diff --git a/README.md b/README.md index 0090a04..a722caf 100644 --- a/README.md +++ b/README.md @@ -98,7 +98,7 @@ The general metadata is declared in `meta/nodes.nix`, the main values to declare Create the directory `secrets` in the configuration folder, and add a `secrets.nix` file containing : ```nix -(import ../../../keys).mkSecrets [ "host02" ] [ +(import ../../../keys.nix).mkSecrets [ "host02" ] [ # List of secrets for host02 ] ``` diff --git a/default.nix b/default.nix index f12d53a..3936d91 100644 --- a/default.nix +++ b/default.nix @@ -4,8 +4,8 @@ # SPDX-License-Identifier: EUPL-1.2 { - sources ? import ./npins, - pkgs ? import sources.nixos-unstable { }, + sources ? import ./sources.nix, + pkgs ? sources.bootstrapNixpkgs, }: let diff --git a/hive.nix b/hive.nix index df57365..b23b83f 100644 --- a/hive.nix +++ b/hive.nix @@ -4,45 +4,33 @@ # # SPDX-License-Identifier: EUPL-1.2 +# TODO: change comments to ### \n # [text] \n # + let - sources' = import ./npins; + ### Init some tooling - # Patch sources directly - sources = - builtins.mapAttrs (patch.base { pkgs = import sources'.nixos-unstable { }; }).applyPatches' - sources'; + sources = import ./sources.nix; + + inherit (sources) bootstrapNixpkgs; + + lib = bootstrapNixpkgs.lib.extend (_: _: { + extra = import ./lib/nix-lib; + }); + + nix-lib = lib.extra; # TODO: Assess perf penalty of fixed point + # TODO same but using bootstrapnixpkgs for nix-lib instanciation + # original statement: import ./lib/nix-lib; - nix-lib = import ./lib/nix-lib; inherit (nix-lib) mapSingleFuse; - patch = import ./lib/nix-patches { patchFile = ./patches; }; + ### Let's build meta + metadata = (import ./meta) lib; - nodes' = import ./meta/nodes; - nodes = builtins.attrNames nodes'; + nodes = builtins.attrNames metadata.nodes; - mkNode = node: { - deployment.systemType = system node; - }; + ### Nixpkgs instanciation nixpkgs' = import ./meta/nixpkgs.nix; - # All supported nixpkgs versions × systems, instanciated - nixpkgs = mapSingleFuse (s: mapSingleFuse (mkSystemNixpkgs s) nixpkgs'.versions) nixpkgs'.systems; - - # Get the configured nixos version for the node, - # defaulting to the one defined in meta/nixpkgs - version = node: nodes'.${node}.nixpkgs.version; - system = node: nodes'.${node}.nixpkgs.system; - category = node: nixpkgs'.categories.${system node}; - - nodePkgs = node: nixpkgs.${system node}.${version node}; - - # Builds a patched version of nixpkgs, only as the source - mkNixpkgs' = - v: - patch.mkNixpkgsSrc rec { - src = sources'.${name}; - name = "nixos-${v}"; - }; # Build up the nixpkgs configuration for Liminix embedded systems mkLiminixConfig = @@ -58,21 +46,35 @@ let }; }; + # Build up the arguments to instantiate a nixpkgs given a system and a version. mkNixpkgsConfig = system: { - nixos = _: { }; + nixos = _: { }; # TODO: add nix-pkgs overlay here zyxel-nwa50ax = mkLiminixConfig system; netconf = _: { }; } .${system} or (throw "Unknown system: ${system} for nixpkgs configuration instantiation"); # Instanciates the required nixpkgs version - mkSystemNixpkgs = system: version: import (mkNixpkgs' version) (mkNixpkgsConfig system version); + mkSystemNixpkgs = system: version: + import sources."nixos-${version}" (mkNixpkgsConfig system version); - ### - # Function to create arguments based on the node + # All supported nixpkgs versions × systems, instanciated + nixpkgs = mapSingleFuse (s: mapSingleFuse (mkSystemNixpkgs s) nixpkgs'.versions) nixpkgs'.systems; + + + # Get the configured nixos version for the node, + # defaulting to the one defined in meta/nixpkgs + version = node: metadata.nodes.${node}.nixpkgs.version; + system = node: metadata.nodes.${node}.nixpkgs.system; + category = node: nixpkgs'.categories.${system node}; + + nodePkgs = node: nixpkgs.${system node}.${version node}; + + ########## + # Function to create arguments based on the node # mkArgs = node: rec { lib = sourcePkgs.lib // { @@ -80,11 +82,19 @@ let }; sourcePkgs = nodePkgs node; - meta = (import ./meta) lib; + meta = metadata; - nodeMeta = meta.nodes.${node}; + nodeMeta = metadata.nodes.${node}; nodePath = "machines/${category node}/${node}"; }; + + ########## + # Module for each node (quite empty since almost everything is in the default module) + # + mkNode = node: { + deployment.systemType = system node; + }; + in { @@ -95,7 +105,10 @@ in specialArgs = { inherit nixpkgs sources; - dgn-keys = import ./keys; + dgn-keys = import ./lib/keys { + meta = metadata; + inherit lib; + }; }; nodeSpecialArgs = mapSingleFuse mkArgs nodes; @@ -219,5 +232,6 @@ in }; }; }; + } // (mapSingleFuse mkNode nodes) diff --git a/iso/configuration.nix b/iso/configuration.nix index aad91fa..aac4324 100644 --- a/iso/configuration.nix +++ b/iso/configuration.nix @@ -5,9 +5,9 @@ { lib, pkgs, ... }: let - dgn-keys = import ../keys; + dgn-keys = import ../keys.nix; - dgn-members = (import ../meta lib).organization.groups.root; + dgn-members = (import ../meta lib).config.organization.groups.root; in { diff --git a/keys.nix b/keys.nix new file mode 100644 index 0000000..7945d52 --- /dev/null +++ b/keys.nix @@ -0,0 +1,13 @@ +# SPDX-FileCopyrightText: 2024 Tom Hubrecht +# +# SPDX-License-Identifier: EUPL-1.2 + +let + _sources = import ../npins; + + inherit (import _sources.nixpkgs { }) lib; + + meta = (import ../meta lib).config; + +in + import ./lib/keys { inherit meta lib; } diff --git a/keys/default.nix b/lib/keys/default.nix similarity index 53% rename from keys/default.nix rename to lib/keys/default.nix index 99cc7a5..1f0711f 100644 --- a/keys/default.nix +++ b/lib/keys/default.nix @@ -1,20 +1,15 @@ +# SPDX-FileCopyrightText: 2024 Ryan Lahfa # SPDX-FileCopyrightText: 2024 Tom Hubrecht +# SPDX-FileContributor: Maurice Debray # # SPDX-License-Identifier: EUPL-1.2 +{ meta, lib }: let - _sources = import ../npins; - - inherit (import _sources.nixos-unstable { }) lib; - - meta = import ../meta lib; - - inherit (import ../lib/nix-lib) setDefault unique; + inherit (import ../nix-lib) setDefault unique; getAttr = lib.flip builtins.getAttr; - in - rec { _memberKeys = builtins.mapAttrs (_: v: v.sshKeys) meta.organization.members; _nodeKeys = builtins.mapAttrs (_: v: v.sshKeys) meta.nodes; @@ -28,22 +23,25 @@ rec { # List of keys for the root group rootKeys = getMemberKeys meta.organization.groups.root; - # All keys that can access a node - getNodeKeys' = + # All admins for a node + getNodeAdmins = node: - let - names = [ node ] ++ - meta.nodes.