DGNum/infrastructure
11
6
Fork 2
Code Issues 20 Pull requests 14 Projects 1 Releases Packages Wiki Activity Actions

chore: Refactor meta to a module architecture

Browse source 
Get rid of the weird half nix half module stuff.
This commit is contained in:
sinavir 2025-01-08 19:58:17 +01:00
parent 84b2a7df08
commit 9673287fb9
No known key found for this signature in database
39 changed files with 842 additions and 790 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -98,7 +98,7 @@ The general metadata is declared in `meta/nodes.nix`, the main values to declare
Create the directory `secrets` in the configuration folder, and add a `secrets.nix` file containing : Create the directory `secrets` in the configuration folder, and add a `secrets.nix` file containing :
```nix ```nix
(import ../../../keys).mkSecrets [ "host02" ] [ (import ../../../keys.nix).mkSecrets [ "host02" ] [
# List of secrets for host02 # List of secrets for host02
] ]
``` ```

4
default.nix
View file

@ -4,8 +4,8 @@
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ {
sources ? import ./npins, sources ? import ./sources.nix,
pkgs ? import sources.nixos-unstable { }, pkgs ? sources.bootstrapNixpkgs,
}: }:
let let

88
hive.nix
View file

@ -4,45 +4,33 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
# TODO: change comments to ### \n # [text] \n #
let let
sources' = import ./npins; ### Init some tooling
# Patch sources directly sources = import ./sources.nix;
sources =
builtins.mapAttrs (patch.base { pkgs = import sources'.nixos-unstable { }; }).applyPatches' inherit (sources) bootstrapNixpkgs;
sources';
lib = bootstrapNixpkgs.lib.extend (_: _: {
extra = import ./lib/nix-lib;
});
nix-lib = lib.extra; # TODO: Assess perf penalty of fixed point
# TODO same but using bootstrapnixpkgs for nix-lib instanciation
# original statement: import ./lib/nix-lib;
nix-lib = import ./lib/nix-lib;
inherit (nix-lib) mapSingleFuse; inherit (nix-lib) mapSingleFuse;
patch = import ./lib/nix-patches { patchFile = ./patches; }; ### Let's build meta
metadata = (import ./meta) lib;
nodes' = import ./meta/nodes; nodes = builtins.attrNames metadata.nodes;
nodes = builtins.attrNames nodes';
mkNode = node: { ### Nixpkgs instanciation
deployment.systemType = system node;
};
nixpkgs' = import ./meta/nixpkgs.nix; nixpkgs' = import ./meta/nixpkgs.nix;
# All supported nixpkgs versions × systems, instanciated
nixpkgs = mapSingleFuse (s: mapSingleFuse (mkSystemNixpkgs s) nixpkgs'.versions) nixpkgs'.systems;
# Get the configured nixos version for the node,
# defaulting to the one defined in meta/nixpkgs
version = node: nodes'.${node}.nixpkgs.version;
system = node: nodes'.${node}.nixpkgs.system;
category = node: nixpkgs'.categories.${system node};
nodePkgs = node: nixpkgs.${system node}.${version node};
# Builds a patched version of nixpkgs, only as the source
mkNixpkgs' =
v:
patch.mkNixpkgsSrc rec {
src = sources'.${name};
name = "nixos-${v}";
};
# Build up the nixpkgs configuration for Liminix embedded systems # Build up the nixpkgs configuration for Liminix embedded systems
mkLiminixConfig = mkLiminixConfig =
@ -58,21 +46,35 @@ let
}; };
}; };
# Build up the arguments to instantiate a nixpkgs given a system and a version. # Build up the arguments to instantiate a nixpkgs given a system and a version.
mkNixpkgsConfig = mkNixpkgsConfig =
system: system:
{ {
nixos = _: { }; nixos = _: { }; # TODO: add nix-pkgs overlay here
zyxel-nwa50ax = mkLiminixConfig system; zyxel-nwa50ax = mkLiminixConfig system;
netconf = _: { }; netconf = _: { };
} }
.${system} or (throw "Unknown system: ${system} for nixpkgs configuration instantiation"); .${system} or (throw "Unknown system: ${system} for nixpkgs configuration instantiation");
# Instanciates the required nixpkgs version # Instanciates the required nixpkgs version
mkSystemNixpkgs = system: version: import (mkNixpkgs' version) (mkNixpkgsConfig system version); mkSystemNixpkgs = system: version:
import sources."nixos-${version}" (mkNixpkgsConfig system version);
### # All supported nixpkgs versions × systems, instanciated
# Function to create arguments based on the node nixpkgs = mapSingleFuse (s: mapSingleFuse (mkSystemNixpkgs s) nixpkgs'.versions) nixpkgs'.systems;
# Get the configured nixos version for the node,
# defaulting to the one defined in meta/nixpkgs
version = node: metadata.nodes.${node}.nixpkgs.version;
system = node: metadata.nodes.${node}.nixpkgs.system;
category = node: nixpkgs'.categories.${system node};
nodePkgs = node: nixpkgs.${system node}.${version node};
##########
# Function to create arguments based on the node
# #
mkArgs = node: rec { mkArgs = node: rec {
lib = sourcePkgs.lib // { lib = sourcePkgs.lib // {
@ -80,11 +82,19 @@ let
}; };
sourcePkgs = nodePkgs node; sourcePkgs = nodePkgs node;
meta = (import ./meta) lib; meta = metadata;
nodeMeta = meta.nodes.${node}; nodeMeta = metadata.nodes.${node};
nodePath = "machines/${category node}/${node}"; nodePath = "machines/${category node}/${node}";
}; };
##########
# Module for each node (quite empty since almost everything is in the default module)
#
mkNode = node: {
deployment.systemType = system node;
};
in in
{ {
@ -95,7 +105,10 @@ in
specialArgs = { specialArgs = {
inherit nixpkgs sources; inherit nixpkgs sources;
dgn-keys = import ./keys; dgn-keys = import ./lib/keys {
meta = metadata;
inherit lib;
};
}; };
nodeSpecialArgs = mapSingleFuse mkArgs nodes; nodeSpecialArgs = mapSingleFuse mkArgs nodes;
@ -219,5 +232,6 @@ in
}; };
}; };
}; };
} }
// (mapSingleFuse mkNode nodes) // (mapSingleFuse mkNode nodes)

4
iso/configuration.nix
View file

@ -5,9 +5,9 @@
{ lib, pkgs, ... }: { lib, pkgs, ... }:
let let
dgn-keys = import ../keys; dgn-keys = import ../keys.nix;
dgn-members = (import ../meta lib).organization.groups.root; dgn-members = (import ../meta lib).config.organization.groups.root;
in in
{ {

13
keys.nix Normal file
View file

@ -0,0 +1,13 @@
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
let
_sources = import ../npins;
inherit (import _sources.nixpkgs { }) lib;
meta = (import ../meta lib).config;
in
import ./lib/keys { inherit meta lib; }

38
keys/default.nix → lib/keys/default.nix
View file

@ -1,20 +1,15 @@
# SPDX-FileCopyrightText: 2024 Ryan Lahfa <ryan.lahfa@dgnum.eu>
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu> # SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
# SPDX-FileContributor: Maurice Debray <maurice.debray@dgnum.eu>
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ meta, lib }:
let let
_sources = import ../npins; inherit (import ../nix-lib) setDefault unique;
inherit (import _sources.nixos-unstable { }) lib;
meta = import ../meta lib;
inherit (import ../lib/nix-lib) setDefault unique;
getAttr = lib.flip builtins.getAttr; getAttr = lib.flip builtins.getAttr;
in in
rec { rec {
_memberKeys = builtins.mapAttrs (_: v: v.sshKeys) meta.organization.members; _memberKeys = builtins.mapAttrs (_: v: v.sshKeys) meta.organization.members;
_nodeKeys = builtins.mapAttrs (_: v: v.sshKeys) meta.nodes; _nodeKeys = builtins.mapAttrs (_: v: v.sshKeys) meta.nodes;
@ -28,22 +23,25 @@ rec {
# List of keys for the root group # List of keys for the root group
rootKeys = getMemberKeys meta.organization.groups.root; rootKeys = getMemberKeys meta.organization.groups.root;
# All keys that can access a node # All admins for a node
getNodeKeys' = getNodeAdmins =
node: node:
let meta.organization.groups.root
names = [ node ] ++ ++ meta.nodes.${node}.admins
meta.nodes.${node}.admins ++ (builtins.concatMap (g: meta.organization.groups.${g}) meta.nodes.${node}.adminGroups);
++ (builtins.concatMap (g: meta.organization.groups.${g}) meta.nodes.${node}.adminGroups);
in # All keys needed for secret encryption
unique (getMemberKeys names ++ getNodeKeys [ node ]); getSecretKeys = node: unique (getMemberKeys (getNodeAdmins node) ++ getNodeKeys [ node ]);
# List of keys for all machines wide secrets # List of keys for all machines wide secrets
machineKeys = rootKeys ++ (getNodeKeys (builtins.attrNames meta.nodes)); machineKeys = rootKeys ++ (getNodeKeys (builtins.attrNames meta.nodes));
mkSecrets = nodes: setDefault { publicKeys = unique (builtins.concatMap getNodeKeys' nodes); }; mkSecrets = nodes: setDefault { publicKeys = unique (builtins.concatMap getSecretKeys nodes); };
machineKeysBySystem = system: machineKeysBySystem =
system:
rootKeys rootKeys
++ (getNodeKeys (builtins.attrNames (lib.filterAttrs (_: v: v.nixpkgs.system == system) meta.nodes))); ++ (getNodeKeys (
builtins.attrNames (lib.filterAttrs (_: v: v.nixpkgs.system == system) meta.nodes)
));
} }

2
machines/nixos/bridge01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "bridge01" ] [ "bridge01" ]
[ [
# List of secrets for bridge01 # List of secrets for bridge01

2
machines/nixos/build01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "build01" ] [ "build01" ]
[ [
"forgejo_runners-token_file" "forgejo_runners-token_file"

4
machines/nixos/compute01/extranix/default.nix
View file

@ -5,6 +5,7 @@
{ {
lib, lib,
sources, sources,
dgn-keys,
... ...
}: }:
let let
@ -68,6 +69,9 @@ in
meta = { meta = {
organization.groups.root = [ ]; organization.groups.root = [ ];
}; };
dgn-keys = dgn-keys // {
getNodeAdmins = _: [ ];
};
}; };
path-translations = [ path-translations = [
{ {

2
machines/nixos/compute01/kanidm/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../../keys).mkSecrets (import ../../../../../keys.nix).mkSecrets
[ "compute01" ] [ "compute01" ]
[ [
"kanidm-password_admin" "kanidm-password_admin"

2
machines/nixos/compute01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "compute01" ] [ "compute01" ]
[ [
# List of secrets for compute01 # List of secrets for compute01

2
machines/nixos/geo01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "geo01" ] [ "geo01" ]
[ [
# List of secrets for geo01 # List of secrets for geo01

2
machines/nixos/geo02/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "geo02" ] [ "geo02" ]
[ [
# List of secrets for geo02 # List of secrets for geo02

2
machines/nixos/hypervisor01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifer: EUPL-1.2 # SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "hypervisor01" ] [ "hypervisor01" ]
[ [

2
machines/nixos/hypervisor02/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifer: EUPL-1.2 # SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "hypervisor02" ] [ "hypervisor02" ]
[ [

2
machines/nixos/hypervisor03/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifer: EUPL-1.2 # SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "hypervisor03" ] [ "hypervisor03" ]
[ [

2
machines/nixos/rescue01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "rescue01" ] [ "rescue01" ]
[ [
# List of secrets for rescue01 # List of secrets for rescue01

2
machines/nixos/storage01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "storage01" ] [ "storage01" ]
[ [
# List of secrets for storage01 # List of secrets for storage01

3
machines/nixos/tower01/secrets/secrets.nix
View file

@ -2,7 +2,8 @@
# #
# SPDX-License-Identifer: EUPL-1.2 # SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "tower01" ] [ "tower01" ]
[ [
] ]

2
machines/nixos/vault01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "vault01" ] [ "vault01" ]
[ [
# List of secrets for vault01 # List of secrets for vault01

