499 lines
15 KiB
Nix
499 lines
15 KiB
Nix
{
|
|
imports = [
|
|
./personal-computer.nix
|
|
./emmie.nix
|
|
];
|
|
clan = {
|
|
inventory = {
|
|
|
|
tags = {
|
|
glom = [
|
|
"vega"
|
|
"ramus"
|
|
"canopus"
|
|
];
|
|
poy = [
|
|
"deneb"
|
|
"bosona"
|
|
];
|
|
w = [ "sirius" ];
|
|
b4l = [
|
|
"rigel"
|
|
"rana"
|
|
"petra"
|
|
"alasia"
|
|
];
|
|
phonebox = [
|
|
"rigel"
|
|
"almach"
|
|
"alpheratz"
|
|
"mirach"
|
|
"adhil"
|
|
"buna"
|
|
];
|
|
|
|
prometheus = [
|
|
"cursa"
|
|
"rigel"
|
|
"vega"
|
|
];
|
|
|
|
dm-bootstrapper = [
|
|
"rigel"
|
|
"cursa"
|
|
"deneb"
|
|
"bosona"
|
|
"canopus"
|
|
];
|
|
};
|
|
|
|
instances = {
|
|
|
|
borgbackup = {
|
|
module = {
|
|
name = "borgbackup";
|
|
input = "clan-core";
|
|
};
|
|
roles.client.machines."cursa".settings.destinations = {
|
|
alex = {
|
|
repo = "ssh://borg@10.0.10.225:2222/backup/cursa/backup";
|
|
rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
|
|
};
|
|
};
|
|
roles.client.machines."hadar".settings.destinations = {
|
|
alex = {
|
|
repo = "ssh://borg@10.0.10.225:2222/backup/hadar/backup";
|
|
rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
|
|
};
|
|
};
|
|
roles.client.machines."procyon".settings.destinations = {
|
|
alex = {
|
|
repo = "ssh://borg@10.0.10.225:2222/backup/procyon/backup";
|
|
rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
|
|
};
|
|
};
|
|
roles.client.machines."bosona".settings.destinations = {
|
|
alex = {
|
|
repo = "ssh://borg@10.0.10.225:2222/backup/bosona/backup";
|
|
rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
|
|
};
|
|
};
|
|
roles.client.machines."canopus".settings.destinations = {
|
|
alex = {
|
|
repo = "ssh://borg@10.0.10.225:2222/backup/canopus/backup";
|
|
rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
|
|
};
|
|
};
|
|
roles.client.machines."deneb".settings.destinations = {
|
|
alex = {
|
|
repo = "ssh://borg@10.0.10.225:2222/backup/deneb/backup";
|
|
rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
|
|
};
|
|
};
|
|
roles.client.machines."alasia".settings.destinations = {
|
|
alex = {
|
|
repo = "ssh://borg@10.0.10.225:2222/backup/alasia/backup";
|
|
rsh = "ssh -i /run/secrets/vars/borgbackup/borgbackup.ssh";
|
|
};
|
|
};
|
|
};
|
|
|
|
data-mesher = {
|
|
module = {
|
|
name = "data-mesher";
|
|
input = "clan-core";
|
|
};
|
|
roles.bootstrap.tags = [ "dm-bootstrapper" ];
|
|
roles.default.tags = [ "all" ];
|
|
roles.default.settings.interfaces = [ "ygg" ];
|
|
};
|
|
|
|
auto-pull-update = {
|
|
module = {
|
|
name = "dm-pull-deploy";
|
|
input = "clan-community";
|
|
};
|
|
roles.push.machines."rigel".settings = {
|
|
gitUrl = "https://git.b4l.co.th/newedge/infra.git";
|
|
branch = "main";
|
|
};
|
|
roles.push.extraModules = [
|
|
(
|
|
{ pkgs, config, ... }:
|
|
{
|
|
# work around until upstream is fixed
|
|
environment.systemPackages = [
|
|
(pkgs.writeShellApplication {
|
|
name = "custom-dm-send-deploy";
|
|
runtimeInputs = [
|
|
config.services.data-mesher.package
|
|
pkgs.git
|
|
pkgs.nix
|
|
pkgs.jq
|
|
];
|
|
text =
|
|
let
|
|
settings.gitUrl = "https://git.b4l.co.th/newedge/infra.git";
|
|
settings.branch = "main";
|
|
in
|
|
''
|
|
if [ $# -gt 1 ]; then
|
|
echo "Usage: dm-send-deploy [<flake-ref>]"
|
|
echo "Without arguments, sends the latest commit on '${settings.branch}' from ${settings.gitUrl}"
|
|
echo "Example: dm-send-deploy git+https://example.com/repo.git?rev=abc123..."
