
#hostname = "trinkgenossin.wg.pub.solar";
|
|
||||||
sshUser = username;
|
|
||||||
};
|
|
||||||
delite = {
|
|
||||||
#hostname = "delite.wg.pub.solar";
|
|
||||||
sshUser = username;
|
|
||||||
};
|
|
||||||
blue-shell = {
|
|
||||||
#hostname = "delite.wg.pub.solar";
|
|
||||||
sshUser = username;
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
||||||
|
|
@ -1,30 +0,0 @@
|
||||||
{ config, lib, pkgs, ... }:
|
|
||||||
{
|
|
||||||
boot.loader.grub.enable = true;
|
|
||||||
|
|
||||||
boot.kernelParams = [
|
|
||||||
"boot.shell_on_fail=1"
|
|
||||||
"ip=dhcp"
|
|
||||||
];
|
|
||||||
|
|
||||||
services.openssh.openFirewall = true;
|
|
||||||
|
|
||||||
# This option defines the first version of NixOS you have installed on this particular machine,
|
|
||||||
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
|
|
||||||
#
|
|
||||||
# Most users should NEVER change this value after the initial install, for any reason,
|
|
||||||
# even if you've upgraded your system to a new NixOS release.
|
|
||||||
#
|
|
||||||
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
|
|
||||||
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
|
|
||||||
# to actually do that.
|
|
||||||
#
|
|
||||||
# This value being lower than the current NixOS release does NOT mean your system is
|
|
||||||
# out of date, out of support, or vulnerable.
|
|
||||||
#
|
|
||||||
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
|
|
||||||
# and migrated your data accordingly.
|
|
||||||
#
|
|
||||||
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
|
|
||||||
system.stateVersion = "24.05"; # Did you read the comment?
|
|
||||||
}
|
|
||||||
|
|
@ -1,13 +0,0 @@
|
||||||
{ flake, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
./hardware-configuration.nix
|
|
||||||
./configuration.nix
|
|
||||||
./disk-config.nix
|
|
||||||
|
|
||||||
./networking.nix
|
|
||||||
#./wireguard.nix
|
|
||||||
#./backups.nix
|
|
||||||
];
|
|
||||||
}
|
|
||||||
|
|
@ -1,109 +0,0 @@
|
||||||
{
|
|
||||||
disko.devices = {
|
|
||||||
disk = {
|
|
||||||
main = {
|
|
||||||
type = "disk";
|
|
||||||
device = "/dev/vdb";
|
|
||||||
content = {
|
|
||||||
type = "gpt";
|
|
||||||
partitions = {
|
|
||||||
bios = {
|
|
||||||
size = "1M";
|
|
||||||
type = "EF02"; # for grub MBR
|
|
||||||
};
|
|
||||||
boot = {
|
|
||||||
size = "1G";
|
|
||||||
type = "8300";
|
|
||||||
content = {
|
|
||||||
type = "filesystem";
|
|
||||||
format = "ext4";
|
|
||||||
mountpoint = "/boot";
|
|
||||||
mountOptions = [
|
|
||||||
"defaults"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
luks = {
|
|
||||||
size = "100%";
|
|
||||||
content = {
|
|
||||||
type = "luks";
|
|
||||||
name = "cryptroot";
|
|
||||||
extraOpenArgs = [ ];
|
|
||||||
# if you want to use the key for interactive login be sure there is no trailing newline
|
|
||||||
# for example use `echo -n "password" > /tmp/secret.key`
|
|
||||||
passwordFile = "/tmp/luks-password";
|
|
||||||
content = {
|
|
||||||
type = "lvm_pv";
|
|
||||||
vg = "vg0";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
data = {
|
|
||||||
type = "disk";
|
|
||||||
device = "/dev/vdc";
|
|
||||||
content = {
|
|
||||||
type = "gpt";
|
|
||||||
partitions = {
|
|
||||||
luks = {
|
|
||||||
size = "100%";
|
|
||||||
content = {
|
|
||||||
type = "luks";
|
|
||||||
name = "cryptdata";
|
|
||||||
extraOpenArgs = [ ];
|
|
||||||
# if you want to use the key for interactive login be sure there is no trailing newline
|
|
||||||
# for example use `echo -n "password" > /tmp/secret.key`
|
|
||||||
passwordFile = "/tmp/luks-password";
|
|
||||||
content = {
|
|
||||||
type = "filesystem";
|
|
||||||
format = "xfs";
|
|
||||||
mountpoint = "/var/lib/garage/data";
|
|
||||||
mountOptions = [
|
|
||||||