2
machines/nixos/web01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "web01" ] [ "web01" ]
[ [
# List of secrets for web01 # List of secrets for web01

2
machines/nixos/web02/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "web02" ] [ "web02" ]
[ [
# List of secrets for web02 # List of secrets for web02

2
machines/nixos/web03/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "web03" ] [ "web03" ]
[ [
# List of secrets for web03 # List of secrets for web03

8
meta/default.nix
View file

@ -12,11 +12,9 @@ lib:
(lib.evalModules { (lib.evalModules {
modules = [ modules = [
./options.nix ./options.nix
{ ./network.nix
network = import ./network.nix; ./nodes
nodes = import ./nodes; ./organization.nix
organization = import ./organization.nix;
}
]; ];
class = "dgnumMeta"; class = "dgnumMeta";
}).config }).config

488
meta/network.nix
View file

@ -6,304 +6,306 @@
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ {
bridge01 = { network = {
hostId = "f57f3ba0"; bridge01 = {
hostId = "f57f3ba0";
interfaces = { }; interfaces = { };
netbirdIp = null; netbirdIp = null;
};
build01 = {
interfaces = {
enp35s0f0np0 = {
ipv4 = [
{
address = "10.0.254.21";
prefixLength = 24;
}
];
gateways = [ "10.0.254.1" ];
enableDefaultDNS = true;
};
}; };
hostId = "adb676ce"; build01 = {
netbirdIp = "100.80.31.249"; interfaces = {
}; enp35s0f0np0 = {
ipv4 = [
{
address = "10.0.254.21";
prefixLength = 24;
}
];
compute01 = { gateways = [ "10.0.254.1" ];
interfaces = { enableDefaultDNS = true;
eno1 = { };
ipv4 = [
{
address = "129.199.146.147";
prefixLength = 24;
}
{
address = "192.168.1.147";
prefixLength = 24;
}
];
gateways = [ "129.199.146.254" ];
enableDefaultDNS = true;
}; };
hostId = "adb676ce";
netbirdIp = "100.80.31.249";
}; };
hostId = "8df60941"; compute01 = {
netbirdIp = "100.80.75.197"; interfaces = {
}; eno1 = {
ipv4 = [
{
address = "129.199.146.147";
prefixLength = 24;
}
{
address = "192.168.1.147";
prefixLength = 24;
}
];
geo01 = { gateways = [ "129.199.146.254" ];
interfaces = { enableDefaultDNS = true;
eno1 = { };
ipv4 = [
{
address = "129.199.210.194";
prefixLength = 24;
}
];
gateways = [ "129.199.210.254" ];
dns = [
"129.199.96.11"
"129.199.72.99"
];
}; };
hostId = "8df60941";
netbirdIp = "100.80.75.197";
}; };
hostId = "b88fee0c"; geo01 = {
netbirdIp = "100.80.8.66"; interfaces = {
}; eno1 = {
ipv4 = [
{
address = "129.199.210.194";
prefixLength = 24;
}
];
geo02 = { gateways = [ "129.199.210.254" ];
interfaces = {
eno1 = {
ipv4 = [
{
address = "129.199.210.69";
prefixLength = 24;
}
];
gateways = [ "129.199.210.254" ]; dns = [
"129.199.96.11"
dns = [ "129.199.72.99"
