flake.lock

@@ -122,6 +122,21 @@
         "type": "github"
       }
     },
+    "flake-utils_2": {
+      "locked": {
+        "lastModified": 1653893745,
+        "narHash": "sha256-0jntwV3Z8//YwuOjzhV2sgJJPt+HY6KhU7VZUL0fKZQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "1ed9fb1935d260de5fe1c2f7ee0ebaae17ed2fa1",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "home-manager": {
       "inputs": {
         "nixpkgs": [
@@ -280,6 +295,7 @@
         "nixos-flake": "nixos-flake",
         "nixpkgs": "nixpkgs",
         "nixpkgs-2205": "nixpkgs-2205",
+        "triton-vmtools": "triton-vmtools",
         "unstable": "unstable"
       }
     },
@@ -313,6 +329,30 @@
         "type": "github"
       }
     },
+    "triton-vmtools": {
+      "inputs": {
+        "flake-utils": "flake-utils_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "dir": "vmtools",
+        "lastModified": 1698443513,
+        "narHash": "sha256-wX2JIJ3JmJn6MAurdyjwZU+FZjLCwBArMrVSeeCb/ZU=",
+        "ref": "main",
+        "rev": "0d039dcf06afb8cbddd7ac54bae4d0d185f3e88e",
+        "revCount": 85,
+        "type": "git",
+        "url": "https://git.pub.solar/pub-solar/infra-vintage?dir=vmtools"
+      },
+      "original": {
+        "dir": "vmtools",
+        "ref": "main",
+        "type": "git",
+        "url": "https://git.pub.solar/pub-solar/infra-vintage?dir=vmtools"
+      }
+    },
     "unstable": {
       "locked": {
         "lastModified": 1698318101,

flake.nix

@@ -26,6 +26,9 @@
 
     keycloak-theme-pub-solar.url = "git+https://git.pub.solar/pub-solar/keycloak-theme?ref=main";
     keycloak-theme-pub-solar.inputs.nixpkgs.follows = "nixpkgs";
+
+    triton-vmtools.url = "git+https://git.pub.solar/pub-solar/infra-vintage?ref=main&dir=vmtools";
+    triton-vmtools.inputs.nixpkgs.follows = "nixpkgs";
   };
 
   outputs = inputs@{ self, ... }:

hosts/default.nix

@@ -13,6 +13,16 @@
             self.nixosModules.docker
           ];
         };
+
+        flora-6 = self.nixos-flake.lib.mkLinuxSystem {
+          imports = [
+            self.inputs.agenix.nixosModules.default
+            self.nixosModules.home-manager
+            ./flora-6
+            self.nixosModules.overlays
+            self.nixosModules.core
+          ];
+        };
       };
     };
   }

hosts/flora-6/README.md

@@ -0,0 +1,50 @@
+# Deploy infra branch to flora-6
+
+Use this command after updating flake inputs to update services on `flora-6`.
+
+```
+deploy --skip-checks --confirm-timeout 300 --targets '.#flora-6'
+
+An alternative, if deployment always fails and rolls back.
+
+```
+
+deploy --skip-checks --magic-rollback false --auto-rollback false --targets '.#flora-6'
+
+```
+
+# SSH access to flora-6
+Ensure your SSH public key is in place [here](./users/barkeeper/default.nix) and
+was deployed by someone with access.
+
+```
+
+ssh barkeeper@flora-6.pub.solar
+
+```
+
+# Mailman on NixOS docs
+
+- add reverse DNS record for IP
+
+Manual setup done for mailman, adapted from https://nixos.wiki/wiki/Mailman:
+
+```
+
+# Add DNS records in infra repo using terraform:
+
+# https://git.pub.solar/pub-solar/infra/commit/db234cdb5b55758a3d74387ada0760e06e166b9d
+
+# Generate initial postfix_domains.db and postfix_lmtp.db databases for Postfix
+
+sudo -u mailman mailman aliases
+
+# Create a django superuser account
+
+sudo -u mailman-web mailman-web createsuperuser
+
+# Followed outlined steps in web UI
+
+```
+
+```

