From 5b4cf12ed79fd44698e962a56cf88209ba101d53 Mon Sep 17 00:00:00 2001 From: Tom Hubrecht Date: Tue, 18 Jul 2023 17:00:31 +0200 Subject: [PATCH] machines: Add compute01 and storage01 --- keys/machines/compute01.keys | 0 keys/machines/storage01.keys | 0 machines/compute01/_configuration.nix | 10 ++ .../compute01/_hardware-configuration.nix | 60 +++++++++++ machines/compute01/secrets/secrets.nix | 7 ++ machines/storage01/_configuration.nix | 99 +++++++++++++++++++ .../storage01/_hardware-configuration.nix | 58 +++++++++++ machines/storage01/secrets/secrets.nix | 7 ++ meta/members.nix | 2 + meta/nodes.nix | 24 +++++ modules/default.nix | 1 + modules/dgn-console.nix | 53 ++++++++++ 12 files changed, 321 insertions(+) create mode 100644 keys/machines/compute01.keys create mode 100644 keys/machines/storage01.keys create mode 100644 machines/compute01/_configuration.nix create mode 100644 machines/compute01/_hardware-configuration.nix create mode 100644 machines/compute01/secrets/secrets.nix create mode 100644 machines/storage01/_configuration.nix create mode 100644 machines/storage01/_hardware-configuration.nix create mode 100644 machines/storage01/secrets/secrets.nix create mode 100644 modules/dgn-console.nix diff --git a/keys/machines/compute01.keys b/keys/machines/compute01.keys new file mode 100644 index 0000000..e69de29 diff --git a/keys/machines/storage01.keys b/keys/machines/storage01.keys new file mode 100644 index 0000000..e69de29 diff --git a/machines/compute01/_configuration.nix b/machines/compute01/_configuration.nix new file mode 100644 index 0000000..1c92de7 --- /dev/null +++ b/machines/compute01/_configuration.nix @@ -0,0 +1,10 @@ +{ ... }: + +{ + # Use the systemd-boot EFI boot loader. + networking.hostName = "compute01"; + networking.domain = "par01.infra.dgnum.eu"; + networking.hostId = "8df60941"; + + system.stateVersion = "23.05"; # Did you read the comment? +} diff --git a/machines/compute01/_hardware-configuration.nix b/machines/compute01/_hardware-configuration.nix new file mode 100644 index 0000000..cf225d8 --- /dev/null +++ b/machines/compute01/_hardware-configuration.nix @@ -0,0 +1,60 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "ahci" "ehci_pci" "megaraid_sas" "usb_storage" "usbhid" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.supportedFilesystems = [ "zfs" ]; + boot.zfs.forceImportRoot = false; + boot.zfs.extraPools = [ "fast01" "work01" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { + device = "/dev/disk/by-uuid/c83f6978-fd26-44a8-a86a-b0e971bb0c8c"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { + device = "/dev/disk/by-uuid/55DB-056F"; + fsType = "vfat"; + }; + + swapDevices = + [{ device = "/dev/disk/by-uuid/30547280-00e9-4ee1-8a07-d116590d9fbf"; }]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + # networking.useDHCP = lib.mkDefault true; + networking.interfaces.eno1 = { + useDHCP = true; + ipv4 = { + addresses = [ + { address = "129.199.146.147"; prefixLength = 24; } + { address = "192.168.1.147"; prefixLength = 24; } + ]; + + routes = [ + { address = "192.168.1.0"; prefixLength = 24; } + ]; + }; + }; + # networking.interfaces.eno2.useDHCP = lib.mkDefault true; + # networking.interfaces.eno3.useDHCP = lib.mkDefault true; + # networking.interfaces.eno4.useDHCP = lib.mkDefault true; + # networking.interfaces.idrac.