|
|
exit 1
|
|
fi
|
|
|
|
KEY="${config.clan.core.vars.generators.dm-pull-deploy-signing-key.files."signing.key".path}"
|
|
if [ ! -r "$KEY" ]; then
|
|
echo "Error: cannot read signing key at $KEY (are you root?)"
|
|
exit 1
|
|
fi
|
|
|
|
if [ $# -eq 1 ]; then
|
|
FLAKE_REF="$1"
|
|
else
|
|
REV=$(git ls-remote "${settings.gitUrl}" "refs/heads/${settings.branch}" | cut -f1)
|
|
if [ -z "$REV" ]; then
|
|
echo "Error: could not determine latest commit on ${settings.branch} from ${settings.gitUrl}"
|
|
exit 1
|
|
fi
|
|
FLAKE_REF="git+${settings.gitUrl}?rev=$REV"
|
|
fi
|
|
|
|
TMPFILE=$(mktemp)
|
|
trap 'rm -f "$TMPFILE"' EXIT
|
|
|
|
printf '%s' "$FLAKE_REF" > "$TMPFILE"
|
|
|
|
NETWORK_ID="${config.clan.core.vars.generators.data-mesher-network.files."network.pub".path}"
|
|
|
|
data-mesher file update "$TMPFILE" \
|
|
--url http://localhost:7331 \
|
|
--network-id "$NETWORK_ID" \
|
|
--key "$KEY" \
|
|
--name "dm_pull_deploy/target"
|
|
|
|
echo "Deployment target pushed: $FLAKE_REF"
|
|
'';
|
|
})
|
|
];
|
|
}
|
|
)
|
|
];
|
|
roles.default.tags = [ "all" ];
|
|
roles.default.settings.action = "switch";
|
|
};
|
|
|
|
sshd = {
|
|
roles.server.tags."all" = { };
|
|
roles.server.settings = {
|
|
authorizedKeys = {
|
|
"berwn" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAB/raxJR8gASmquP63weHelbi+da2WBJR1DgzHPNz/f";
|
|
"davhau" = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDuhpzDHBPvn8nv8RH1MRomDOaXyP4GziQm7r3MZ1Syk";
|
|
"kurogeek" =
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcZ/p1Ofa9liwIzPWzNtONhJ7+FUWd2lCz33r81t8+w kurogeek@kurogeek";
|
|
"matthewcroughan" =
|
|
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIOJDRQfb1+7VK5tOe8W40iryfBWYRO6Uf1r2viDjmsJtAAAABHNzaDo=";
|
|
"matthewcroughan-1" =
|
|
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIDgsWq+G/tcr6eUQYT7+sJeBtRmOMabgFiIgIV44XNc6AAAABHNzaDo=";
|
|
"matthewcroughan-2" =
|
|
"sk-ssh-ed25519@openssh.com AAAAGnNrLXNzaC1lZDI1NTE5QG9wZW5zc2guY29tAAAAIJMi3TAuwDtIeO4MsORlBZ31HzaV5bji1fFBPcC9/tWuAAAABHNzaDo=";
|
|
};
|
|
};
|
|
};
|
|
|
|
root-password = {
|
|
module = {
|
|
name = "users";
|
|
input = "clan-core";
|
|
};
|
|
roles.default.tags."all" = { };
|
|
roles.default.settings = {
|
|
user = "root";
|
|
};
|
|
};
|
|
|
|
tor = {
|
|
module = {
|
|
name = "tor";
|
|
input = "clan-core";
|
|
};
|
|
roles.server.tags."nixos" = { };
|
|
};
|
|
|
|
w-network = {
|
|
module = {
|
|
name = "zerotier";
|
|
input = "clan-core";
|
|
};
|
|
roles.controller.machines."sirius" = {
|
|
settings.allowedIps = [
|
|
#kurogeek
|
|
"fdfe:7bf:a795:4524:4c99:932b:d36d:b8cc"
|
|
];
|
|
};
|
|