"defaults"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
lvm_vg = {
|
|
||||||
vg0 = {
|
|
||||||
type = "lvm_vg";
|
|
||||||
lvs = {
|
|
||||||
root = {
|
|
||||||
size = "100G";
|
|
||||||
content = {
|
|
||||||
type = "filesystem";
|
|
||||||
format = "ext4";
|
|
||||||
mountpoint = "/";
|
|
||||||
mountOptions = [
|
|
||||||
"defaults"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
swap = {
|
|
||||||
size = "16G";
|
|
||||||
content = {
|
|
||||||
type = "swap";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
metadata = {
|
|
||||||
size = "50G";
|
|
||||||
content = {
|
|
||||||
type = "filesystem";
|
|
||||||
format = "btrfs";
|
|
||||||
mountpoint = "/var/lib/garage/meta";
|
|
||||||
mountOptions = [
|
|
||||||
"defaults"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,17 +0,0 @@
|
||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
|
|
||||||
boot.initrd.kernelModules = [ ];
|
|
||||||
boot.kernelModules = [ ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
}
|
|
||||||
|
|
@ -1,26 +0,0 @@
|
||||||
{
|
|
||||||
config,
|
|
||||||
pkgs,
|
|
||||||
flake,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
{
|
|
||||||
services.garage.settings.rpc_public_addr = "[2a03:4000:43:24e::1]:3901";
|
|
||||||
|
|
||||||
networking.hostName = "blue-shell";
|
|
||||||
networking.hostId = "00000005";
|
|
||||||
|
|
||||||
networking.useDHCP = false;
|
|
||||||
systemd.network.enable = true;
|
|
||||||
systemd.network.networks."10-wan" = {
|
|
||||||
matchConfig.Name = "ens3";
|
|
||||||
address = [
|
|
||||||
"194.13.83.205/22"
|
|
||||||
"2a03:4000:43:24e::1/64"
|
|
||||||
];
|
|
||||||
gateway = [
|
|
||||||
"194.13.80.1"
|
|
||||||
"fe80::1"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -87,53 +87,6 @@
|
||||||
self.nixosModules.promtail
|
self.nixosModules.promtail
|
||||||
];
|
];
|
||||||
};
|
};
|
||||||
|
|
||||||
trinkgenossin = self.nixos-flake.lib.mkLinuxSystem {
|
|
||||||
imports = [
|
|
||||||
self.inputs.agenix.nixosModules.default
|
|
||||||
self.nixosModules.home-manager
|
|
||||||
./trinkgenossin
|
|
||||||
self.nixosModules.overlays
|
|
||||||
self.nixosModules.unlock-luks-on-boot
|
|
||||||
self.nixosModules.core
|
|
||||||
#self.nixosModules.prometheus-exporters
|
|
||||||
#self.nixosModules.promtail
|
|
||||||
|
|
||||||
self.nixosModules.garage
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
delite = self.nixos-flake.lib.mkLinuxSystem {
|
|
||||||
imports = [
|
|
||||||
self.inputs.agenix.nixosModules.default
|
|
||||||
self.inputs.disko.nixosModules.disko
|
|
||||||
self.nixosModules.home-manager
|
|
||||||
./delite
|
|
||||||
self.nixosModules.overlays
|
|
||||||
self.nixosModules.unlock-luks-on-boot
|
|
||||||
self.nixosModules.core
|
|
||||||
#self.nixosModules.prometheus-exporters
|
|
||||||
#self.nixosModules.promtail
|
|
||||||
|
|
||||||
self.nixosModules.garage
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
blue-shell = self.nixos-flake.lib.mkLinuxSystem {
|
|
||||||
imports = [
|
|
||||||
self.inputs.agenix.nixosModules.default
|
|
||||||
self.inputs.disko.nixosModules.disko
|
|
||||||
self.nixosModules.home-manager
|
|
||||||
./blue-shell
|
|
||||||
self.nixosModules.overlays
|
|
||||||
self.nixosModules.unlock-luks-on-boot
|
|
||||||
self.nixosModules.core
|
|
||||||
#self.nixosModules.prometheus-exporters
|
|
||||||
#self.nixosModules.promtail
|
|
||||||
|
|
||||||
self.nixosModules.garage
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,35 +0,0 @@
|
||||||
{
|
|
||||||
flake,
|
|
||||||
config,
|
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
{
|
|
||||||
boot.loader.grub.enable = true;
|
|
||||||
|
|
||||||
boot.kernelParams = [
|
|
||||||
"boot.shell_on_fail=1"
|
|
||||||
"ip=dhcp"
|
|
||||||
];
|
|
||||||
|
|
||||||
services.openssh.openFirewall = true;