${node}.admins - ++ (builtins.concatMap (g: meta.organization.groups.${g}) meta.nodes.${node}.adminGroups); - in - unique (getMemberKeys names ++ getNodeKeys [ node ]); + meta.organization.groups.root + ++ meta.nodes.${node}.admins + ++ (builtins.concatMap (g: meta.organization.groups.${g}) meta.nodes.${node}.adminGroups); + + # All keys needed for secret encryption + getSecretKeys = node: unique (getMemberKeys (getNodeAdmins node) ++ getNodeKeys [ node ]); # List of keys for all machines wide secrets machineKeys = rootKeys ++ (getNodeKeys (builtins.attrNames meta.nodes)); - mkSecrets = nodes: setDefault { publicKeys = unique (builtins.concatMap getNodeKeys' nodes); }; + mkSecrets = nodes: setDefault { publicKeys = unique (builtins.concatMap getSecretKeys nodes); }; - machineKeysBySystem = system: + machineKeysBySystem = + system: rootKeys - ++ (getNodeKeys (builtins.attrNames (lib.filterAttrs (_: v: v.nixpkgs.system == system) meta.nodes))); + ++ (getNodeKeys ( + builtins.attrNames (lib.filterAttrs (_: v: v.nixpkgs.system == system) meta.nodes) + )); } diff --git a/machines/nixos/bridge01/secrets/secrets.nix b/machines/nixos/bridge01/secrets/secrets.nix index 78adcca..a63c32d 100644 --- a/machines/nixos/bridge01/secrets/secrets.nix +++ b/machines/nixos/bridge01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "bridge01" ] [ # List of secrets for bridge01 diff --git a/machines/nixos/build01/secrets/secrets.nix b/machines/nixos/build01/secrets/secrets.nix index f234224..3da9805 100644 --- a/machines/nixos/build01/secrets/secrets.nix +++ b/machines/nixos/build01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "build01" ] [ "forgejo_runners-token_file" diff --git a/machines/nixos/compute01/extranix/default.nix b/machines/nixos/compute01/extranix/default.nix index 3d77d2d..e8be054 100644 --- a/machines/nixos/compute01/extranix/default.nix +++ b/machines/nixos/compute01/extranix/default.nix @@ -5,6 +5,7 @@ { lib, sources, + dgn-keys, ... }: let @@ -68,6 +69,9 @@ in meta = { organization.groups.root = [ ]; }; + dgn-keys = dgn-keys // { + getNodeAdmins = _: [ ]; + }; }; path-translations = [ { diff --git a/machines/nixos/compute01/kanidm/secrets/secrets.nix b/machines/nixos/compute01/kanidm/secrets/secrets.nix index c424c1b..3229f76 100644 --- a/machines/nixos/compute01/kanidm/secrets/secrets.nix +++ b/machines/nixos/compute01/kanidm/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../../keys).mkSecrets +(import ../../../../../keys.nix).mkSecrets [ "compute01" ] [ "kanidm-password_admin" diff --git a/machines/nixos/compute01/secrets/secrets.nix b/machines/nixos/compute01/secrets/secrets.nix index d575bbf..00e0f39 100644 --- a/machines/nixos/compute01/secrets/secrets.nix +++ b/machines/nixos/compute01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "compute01" ] [ # List of secrets for compute01 diff --git a/machines/nixos/geo01/secrets/secrets.nix b/machines/nixos/geo01/secrets/secrets.nix index fb7ffd4..7813f07 100644 --- a/machines/nixos/geo01/secrets/secrets.nix +++ b/machines/nixos/geo01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "geo01" ] [ # List of secrets for geo01 diff --git a/machines/nixos/geo02/secrets/secrets.nix b/machines/nixos/geo02/secrets/secrets.nix index a4b84cb..77e9535 100644 --- a/machines/nixos/geo02/secrets/secrets.nix +++ b/machines/nixos/geo02/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "geo02" ] [ # List of secrets for geo02 diff --git a/machines/nixos/hypervisor01/secrets/secrets.nix b/machines/nixos/hypervisor01/secrets/secrets.nix index 02ef5f5..e86e467 100644 --- a/machines/nixos/hypervisor01/secrets/secrets.nix +++ b/machines/nixos/hypervisor01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifer: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "hypervisor01" ] [ diff --git a/machines/nixos/hypervisor02/secrets/secrets.nix b/machines/nixos/hypervisor02/secrets/secrets.nix index 1c3dae5..8d5f6fc 100644 --- a/machines/nixos/hypervisor02/secrets/secrets.nix +++ b/machines/nixos/hypervisor02/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifer: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "hypervisor02" ] [ diff --git a/machines/nixos/hypervisor03/secrets/secrets.nix b/machines/nixos/hypervisor03/secrets/secrets.nix index ad06613..02d6078 100644 --- a/machines/nixos/hypervisor03/secrets/secrets.nix +++ b/machines/nixos/hypervisor03/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifer: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "hypervisor03" ] [ diff --git a/machines/nixos/rescue01/secrets/secrets.nix b/machines/nixos/rescue01/secrets/secrets.nix index f270805..14618e6 100644 --- a/machines/nixos/rescue01/secrets/secrets.nix +++ b/machines/nixos/rescue01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "rescue01" ] [ # List of secrets for rescue01 diff --git a/machines/nixos/storage01/secrets/secrets.nix b/machines/nixos/storage01/secrets/secrets.nix index 94ef3cf..d0d9e85 100644 --- a/machines/nixos/storage01/secrets/secrets.nix +++ b/machines/nixos/storage01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "storage01" ] [ # List of secrets for storage01 diff --git a/machines/nixos/tower01/secrets/secrets.nix b/machines/nixos/tower01/secrets/secrets.nix index fc08f6d..d95317e 100644 --- a/machines/nixos/tower01/secrets/secrets.nix +++ b/machines/nixos/tower01/secrets/secrets.nix @@ -2,7 +2,8 @@ # # SPDX-License-Identifer: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "tower01" ] [ + ] diff --git a/machines/nixos/vault01/secrets/secrets.nix b/machines/nixos/vault01/secrets/secrets.nix index 5453626..f93ee25 100644 --- a/machines/nixos/vault01/secrets/secrets.nix +++ b/machines/nixos/vault01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "vault01" ] [ # List of secrets for vault01 diff --git a/machines/nixos/web01/secrets/secrets.nix b/machines/nixos/web01/secrets/secrets.nix index 7935c7c..6305b11 100644 --- a/machines/nixos/web01/secrets/secrets.nix +++ b/machines/nixos/web01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "web01" ] [ # List of secrets for web01 diff --git a/machines/nixos/web02/secrets/secrets.nix b/machines/nixos/web02/secrets/secrets.nix index 43ffc58..a7db18d 100644 --- a/machines/nixos/web02/secrets/secrets.nix +++ b/machines/nixos/web02/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "web02" ] [ # List of secrets for web02 diff --git a/machines/nixos/web03/secrets/secrets.nix b/machines/nixos/web03/secrets/secrets.nix index 36db49f..b365c92 100644 --- a/machines/nixos/web03/secrets/secrets.nix +++ b/machines/nixos/web03/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "web03" ] [ # List of secrets for web03 diff --git a/meta/default.nix b/meta/default.nix index b2e07b1..2199e0b 100644 --- a/meta/default.nix +++ b/meta/default.nix @@ -12,11 +12,9 @@ lib: (lib.evalModules { modules = [ ./options.nix - { - network = import ./network.nix; - nodes = import ./nodes; - organization = import ./organization.nix; - } + ./network.nix + ./nodes + ./organization.nix ]; class = "dgnumMeta"; }).config diff --git a/meta/network.nix b/meta/network.nix index 69cf8b5..f0d904a 100644 --- a/meta/network.nix +++ b/meta/network.nix @@ -6,304 +6,306 @@ # SPDX-License-Identifier: EUPL-1.2 { - bridge01 = { - hostId = "f57f3ba0"; + network = { + bridge01 = { + hostId = "f57f3ba0"; - interfaces = { }; - netbirdIp = null; - }; - - build01 = { - interfaces = { - enp35s0f0np0 = { - ipv4 = [ - { - address = "10.0.254.21"; - prefixLength = 24; - } - ]; - - gateways = [ "10.0.254.1" ]; - enableDefaultDNS = true; - }; + interfaces = { }; + netbirdIp = null; }; - hostId = "adb676ce"; - netbirdIp = "100.80.31.249"; - }; + build01 = { + interfaces = { + enp35s0f0np0 = { + ipv4 = [ + { + address = "10.0.254.21"; + prefixLength = 24; + } + ]; - compute01 = { - interfaces = { - eno1 = { - ipv4 = [ - { - address = "129.199.146.147"; - prefixLength = 24; - } - { - address = "192.168.1.147"; - prefixLength = 24; - } - ]; - - gateways = [ "129.199.146.254" ]; - enableDefaultDNS = true; + gateways = [ "10.0.254.1" ]; + enableDefaultDNS = true; + }; }; + + hostId = "adb676ce"; + netbirdIp = "100.80.31.249"; }; - hostId = "8df60941"; - netbirdIp = "100.80.75.197"; - }; + compute01 = { + interfaces = { + eno1 = { + ipv4 = [ + { + address = "129.199.146.147"; + prefixLength = 24; + } + { + address = "192.168.1.147"; + prefixLength = 24; + } + ]; - geo01 = { - interfaces = { - eno1 = { - ipv4 = [ - { - address = "129.199.210.194"; - prefixLength = 24; - } - ]; - - gateways = [ "129.199.210.254" ]; - - dns = [ - "129.199.96.11" - "129.199.72.99" - ]; + gateways = [ "129.199.146.254" ]; + enableDefaultDNS = true; + }; }; + + hostId = "8df60941"; + netbirdIp = "100.80.75.197"; }; - hostId = "b88fee0c"; - netbirdIp = "100.80.8.66"; - }; + geo01 = { + interfaces = { + eno1 = { + ipv4 = [ + { + address = "129.199.210.194"; + prefixLength = 24; + } + ]; - geo02 = { - interfaces = { - eno1 = { - ipv4 = [ - { - address = "129.199.210.69"; - prefixLength = 24; - } - ]; + gateways = [ "129.199.210.254" ]; - gateways = [ "129.199.210.254" ]; - - dns = [ - "129.199.96.11" - "129.199.72.99" - ]; + dns = [ + "129.199.96.11" + "129.199.72.99" + ]; + }; }; + + hostId = "b88fee0c"; + netbirdIp = "100.80.8.66"; }; - hostId = "45d65237"; - netbirdIp = "100.80.233.249"; - }; + geo02 = { + interfaces = { + eno1 = { + ipv4 = [ + { + address = "129.199.210.69"; + prefixLength = 24; + } + ]; - hypervisor01 = { - interfaces = { - eno4 = { - ipv4 = [ - { - address = "10.0.254.11"; - prefixLength = 24; - } - ]; + gateways = [ "129.199.210.254" ]; - gateways = [ "10.0.254.1" ]; - enableDefaultDNS = true; + dns = [ + "129.199.96.11" + "129.199.72.99" + ]; + }; }; + + hostId = "45d65237"; + netbirdIp = "100.80.233.249"; }; - hostId = "4dbbd76a"; - netbirdIp = "100.80.242.115"; - }; + hypervisor01 = { + interfaces = { + eno4 = { + ipv4 = [ + { + address = "10.0.254.11"; + prefixLength = 24; + } + ]; - hypervisor02 = { - interfaces = { - eno4 = { - ipv4 = [ - { - address = "10.0.254.12"; - prefixLength = 24; - } - ]; - - gateways = [ "10.0.254.1" ]; - enableDefaultDNS = true; + gateways = [ "10.0.254.1" ]; + enableDefaultDNS = true; + }; }; + + hostId = "4dbbd76a"; + netbirdIp = "100.80.242.115"; }; - hostId = "d0b48483"; - netbirdIp = "100.80.37.202"; - }; + hypervisor02 = { + interfaces = { + eno4 = { + ipv4 = [ + { + address = "10.0.254.12"; + prefixLength = 24; + } + ]; - hypervisor03 = { - interfaces = { - eno4 = { - ipv4 = [ - { - address = "10.0.254.13"; - prefixLength = 24; - } - ]; - - gateways = [ "10.0.254.1" ]; - enableDefaultDNS = true; + gateways = [ "10.0.254.1" ]; + enableDefaultDNS = true; + }; }; + + hostId = "d0b48483"; + netbirdIp = "100.80.37.202"; }; - hostId = "1c407ea8"; - netbirdIp = "100.80.58.178"; - }; + hypervisor03 = { + interfaces = { + eno4 = { + ipv4 = [ + { + address = "10.0.254.13"; + prefixLength = 24; + } + ]; - rescue01 = { - interfaces = { - ens18 = { - ipv6 = [ - { - address = "2a01:e0a:de4:a0e1:2d73:2a7e:18db:5728"; - prefixLength = 64; - } - ]; - - ipv4 = [ - { - address = "192.168.0.232"; - prefixLength = 21; - } - ]; - gateways = [ "192.168.0.1" ]; - enableDefaultDNS = true; + gateways = [ "10.0.254.1" ]; + enableDefaultDNS = true; + }; }; + + hostId = "1c407ea8"; + netbirdIp = "100.80.58.178"; }; - addresses.ipv4 = [ "82.67.34.230" ]; + rescue01 = { + interfaces = { + ens18 = { + ipv6 = [ + { + address = "2a01:e0a:de4:a0e1:2d73:2a7e:18db:5728"; + prefixLength = 64; + } + ]; - hostId = "007f0200"; - netbirdIp = "100.80.97.140"; - }; - - storage01 = { - interfaces = { - eno1 = { - ipv4 = [ - { - address = "129.199.146.148"; - prefixLength = 24; - } - { - address = "192.168.1.148"; - prefixLength = 24; - } - ]; - - gateways = [ "129.199.146.254" ]; - enableDefaultDNS = true; + ipv4 = [ + { + address = "192.168.0.232"; + prefixLength = 21; + } + ]; + gateways = [ "192.168.0.1" ]; + enableDefaultDNS = true; + }; }; + + addresses.ipv4 = [ "82.67.34.230" ]; + + hostId = "007f0200"; + netbirdIp = "100.80.97.140"; }; - hostId = "d4e7c369"; - netbirdIp = "100.80.156.154"; - }; + storage01 = { + interfaces = { + eno1 = { + ipv4 = [ + { + address = "129.199.146.148"; + prefixLength = 24; + } + { + address = "192.168.1.148"; + prefixLength = 24; + } + ]; - tower01 = { - interfaces = { - eno2 = { - ipv4 = [ - { - address = "129.199.210.119"; - prefixLength = 24; - } - ]; - - gateways = [ "129.199.210.254" ]; - - dns = [ - "129.199.96.11" - "129.199.72.99" - ]; + gateways = [ "129.199.146.254" ]; + enableDefaultDNS = true; + }; }; + + hostId = "d4e7c369"; + netbirdIp = "100.80.156.154"; }; - hostId = "7874d06e"; - netbirdIp = "100.80.185.124"; - }; + tower01 = { + interfaces = { + eno2 = { + ipv4 = [ + { + address = "129.199.210.119"; + prefixLength = 24; + } + ]; - vault01 = { - interfaces = { - vlan-uplink-cri = { - ipv4 = [ - { - # see also machines/vault01/networking.nix - address = "129.199.195.129"; - prefixLength = 32; - } - ]; - gateways = [ ]; - enableDefaultDNS = true; + gateways = [ "129.199.210.254" ]; + + dns = [ + "129.199.96.11" + "129.199.72.99" + ]; + }; }; + + hostId = "7874d06e"; + netbirdIp = "100.80.185.124"; }; - hostId = "e83b600d"; - netbirdIp = "100.80.255.180"; - }; - - web01 = { - interfaces = { - ens3 = { - ipv4 = [ - { - address = "129.199.129.53"; - prefixLength = 24; - } - ]; - - gateways = [ "129.199.129.1" ]; - enableDefaultDNS = true; + vault01 = { + interfaces = { + vlan-uplink-cri = { + ipv4 = [ + { + # see also machines/vault01/networking.nix + address = "129.199.195.129"; + prefixLength = 32; + } + ]; + gateways = [ ]; + enableDefaultDNS = true; + }; }; + + hostId = "e83b600d"; + netbirdIp = "100.80.255.180"; }; - hostId = "050df79e"; - netbirdIp = "100.80.77.90"; - }; + web01 = { + interfaces = { + ens3 = { + ipv4 = [ + { + address = "129.199.129.53"; + prefixLength = 24; + } + ]; - web02 = { - interfaces = { - ens3 = { - ipv4 = [ - { - address = "129.199.129.235"; - prefixLength = 24; - } - ]; - - gateways = [ "129.199.129.1" ]; - enableDefaultDNS = true; + gateways = [ "129.199.129.1" ]; + enableDefaultDNS = true; + }; }; + + hostId = "050df79e"; + netbirdIp = "100.80.77.90"; }; - hostId = "b431ca10"; - netbirdIp = null; # web02 is not to be connected on the VPN - }; + web02 = { + interfaces = { + ens3 = { + ipv4 = [ + { + address = "129.199.129.235"; + prefixLength = 24; + } + ]; - web03 = { - interfaces = { - enp1s0 = { - ipv4 = [ - { - address = "129.199.129.223"; - prefixLength = 24; - } - ]; - - gateways = [ "129.199.129.1" ]; - enableDefaultDNS = true; + gateways = [ "129.199.129.1" ]; + enableDefaultDNS = true; + }; }; + + hostId = "b431ca10"; + netbirdIp = null; # web02 is not to be connected on the VPN }; - hostId = "8afc7749"; - netbirdIp = "100.80.157.46"; + web03 = { + interfaces = { + enp1s0 = { + ipv4 = [ + { + address = "129.199.129.223"; + prefixLength = 24; + } + ]; + + gateways = [ "129.199.129.1" ]; + enableDefaultDNS = true; + }; + }; + + hostId = "8afc7749"; + netbirdIp = "100.80.157.46"; + }; }; } diff --git a/meta/nodes/default.nix b/meta/nodes/default.nix index e5caf35..ec94bef 100644 --- a/meta/nodes/default.nix +++ b/meta/nodes/default.nix @@ -2,9 +2,10 @@ # SPDX-FileContributor: Ryan Lahfa # # SPDX-License-Identifier: EUPL-1.2 - -builtins.foldl' (nodes: path: nodes // import path) { } [ - ./liminix.nix - ./nixos.nix - ./netconf.nix -] +{ + imports = [ + ./liminix.nix + ./nixos.nix + ./netconf.nix + ]; +} diff --git a/meta/nodes/liminix.nix b/meta/nodes/liminix.nix index 5c6e952..7618c92 100644 --- a/meta/nodes/liminix.nix +++ b/meta/nodes/liminix.nix @@ -16,17 +16,19 @@ # } { - ap01 = { - site = "unknown"; - adminGroups = [ "fai" ]; + nodes = { + ap01 = { + site = "unknown"; + adminGroups = [ "fai" ]; - hashedPassword = "$y$j9T$DMOQEWOYFHjNS0myrXp4x/$MG33VSdXGvib.99eN.AbvyVdNNJw4ERjAwK4.ULJe/A"; + hashedPassword = "$y$j9T$DMOQEWOYFHjNS0myrXp4x/$MG33VSdXGvib.99eN.AbvyVdNNJw4ERjAwK4.ULJe/A"; - stateVersion = null; + stateVersion = null; - nixpkgs = { - system = "zyxel-nwa50ax"; - version = "24.05"; + nixpkgs = { + system = "zyxel-nwa50ax"; + version = "24.05"; + }; }; }; } diff --git a/meta/nodes/netconf.nix b/meta/nodes/netconf.nix index 162bd8d..f26400c 100644 --- a/meta/nodes/netconf.nix +++ b/meta/nodes/netconf.nix @@ -2,48 +2,50 @@ # # SPDX-License-Identifier: EUPL-1.2 { - netcore02 = { - site = "hyp01"; + nodes = { + netcore02 = { + site = "hyp01"; - hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0"; + hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0"; - stateVersion = null; + stateVersion = null; - adminGroups = [ "fai" ]; + adminGroups = [ "fai" ]; - deployment = { - targetHost = "fd26:baf9:d250:8000::1001"; - sshOptions = [ - "-J" - "root@vault01.hyp01.infra.dgnum.eu" - ]; - }; - - nixpkgs = { - version = "24.05"; # FIXME: meaningless - system = "netconf"; + deployment = { + targetHost = "fd26:baf9:d250:8000::1001"; + sshOptions = [ + "-J" + "root@vault01.hyp01.infra.dgnum.eu" + ]; + }; + + nixpkgs = { + version = "24.05"; # FIXME: meaningless + system = "netconf"; + }; }; + # netaccess01 = { + # site = "hyp02"; + # + # hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0"; + # + # stateVersion = null; + # + # adminGroups = [ "fai" ]; + # + # deployment = { + # targetHost = "fd26:baf9:d250:8000::2001"; + # sshOptions = [ + # "-J" + # "root@vault01.hyp01.infra.dgnum.eu" + # ]; + # }; + # + # nixpkgs = { + # version = "24.05"; # FIXME: meaningless + # system = "netconf"; + # }; + # }; }; - # netaccess01 = { - # site = "hyp02"; - # - # hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0"; - # - # stateVersion = null; - # - # adminGroups = [ "fai" ]; - # - # deployment = { - # targetHost = "fd26:baf9:d250:8000::2001"; - # sshOptions = [ - # "-J" - # "root@vault01.hyp01.infra.dgnum.eu" - # ]; - # }; - # - # nixpkgs = { - # version = "24.05"; # FIXME: meaningless - # system = "netconf"; - # }; - # }; } diff --git a/meta/nodes/nixos.nix b/meta/nodes/nixos.nix index 170fb37..11d26e0 100644 --- a/meta/nodes/nixos.nix +++ b/meta/nodes/nixos.nix @@ -26,295 +26,293 @@ - luj01 -> VM de Luj */ { - bridge01 = { - site = "hyp01"; + nodes = { + bridge01 = { + site = "hyp01"; - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5bS3iBXz8wycBnTvI5Qi79WLu0h4IVv/EOdKYbP5y7" ]; + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5bS3iBXz8wycBnTvI5Qi79WLu0h4IVv/EOdKYbP5y7" ]; - hashedPassword = "$y$j9T$EPJdz70kselouXAVUmAH01$8nYbUBY9NPTMfYigegY0qFSdxJwhqzW8sFacDqEYCP5"; + hashedPassword = "$y$j9T$EPJdz70kselouXAVUmAH01$8nYbUBY9NPTMfYigegY0qFSdxJwhqzW8sFacDqEYCP5"; - stateVersion = "24.05"; + stateVersion = "24.05"; - adminGroups = [ "fai" ]; + adminGroups = [ "fai" ]; - deployment = { - targetHost = "fd26:baf9:d250:8000::ffff"; - sshOptions = [ - "-J" - "root@vault01.hyp01.infra.dgnum.eu" + deployment = { + targetHost = "fd26:baf9:d250:8000::ffff"; + sshOptions = [ + "-J" + "root@vault01.hyp01.infra.dgnum.eu" + ]; + }; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + }; + + build01 = { + site = "pot01"; + + hashedPassword = "$y$j9T$n83qOn1OkQhFwQe50tPM11$jZ1tvgqMTcp4HLGEfJmTMsf0NnRUYQkzco9vibWTpU2"; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYJcEMQpOyKInqtd2/brnSQuzwgv6fNPlTSQx9tcvPu" ]; + + stateVersion = "24.11"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + + admins = [ "ecoppens" ]; + + deployment = { + targetHost = "build01.dgnum"; + }; + }; + + compute01 = { + site = "pav01"; + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/YluSVS+4h3oV8CIUj0OmquyJXju8aEQy0Jz210vTu" ]; + + hashedPassword = "$y$j9T$2nxZHq84G7fWvWMEaGavE/$0ADnmD9qMpXJJ.rWWH9086EakvZ3wAg0mSxZYugOf3C"; + + stateVersion = "23.05"; + nix-modules = [ "services/stirling-pdf" ]; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + }; + + geo01 = { + site = "oik01"; + deployment.tags = [ "geo" ]; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEl6Pubbau+usQkemymoSKrTBbrX8JU5m5qpZbhNx8p4" ]; + + hashedPassword = "$y$j9T$2XmDpJu.QLhV57yYCh5Lf1$LK.X0HKB02Q0Ujvhj5nIofW2IRrIAL/Uxnvl9AXM1L8"; + + deployment.targetHost = "geo01.dgnum"; + + stateVersion = "24.05"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + }; + + geo02 = { + site = "oik01"; + deployment.tags = [ "geo" ]; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNXaCS0/Nsu5npqQk1TP6wMHCVIOaj4pblp2tIg6Ket" ]; + + hashedPassword = "$y$j9T$Q4fbMpSm9beWu4DPNAR9t0$dx/1pH4GPY72LpS5ZiECXAZFDdxwmIywztsX.qo2VVA"; + + deployment.targetHost = "geo02.dgnum"; + + stateVersion = "24.05"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + }; + + hypervisor01 = { + site = "pot01"; + + hashedPassword = "$y$j9T$Yw.M.epJj/sakb4Gq/9WV0$P85aQPo/FmFM1.ap413UL3vlGk3mavHwmaALKKDd4n."; + + stateVersion = "24.11"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINPE0typcnvSioMfdLUloIfR5zcf/X0k6201xMHoQBCr" ]; + + adminGroups = [ "hypervisors" ]; + + deployment = { + targetHost = "hypervisor01.dgnum"; + }; + }; + + hypervisor02 = { + site = "pot01"; + + hashedPassword = "$y$j9T$Zu98DVlKq7KP5GmIHOwBy1$Bd7W6LstWDm8zjbZ9JSPLnhMFPmZgmU4e7t7u6EhavA"; + + stateVersion = "24.11"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPETkWlOfESXQic+HgfGLV/T4Nqg0WjdDbEqtgDwkH+S" ]; + + adminGroups = [ "hypervisors" ]; + + deployment = { + targetHost = "hypervisor02.dgnum"; + }; + }; + + hypervisor03 = { + site = "pot01"; + + hashedPassword = "$y$j9T$plTv9.UwmkTODagd4docj0$3zd35wPSsamygiYngwfDGICapKbx5UbzyLBhAwOUSfC"; + + stateVersion = "24.11"; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFLF0mxSGitsDE3/YXfrHNjtOMUt4HT2MbryyUKPLSBI" ]; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + + adminGroups = [ "hypervisors" ]; + + deployment = { + targetHost = "hypervisor03.dgnum"; + }; + }; + + rescue01 = { + site = "luj01"; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJa02Annu8o7ggPjTH/9ttotdNGyghlWfU9E8pnuLUf" ]; + + deployment.targetHost = "v6.rescue01.luj01.infra.dgnum.eu"; + + hashedPassword = "$y$j9T$nqoMMu/axrD0m8AlUFdbs.$UFVmIdPAOHBe2jJv5HJJTcDgINC7LTnSGRQNs9zS1mC"; + + stateVersion = "23.11"; + vm-cluster = "Hyperviseur Luj"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + nix-modules = [ + "services/netbird/server.nix" ]; }; - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - }; + storage01 = { + site = "pav01"; - build01 = { - site = "pot01"; + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA0s+rPcEcfWCqZ4B2oJiWT/60awOI8ijL1rtDM2glXZ" ]; - hashedPassword = "$y$j9T$n83qOn1OkQhFwQe50tPM11$jZ1tvgqMTcp4HLGEfJmTMsf0NnRUYQkzco9vibWTpU2"; + hashedPassword = "$y$j9T$tvRu1EJ9MwDSvEm0ogwe70$bKSw6nNteN0L3NOy2Yix7KlIvO/oROQmQ.Ynq002Fg8"; - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYJcEMQpOyKInqtd2/brnSQuzwgv6fNPlTSQx9tcvPu" ]; + stateVersion = "23.11"; - stateVersion = "24.11"; + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - - admins = [ "ecoppens" ]; - - deployment = { - targetHost = "build01.dgnum"; - }; - }; - - compute01 = { - site = "pav01"; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/YluSVS+4h3oV8CIUj0OmquyJXju8aEQy0Jz210vTu" ]; - - hashedPassword = "$y$j9T$2nxZHq84G7fWvWMEaGavE/$0ADnmD9qMpXJJ.rWWH9086EakvZ3wAg0mSxZYugOf3C"; - - stateVersion = "23.05"; - nix-modules = [ "services/stirling-pdf" ]; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - }; - - geo01 = { - site = "oik01"; - deployment.tags = [ "geo" ]; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEl6Pubbau+usQkemymoSKrTBbrX8JU5m5qpZbhNx8p4" ]; - - hashedPassword = "$y$j9T$2XmDpJu.QLhV57yYCh5Lf1$LK.X0HKB02Q0Ujvhj5nIofW2IRrIAL/Uxnvl9AXM1L8"; - - deployment.targetHost = "geo01.dgnum"; - - stateVersion = "24.05"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - }; - - geo02 = { - site = "oik01"; - deployment.tags = [ "geo" ]; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNXaCS0/Nsu5npqQk1TP6wMHCVIOaj4pblp2tIg6Ket" ]; - - hashedPassword = "$y$j9T$Q4fbMpSm9beWu4DPNAR9t0$dx/1pH4GPY72LpS5ZiECXAZFDdxwmIywztsX.qo2VVA"; - - deployment.targetHost = "geo02.dgnum"; - - stateVersion = "24.05"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - }; - - hypervisor01 = { - site = "pot01"; - - hashedPassword = "$y$j9T$Yw.M.epJj/sakb4Gq/9WV0$P85aQPo/FmFM1.ap413UL3vlGk3mavHwmaALKKDd4n."; - - stateVersion = "24.11"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINPE0typcnvSioMfdLUloIfR5zcf/X0k6201xMHoQBCr" ]; - - adminGroups = [ "hypervisors" ]; - - deployment = { - targetHost = "hypervisor01.dgnum"; - }; - }; - - hypervisor02 = { - site = "pot01"; - - hashedPassword = "$y$j9T$Zu98DVlKq7KP5GmIHOwBy1$Bd7W6LstWDm8zjbZ9JSPLnhMFPmZgmU4e7t7u6EhavA"; - - stateVersion = "24.11"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPETkWlOfESXQic+HgfGLV/T4Nqg0WjdDbEqtgDwkH+S" ]; - - adminGroups = [ "hypervisors" ]; - - deployment = { - targetHost = "hypervisor02.dgnum"; - }; - }; - - hypervisor03 = { - site = "pot01"; - - hashedPassword = "$y$j9T$plTv9.UwmkTODagd4docj0$3zd35wPSsamygiYngwfDGICapKbx5UbzyLBhAwOUSfC"; - - stateVersion = "24.11"; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFLF0mxSGitsDE3/YXfrHNjtOMUt4HT2MbryyUKPLSBI" ]; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - - adminGroups = [ "hypervisors" ]; - - deployment = { - targetHost = "hypervisor03.dgnum"; - }; - }; - - rescue01 = { - site = "luj01"; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJa02Annu8o7ggPjTH/9ttotdNGyghlWfU9E8pnuLUf" ]; - - deployment.targetHost = "v6.rescue01.luj01.infra.dgnum.eu"; - - hashedPassword = "$y$j9T$nqoMMu/axrD0m8AlUFdbs.