roles.peer.tags.w = { };
|
|
};
|
|
|
|
glom-network = {
|
|
module = {
|
|
name = "zerotier";
|
|
input = "clan-core";
|
|
};
|
|
roles.controller.machines."vega" = {
|
|
settings.allowedIds = [
|
|
"dbe44c0287" # Alex-gateway
|
|
"b0e0b84fd3" # Alex
|
|
"2bd36db8cc" # kurogeek-thinkpad
|
|
];
|
|
};
|
|
roles.peer.tags.glom = { };
|
|
};
|
|
|
|
b4l-network = {
|
|
module = {
|
|
name = "zerotier";
|
|
input = "clan-core";
|
|
};
|
|
roles.controller.machines."rigel" = {
|
|
settings.allowedIds = [
|
|
"dbe44c0287" # Alex-gateway
|
|
"b0e0b84fd3" # Alex
|
|
"2bd36db8cc" # kurogeek-thinkpad
|
|
];
|
|
};
|
|
roles.peer.tags.b4l = { };
|
|
};
|
|
|
|
poy-network = {
|
|
module = {
|
|
name = "zerotier";
|
|
input = "clan-core";
|
|
};
|
|
roles.controller.machines."deneb" = {
|
|
settings.allowedIps = [
|
|
#kurogeek
|
|
"fdfe:7bf:a795:4524:4c99:932b:d36d:b8cc"
|
|
];
|
|
};
|
|
roles.peer.tags."poy" = { };
|
|
};
|
|
|
|
internet = {
|
|
module.name = "internet";
|
|
roles.default.machines = {
|
|
ramus.settings.host = "5.223.63.55";
|
|
tangra.settings.host = "5.223.65.50";
|
|
};
|
|
};
|
|
|
|
yggdrasil-global-network = {
|
|
module = {
|
|
name = "yggdrasil";
|
|
input = "clan-core";
|
|
};
|
|
roles.default.tags."all" = { };
|
|
roles.default.settings.extraYggdrasilIPs = [
|
|
# kurogeek's laptop
|
|
"200:c8db:ea9b:5bdc:44ed:ad87:462a:6bd0"
|
|
];
|
|
roles.default.settings.extraPeers = [
|
|
"tls://ygg.jjolly.dev:3443"
|
|
"tls://[2602:fc24:18:7a42::1]:993"
|
|
"tcp://leo.node.3dt.net:9002"
|
|
"tcp://ygg-kcmo.incognet.io:8883"
|
|
];
|
|
};
|
|
|
|
newedge-headscale = {
|
|
module = {
|
|
name = "headscale";
|
|
input = "self";
|
|
};
|
|
roles.server.machines."alasia".settings = {
|
|
public_url = "tailvpn.public.newedge.house";
|
|
base_domain = "tailnet.newedge.house";
|
|
advertise_routes = [ "10.0.10.0/24" ];
|
|
nameservers = [
|
|
"10.0.10.82"
|
|
"1.1.1.1"
|
|
"8.8.8.8"
|
|
];
|
|
};
|
|
};
|
|
|
|
phonebox = {
|
|
module = {
|
|
name = "phonebox";
|
|
input = "self";
|
|
};
|
|
roles.default.tags."phonebox" = { };
|
|
roles.default.machines."adhil".settings = {
|
|
ata-ethernet-iface = "end0";
|
|
};
|
|
roles.default.machines."rigel".settings = {
|
|
extraClientNumbers = [
|
|
"01"
|
|
"02"
|
|
];
|
|
extraFixedIPClient = { };
|
|
};
|
|
};
|
|
|
|
pulse-stream = {
|
|
module = {
|
|
name = "pulse-stream";
|
|
input = "self";
|
|
};
|
|
roles.default.machines.neptune = {
|
|
settings.client-ip-ranges = [
|
|
"10.0.0.0/24"
|
|
];
|
|
};
|
|
};
|
|
jukebox = {
|
|
module = {
|
|
name = "jukebox";
|
|
input = "self";
|
|
};
|
|
roles.default.machines.neptune = {