|
|
||||||
|
|
||||||
# This option defines the first version of NixOS you have installed on this particular machine,
|
|
||||||
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
|
|
||||||
#
|
|
||||||
# Most users should NEVER change this value after the initial install, for any reason,
|
|
||||||
# even if you've upgraded your system to a new NixOS release.
|
|
||||||
#
|
|
||||||
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
|
|
||||||
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
|
|
||||||
# to actually do that.
|
|
||||||
#
|
|
||||||
# This value being lower than the current NixOS release does NOT mean your system is
|
|
||||||
# out of date, out of support, or vulnerable.
|
|
||||||
#
|
|
||||||
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
|
|
||||||
# and migrated your data accordingly.
|
|
||||||
#
|
|
||||||
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
|
|
||||||
system.stateVersion = "24.05"; # Did you read the comment?
|
|
||||||
}
|
|
||||||
|
|
@ -1,13 +0,0 @@
|
||||||
{ flake, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
./hardware-configuration.nix
|
|
||||||
./configuration.nix
|
|
||||||
./disk-config.nix
|
|
||||||
|
|
||||||
./networking.nix
|
|
||||||
#./wireguard.nix
|
|
||||||
#./backups.nix
|
|
||||||
];
|
|
||||||
}
|
|
||||||
|
|
@ -1,92 +0,0 @@
|
||||||
{
|
|
||||||
disko.devices = {
|
|
||||||
disk = {
|
|
||||||
main = {
|
|
||||||
type = "disk";
|
|
||||||
device = "/dev/vda";
|
|
||||||
content = {
|
|
||||||
type = "gpt";
|
|
||||||
partitions = {
|
|
||||||
bios = {
|
|
||||||
size = "1M";
|
|
||||||
type = "EF02"; # for grub MBR
|
|
||||||
};
|
|
||||||
boot = {
|
|
||||||
size = "1G";
|
|
||||||
type = "8300";
|
|
||||||
content = {
|
|
||||||
type = "filesystem";
|
|
||||||
format = "ext4";
|
|
||||||
mountpoint = "/boot";
|
|
||||||
mountOptions = [
|
|
||||||
"defaults"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
luks = {
|
|
||||||
size = "100%";
|
|
||||||
content = {
|
|
||||||
type = "luks";
|
|
||||||
name = "cryptroot";
|
|
||||||
extraOpenArgs = [ ];
|
|
||||||
# if you want to use the key for interactive login be sure there is no trailing newline
|
|
||||||
# for example use `echo -n "password" > /tmp/secret.key`
|
|
||||||
passwordFile = "/tmp/luks-password";
|
|
||||||
content = {
|
|
||||||
type = "lvm_pv";
|
|
||||||
vg = "vg0";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
lvm_vg = {
|
|
||||||
vg0 = {
|
|
||||||
type = "lvm_vg";
|
|
||||||
lvs = {
|
|
||||||
root = {
|
|
||||||
size = "40G";
|
|
||||||
content = {
|
|
||||||
type = "filesystem";
|
|
||||||
format = "ext4";
|
|
||||||
mountpoint = "/";
|
|
||||||
mountOptions = [
|
|
||||||
"defaults"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
swap = {
|
|
||||||
size = "8G";
|
|
||||||
content = {
|
|
||||||
type = "swap";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
data = {
|
|
||||||
size = "800G";
|
|
||||||
content = {
|
|
||||||
type = "filesystem";
|
|
||||||
format = "xfs";
|
|
||||||
mountpoint = "/var/lib/garage/data";
|
|
||||||
mountOptions = [
|
|
||||||
"defaults"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
metadata = {