hosts/flora-6/apps/caddy.nix

@@ -0,0 +1,41 @@
+{
+  config,
+  lib,
+  pkgs,
+  flake,
+  ...
+}:
+{
+  systemd.tmpfiles.rules = [
+    "d '/data/srv/www/os/download/' 0750 hakkonaut hakkonaut - -"
+  ];
+
+  services.caddy = {
+    enable = lib.mkForce true;
+    group = "hakkonaut";
+    email = "admins@pub.solar";
+    enableReload = true;
+    globalConfig = lib.mkForce ''
+      grace_period 60s
+    '';
+    virtualHosts = {
+      "ci.pub.solar" = {
+        logFormat = lib.mkForce ''
+          output discard
+        '';
+        extraConfig = ''
+          reverse_proxy :4000
+        '';
+      };
+      "obs-portal.pub.solar" = {
+        logFormat = lib.mkForce ''
+          output discard
+        '';
+        extraConfig = ''
+          reverse_proxy obs-portal.svc.e5756d08-36fd-424b-f8bc-acdb92ca7b82.lev-1.int.greenbaum.zone:3000
+        '';
+      };
+    };
+  };
+  networking.firewall.allowedTCPPorts = [80 443];
+}

hosts/flora-6/apps/drone.nix

@@ -0,0 +1,116 @@
+{
+  config,
+  lib,
+  pkgs,
+  flake,
+  ...
+}: {
+  age.secrets.drone-secrets = {
+    file = "${flake.self}/secrets/drone-secrets.age";
+    mode = "600";
+    owner = "drone";
+  };
+  age.secrets.drone-db-secrets = {
+    file = "${flake.self}/secrets/drone-db-secrets.age";
+    mode = "600";
+    owner = "drone";
+  };
+
+  users.users.drone = {
+    description = "Drone Service";
+    home = "/var/lib/drone";
+    useDefaultShell = true;
+    uid = 994;
+    group = "drone";
+    isSystemUser = true;
+  };
+
+  users.groups.drone = {};
+
+  systemd.tmpfiles.rules = [
+    "d '/var/lib/drone-db' 0750 drone drone - -"
+  ];
+
+  systemd.services."docker-network-drone" = let
+    docker = config.virtualisation.oci-containers.backend;
+    dockerBin = "${pkgs.${docker}}/bin/${docker}";
+  in {
+    serviceConfig.Type = "oneshot";
+    before = ["docker-drone-server.service"];
+    script = ''
+      ${dockerBin} network inspect drone-net >/dev/null 2>&1 || ${dockerBin} network create drone-net --subnet 172.20.0.0/24
+    '';
+  };
+
+  virtualisation = {
+    docker = {
+      enable = true; # sadly podman is not supported rightnow
+      extraOptions = ''
+        --data-root /data/docker
+      '';
+    };
+
+    oci-containers = {
+      backend = "docker";
+      containers."drone-db" = {
+        image = "postgres:14";
+        autoStart = true;
+        user = "994";
+        volumes = [
+          "/var/lib/drone-db:/var/lib/postgresql/data"
+        ];
+        extraOptions = [
+          "--network=drone-net"
+        ];
+        environmentFiles = [
+          config.age.secrets.drone-db-secrets.path
+        ];
+      };
+      containers."drone-server" = {
+        image = "drone/drone:2";
+        autoStart = true;
+        user = "994";
+        ports = [
+          "4000:80"
+        ];
+        dependsOn = ["drone-db"];
+        extraOptions = [
+          "--network=drone-net"
+          "--pull=always"
+        ];
+        environment = {
+          DRONE_GITEA_SERVER = "https://git.pub.solar";
+          DRONE_SERVER_HOST = "ci.pub.solar";
+          DRONE_SERVER_PROTO = "https";
+          DRONE_DATABASE_DRIVER = "postgres";
+        };
+        environmentFiles = [
+          config.age.secrets.drone-secrets.path
+        ];
+      };
+      containers."drone-docker-runner" = {
+        image = "drone/drone-runner-docker:1";
+        autoStart = true;
+        # needs to run as root
+        #user = "994";
+        volumes = [
+          "/var/run/docker.sock:/var/run/docker.sock"
+        ];
+        dependsOn = ["drone-db"];
+        extraOptions = [
+          "--network=drone-net"
+          "--pull=always"
+        ];
+        environment = {
+          DRONE_RPC_HOST = "ci.pub.solar";
+          DRONE_RPC_PROTO = "https";
+          DRONE_RUNNER_CAPACITY = "2";
+          DRONE_RUNNER_NAME = "flora-6-docker-runner";
+        };
+        environmentFiles = [
+          config.age.secrets.drone-secrets.path
+        ];
+      };
+    };
+  };
+}

