From 871f8e1e6a2b6da96d4c049641c3bcfdba22def0 Mon Sep 17 00:00:00 2001 From: mdebray Date: Fri, 12 May 2023 00:59:03 +0000 Subject: [PATCH 1/5] web-01: create partionning scheme --- machines/web-01/disko.nix | 71 +++++++++++++++++++++++++++++++++++++++ npins/sources.json | 14 ++++++++ shell.nix | 6 +++- 3 files changed, 90 insertions(+), 1 deletion(-) create mode 100644 machines/web-01/disko.nix diff --git a/machines/web-01/disko.nix b/machines/web-01/disko.nix new file mode 100644 index 0000000..8034d79 --- /dev/null +++ b/machines/web-01/disko.nix @@ -0,0 +1,71 @@ +{...}: { + disko.devices = { + disk = { + vdb = { + device = "/dev/vdb"; + type = "disk"; + content = { + type = "table"; + format = "gpt"; + partitions = [ + { + name = "ESP"; + start = "1MiB"; + end = "512MiB"; + fs-type = "fat32"; + bootable = true; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + }; + } + { + name = "luks"; + start = "512MiB"; + end = "-4GiB"; + content = rec { + type = "luks"; + name = "mainfs"; + extraOpenArgs = [ "--keyfile-size=1" ]; + extraFormatArgs = extraOpenArgs; + keyFile = "/dev/zero"; + content = { + type = "btrfs"; + mountpoint = "/mnt/btrfs-root"; + subvolumes = { + "/rootfs" = { + mountpoint = "/"; + mountOptions = [ "compress=zstd" ]; + }; + "/home" = { + mountOptions = [ "compress=zstd" ]; + mountpoint = "/home"; + }; + "/var-log" = { + mountOptions = [ "compress=zstd" ]; + mountpoint = "/var/log"; + }; + "/nix" = { + mountOptions = [ "noatime" "compress=zstd" ]; + mountpoint = "/nix"; + }; + }; + }; + }; + } + { + name = "swap"; + start = "-4GiB"; + end = "100%"; + content = { + type = "swap"; + randomEncryption = true; + }; + } + ]; + }; + }; + }; + }; +} diff --git a/npins/sources.json b/npins/sources.json index 31e5d7f..48e831c 100644 --- a/npins/sources.json +++ b/npins/sources.json @@ -1,5 +1,19 @@ { "pins": { + "disko": { + "type": "GitRelease", + "repository": { + "type": "GitHub", + "owner": "nix-community", + "repo": "disko" + }, + "pre_releases": false, + "version_upper_bound": null, + "version": "v1.0.0", + "revision": "6cbfde5b505bbbf0cfcfff230efb272e4d4a2230", + "url": "https://api.github.com/repos/nix-community/disko/tarball/v1.0.0", + "hash": "153cm29hjgklsi1aw85srvcd3h3afm7j77llk4fj3slf5gcwnmx9" + }, "krops": { "type": "GitRelease", "repository": { diff --git a/shell.nix b/shell.nix index 2469f62..8e9b974 100644 --- a/shell.nix +++ b/shell.nix @@ -1,6 +1,10 @@ -{ pkgs ? import (import ./npins { }).nixpkgs {} }: +let + sources = (import ./npins); + pkgs = import sources.nixpkgs {}; +in pkgs.mkShell { packages = [ pkgs.npins + (pkgs.callPackage (sources.disko + "/package.nix") {}) ]; } From fbde3006e56e39de7d39b79b4c477f287f9d5e07 Mon Sep 17 00:00:00 2001 From: mdebray Date: Fri, 12 May 2023 01:22:09 +0000 Subject: [PATCH 2/5] web-01: minimal config --- admin_keys/anon.keys | 5 +++ admin_keys/mdebray.keys | 1 + machines/web-01/configuration.nix | 42 ++++++++++++++++++++++ machines/web-01/disko.nix | 12 +++++-- machines/web-01/hardware-configuration.nix | 19 ++++++++++ 5 files changed, 77 insertions(+), 2 deletions(-) create mode 100644 admin_keys/anon.keys create mode 100644 admin_keys/mdebray.keys create mode 100644 machines/web-01/configuration.nix create mode 100644 machines/web-01/hardware-configuration.nix diff --git a/admin_keys/anon.keys b/admin_keys/anon.keys new file mode 100644 index 0000000..ef0e9c0 --- /dev/null +++ b/admin_keys/anon.keys @@ -0,0 +1,5 @@ +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcEkYM1r8QVNM/G5CxJInEdoBCWjEHHDdHlzDYNSUIdHHsn04QY+XI67AdMCm8w30GZnLUIj5RiJEWXREUApby0GrfxGGcy8otforygfgtmuUKAUEHdU2MMwrQI7RtTZ8oQ0USRGuqvmegxz3l5caVU7qGvBllJ4NUHXrkZSja2/51vq80RF4MKkDGiz7xUTixI2UcBwQBCA/kQedKV9G28EH+1XfvePqmMivZjl+7VyHsgUVj9eRGA1XWFw59UPZG8a7VkxO/Eb3K9NF297HUAcFMcbY6cPFi9AaBgu3VC4eetDnoN/+xT1owiHi7BReQhGAy/6cdf7C/my5ehZwD +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0xMwWedkKosax9+7D2OlnMxFL/eV4CvFZLsbLptpXr +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKiXXYkhRh+s7ixZ8rvG8ntIqd6FELQ9hh7HoaHQJRPU +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+EZXYziiaynJX99EW8KesnmRTZMof3BoIs3mdEl8L3 +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHL4M4HKjs4cjRAYRk9pmmI8U0R4+T/jQh6Fxp/i1Eoy diff --git a/admin_keys/mdebray.keys b/admin_keys/mdebray.keys new file mode 100644 index 0000000..3f26a23 --- /dev/null +++ b/admin_keys/mdebray.keys @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEpwF+XD3HgX64kqD42pcEZRNYAWoO4YNiOm5KO4tH6o maurice@polaris diff --git a/machines/web-01/configuration.nix b/machines/web-01/configuration.nix new file mode 100644 index 0000000..7c14bb8 --- /dev/null +++ b/machines/web-01/configuration.nix @@ -0,0 +1,42 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ config, pkgs, lib, ... }: +let + sources = import ../../npins; +in +{ + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + (sources.disko + "/module.nix") + ./disko.nix + ]; + + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + networking.hostName = "web-01";# Define your hostname. + + time.timeZone = "Europe/Paris"; + + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.ens3.useDHCP = lib.mkDefault true; + + users.users.root.openssh.authorizedKeys.keyFiles = [ ../../admin_keys/anon.keys ../../admin_keys/mdebray.keys ]; + + # Enable the OpenSSH daemon. + services.openssh.enable = true; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "22.11"; # Did you read the comment? + +} + diff --git a/machines/web-01/disko.nix b/machines/web-01/disko.nix index 8034d79..b9a5f8e 100644 --- a/machines/web-01/disko.nix +++ b/machines/web-01/disko.nix @@ -1,4 +1,12 @@ -{...}: { +{...}: +let + luksName = "mainfs"; +in +{ + boot.initrd.luks.devices.${luksName} = { + keyFile = "/dev/zero"; + keyFileSize = 1; + }; disko.devices = { disk = { vdb = { @@ -26,7 +34,7 @@ end = "-4GiB"; content = rec { type = "luks"; - name = "mainfs"; + name = luksName; extraOpenArgs = [ "--keyfile-size=1" ]; extraFormatArgs = extraOpenArgs; keyFile = "/dev/zero"; diff --git a/machines/web-01/hardware-configuration.nix b/machines/web-01/hardware-configuration.nix new file mode 100644 index 0000000..33543ed --- /dev/null +++ b/machines/web-01/hardware-configuration.nix @@ -0,0 +1,19 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ehci_pci" "virtio_pci" "ahci" "virtio_blk" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} From b74ed6a17b92ed151433bb25122d39eeb8ae6755 Mon Sep 17 00:00:00 2001 From: mdebray Date: Fri, 12 May 2023 11:04:05 +0000 Subject: [PATCH 3/5] web-01: refactor disko import --- machines/web-01/configuration.nix | 5 ----- machines/web-01/hardware-configuration.nix | 6 ++++-- 2 files changed, 4 insertions(+), 7 deletions(-) diff --git a/machines/web-01/configuration.nix b/machines/web-01/configuration.nix index 7c14bb8..1187078 100644 --- a/machines/web-01/configuration.nix +++ b/machines/web-01/configuration.nix @@ -3,15 +3,10 @@ # and in the NixOS manual (accessible by running ‘nixos-help’). { config, pkgs, lib, ... }: -let - sources = import ../../npins; -in { imports = [ # Include the results of the hardware scan. ./hardware-configuration.nix - (sources.disko + "/module.nix") - ./disko.nix ]; # Use the systemd-boot EFI boot loader. diff --git a/machines/web-01/hardware-configuration.nix b/machines/web-01/hardware-configuration.nix index 33543ed..0cff5b2 100644 --- a/machines/web-01/hardware-configuration.nix +++ b/machines/web-01/hardware-configuration.nix @@ -4,8 +4,10 @@ { config, lib, pkgs, modulesPath, ... }: { - imports = - [ (modulesPath + "/profiles/qemu-guest.nix") + imports = [ + (modulesPath + "/profiles/qemu-guest.nix") + (let sources = import ../../npins; in sources.disko + "/module.nix") + ./disko.nix ]; boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ehci_pci" "virtio_pci" "ahci" "virtio_blk" ]; From 6195c01e6e4d2b28d620e4f2e8068ba6e03be01b Mon Sep 17 00:00:00 2001 From: sinavir Date: Fri, 12 May 2023 16:56:34 +0200 Subject: [PATCH 4/5] Add some flakes in the codebase to satisfy jmalka --- README.md | 4 ++-- shell.nix | 1 + 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 24529e5..4a8d0b4 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,3 @@ -# infrastructure +# ❄️ infrastructure -The dgnum infrastructure \ No newline at end of file +The dgnum infrastructure diff --git a/shell.nix b/shell.nix index 8e9b974..da44745 100644 --- a/shell.nix +++ b/shell.nix @@ -8,3 +8,4 @@ pkgs.mkShell { (pkgs.callPackage (sources.disko + "/package.nix") {}) ]; } +# ❄️ ❄️ ❄️ From 107dcbe83d5d000231037b0d5e0dd3f32ec6f699 Mon Sep 17 00:00:00 2001 From: sinavir Date: Fri, 12 May 2023 17:05:25 +0200 Subject: [PATCH 5/5] add satisfactory flake.nix --- flake.nix | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 flake.nix diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..70a2cf8 --- /dev/null +++ b/flake.nix @@ -0,0 +1,7 @@ +❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ +❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ +❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ +❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ +❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ +❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ +❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ ❄️ .nix