|
|
||||||
size = "50G";
|
|
||||||
content = {
|
|
||||||
type = "filesystem";
|
|
||||||
format = "btrfs";
|
|
||||||
mountpoint = "/var/lib/garage/meta";
|
|
||||||
mountOptions = [
|
|
||||||
"defaults"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,18 +0,0 @@
|
||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{ config, lib, pkgs, modulesPath, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports =
|
|
||||||
[ (modulesPath + "/profiles/qemu-guest.nix")
|
|
||||||
];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_blk" ];
|
|
||||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
|
||||||
boot.kernelModules = [ ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
}
|
|
||||||
|
|
@ -1,26 +0,0 @@
|
||||||
{
|
|
||||||
config,
|
|
||||||
pkgs,
|
|
||||||
flake,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
{
|
|
||||||
services.garage.settings.rpc_public_addr = "[2a04:52c0:124:9d8c::2]:3901";
|
|
||||||
|
|
||||||
networking.hostName = "delite";
|
|
||||||
networking.hostId = "00000004";
|
|
||||||
|
|
||||||
networking.useDHCP = false;
|
|
||||||
systemd.network.enable = true;
|
|
||||||
systemd.network.networks."10-wan" = {
|
|
||||||
matchConfig.Name = "ens3";
|
|
||||||
address = [
|
|
||||||
"5.255.119.132/24"
|
|
||||||
"2a04:52c0:124:9d8c::2/48"
|
|
||||||
];
|
|
||||||
gateway = [
|
|
||||||
"5.255.119.1"
|
|
||||||
"2a04:52c0:124::1"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,37 +0,0 @@
|
||||||
{
|
|
||||||
flake,
|
|
||||||
config,
|
|
||||||
lib,
|
|
||||||
pkgs,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
{
|
|
||||||
boot.loader.grub.enable = true;
|
|
||||||
boot.loader.grub.devices = ["/dev/vda"];
|
|
||||||
|
|
||||||
boot.kernelParams = [
|
|
||||||
"boot.shell_on_fail=1"
|
|
||||||
"ip=dhcp"
|
|
||||||
];
|
|
||||||
|
|
||||||
services.openssh.openFirewall = true;
|
|
||||||
|
|
||||||
# This option defines the first version of NixOS you have installed on this particular machine,
|
|
||||||
# and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
|
|
||||||
#
|
|
||||||
# Most users should NEVER change this value after the initial install, for any reason,
|
|
||||||
# even if you've upgraded your system to a new NixOS release.
|
|
||||||
#
|
|
||||||
# This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
|
|
||||||
# so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
|
|
||||||
# to actually do that.
|
|
||||||
#
|
|
||||||
# This value being lower than the current NixOS release does NOT mean your system is
|
|
||||||
# out of date, out of support, or vulnerable.
|
|
||||||
#
|
|
||||||
# Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
|
|
||||||
# and migrated your data accordingly.
|
|
||||||
#
|
|
||||||
# For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
|
|
||||||
system.stateVersion = "24.05"; # Did you read the comment?
|
|
||||||
}
|
|
||||||
|
|
@ -1,12 +0,0 @@
|
||||||
{ flake, ... }:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports = [
|
|
||||||
./hardware-configuration.nix
|
|
||||||
./configuration.nix
|
|
||||||
|
|
||||||
./networking.nix
|
|
||||||
#./wireguard.nix
|
|
||||||
#./backups.nix
|
|
||||||
];