$UFVmIdPAOHBe2jJv5HJJTcDgINC7LTnSGRQNs9zS1mC"; - - stateVersion = "23.11"; - vm-cluster = "Hyperviseur Luj"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - }; - - storage01 = { - site = "pav01"; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA0s+rPcEcfWCqZ4B2oJiWT/60awOI8ijL1rtDM2glXZ" ]; - - hashedPassword = "$y$j9T$tvRu1EJ9MwDSvEm0ogwe70$bKSw6nNteN0L3NOy2Yix7KlIvO/oROQmQ.Ynq002Fg8"; - - stateVersion = "23.11"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - - nix-modules = [ - "services/netbird/server.nix" - ]; - }; - - tower01 = { - site = "oik01"; - - hashedPassword = "$y$j9T$axihKDa.CrYcyoamJWxBq1$bl4TfropTrwLqMy6XK0DKkWRyx9b74kyI/ukE8X5iiD"; - - sshKeys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVpR+TMRLGAfhn7Q0C3tKOydYYjfoC/e1ZYbKpby01Z" - ]; - - stateVersion = "24.11"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - - deployment = { - sshOptions = [ - "-J" - "root@vault01.hyp01.infra.dgnum.eu" + nix-modules = [ + "services/forgejo-nix-runners" + "services/netbird/server.nix" ]; }; - admins = [ "ecoppens" ]; - }; + tower01 = { + site = "oik01"; - vault01 = { - site = "hyp01"; - deployment.targetHost = "vault01.hyp01.infra.dgnum.eu"; + hashedPassword = "$y$j9T$axihKDa.CrYcyoamJWxBq1$bl4TfropTrwLqMy6XK0DKkWRyx9b74kyI/ukE8X5iiD"; - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJA6VA7LENvTRlKdcrqt8DxDOPvX3bg3Gjy9mNkdFEW" ]; + sshKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVpR+TMRLGAfhn7Q0C3tKOydYYjfoC/e1ZYbKpby01Z" + ]; - hashedPassword = "$y$j9T$5osXVNxCDxu3jIndcyh7G.$UrjiDRpMu3W59tKHLGNdLWllZh.4p8IM4sBS5SrNrN1"; + stateVersion = "24.11"; - stateVersion = "23.11"; + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; - nixpkgs = { - version = "24.11"; - system = "nixos"; + admins = [ "ecoppens" ]; }; - adminGroups = [ "fai" ]; - }; + vault01 = { + site = "hyp01"; + deployment.targetHost = "vault01.hyp01.infra.dgnum.eu"; - web01 = { - site = "rat01"; + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJA6VA7LENvTRlKdcrqt8DxDOPvX3bg3Gjy9mNkdFEW" ]; - deployment.tags = [ "web" ]; + hashedPassword = "$y$j9T$5osXVNxCDxu3jIndcyh7G.$UrjiDRpMu3W59tKHLGNdLWllZh.4p8IM4sBS5SrNrN1"; - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPR+lewuJ/zhCyizJGJOH1UaAB699ItNKEaeuoK57LY5" ]; + stateVersion = "23.11"; - hashedPassword = "$y$j9T$9YqXO93VJE/GP3z8Sh4h51$hrBsEPL2O1eP/wBZTrNT8XV906V4JKbQ0g04IWBcyd2"; + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; - stateVersion = "23.05"; - vm-cluster = "Hyperviseur NPS"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; + adminGroups = [ "fai" ]; }; - }; - web02 = { - site = "rat01"; + web01 = { + site = "rat01"; - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID+QDE+GgZs6zONHvzRW15BzGJNW69k2BFZgB/Zh/tLX" ]; + deployment.tags = [ "web" ]; - hashedPassword = "$y$j9T$p42UVNy78PykkQOjPwXNJ/$B/zCUOrHXVSFGUY63wnViMiSmU2vCWsiX0y62qqgNQ5"; + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPR+lewuJ/zhCyizJGJOH1UaAB699ItNKEaeuoK57LY5" ]; - stateVersion = "24.05"; - vm-cluster = "Hyperviseur NPS"; + hashedPassword = "$y$j9T$9YqXO93VJE/GP3z8Sh4h51$hrBsEPL2O1eP/wBZTrNT8XV906V4JKbQ0g04IWBcyd2"; - nixpkgs = { - version = "24.11"; - system = "nixos"; + stateVersion = "23.05"; + vm-cluster = "Hyperviseur NPS"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; }; - }; - web03 = { - site = "rat01"; + web02 = { + site = "rat01"; - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrWsMEfK86iaO9SubMqE2UvZNtHkLY5VUod/bbqKC0L" ]; + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID+QDE+GgZs6zONHvzRW15BzGJNW69k2BFZgB/Zh/tLX" ]; - hashedPassword = "$y$j9T$Un/tcX5SPKNXG.sy/BcTa.$kyNHELjb1GAOWnauJfcjyVi5tacWcuEBKflZDCUC6x4"; + hashedPassword = "$y$j9T$p42UVNy78PykkQOjPwXNJ/$B/zCUOrHXVSFGUY63wnViMiSmU2vCWsiX0y62qqgNQ5"; - stateVersion = "24.05"; - vm-cluster = "Hyperviseur NPS"; + stateVersion = "24.05"; + vm-cluster = "Hyperviseur NPS"; - nixpkgs = { - version = "24.11"; - system = "nixos"; + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + }; + + web03 = { + site = "rat01"; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrWsMEfK86iaO9SubMqE2UvZNtHkLY5VUod/bbqKC0L" ]; + + hashedPassword = "$y$j9T$Un/tcX5SPKNXG.sy/BcTa.$kyNHELjb1GAOWnauJfcjyVi5tacWcuEBKflZDCUC6x4"; + + stateVersion = "24.05"; + vm-cluster = "Hyperviseur NPS"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; }; }; } diff --git a/meta/organization.nix b/meta/organization.nix index dcd3ddd..5636bec 100644 --- a/meta/organization.nix +++ b/meta/organization.nix @@ -13,164 +13,166 @@ */ { - members = { - agroudiev = { - name = "Antoine Groudiev"; - email = "antoine.groudiev@dgnum.eu"; - sshKeys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDgyt3ntpcoI/I2n97R1hzjBiNL6R98S73fSi7pkSE/8mQbI8r9GzsPUBcxQ+tIg0FgwkLxTwF8DwLf0E+Le/rPznxBS5LUQaAktSQSrxz/IIID1+jN8b03vf5PjfKS8H2Tu3Q8jZXa8HNsj3cpySpGMqGrE3ieUmknd/YfppRRf+wM4CsGKZeS3ZhB9oZi3Jn22A0U/17AOJTnv4seq+mRZWRQt3pvQvpp8/2M7kEqizie/gTr/DnwxUr45wisqYYH4tat9Cw6iDr7LK10VCrK37BfFagMIZ08Hkh3c46jghjYNQWe+mBUWJByWYhTJ0AtYrbaYeUV1HVYbsRJ6bNx25K6794QQPaE/vc2Z/VK/ILgvJ+9myFSAWVylCWdyYpwUu07RH/jDBl2aqH62ESwAG7SDUUcte6h9N+EryAQLWc8OhsGAYLpshhBpiqZwzX90m+nkbhx1SqMbtt6TS+RPDEHKFYn8E6FBrf1FK34482ndq/hHXZ88mqzGb1nOnM=" + organization = { + members = { + agroudiev = { + name = "Antoine Groudiev"; + email = "antoine.groudiev@dgnum.eu"; + sshKeys = [ + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDgyt3ntpcoI/I2n97R1hzjBiNL6R98S73fSi7pkSE/8mQbI8r9GzsPUBcxQ+tIg0FgwkLxTwF8DwLf0E+Le/rPznxBS5LUQaAktSQSrxz/IIID1+jN8b03vf5PjfKS8H2Tu3Q8jZXa8HNsj3cpySpGMqGrE3ieUmknd/YfppRRf+wM4CsGKZeS3ZhB9oZi3Jn22A0U/17AOJTnv4seq+mRZWRQt3pvQvpp8/2M7kEqizie/gTr/DnwxUr45wisqYYH4tat9Cw6iDr7LK10VCrK37BfFagMIZ08Hkh3c46jghjYNQWe+mBUWJByWYhTJ0AtYrbaYeUV1HVYbsRJ6bNx25K6794QQPaE/vc2Z/VK/ILgvJ+9myFSAWVylCWdyYpwUu07RH/jDBl2aqH62ESwAG7SDUUcte6h9N+EryAQLWc8OhsGAYLpshhBpiqZwzX90m+nkbhx1SqMbtt6TS+RPDEHKFYn8E6FBrf1FK34482ndq/hHXZ88mqzGb1nOnM=" + ]; + }; + + catvayor = { + name = "Lubin Bailly"; + email = "catvayor@dgnum.eu"; + username = "lbailly"; + sshKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA16foz+XzwKwyIR4wFgNIAE3Y7AfXyEsUZFVVz8Rie catvayor@katvayor" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFfIJ8BToZ9EDxBsEJXQhUju7gm+rUDjGCNMvFSZCl1o