hosts/flora-6/apps/forgejo-actions-runner.nix

@@ -0,0 +1,35 @@
+{
+  config,
+  lib,
+  pkgs,
+  flake,
+  ...
+}: {
+  age.secrets.forgejo-actions-runner-token = {
+    file = "${flake.self}/secrets/forgejo-actions-runner-token.age";
+    mode = "644";
+  };
+
+  # forgejo actions runner
+  # https://forgejo.org/docs/latest/admin/actions/
+  # https://docs.gitea.com/usage/actions/quickstart
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-actions-runner;
+    instances."flora-6" = {
+      enable = true;
+      name = config.networking.hostName;
+      url = "https://git.pub.solar";
+      tokenFile = config.age.secrets.forgejo-actions-runner-token.path;
+      labels = [
+        # provide a debian 12 bookworm base for actions
+        "debian-latest:docker://debian:bookworm"
+        # fake the ubuntu name, commonly used in actions examples
+        "ubuntu-latest:docker://debian:bookworm"
+        # alpine
+        "alpine-latest:docker://alpine:3.18"
+        # nix flakes enabled image from
+        "nix-flakes:docker://git.pub.solar/pub-solar/nix-flakes-node:latest"
+      ];
+    };
+  };
+}

hosts/flora-6/configuration.nix

@@ -0,0 +1,71 @@
+{
+  config,
+  lib,
+  pkgs,
+  flake,
+  ...
+}: let
+  psCfg = config.pub-solar;
+in {
+  imports = [
+    "${flake.inputs.unstable}/nixos/modules/services/continuous-integration/gitea-actions-runner.nix"
+    "${flake.inputs.unstable}/nixos/modules/services/web-servers/caddy/default.nix"
+  ];
+  disabledModules = [
+    "services/continuous-integration/gitea-actions-runner.nix"
+    "services/web-servers/caddy/default.nix"
+  ];
+
+  config = {
+    # Override nix.conf for more agressive garbage collection
+    nix.extraOptions = lib.mkForce ''
+      experimental-features = flakes nix-command
+      min-free = 536870912
+      keep-outputs = false
+      keep-derivations = false
+      fallback = true
+    '';
+
+    # # #
+    # # # Triton host specific options
+    # # # DO NOT ALTER below this line, changes might render system unbootable
+    # # #
+
+    # Use the systemd-boot EFI boot loader.
+    boot.loader.systemd-boot.enable = true;
+    boot.loader.efi.canTouchEfiVariables = true;
+
+    # Force getting the hostname from cloud-init
+    networking.hostName = lib.mkDefault "";
+
+    # List services that you want to enable:
+    services.cloud-init.enable = true;
+    services.cloud-init.ext4.enable = true;
+    services.cloud-init.network.enable = true;
+    # use the default NixOS cloud-init config, but add some SmartOS customization to it
+    environment.etc."cloud/cloud.cfg.d/90_smartos.cfg".text = ''
+      datasource_list: [ SmartOS ]
+
+      # Do not create the centos/ubuntu/debian user
+      users: [ ]
+
+      # mount second disk with label ephemeral0, gets formated by cloud-init
+      # this will fail to get added to /etc/fstab as it's read-only, but should
+      # mount at boot anyway
+      mounts:
+      - [ vdb, /data, auto, "defaults,nofail" ]
+    '';
+
+    # We manage the firewall with nix, too
+    # altough triton can also manage firewall rules via the triton fwrule subcommand
+    networking.firewall.enable = true;
+
+    # This value determines the NixOS release from which the default
+    # settings for stateful data, like file locations and database versions
+    # on your system were taken. It‘s perfectly fine and recommended to leave
+    # this value at the release version of the first install of this system.
+    # Before changing this value read the documentation for this option
+    # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+    system.stateVersion = "22.05"; # Did you read the comment?
+  };
+}

hosts/flora-6/default.nix

@@ -0,0 +1,15 @@
+{ ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+      ./configuration.nix
+      ./triton-vmtools.nix
+
+      ./apps/caddy.nix
+
+      ./apps/drone.nix
+      ./apps/forgejo-actions-runner.nix
+    ];
+}