"129.199.96.11" ];
"129.199.72.99" };
];
}; };
hostId = "b88fee0c";
netbirdIp = "100.80.8.66";
}; };
hostId = "45d65237"; geo02 = {
netbirdIp = "100.80.233.249"; interfaces = {
}; eno1 = {
ipv4 = [
{
address = "129.199.210.69";
prefixLength = 24;
}
];
hypervisor01 = { gateways = [ "129.199.210.254" ];
interfaces = {
eno4 = {
ipv4 = [
{
address = "10.0.254.11";
prefixLength = 24;
}
];
gateways = [ "10.0.254.1" ]; dns = [
enableDefaultDNS = true; "129.199.96.11"
"129.199.72.99"
];
};
}; };
hostId = "45d65237";
netbirdIp = "100.80.233.249";
}; };
hostId = "4dbbd76a"; hypervisor01 = {
netbirdIp = "100.80.242.115"; interfaces = {
}; eno4 = {
ipv4 = [
{
address = "10.0.254.11";
prefixLength = 24;
}
];
hypervisor02 = { gateways = [ "10.0.254.1" ];
interfaces = { enableDefaultDNS = true;
eno4 = { };
ipv4 = [
{
address = "10.0.254.12";
prefixLength = 24;
}
];
gateways = [ "10.0.254.1" ];
enableDefaultDNS = true;
}; };
hostId = "4dbbd76a";
netbirdIp = "100.80.242.115";
}; };
hostId = "d0b48483"; hypervisor02 = {
netbirdIp = "100.80.37.202"; interfaces = {
}; eno4 = {
ipv4 = [
{
address = "10.0.254.12";
prefixLength = 24;
}
];
hypervisor03 = { gateways = [ "10.0.254.1" ];
interfaces = { enableDefaultDNS = true;
eno4 = { };
ipv4 = [
{
address = "10.0.254.13";
prefixLength = 24;
}
];
gateways = [ "10.0.254.1" ];
enableDefaultDNS = true;
}; };
hostId = "d0b48483";
netbirdIp = "100.80.37.202";
}; };
hostId = "1c407ea8"; hypervisor03 = {
netbirdIp = "100.80.58.178"; interfaces = {
}; eno4 = {
ipv4 = [
{
address = "10.0.254.13";
prefixLength = 24;
}
];
rescue01 = { gateways = [ "10.0.254.1" ];
interfaces = { enableDefaultDNS = true;
ens18 = { };
ipv6 = [
{
address = "2a01:e0a:de4:a0e1:2d73:2a7e:18db:5728";
prefixLength = 64;
}
];
ipv4 = [
{
address = "192.168.0.232";
prefixLength = 21;
}
];
gateways = [ "192.168.0.1" ];
enableDefaultDNS = true;
}; };
hostId = "1c407ea8";
netbirdIp = "100.80.58.178";
}; };
addresses.ipv4 = [ "82.67.34.230" ]; rescue01 = {
interfaces = {
ens18 = {
ipv6 = [
{
address = "2a01:e0a:de4:a0e1:2d73:2a7e:18db:5728";
prefixLength = 64;
}
];
hostId = "007f0200"; ipv4 = [
netbirdIp = "100.80.97.140"; {
}; address = "192.168.0.232";
prefixLength = 21;
storage01 = { }
interfaces = { ];
eno1 = { gateways = [ "192.168.0.1" ];
ipv4 = [ enableDefaultDNS = true;
{ };
address = "129.199.146.148";
prefixLength = 24;
}
{
address = "192.168.1.148";
prefixLength = 24;
}
];
gateways = [ "129.199.146.254" ];
enableDefaultDNS = true;
}; };
addresses.ipv4 = [ "82.67.34.230" ];
hostId = "007f0200";
netbirdIp = "100.80.97.140";
}; };
hostId = "d4e7c369"; storage01 = {