|
|
||||||
}
|
|
||||||
|
|
@ -1,56 +0,0 @@
|
||||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
|
||||||
# and may be overwritten by future invocations. Please make changes
|
|
||||||
# to /etc/nixos/configuration.nix instead.
|
|
||||||
{
|
|
||||||
config,
|
|
||||||
lib,
|
|
||||||
pkgs,
|
|
||||||
modulesPath,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
|
|
||||||
{
|
|
||||||
imports = [ ];
|
|
||||||
|
|
||||||
boot.initrd.availableKernelModules = [
|
|
||||||
"ata_piix"
|
|
||||||
"uhci_hcd"
|
|
||||||
"virtio_pci"
|
|
||||||
"sr_mod"
|
|
||||||
"virtio_blk"
|
|
||||||
];
|
|
||||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
|
||||||
boot.kernelModules = [ "kvm-amd" ];
|
|
||||||
boot.extraModulePackages = [ ];
|
|
||||||
|
|
||||||
boot.initrd.luks.devices."cryptroot" = {
|
|
||||||
device = "/dev/disk/by-uuid/52a1fd17-63d7-4d0a-b7ff-74aceaf6085a";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/" = {
|
|
||||||
device = "/dev/disk/by-label/nixos";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/boot" = {
|
|
||||||
device = "/dev/disk/by-label/boot";
|
|
||||||
fsType = "ext4";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/var/lib/garage/data" = {
|
|
||||||
device = "/dev/disk/by-label/data";
|
|
||||||
fsType = "xfs";
|
|
||||||
};
|
|
||||||
|
|
||||||
fileSystems."/var/lib/garage/meta" = {
|
|
||||||
device = "/dev/disk/by-label/metadata";
|
|
||||||
fsType = "btrfs";
|
|
||||||
};
|
|
||||||
|
|
||||||
swapDevices = [
|
|
||||||
{ device = "/dev/disk/by-label/swap"; }
|
|
||||||
];
|
|
||||||
|
|
||||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
|
||||||
virtualisation.hypervGuest.enable = true;
|
|
||||||
}
|
|
||||||
|
|
@ -1,15 +0,0 @@
|
||||||
{
|
|
||||||
config,
|
|
||||||
pkgs,
|
|
||||||
flake,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
{
|
|
||||||
services.garage.settings.rpc_public_addr = "[2a01:239:35d:f500::1]:3901";
|
|
||||||
|
|
||||||
networking.hostName = "trinkgenossin";
|
|
||||||
networking.hostId = "00000003";
|
|
||||||
|
|
||||||
networking.enableIPv6 = true;
|
|
||||||
networking.useDHCP = true;
|
|
||||||
}
|
|
||||||
|
|
@ -1,75 +0,0 @@
|
||||||
{
|
|
||||||
config,
|
|
||||||
lib,
|
|
||||||
pkgs,
|
|
||||||
flake,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
{
|
|
||||||
age.secrets."garage-rpc-secret" = {
|
|
||||||
file = "${flake.self}/secrets/garage-rpc-secret.age";
|
|
||||||
mode = "400";
|
|
||||||
};
|
|
||||||
|
|
||||||
age.secrets."garage-admin-token" = {
|
|
||||||
file = "${flake.self}/secrets/garage-admin-token.age";
|
|
||||||
mode = "400";
|
|
||||||
};
|
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = [
|
|
||||||
3900
|
|
||||||
3901
|
|
||||||
3902
|
|
||||||
];
|
|
||||||
|
|
||||||
services.garage = {
|
|
||||||
enable = true;
|
|
||||||
package = pkgs.garage_1_0_0;
|
|
||||||
settings = {
|
|
||||||
data_dir = "/var/lib/garage/data";
|
|
||||||
metadata_dir = "/var/lib/garage/meta";
|
|
||||||
db_engine = "lmdb";
|
|
||||||
replication_factor = 3;
|
|
||||||
compression_level = 2;
|
|
||||||
rpc_bind_addr = "[::]:3901";
|
|
||||||
s3_api = {
|
|
||||||
s3_region = "eu-central";
|
|
||||||
api_bind_addr = "[::]:3900";
|
|
||||||
root_domain = ".s3.${config.pub-solar-os.networking.domain}";
|
|
||||||
};
|
|
||||||
s3_web = {
|
|
||||||
bind_addr = "[::]:3902";
|
|
||||||
root_domain = ".web.${config.pub-solar-os.networking.domain}";
|
|
||||||
index = "index.html";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
users.users.garage = {
|
|
||||||
isSystemUser = true;
|
|
||||||
home = "/var/lib/garage";
|
|
||||||
group = "garage";
|
|
||||||
};
|
|
||||||
|
|
||||||
users.groups.garage = { };
|
|
||||||
|
|
||||||
# Adapted from https://git.clan.lol/clan/clan-core/src/commit/23a9e35c665ff531fe1193dcc47056432fbbeacf/clanModules/garage/default.nix
|
|
||||||
# Disabled DynamicUser https://github.com/NixOS/nixpkgs/blob/nixos-24.05/nixos/modules/services/web-servers/garage.nix
|
|
||||||
# for mounts + permissions to work
|
|
||||||
systemd.services.garage = {
|
|
||||||
serviceConfig = {
|
|
||||||
user = "garage";
|
|
||||||
group = "garage";
|
|
||||||
DynamicUser = false;
|
|
||||||
LoadCredential = [
|
|
||||||
"rpc_secret_path:${config.age.secrets.garage-rpc-secret.path}"
|
|
||||||
"admin_token_path:${config.age.secrets.garage-admin-token.path}"
|
|
||||||
];
|
|
||||||
Environment = [
|
|
||||||
"GARAGE_ALLOW_WORLD_READABLE_SECRETS=true"
|
|
||||||
"GARAGE_RPC_SECRET_FILE=%d/rpc_secret_path"
|
|
||||||
"GARAGE_ADMIN_TOKEN_FILE=%d/admin_token_path"
|
|
||||||
];
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,20 +0,0 @@
|
||||||
{ flake, config, ... }:
|
|
||||||
{
|
|
||||||
boot.initrd.network = {
|
|
||||||
enable = true;
|
|
||||||
ssh = {
|
|
||||||
enable = true;
|
|
||||||
# To prevent ssh clients from freaking out because a different host key is used,
|
|
||||||
# a different port for ssh is useful (assuming the same host has also a regular sshd running)
|
|
||||||
port = 2222;