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/machines/compute01/secrets/secrets.nix b/machines/compute01/secrets/secrets.nix new file mode 100644 index 0000000..2ee797d --- /dev/null +++ b/machines/compute01/secrets/secrets.nix @@ -0,0 +1,7 @@ +let + lib = import ../../../lib { inherit (import { }) lib; }; + publicKeys = lib.getNodeKeys "compute01"; +in + +lib.setDefault { inherit publicKeys; } [ +] diff --git a/machines/storage01/_configuration.nix b/machines/storage01/_configuration.nix new file mode 100644 index 0000000..241c17b --- /dev/null +++ b/machines/storage01/_configuration.nix @@ -0,0 +1,99 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running `nixos-help`). + +{ config, pkgs, ... }: + +{ + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + networking.hostName = "storage01"; + networking.domain = "par01.infra.dgnum.eu"; + networking.hostId = "d4e7c369"; + # Pick only one of the below networking options. + # networking.wireless.enable = true; # Enables wireless support via wpa_supplicant. + # networking.networkmanager.enable = true; # Easiest to use and most distros use this by default. + + # Set your time zone. + time.timeZone = "Europe/Paris"; + + # Configure network proxy if necessary + # networking.proxy.default = "http://user:password@proxy:port/"; + # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain"; + + # Select internationalisation properties. + # i18n.defaultLocale = "en_US.UTF-8"; + console = { + # font = "Lat2-Terminus16"; + keyMap = "fr"; + # useXkbConfig = true; # use xkbOptions in tty. + }; + + # Configure keymap in X11 + services.xserver.layout = "fr"; + # services.xserver.xkbOptions = "eurosign:e,caps:escape"; + + # Enable CUPS to print documents. + # services.printing.enable = true; + + # Enable sound. + # sound.enable = true; + # hardware.pulseaudio.enable = true; + + # Enable touchpad support (enabled default in most desktopManager). + # services.xserver.libinput.enable = true; + + # Define a user account. Don't forget to set a password with ‘passwd’. + # users.users.alice = { + # isNormalUser = true; + # extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. + # packages = with pkgs; [ + # firefox + # tree + # ]; + # }; + + # List packages installed in system profile. To search, run: + # $ nix search wget + environment.systemPackages = with pkgs; [ + vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default. + wget + kitty.terminfo + ]; + + # Some programs need SUID wrappers, can be configured further or are + # started in user sessions. + # programs.mtr.enable = true; + # programs.gnupg.agent = { + # enable = true; + # enableSSHSupport = true; + # }; + + # List services that you want to enable: + + # Enable the OpenSSH daemon. + # services.openssh.enable = true; + # users.users.root.openssh.authorizedKeys.keyFiles = [ ./rootKeys ]; + + # Open ports in the firewall. + # networking.firewall.allowedTCPPorts = [ ... ]; + # networking.firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + # networking.firewall.enable = false; + + # Copy the NixOS configuration file and link it from the resulting system + # (/run/current-system/configuration.nix). This is useful in case you + # accidentally delete configuration.nix. + # system.copySystemConfiguration = true; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It's perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "23.05"; # Did you read the comment? + +} diff --git a/machines/storage01/_hardware-configuration.nix b/machines/storage01/_hardware-configuration.nix new file mode 100644 index 0000000..8b933d5 --- /dev/null +++ b/machines/storage01/_hardware-configuration.nix @@ -0,0 +1,58 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ + (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "ahci" "ehci_pci" "megaraid_sas" "usb_storage" "usbhid" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.supportedFilesystems = [ "zfs" ]; + boot.zfs.forceImportRoot = false; + boot.zfs.extraPools = [ "fast01" "medium01" "work01" "small01" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { + device = "/dev/disk/by-uuid/278cb2a2-47b9-4ec5-8b68-a5a6d037d59e"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { + device = "/dev/disk/by-uuid/8BD2-C908"; + fsType = "vfat"; + }; + + swapDevices = + [{ device = "/dev/disk/by-uuid/65a6f6e4-e996-4718-a4d0-cd0c78dcb15b"; }]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.interfaces.eno1 = { + useDHCP = true; + ipv4 = { + addresses = [ + { address = "129.199.146.148"; prefixLength = 24; } + { address = "192.168.1.148"; prefixLength = 24; } + ]; + + routes = [ + { address = "192.168.1.0"; prefixLength = 24; } + ]; + }; + }; + # networking.interfaces.eno2.useDHCP = lib.mkDefault true; + # networking.interfaces.eno3.useDHCP = lib.mkDefault true; + # networking.interfaces.eno4.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/machines/storage01/secrets/secrets.nix b/machines/storage01/secrets/secrets.nix new file mode 100644 index 0000000..17c20cd --- /dev/null +++ b/machines/storage01/secrets/secrets.nix @@ -0,0 +1,7 @@ +let + lib = import ../../../lib { inherit (import { }) lib; }; + publicKeys = lib.getNodeKeys "storage01"; +in + +lib.setDefault { inherit publicKeys; } [ +] diff --git a/meta/members.nix b/meta/members.nix index b9c6a84..4ad6b5e 100644 --- a/meta/members.nix +++ b/meta/members.nix @@ -29,6 +29,8 @@ let # members of this group will have root acces on the installation isos iso = [ "thubrecht" "mdebray" "raito" ]; + + bureau = [ "gdd" "raito" ]; }; in diff --git a/meta/nodes.nix b/meta/nodes.nix index f292ac9..5fc84a6 100644 --- a/meta/nodes.nix +++ b/meta/nodes.nix @@ -22,4 +22,28 @@ NODE_NAME = { nixpkgs = "23.05"; }; + + compute01 = { + adminGroups = [ "bureau" ]; + admins = [ ]; + + deployment = { + tags = [ "infra-pasteur" ]; + targetHost = "129.199.146.147"; + }; + + nixpkgs = "23.05"; + }; + + storage01 = { + adminGroups = [ "bureau" ]; + admins = [ ]; + + deployment = { + tags = [ "infra-pasteur" ]; + targetHost = "129.199.146.148"; + }; + + nixpkgs = "23.05"; + }; } diff --git a/modules/default.nix b/modules/default.nix index ca16072..e57a4b2 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -37,6 +37,7 @@ imports = (dgn-lib.mkImports ./. [ "dgn-access-control" "dgn-acme" + "dgn-console" "dgn-secrets" "dgn-ssh" ]) ++ [ diff --git a/modules/dgn-console.nix b/modules/dgn-console.nix new file mode 100644 index 0000000..dc45f3b --- /dev/null +++ b/modules/dgn-console.nix @@ -0,0 +1,53 @@ +{ config, lib, pkgs, ... }: + +let + inherit (lib) + mkEnableOption + mkIf; + + cfg = config.dgn-console; +in + +{ + options.dgn-console = { + enable = mkEnableOption "DGNum console setup." // { default = true; }; + }; + + config = mkIf cfg.enable { + time.timeZone = "Europe/Paris"; + + console = { + keyMap = "fr"; + }; + + environment.systemPackages = with pkgs; [ + nvim + wget + kitty.terminfo + ]; + + environment.variables.EDITOR = "nvim"; + + programs.neovim.vimAlias = true; + + services.nscd.enableNsncd = false; + programs.bash.promptInit = '' + # Provide a nice prompt if the terminal supports it. + if [ "$TERM" != "dumb" ] || [ -n "$INSIDE_EMACS" ]; then + PROMPT_COLOR="1;31m" + ((UID)) && PROMPT_COLOR="1;32m" + if [ -n "$INSIDE_EMACS" ] || [ "$TERM" = "eterm" ] || [ "$TERM" = "eterm-color" ]; then + # Emacs term mode doesn't support xterm title escape sequence (\e]0;) + PS1="\n\[\033[$PROMPT_COLOR\][\u@$(hostname -f):\w]\\$\[\033[0m\] " + else + PS1="\n\[\033[$PROMPT_COLOR\][\[\e]0;\u@\H: \w\a\]\u@$(hostname -f):\w]\\$\[\033[0m\] " + fi + if test "$TERM" = "xterm"; then + PS1="\[\033]2;$(hostname -f):\u:\w\007\]$PS1" + fi + fi + ''; + + hardware.enableRedistributableFirmware = true; + }; +}