Berwn
158252323f
Reusable cnx.router.* module for the Topton 1U boxes replacing OPNsense: PPPoE WAN (optionally VLAN-tagged, AIS: 10, secret credentials incl. username), VLAN-filtering bridge, nftables NAT/firewall with MSS clamp, Kea DHCP with per-VLAN lease time, Blocky DNS, DHCPv6-PD, CrowdSec with the ZeroTier mesh whitelisted, optional Omada controller, ZFS disk. Fleet baseline rides along: admins sops group is now derived for every machine in clan.nix (secrets encrypt to it from the first vars generate) and time sync is chrony everywhere instead of systemd-timesyncd.
79 lines
2.2 KiB
Nix
79 lines
2.2 KiB
Nix
# Single-disk ZFS layout for the Topton's 256GB mSATA SSD: vfat ESP for boot,
|
|
# the rest a zpool (zstd compression, no atime). Single disk = no redundancy;
|
|
# ZFS buys us compression, snapshots, and checksumming. Requires
|
|
# networking.hostId (set in configuration.nix). The device is a placeholder:
|
|
# boot the installer, read the real id from `ls -l /dev/disk/by-id/`, and fill
|
|
# it in before `clan machines install`. Changing the layout later requires
|
|
# wiping and reinstalling.
|
|
{
|
|
|
|
boot.loader.grub.efiSupport = true;
|
|
boot.loader.grub.efiInstallAsRemovable = true;
|
|
boot.loader.grub.enable = true;
|
|
disko.devices = {
|
|
disk = {
|
|
main = {
|
|
name = "main-gw-cnx-1";
|
|
device = "/dev/disk/by-id/CHANGE-ME-msata-ssd";
|
|
type = "disk";
|
|
content = {
|
|
type = "gpt";
|
|
partitions = {
|
|
"boot" = {
|
|
size = "1M";
|
|
type = "EF02"; # for grub MBR
|
|
priority = 1;
|
|
};
|
|
ESP = {
|
|
type = "EF00";
|
|
size = "500M";
|
|
content = {
|
|
type = "filesystem";
|
|
format = "vfat";
|
|
mountpoint = "/boot";
|
|
mountOptions = [ "umask=0077" ];
|
|
};
|
|
};
|
|
zfs = {
|
|
size = "100%";
|
|
content = {
|
|
type = "zfs";
|
|
pool = "rpool";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
zpool = {
|
|
rpool = {
|
|
type = "zpool";
|
|
options.ashift = "12";
|
|
rootFsOptions = {
|
|
compression = "zstd";
|
|
acltype = "posixacl";
|
|
xattr = "sa";
|
|
atime = "off";
|
|
mountpoint = "none";
|
|
};
|
|
datasets = {
|
|
root = {
|
|
type = "zfs_fs";
|
|
mountpoint = "/";
|
|
};
|
|
nix = {
|
|
type = "zfs_fs";
|
|
mountpoint = "/nix";
|
|
};
|
|
# Service state (Omada, Kea leases, CrowdSec db, journald) — its own
|
|
# dataset so it can be snapshotted/sent independently of the OS.
|
|
var = {
|
|
type = "zfs_fs";
|
|
mountpoint = "/var";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|