|
|
||||||
|
|
||||||
# Please create this manually the first time.
|
|
||||||
hostKeys = [ "/etc/secrets/initrd/ssh_host_ed25519_key" ];
|
|
||||||
authorizedKeys = config.pub-solar-os.authentication.sshPubKeys;
|
|
||||||
};
|
|
||||||
postCommands = ''
|
|
||||||
# Automatically ask for the password on SSH login
|
|
||||||
echo 'cryptsetup-askpass || echo "Unlock was successful; exiting SSH session" && exit 1' >> /root/.profile
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -1,47 +0,0 @@
|
||||||
age-encryption.org/v1
|
|
||||||
-> ssh-ed25519 NID4eA MqbdKdPSNLU32j+ZFTT1bmSFk4ZQowSuYcuP/FRtKgs
|
|
||||||
m0UaJclORGOrQDLIvdIv4Aq4U3XNOet9CzU8pX/pGsI
|
|
||||||
-> ssh-ed25519 9RQHxg WyTt2Lqd2mRtwsx2PLajmk68IB1yP0DkgXR/xfIMERM
|
|
||||||
4JaJ+DB97XxOuI2G/qnk+NX8Xv1ruY28NPRl7aUPWEc
|
|
||||||
-> ssh-ed25519 eP5MMw HUf/aXRbaIEjQFdWpo8vWtNSqzYcQKaNKJ7y+ewMVz0
|
|
||||||
6IcRiPufkMLjOV5mSaOBclPmFDVKII/8mqGN7jmfkYk
|
|
||||||
-> ssh-ed25519 uYcDNw gHg0z1q+4AGZtuMzbV1dZjWojmYNE0JO1ZhMnGqAbR0
|
|
||||||
sFE6mIV3ZgRMlsuHFltkC4M+aAhEDzVQQ3rkgiR5GSY
|
|
||||||
-> ssh-rsa f5THog
|
|
||||||
BFJZWIMurARpA6XJMlxnDYFUTGCX5gEb6IycqUQbIdu9+91mpDR3WxlJYLLZC3vD
|
|
||||||
j7e5xFvr4bOXQg56N59k4AD5CnC7CoZld/PqGtP5JqUcoXPFHgq95GzfiuTLedkZ
|
|
||||||
esPsPvXfdeyqfzcdMhxTz8pO0RRPUk9Xc2wnvHrDyeNO0vS5N+bMsNMvFfRaMZTi
|
|
||||||
xV2Xl98VFl90+gzuPACN0zpfoEqajcJhPtMqoaOjOzD7sGaAz5UYLAIyOHdh3t9w
|
|
||||||
DwVorUheXKLqq1kxZRZ5QCC7N+TCbi7x6B5xCezz9hF2vXkzunDh/d7maQG34AXJ
|
|
||||||
x1sQ4R9dXn778j14RqBBNbsFPDg8WIS4Zs+ypdqev8w+aOhZkcDf5unKQJLdeu3N
|
|
||||||
W+IUJTN5zFObMX0TXtj0yI7xUSkZKSLuZs43MhdVkNo1YewHalMpKetctnw2Lz+z
|
|
||||||
ZcDCRLmD91U5BL7xp9KYQQ9EBjEn8dyw9hn8RmCaRKsvi71cIStv4OtuGxzIvTOJ
|
|
||||||
phqDJdjz53E6L/0NDmhgN7bxolYZJsPC2o/ca0lG1rx3SZdfI18WaTsQrOO2NaeZ
|
|
||||||
i4u9vkw/k7xT65mPxPsN7s67niE6lVGyTOLMwjvfO1sAHABbtto2GL0zRc454b9v
|
|