openpgp:0x5CADCA1B" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdOxx4I8BSbYPdouvuzDepwTwzQzGSBCNIV8TB5dduT openpgp:0xF6018131" + ]; + }; + + cst1 = { + name = "Constantin Gierczak--Galle"; + email = "cst1@dgnum.eu"; + username = "cgierczakgalle"; + sshKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrijwPlb7KQkYPLznMPVzPPT69cLzhEsJzZi9tmxzTh cst1@x270" + ]; + }; + + ecoppens = { + name = "Elias Coppens"; + email = "ecoppens@dgnum.eu"; + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGmU7yEOCGuGNt4PlQbzd0Cms1RePpo8yEA7Ij/+TdA" ]; + }; + + jemagius = { + name = "Jean-Marc Gailis"; + email = "jm@dgnum.eu"; + username = "jgailis"; + sshKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOoxmou5OU74GgpIUkhVt6GiB+O9Jy4ge0TwK5MDFJ2F" + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxQX0JLRah3GfIOkua4ZhEJhp5Ykv55RO0SPrSUwCBs5arnALg8gq12YLr09t4bzW/NA9/jn7flhh4S54l4RwBUhmV4JSQhGu71KGhfOj5ZBkDoSyYqzbu206DfZP5eQonSmjfP6XghcWOr/jlBzw9YAAQkFxsQgXEkr4kdn0ZXfZGz6b0t3YUjYIuDNbptFsGz2V9iQVy1vnxrjnLSfc25j4et8z729Vpy4M7oCaE6a6hgon4V1jhVbg43NAE5gu2eYFAPIzO3E7ZI8WjyLu1wtOBClk1f+HMen3Tr+SX2PXmpPGb+I2fAkbzu/C4X/M3+2bL1dYjxuvQhvvpAjxFwmdoXW4gWJ3J/FRiFrKsiAY0rYC+yi8SfacJWCv4EEcV/yQ4gYwpmU9xImLaro6w5cOHGCqrzYqjZc4Wi6AWFGeBSNzNs9PXLgMRWeUyiIDOFnSep2ebZeVjTB16m+o/YDEhE10uX9kCCx3Dy/41iJ1ps7V4JWGFsr0Fqaz8mu8=" + ]; + }; + + luj = { + name = "Julien Malka"; + email = "luj@dgnum.eu"; + username = "jmalka"; + sshKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMBW7rTtfZL9wtrpCVgariKdpN60/VeAzXkh9w3MwbO julien@enigma" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGa+7n7kNzb86pTqaMn554KiPrkHRGeTJ0asY1NjSbpr julien@tower" + ]; + }; + + mboyer = { + name = "Matthieu Boyer"; + email = "matthieu.boyer@dgnum.eu"; + username = "mboyer02"; + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGYnwZaFYvUxtJeNvpaA20rLfq8fOO4dFp7cIXsD8YNx" ]; + }; + + mdebray = { + name = "Maurice Debray"; + email = "maurice.debray@dgnum.eu"; + sshKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEpwF+XD3HgX64kqD42pcEZRNYAWoO4YNiOm5KO4tH6o maurice@polaris" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdDnSl3cyWil+S5JiyGqOvBR3wVh+lduw58S5WvraoL maurice@fekda" + ]; + }; + + raito = { + name = "Ryan Lahfa"; + email = "ryan@dgnum.eu"; + username = "rlahfa"; + sshKeys = [ + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcEkYM1r8QVNM/G5CxJInEdoBCWjEHHDdHlzDYNSUIdHHsn04QY+XI67AdMCm8w30GZnLUIj5RiJEWXREUApby0GrfxGGcy8otforygfgtmuUKAUEHdU2MMwrQI7RtTZ8oQ0USRGuqvmegxz3l5caVU7qGvBllJ4NUHXrkZSja2/51vq80RF4MKkDGiz7xUTixI2UcBwQBCA/kQedKV9G28EH+1XfvePqmMivZjl+7VyHsgUVj9eRGA1XWFw59UPZG8a7VkxO/Eb3K9NF297HUAcFMcbY6cPFi9AaBgu3VC4eetDnoN/+xT1owiHi7BReQhGAy/6cdf7C/my5ehZwD" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0xMwWedkKosax9+7D2OlnMxFL/eV4CvFZLsbLptpXr" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKiXXYkhRh+s7ixZ8rvG8ntIqd6FELQ9hh7HoaHQJRPU" + ]; + }; + + thubrecht = { + name = "Tom Hubrecht"; + email = "tom.hubrecht@dgnum.eu"; + sshKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+EZXYziiaynJX99EW8KesnmRTZMof3BoIs3mdEl8L3" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHL4M4HKjs4cjRAYRk9pmmI8U0R4+T/jQh6Fxp/i1Eoy" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPM1jpXR7BWQa7Sed7ii3SbvIPRRlKb3G91qC0vOwfJn" + ]; + }; + }; + + groups = { + # members of this group are root on all nodes + root = [ + "thubrecht" + "raito" + "mdebray" + ]; + + # members of this group are root on the fai infrastructure + fai = [ + "catvayor" + "ecoppens" + ]; + + lab = [ + "catvayor" + "cst1" + "ecoppens" + ]; + + hypervisors = [ + "catvayor" + "ecoppens" + ]; + + nix-builder = [ + "catvayor" + "ecoppens" + "mdebray" + "raito" + "thubrecht" ]; }; - catvayor = { - name = "Lubin Bailly"; - email = "catvayor@dgnum.eu"; - username = "lbailly"; - sshKeys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA16foz+XzwKwyIR4wFgNIAE3Y7AfXyEsUZFVVz8Rie catvayor@katvayor" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFfIJ8BToZ9EDxBsEJXQhUju7gm+rUDjGCNMvFSZCl1o openpgp:0x5CADCA1B" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdOxx4I8BSbYPdouvuzDepwTwzQzGSBCNIV8TB5dduT openpgp:0xF6018131" + external = { + dns = [ + "thubrecht" + "raito" ]; + + email = [ "raito" ]; + + irc = [ "raito" ]; }; - cst1 = { - name = "Constantin Gierczak--Galle"; - email = "cst1@dgnum.eu"; - username = "cgierczakgalle"; - sshKeys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrijwPlb7KQkYPLznMPVzPPT69cLzhEsJzZi9tmxzTh cst1@x270" + services = { + # Démarches Normaliennes + ds-fr.admins = [ + "thubrecht" + "jemagius" ]; - }; - ecoppens = { - name = "Elias Coppens"; - email = "ecoppens@dgnum.eu"; - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGmU7yEOCGuGNt4PlQbzd0Cms1RePpo8yEA7Ij/+TdA" ]; - }; - - jemagius = { - name = "Jean-Marc Gailis"; - email = "jm@dgnum.eu"; - username = "jgailis"; - sshKeys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOoxmou5OU74GgpIUkhVt6GiB+O9Jy4ge0TwK5MDFJ2F" - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxQX0JLRah3GfIOkua4ZhEJhp5Ykv55RO0SPrSUwCBs5arnALg8gq12YLr09t4bzW/NA9/jn7flhh4S54l4RwBUhmV4JSQhGu71KGhfOj5ZBkDoSyYqzbu206DfZP5eQonSmjfP6XghcWOr/jlBzw9YAAQkFxsQgXEkr4kdn0ZXfZGz6b0t3YUjYIuDNbptFsGz2V9iQVy1vnxrjnLSfc25j4et8z729Vpy4M7oCaE6a6hgon4V1jhVbg43NAE5gu2eYFAPIzO3E7ZI8WjyLu1wtOBClk1f+HMen3Tr+SX2PXmpPGb+I2fAkbzu/C4X/M3+2bL1dYjxuvQhvvpAjxFwmdoXW4gWJ3J/FRiFrKsiAY0rYC+yi8SfacJWCv4EEcV/yQ4gYwpmU9xImLaro6w5cOHGCqrzYqjZc4Wi6AWFGeBSNzNs9PXLgMRWeUyiIDOFnSep2ebZeVjTB16m+o/YDEhE10uX9kCCx3Dy/41iJ1ps7V4JWGFsr0Fqaz8mu8=" + # Cloud DGNum + nextcloud.admins = [ + "thubrecht" + "raito" ]; - }; - luj = { - name = "Julien Malka"; - email = "luj@dgnum.eu"; - username = "jmalka"; - sshKeys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMBW7rTtfZL9wtrpCVgariKdpN60/VeAzXkh9w3MwbO julien@enigma" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGa+7n7kNzb86pTqaMn554KiPrkHRGeTJ0asY1NjSbpr julien@tower" + # Netbox DGNum + netbox.adminGroups = [ + "root" + "fai" ]; + + # Videos DGNum + peertube.admins = [ "thubrecht" ]; }; - - mboyer = { - name = "Matthieu Boyer"; - email = "matthieu.boyer@dgnum.eu"; - username = "mboyer02"; - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGYnwZaFYvUxtJeNvpaA20rLfq8fOO4dFp7cIXsD8YNx" ]; - }; - - mdebray = { - name = "Maurice Debray"; - email = "maurice.debray@dgnum.eu"; - sshKeys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEpwF+XD3HgX64kqD42pcEZRNYAWoO4YNiOm5KO4tH6o maurice@polaris" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdDnSl3cyWil+S5JiyGqOvBR3wVh+lduw58S5WvraoL maurice@fekda" - ]; - }; - - raito = { - name = "Ryan Lahfa"; - email = "ryan@dgnum.eu"; - username = "rlahfa"; - sshKeys = [ - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcEkYM1r8QVNM/G5CxJInEdoBCWjEHHDdHlzDYNSUIdHHsn04QY+XI67AdMCm8w30GZnLUIj5RiJEWXREUApby0GrfxGGcy8otforygfgtmuUKAUEHdU2MMwrQI7RtTZ8oQ0USRGuqvmegxz3l5caVU7qGvBllJ4NUHXrkZSja2/51vq80RF4MKkDGiz7xUTixI2UcBwQBCA/kQedKV9G28EH+1XfvePqmMivZjl+7VyHsgUVj9eRGA1XWFw59UPZG8a7VkxO/Eb3K9NF297HUAcFMcbY6cPFi9AaBgu3VC4eetDnoN/+xT1owiHi7BReQhGAy/6cdf7C/my5ehZwD" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0xMwWedkKosax9+7D2OlnMxFL/eV4CvFZLsbLptpXr" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKiXXYkhRh+s7ixZ8rvG8ntIqd6FELQ9hh7HoaHQJRPU" - ]; - }; - - thubrecht = { - name = "Tom Hubrecht"; - email = "tom.hubrecht@dgnum.eu"; - sshKeys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+EZXYziiaynJX99EW8KesnmRTZMof3BoIs3mdEl8L3" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHL4M4HKjs4cjRAYRk9pmmI8U0R4+T/jQh6Fxp/i1Eoy" - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPM1jpXR7BWQa7Sed7ii3SbvIPRRlKb3G91qC0vOwfJn" - ]; - }; - }; - - groups = { - # members of this group are root on all nodes - root = [ - "thubrecht" - "raito" - "mdebray" - ]; - - # members of this group are root on the fai infrastructure - fai = [ - "catvayor" - "ecoppens" - ]; - - lab = [ - "catvayor" - "cst1" - "ecoppens" - ]; - - hypervisors = [ - "catvayor" - "ecoppens" - ]; - - nix-builder = [ - "catvayor" - "ecoppens" - "mdebray" - "raito" - "thubrecht" - ]; - }; - - external = { - dns = [ - "thubrecht" - "raito" - ]; - - email = [ "raito" ]; - - irc = [ "raito" ]; - }; - - services = { - # Démarches Normaliennes - ds-fr.admins = [ - "thubrecht" - "jemagius" - ]; - - # Cloud DGNum - nextcloud.admins = [ - "thubrecht" - "raito" - ]; - - # Netbox DGNum - netbox.adminGroups = [ - "root" - "fai" - ]; - - # Videos DGNum - peertube.admins = [ "thubrecht" ]; }; } diff --git a/meta/verify.nix b/meta/verify.nix index 2465fac..be168d8 100644 --- a/meta/verify.nix +++ b/meta/verify.nix @@ -6,8 +6,8 @@ # Nix expression to check if meta module is evaluating correctly. # To do so run `nix-build ./verify.nix` let - sources = import ../npins; - pkgs = import sources.nixos-unstable { }; + sources = import ../sources.nix; + pkgs = sources.bootstrapNixpkgs; dns = import sources."dns.nix" { inherit pkgs; }; in diff --git a/modules/nixos/dgn-access-control.nix b/modules/nixos/dgn-access-control.nix index 7fed596..b75a6f4 100644 --- a/modules/nixos/dgn-access-control.nix +++ b/modules/nixos/dgn-access-control.nix @@ -5,12 +5,11 @@ { config, lib, + name, dgn-keys, - meta, nodeMeta, ... }: - let inherit (lib) mkDefault @@ -22,11 +21,6 @@ let types ; - admins = - meta.organization.groups.root - ++ nodeMeta.admins - ++ (builtins.concatMap (g: meta.organization.groups.${g}) nodeMeta.adminGroups); - cfg = config.dgn-access-control; in @@ -53,7 +47,7 @@ in config = mkIf cfg.enable { # Admins have root access to the node - dgn-access-control.users.root = mkDefault admins; + dgn-access-control.users.root = mkDefault (dgn-keys.getNodeAdmins name); users.mutableUsers = false; users.users = builtins.mapAttrs ( username: members: diff --git a/modules/nixos/dgn-backups/keys/secrets.nix b/modules/nixos/dgn-backups/keys/secrets.nix index 64f7d42..be205c4 100644 --- a/modules/nixos/dgn-backups/keys/secrets.nix +++ b/modules/nixos/dgn-backups/keys/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ ] [ "compute01.key" diff --git a/modules/nixos/dgn-netbox-agent/secrets/secrets.nix b/modules/nixos/dgn-netbox-agent/secrets/secrets.nix index 66795ca..92ad6c7 100644 --- a/modules/nixos/dgn-netbox-agent/secrets/secrets.nix +++ b/modules/nixos/dgn-netbox-agent/secrets/secrets.nix @@ -2,4 +2,4 @@ # # SPDX-License-Identifier: EUPL-1.2 -{ netbox-agent.publicKeys = (import ../../../../keys).machineKeysBySystem "nixos"; } +{ netbox-agent.publicKeys = (import ../../../../keys.nix).machineKeysBySystem "nixos"; } diff --git a/modules/nixos/dgn-notify/secrets.nix b/modules/nixos/dgn-notify/secrets.nix index 95f7177..92144a7 100644 --- a/modules/nixos/dgn-notify/secrets.nix +++ b/modules/nixos/dgn-notify/secrets.nix @@ -2,4 +2,4 @@ # # SPDX-License-Identifier: EUPL-1.2 -{ mail.publicKeys = (import ../../../keys).machineKeysBySystem "nixos"; } +{ mail.publicKeys = (import ../../../keys.nix).machineKeysBySystem "nixos"; } diff --git a/modules/nixos/dgn-records/secrets.nix b/modules/nixos/dgn-records/secrets.nix index 13a6afd..33eb72c 100644 --- a/modules/nixos/dgn-records/secrets.nix +++ b/modules/nixos/dgn-records/secrets.nix @@ -2,4 +2,4 @@ # # SPDX-License-Identifier: EUPL-1.2 -{ __arkheon-token_file.publicKeys = (import ../../../keys).machineKeysBySystem "nixos"; } +{ __arkheon-token_file.publicKeys = (import ../../../keys.nix).machineKeysBySystem "nixos"; } diff --git a/modules/nixos/dgn-s3/secrets.nix b/modules/nixos/dgn-s3/secrets.nix index 6d17c51..a4dc481 100644 --- a/modules/nixos/dgn-s3/secrets.nix +++ b/modules/nixos/dgn-s3/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../keys).mkSecrets +(import ../../../keys.nix).mkSecrets [ "storage01" "tower01" diff --git a/sources.nix b/sources.nix new file mode 100644 index 0000000..1ea96f7 --- /dev/null +++ b/sources.nix @@ -0,0 +1,23 @@ +# SPDX-FileCopyrightText: 2024 Ryan Lahfa +# SPDX-FileCopyrightText: 2024 Tom Hubrecht +# SPDX-FileContributor: Maurice Debray +# +# SPDX-License-Identifier: EUPL-1.2 + +let + sources' = import ./npins; + + bootstrapNixpkgs = import sources'.nixos-unstable { }; + + patch = (import ./lib/nix-patches { patchFile = ./patches; }).base { + pkgs = bootstrapNixpkgs; + }; + + sources = builtins.mapAttrs ( + k: src: + patch.applyPatches { + inherit src; + name = k; + } + ) sources'; +in sources // { bootstrapNixpkgs = bootstrapNixpkgs; unpatchedSources = sources; } diff --git a/workflows/eval-nodes.nix b/workflows/eval-nodes.nix index d7f919f..4a591e1 100644 --- a/workflows/eval-nodes.nix +++ b/workflows/eval-nodes.nix @@ -7,7 +7,7 @@ let inherit (lib) attrNames genAttrs; - nodes = attrNames (import ../meta/nodes); + nodes = attrNames (import ../meta lib).nodes; in {