netbirdIp = "100.80.156.154"; interfaces = {
}; eno1 = {
ipv4 = [
{
address = "129.199.146.148";
prefixLength = 24;
}
{
address = "192.168.1.148";
prefixLength = 24;
}
];
tower01 = { gateways = [ "129.199.146.254" ];
interfaces = { enableDefaultDNS = true;
eno2 = { };
ipv4 = [
{
address = "129.199.210.119";
prefixLength = 24;
}
];
gateways = [ "129.199.210.254" ];
dns = [
"129.199.96.11"
"129.199.72.99"
];
}; };
hostId = "d4e7c369";
netbirdIp = "100.80.156.154";
}; };
hostId = "7874d06e"; tower01 = {
netbirdIp = "100.80.185.124"; interfaces = {
}; eno2 = {
ipv4 = [
{
address = "129.199.210.119";
prefixLength = 24;
}
];
vault01 = { gateways = [ "129.199.210.254" ];
interfaces = {
vlan-uplink-cri = { dns = [
ipv4 = [ "129.199.96.11"
{ "129.199.72.99"
# see also machines/vault01/networking.nix ];
address = "129.199.195.129"; };
prefixLength = 32;
}
];
gateways = [ ];
enableDefaultDNS = true;
}; };
hostId = "7874d06e";
netbirdIp = "100.80.185.124";
}; };
hostId = "e83b600d"; vault01 = {
netbirdIp = "100.80.255.180"; interfaces = {
}; vlan-uplink-cri = {
ipv4 = [
web01 = { {
interfaces = { # see also machines/vault01/networking.nix
ens3 = { address = "129.199.195.129";
ipv4 = [ prefixLength = 32;
{ }
address = "129.199.129.53"; ];
prefixLength = 24; gateways = [ ];
} enableDefaultDNS = true;
]; };
gateways = [ "129.199.129.1" ];
enableDefaultDNS = true;
}; };
hostId = "e83b600d";
netbirdIp = "100.80.255.180";
}; };
hostId = "050df79e"; web01 = {
netbirdIp = "100.80.77.90"; interfaces = {
}; ens3 = {
ipv4 = [
{
address = "129.199.129.53";
prefixLength = 24;
}
];
web02 = { gateways = [ "129.199.129.1" ];
interfaces = { enableDefaultDNS = true;
ens3 = { };
ipv4 = [
{
address = "129.199.129.235";
prefixLength = 24;
}
];
gateways = [ "129.199.129.1" ];
enableDefaultDNS = true;
}; };
hostId = "050df79e";
netbirdIp = "100.80.77.90";
}; };
hostId = "b431ca10"; web02 = {
netbirdIp = null; # web02 is not to be connected on the VPN interfaces = {
}; ens3 = {
ipv4 = [
{
address = "129.199.129.235";
prefixLength = 24;
}
];
web03 = { gateways = [ "129.199.129.1" ];
interfaces = { enableDefaultDNS = true;
enp1s0 = { };
ipv4 = [
{
address = "129.199.129.223";
prefixLength = 24;
}
];
gateways = [ "129.199.129.1" ];
enableDefaultDNS = true;
}; };
hostId = "b431ca10";
netbirdIp = null; # web02 is not to be connected on the VPN
}; };
hostId = "8afc7749"; web03 = {
netbirdIp = "100.80.157.46"; interfaces = {
enp1s0 = {
ipv4 = [
{
address = "129.199.129.223";
prefixLength = 24;
}
];
gateways = [ "129.199.129.1" ];
enableDefaultDNS = true;
};
};
hostId = "8afc7749";
netbirdIp = "100.80.157.46";
};
}; };
} }

13
meta/nodes/default.nix
View file

@ -2,9 +2,10 @@
# SPDX-FileContributor: Ryan Lahfa <ryan.lahfa@dgnum.eu> # SPDX-FileContributor: Ryan Lahfa <ryan.lahfa@dgnum.eu>
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{
builtins.foldl' (nodes: path: nodes // import path) { } [ imports = [
./liminix.nix ./liminix.nix
./nixos.nix ./nixos.nix
./netconf.nix ./netconf.nix
] ];
}

18
meta/nodes/liminix.nix
View file

@ -16,17 +16,19 @@
# } # }
{ {
ap01 = { nodes = {
site = "unknown"; ap01 = {
adminGroups = [ "fai" ]; site = "unknown";
adminGroups = [ "fai" ];
hashedPassword = "$y$j9T$DMOQEWOYFHjNS0myrXp4x/$MG33VSdXGvib.99eN.AbvyVdNNJw4ERjAwK4.ULJe/A"; hashedPassword = "$y$j9T$DMOQEWOYFHjNS0myrXp4x/$MG33VSdXGvib.99eN.AbvyVdNNJw4ERjAwK4.ULJe/A";
stateVersion = null; stateVersion = null;
nixpkgs = { nixpkgs = {
system = "zyxel-nwa50ax"; system = "zyxel-nwa50ax";
version = "24.05"; version = "24.05";
};
}; };
}; };
} }