||||||
gObMCi/ZbOUo6wndMMPnrQh9SsSGKB6EIOEzmg+8M+Y
|
|
||||||
-> ssh-rsa kFDS0A
|
|
||||||
h9TH7j+1hquLDwCIRDvQiN7UJaO6rJ/NtWdeWTuqTqTGSS+aVvm9gDZBZiLzWyqb
|
|
||||||
GLd2guhepOCuSQkxocD7KAz1hp5pqf++XI8/yqepnHuU+CmInsOBmSZsG8QGktbk
|
|
||||||
wjY3ZqZdcfCorgAxjIaw4aNW3zeoq7ATC3rC3aDeOsZC6jImdgEeCvd8BczWSqOa
|
|
||||||
9acfRqd+QNDjqq3MIGIepVBlQ0nNniRtQoh4XtUey8jVb6kjow4TqBo9V33UhO7x
|
|
||||||
r3WMgk5q1onECAhaAlYFxQ3DzLjUxAVdulnkIoSBqdE1b6Njyc70CI9oYwZcGmbD
|
|
||||||
gC3qdQWmcoeOQ95YkdJAxaFIl3VNOTyn9rSXtn3a1PsVygaT+98qd1zwGPY+3ZDk
|
|
||||||
B1chqWp3IJ4y2oPqt1mO4j0am2NAChpcWlEhgeldD0HoUixoXvp2Gu0igD5ENfyH
|
|
||||||
BopesdhSoIxw8PbjKvnuwPFNSa9ysS6mpdmChTdBGpOCSpwMEcEE/m3pLo4FkzJf
|
|
||||||
nhQaxav7VmvZ2jxnmEgP/NUgxmZPHKOzlI3vqWfTsIwz/chHDwekhb6dB0O5nrjO
|
|
||||||
LzmKVrkVH0EEa3R1/BIfF674RSPXOmW89NNU7tCax3IOuPWC0QYv+2r/zjmAEq+Q
|
|
||||||
LJMPf1fUjLlsCmkOlxDYK4E/EyiG5dcjxdyXk8J+l6s
|
|
||||||
-> piv-p256 vRzPNw AzRQKtxg/bXdDoLXM4IBQaPXZ7Tg/6GSg0LeQQ3GNUnw
|
|
||||||
xf8jnJPg8nqUt26lvtemwdvV8h0nT8k/H4iGO8fBa1k
|
|
||||||
-> piv-p256 zqq/iw AtpFzxs9a5N87BOsagEIMnJFxyBv8PZwsF4orrWS7dlP
|
|
||||||
8w3nDD2dIXKRKtnz/xnFW3it99ZmfY9X4ZiQhjXnaPM
|
|
||||||
-> ssh-ed25519 YFSOsg E3q3wZk2o3+Gmv0xMuokFWqhckCEZxVomrj61M2U21w
|
|
||||||
CUlB8ynJwO5JmHND3+x/NN/PyV0HJXfoxI3TgPjOD/4
|
|
||||||
-> ssh-ed25519 iHV63A 4tjRDQ0kSZZYda0V3pEs6teT7n8r0WFQ1iHj90XIP1c
|
|
||||||
OMGjdTkZo8LOojtNDhIw5OXaWpC21f8hIOcnv1suLA4
|
|
||||||
-> ssh-ed25519 BVsyTA 5BzUJ7kmv/3ZwxRGOq6QNohlWn5nuHgCBTjbcGtA1jU
|
|
||||||
vaN4i/JBvrDtdb9IX+F4uLG8v6wiaF0zjTyBXJ7B0Ts
|
|
||||||
-> ssh-ed25519 +3V2lQ eS/DpYwsqIkwm1JENRu1kIHqe+qAcMssglt/DHIAuBk
|
|
||||||
JYdv3kTgpF+3b4a9eycCzl3FWyLSkunas4IYqfw9z48
|
|
||||||
--- iffZKXnN9jbIrfnm0NrUmqfNhsBtd0FCBEc9Zp0YSj8
|
|
||||||
Ñ[4aÏ“ Ü¥¹ŒçG”Žž(˜ É\<5C>)Y QÍ
'~@L—KñTw¬;æ–jó~,‰¤¤¦îεó½‡Ô*áüq?o}ª' ? ¸×¿
|
|
||||||
Binary file not shown.