hosts/flora-6/hardware-configuration.nix

@@ -0,0 +1,45 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{
+  config,
+  lib,
+  pkgs,
+  modulesPath,
+  ...
+}: {
+  imports = [];
+
+  boot.initrd.availableKernelModules = ["ahci" "virtio_pci" "xhci_pci" "sr_mod" "virtio_blk"];
+  boot.initrd.kernelModules = [];
+  boot.kernelModules = [];
+  boot.extraModulePackages = [];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    autoResize = true;
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/boot";
+    fsType = "vfat";
+  };
+
+  fileSystems."/data" = {
+    device = "/dev/disk/by-label/ephemeral0";
+    fsType = "ext4";
+    options = [
+      "defaults"
+      "nofail"
+    ];
+  };
+
+  swapDevices = [];
+
+  networking.useDHCP = lib.mkDefault false;
+  networking.networkmanager.enable = lib.mkForce false;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/flora-6/triton-vmtools.nix

@@ -0,0 +1,9 @@
+{
+  pkgs,
+  flake,
+  ...
+}: {
+  environment.systemPackages = with pkgs; [
+    flake.inputs.triton-vmtools.packages.${pkgs.system}.default
+  ];
+}

hosts/nachtigall/configuration.nix

@@ -35,14 +35,6 @@
 
   boot.initrd.availableKernelModules = [ "igb" ];
 
-  # Set your time zone.
-  time.timeZone = "Etc/UTC";
-
-  environment = {
-    # just a couple of packages to make our lives easier
-    systemPackages = with pkgs; [ vim ];
-  };
-
   # https://nixos.wiki/wiki/ZFS#declarative_mounting_of_ZFS_datasets
   systemd.services.zfs-mount.enable = false;
 

modules/default.nix

@@ -9,7 +9,7 @@
       terminal-tooling = import ./terminal-tooling.nix;
       users = import ./users.nix;
 
-      core = {
+      core = { pkgs, ... }: {
         imports = [
           nix
           networking
@@ -17,6 +17,19 @@
           users
         ];
 
+        environment = {
+          # Just a couple of global packages to make our lives easier
+          systemPackages = with pkgs; [ git vim wget ];
+        };
+
+        # Select internationalization properties
+        console = {
+          font = "Lat2-Terminus16";
+          keyMap = "us";
+        };
+
+        time.timeZone = "Etc/UTC";
+
         home-manager.users.${self.username} = {
           home.stateVersion = "23.05";
         };

modules/networking.nix

@@ -1,7 +1,29 @@
 { pkgs, ... }: {
-  services.openssh.enable = true;
+  services.openssh = {
-  services.openssh.settings.PermitRootLogin = "prohibit-password";
+    enable = true;
-  services.openssh.settings.PasswordAuthentication = false;
+    settings = {
+      PermitRootLogin = "prohibit-password";
+      PasswordAuthentication = false;
+      # Add back openssh MACs that got removed from defaults
+      # for backwards compatibility
+      #
+      # NixOS default openssh MACs have changed to use "encrypt-then-mac" only.
+      # This breaks compatibilty with clients that do not offer these MACs. For
+      # compatibility reasons, we add back the old defaults.
+      # See: https://github.com/NixOS/nixpkgs/pull/231165
+      # 
+      # https://blog.stribik.technology/2015/01/04/secure-secure-shell.html
+      # https://infosec.mozilla.org/guidelines/openssh#modern-openssh-67
+      Macs = [
+        "hmac-sha2-512-etm@openssh.com"
+        "hmac-sha2-256-etm@openssh.com"
+        "umac-128-etm@openssh.com"
+        "hmac-sha2-512"
+        "hmac-sha2-256"
+        "umac-128@openssh.com"
+      ];
+    };
+  };
 
   services.resolved = {
     enable = true;

overlays/default.nix

@@ -9,6 +9,7 @@
         nixpkgs.overlays = [
           (final: prev: {
             mastodon = inputs.mastodon-fork.legacyPackages.${prev.system}.mastodon;
+            forgejo-actions-runner = inputs.unstable.legacyPackages.${prev.system}.forgejo-actions-runner;
           })
         ];
       });