machines/stellio: a new whitehouse router that uses clanService/router from cnx-network

2026-09-23 15:31:57 +07:00
parent fa95098b7e
commit 9b8d15d583
81 changed files with 1215 additions and 17 deletions
@@ -0,0 +1,89 @@
+{
+  config,
+  inputs,
+  lib,
+  pkgs,
+  ...
+}:
+{
+  imports = [
+    inputs.matthew-hardware.nixosModules.mt7986a-glinet-gl-mt6000
+  ];
+
+  # matthew-hardware's common/generic-uefi-image.nix still sets
+  # `image.repart.enable = true`; nixpkgs removed that option (importing
+  # image/repart.nix now always defines system.build.image). Declare it so the
+  # definition has somewhere to land. Drop once upstream stops setting it.
+  options.image.repart.enable = lib.mkOption {
+    type = lib.types.bool;
+    default = true;
+    internal = true;
+  };
+
+  config = {
+    hardware.mt7986a-glinet-gl-mt6000.enable = true;
+    hardware.mt7986a-glinet-gl-mt6000.zealous = true;
+    hardware.mt7986a-glinet-gl-mt6000.image.repart.enable = true;
+
+    nixpkgs.hostPlatform.system = "aarch64-linux";
+    nixpkgs.buildPlatform.system = "x86_64-linux";
+
+    system.stateVersion = "26.11";
+    clan.core.sops.defaultGroups = [ "admins" ];
+
+    clan.core.settings.name = "stellio";
+    clan.core.settings.machine.description = "Flint-2 router";
+
+    # Root is ext4 on the Flint 2's eMMC: keep steady-state writes off it.
+    # Logs live in RAM (64M; the router needs them for pppd/kea debugging,
+    # unlike sirius which drops them), /tmp is tmpfs, no core dumps, and
+    # ext4 skips atime updates and flushes its journal every 60 s instead
+    # of 5 s so the small periodic writes (Kea leases, timesyncd clock,
+    # speedtest textfile) coalesce. A power cut loses at most a minute of
+    # that state, none of which matters on a gateway.
+    fileSystems."/".options = [
+      "noatime"
+      "commit=60"
+    ];
+    boot.tmp.useTmpfs = true;
+    services.journald.settings.Journal = {
+      Storage = "volatile";
+      RuntimeMaxUse = "64M";
+    };
+    systemd.coredump.enable = false;
+
+    # nixpkgs' services.blocky check runs the aarch64 blocky in a
+    # system.checks derivation, which an x86_64 builder without binfmt cannot
+    # execute (`--max-jobs 0` -> Exec format error). Validate the same YAML
+    # with the build host's blocky instead. Drop once cnx-network's router
+    # service carries this itself (router/dns: validate the Blocky config
+    # with the build host's binary).
+    services.blocky.enableConfigCheck = false;
+    system.checks = [
+      (pkgs.runCommand "check-blocky-config" { } ''
+        ${lib.getExe pkgs.buildPackages.blocky} --config ${
+          (pkgs.formats.yaml { }).generate "blocky-config.yaml" config.services.blocky.settings
+        } validate && touch $out
+      '')
+    ];
+
+    systemd.services.heartbeat-push = {
+      description = "Heartbeat push to uptime monitor";
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.curl}/bin/curl -s -o /dev/null https://uptime.b4l.co.th/api/push/X0WCHAcY5gPf1U8If7BT1FLjpacZqGZu?status=up&msg=OK&ping=";
+      };
+    };
+
+    systemd.timers.heartbeat-push = {
+      description = "Heartbeat push timer";
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnBootSec = "60s";
+        OnUnitActiveSec = "60s";
+        Unit = "heartbeat-push.service";
+      };
+    };
+
+  };
+}