|
|
@ -5,9 +5,6 @@ let
|
||||||
flora-6-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP1InpTBN4AlF/4V8HHumAMLJzeO8DpzjUv9Co/+J09 root@flora-6";
|
flora-6-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGP1InpTBN4AlF/4V8HHumAMLJzeO8DpzjUv9Co/+J09 root@flora-6";
|
||||||
metronom-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICLX6UvvrKALKL0xsNnytLPHryzZF5evUnxAgGokf14i root@metronom";
|
metronom-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICLX6UvvrKALKL0xsNnytLPHryzZF5evUnxAgGokf14i root@metronom";
|
||||||
tankstelle-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJdF6cJKPDiloWiDja1ZtqkXDdXOCHPs10HD+JMzgeU4 root@tankstelle";
|
tankstelle-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJdF6cJKPDiloWiDja1ZtqkXDdXOCHPs10HD+JMzgeU4 root@tankstelle";
|
||||||
trinkgenossin-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDZXRDpom/LtyoCxvRuoONARKxIT6wNUwEyUjzHRE7DG root@trinkgenossin";
|
|
||||||
delite-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKo7zlfQhcJ5/okFTOoOstZtmEL1iNlHxQ4q2baEcWT root@delite";
|
|
||||||
blue-shell-host = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP9g9X0a/MaVtbh44IeLxcq+McuYec0GYAdLsseBpk5f root@blue-shell";
|
|
||||||
|
|
||||||
adminKeys = builtins.foldl' (
|
adminKeys = builtins.foldl' (
|
||||||
keys: login: keys ++ (builtins.attrValues login.secretEncryptionKeys)
|
keys: login: keys ++ (builtins.attrValues login.secretEncryptionKeys)
|
||||||
|
|
@ -20,8 +17,6 @@ let
|
||||||
flora6Keys = [ flora-6-host ];
|
flora6Keys = [ flora-6-host ];
|
||||||
|
|
||||||
metronomKeys = [ metronom-host ];
|
metronomKeys = [ metronom-host ];
|
||||||
|
|
||||||
garageKeys = [ trinkgenossin-host delite-host blue-shell-host ];
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBB5XaH02a6+TchnyQED2VwaltPgeFCbildbE2h6nF5e root@nachtigall
|
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBB5XaH02a6+TchnyQED2VwaltPgeFCbildbE2h6nF5e root@nachtigall
|
||||||
|
|
@ -92,8 +87,4 @@ in
|
||||||
"mail/crew.age".publicKeys = metronomKeys ++ adminKeys;
|
"mail/crew.age".publicKeys = metronomKeys ++ adminKeys;
|
||||||
"mail/erpnext.age".publicKeys = metronomKeys ++ adminKeys;
|
"mail/erpnext.age".publicKeys = metronomKeys ++ adminKeys;
|
||||||
"mail/hakkonaut.age".publicKeys = metronomKeys ++ adminKeys;
|
"mail/hakkonaut.age".publicKeys = metronomKeys ++ adminKeys;
|
||||||
|
|
||||||
# garage
|
|
||||||
"garage-rpc-secret.age".publicKeys = garageKeys ++ adminKeys;
|
|
||||||
"garage-admin-token.age".publicKeys = garageKeys ++ adminKeys;
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -59,36 +59,6 @@ resource "namecheap_domain_records" "pub-solar" {
|
||||||
type = "A"
|
type = "A"
|
||||||
address = "49.13.236.167"
|
address = "49.13.236.167"
|
||||||
}
|
}
|
||||||
record {
|
|
||||||
hostname = "trinkgenossin"
|
|
||||||
type = "A"
|
|
||||||
address = "85.215.152.22"
|
|
||||||
}
|
|
||||||
record {
|
|
||||||
hostname = "trinkgenossin"
|
|
||||||
type = "AAAA"
|
|
||||||
address = "2a01:239:35d:f500::1"
|
|
||||||
}
|
|
||||||
record {
|
|
||||||
hostname = "delite"
|
|
||||||
type = "A"
|
|
||||||
address = "5.255.119.132"
|
|
||||||
}
|
|
||||||
record {
|
|
||||||
hostname = "delite"
|
|
||||||
type = "AAAA"
|
|
||||||
address = "2a04:52c0:124:9d8c::2"
|
|
||||||
}
|
|
||||||
record {
|
|
||||||
hostname = "blue-shell"
|
|
||||||
type = "A"
|
|
||||||
address = "194.13.83.205"
|
|
||||||
}
|
|
||||||
record {
|
|
||||||
hostname = "blue-shell"
|
|
||||||
type = "AAAA"
|
|
||||||
address = "2a03:4000:43:24e::1"
|
|
||||||
}
|
|
||||||
record {
|
record {
|
||||||
hostname = "auth"
|
hostname = "auth"
|
||||||
type = "CNAME"
|
type = "CNAME"
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue