Berwn
7d549a9c17
sshd carries the admin SSH keys and now also CA-signed host certificates (TOFU-less verification via the shared openssh-ca); the users service generates per-machine root passwords (share = false, no prompts).
100 lines
3.5 KiB
Nix
100 lines
3.5 KiB
Nix
let
|
|
hosts = import ./modules/hosts.nix;
|
|
|
|
# Single source of the machine list: inventory AND the per-machine baseline
|
|
# below are both derived from it, so no machine can be added without the
|
|
# baseline (e.g. admins group encryption for all its generated secrets).
|
|
fleet = {
|
|
control = { };
|
|
ns1 = { };
|
|
ns2 = { };
|
|
mx1 = { };
|
|
web01 = { };
|
|
# Site gateways (Topton 1U routers): dynamic PPPoE WAN, so they are NOT in
|
|
# modules/hosts.nix / the `internet` instance — clan reaches them over the
|
|
# zerotier mesh (or Tor) instead.
|
|
gw-cnx-1 = { };
|
|
};
|
|
in
|
|
{
|
|
# Ensure this is unique among all clans you want to use.
|
|
meta.name = "cnx-network-clan";
|
|
meta.domain = "cnx-network.internal";
|
|
|
|
inventory.machines = fleet;
|
|
|
|
inventory.instances = {
|
|
|
|
# Admin SSH keys + root password, split per the clan-core migration off
|
|
# the deprecated `admin` service (sshd handles keys, users the password).
|
|
sshd = {
|
|
roles.server.tags.all = { };
|
|
roles.server.settings.authorizedKeys = {
|
|
"berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIENAjhGQGraQoAjJzsomKP8GAmQPeGL1rNRNHgRcLqtT";
|
|
"kurogeek" =
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
|
|
};
|
|
};
|
|
|
|
root-user = {
|
|
module = {
|
|
name = "users";
|
|
input = "clan-core";
|
|
};
|
|
roles.default.tags.all = { };
|
|
roles.default.settings = {
|
|
user = "root";
|
|
prompt = false; # auto-generate, like the old admin service
|
|
share = false; # per-machine password, not fleet-wide
|
|
};
|
|
};
|
|
|
|
zerotier = {
|
|
roles.controller.machines."control" = { };
|
|
roles.peer.tags.all = { };
|
|
# External members admitted by ZeroTier node id (stable per device).
|
|
# Inventory machines are auto-accepted; this is only for peers outside the
|
|
# clan. Node id comes from `zerotier-cli info` on the joining device.
|
|
roles.controller.settings.allowedIds = [
|
|
"8802c8d7e0" # alex-nixos
|
|
"2bd36db8cc" # kurogeek-thinkpad
|
|
];
|
|
};
|
|
|
|
tor = {
|
|
roles.server.tags.nixos = { };
|
|
};
|
|
|
|
# Direct SSH to public IPs — clan's priority-1 connection path, with the
|
|
# ZeroTier mesh and Tor kept as automatic fallbacks. Raw IPs (from
|
|
# modules/hosts.nix, not the ns1/ns2 DNS names) so reaching these hosts never
|
|
# depends on their own DNS being up.
|
|
internet.roles.default.machines = builtins.mapAttrs (_: h: {
|
|
settings.host = h.ipv4;
|
|
}) hosts;
|
|
|
|
# Recovery root password for console access when a machine fails to boot.
|
|
emergency-access = {
|
|
roles.default.tags.nixos = { };
|
|
};
|
|
|
|
# Encrypted, deduplicating backups. control hosts the repos; ns1 is the
|
|
# only client, backing up its declared clan.core.state (the Knot DNSSEC
|
|
# keystore) over the mesh. Repo lives at /var/lib/borgbackup/ns1 on control.
|
|
# Cross-host so an ns1 loss is recoverable; repokey encryption means control
|
|
# never holds plaintext. Run `clan vars generate ns1` (YubiKey) before deploy.
|
|
borgbackup = {
|
|
roles.server.machines.control = { };
|
|
roles.client.machines.ns1 = { };
|
|
};
|
|
};
|
|
|
|
# Fleet-wide baseline applied to every machine. Secrets minted by
|
|
# `clan vars generate` are encrypted for the admins group from the very
|
|
# first run — generating before this took effect is what forced the
|
|
# re-encryption dance (`clan vars fix`) on gw-cnx-1.
|
|
machines = builtins.mapAttrs (_: _: {
|
|
clan.core.sops.defaultGroups = [ "admins" ];
|
|
}) fleet;
|
|
}
|