|
|
settings = {
|
|
binds = [ "wlp1s0" ];
|
|
disks.m3 = {
|
|
uuid = "105D-319E";
|
|
mountOptions = [ "utf8" ];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
git-daemon = {
|
|
module = {
|
|
name = "git-daemon";
|
|
input = "self";
|
|
};
|
|
roles.default.machines.neptune = {
|
|
settings.repositories =
|
|
let
|
|
defaults = rec {
|
|
write-access = [
|
|
"10.0.0.0/24"
|
|
"200:d7b1:c5d5:ea7:27ad:6837:40f6:404d/128"
|
|
];
|
|
read-access = write-access;
|
|
};
|
|
PUBLIC = {
|
|
read-access = [
|
|
"10.0.0.0/24"
|
|
"0200::/7"
|
|
];
|
|
};
|
|
in
|
|
builtins.mapAttrs (_: override: defaults // override) {
|
|
"9e" = PUBLIC;
|
|
archive-dl = { };
|
|
barrytown = { };
|
|
cleanroom = PUBLIC;
|
|
community-memory = { };
|
|
eris = { };
|
|
ftdi-sd-spi = { };
|
|
go-go-gadget = { };
|
|
hacking-the-kindle = { };
|
|
islands = PUBLIC;
|
|
kt = { };
|
|
legba = { };
|
|
llb = PUBLIC;
|
|
llc = PUBLIC;
|
|
lora = { };
|
|
mute = { };
|
|
navi = { };
|
|
notmuch-memoryhole = PUBLIC;
|
|
pms5003 = { };
|
|
thinc = PUBLIC;
|
|
toad = { };
|
|
yggdrasil-erlang = { };
|
|
};
|
|
};
|
|
};
|
|
|
|
samba = {
|
|
module = {
|
|
name = "samba";
|
|
input = "self";
|
|
};
|
|
roles.server.machines."sirius".settings = {
|
|
globalUsers = {
|
|
w.writePerm = true;
|
|
};
|
|
sharedFolders = {
|
|
WHITEHOUSE = {
|
|
allowedGuest = true;
|
|
};
|
|
};
|
|
dataDir = "/mnt/hdd/samba";
|
|
};
|
|
};
|
|
|
|
wordpress = {
|
|
module = {
|
|
name = "wordpress";
|
|
input = "self";
|
|
};
|
|
roles.server.machines."tangra".settings = {
|
|
tenants = [
|
|
"poyfestival.com"
|
|
];
|
|
phpfpmOptions = ''
|
|
upload_max_filesize=64M
|
|
post_max_size=128M
|
|
'';
|
|
wpExtraConfig = ''
|
|
define('WP_MEMORY_LIMIT', '256M');
|
|
define('WP_DEBUG', false);
|
|
define('WP_DEBUG_DISPLAY', false);
|
|
define('WP_DEBUG_LOG', false);
|
|
'';
|
|
};
|
|
};
|
|
|
|
prometheus-monitoring = {
|
|
module = {
|
|
name = "prometheus";
|
|
input = "self";
|
|
};
|
|
roles.server.machines."cursa".settings = {
|
|
matrix-alertmanager = {
|
|
enable = true;
|
|
homeserverUrl = "https://matrix-client.matrix.org";
|
|
matrixUser = "@nixapollo:matrix.org";
|
|
matrixRooms = [
|
|
{
|
|
receivers = [
|
|
"matrix"
|
|
];
|
|
roomId = "!rqIrWqPvsXqMgYpcNZ:matrix.org";
|
|
}
|
|
];
|
|
};
|
|
};
|
|
|
|
roles.nodes.machines = {
|
|
vega.settings = {
|
|
exporters.smartctl = { };
|
|
exporters.zfs = { };
|
|
};
|
|
rigel.settings = {
|
|
exporters.smartctl = { };
|
|
};
|
|
sirius.settings = {
|
|
exporters.smartctl = { };
|
|
exporters.zfs = { };
|
|
};
|
|
};
|
|
};
|
|
|
|
};
|
|
};
|
|
};
|
|
}
|