78
meta/nodes/netconf.nix
View file

@ -2,48 +2,50 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ {
netcore02 = { nodes = {
site = "hyp01"; netcore02 = {
site = "hyp01";
hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0"; hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0";
stateVersion = null; stateVersion = null;
adminGroups = [ "fai" ]; adminGroups = [ "fai" ];
deployment = { deployment = {
targetHost = "fd26:baf9:d250:8000::1001"; targetHost = "fd26:baf9:d250:8000::1001";
sshOptions = [ sshOptions = [
"-J" "-J"
"root@vault01.hyp01.infra.dgnum.eu" "root@vault01.hyp01.infra.dgnum.eu"
]; ];
}; };
nixpkgs = { nixpkgs = {
version = "24.05"; # FIXME: meaningless version = "24.05"; # FIXME: meaningless
system = "netconf"; system = "netconf";
};
}; };
# netaccess01 = {
# site = "hyp02";
#
# hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0";
#
# stateVersion = null;
#
# adminGroups = [ "fai" ];
#
# deployment = {
# targetHost = "fd26:baf9:d250:8000::2001";
# sshOptions = [
# "-J"
# "root@vault01.hyp01.infra.dgnum.eu"
# ];
# };
#
# nixpkgs = {
# version = "24.05"; # FIXME: meaningless
# system = "netconf";
# };
# };
}; };
# netaccess01 = {
# site = "hyp02";
#
# hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0";
#
# stateVersion = null;
#
# adminGroups = [ "fai" ];
#
# deployment = {
# targetHost = "fd26:baf9:d250:8000::2001";
# sshOptions = [
# "-J"
# "root@vault01.hyp01.infra.dgnum.eu"
# ];
# };
#
# nixpkgs = {
# version = "24.05"; # FIXME: meaningless
# system = "netconf";
# };
# };
} }

496
meta/nodes/nixos.nix
View file

@ -26,295 +26,293 @@
- luj01 -> VM de Luj - luj01 -> VM de Luj
*/ */
{ {
bridge01 = { nodes = {
site = "hyp01"; bridge01 = {
site = "hyp01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5bS3iBXz8wycBnTvI5Qi79WLu0h4IVv/EOdKYbP5y7" ]; sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5bS3iBXz8wycBnTvI5Qi79WLu0h4IVv/EOdKYbP5y7" ];
hashedPassword = "$y$j9T$EPJdz70kselouXAVUmAH01$8nYbUBY9NPTMfYigegY0qFSdxJwhqzW8sFacDqEYCP5"; hashedPassword = "$y$j9T$EPJdz70kselouXAVUmAH01$8nYbUBY9NPTMfYigegY0qFSdxJwhqzW8sFacDqEYCP5";
stateVersion = "24.05"; stateVersion = "24.05";
adminGroups = [ "fai" ]; adminGroups = [ "fai" ];
deployment = { deployment = {
targetHost = "fd26:baf9:d250:8000::ffff"; targetHost = "fd26:baf9:d250:8000::ffff";
sshOptions = [ sshOptions = [
"-J" "-J"
"root@vault01.hyp01.infra.dgnum.eu" "root@vault01.hyp01.infra.dgnum.eu"
];
};
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
build01 = {
site = "pot01";
hashedPassword = "$y$j9T$n83qOn1OkQhFwQe50tPM11$jZ1tvgqMTcp4HLGEfJmTMsf0NnRUYQkzco9vibWTpU2";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYJcEMQpOyKInqtd2/brnSQuzwgv6fNPlTSQx9tcvPu" ];
stateVersion = "24.11";
nixpkgs = {
version = "24.11";
system = "nixos";
};
admins = [ "ecoppens" ];
deployment = {
targetHost = "build01.dgnum";
};
};
compute01 = {
site = "pav01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/YluSVS+4h3oV8CIUj0OmquyJXju8aEQy0Jz210vTu" ];
hashedPassword = "$y$j9T$2nxZHq84G7fWvWMEaGavE/$0ADnmD9qMpXJJ.rWWH9086EakvZ3wAg0mSxZYugOf3C";
stateVersion = "23.05";
nix-modules = [ "services/stirling-pdf" ];
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
geo01 = {
site = "oik01";
deployment.tags = [ "geo" ];
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEl6Pubbau+usQkemymoSKrTBbrX8JU5m5qpZbhNx8p4" ];
hashedPassword = "$y$j9T$2XmDpJu.QLhV57yYCh5Lf1$LK.X0HKB02Q0Ujvhj5nIofW2IRrIAL/Uxnvl9AXM1L8";
deployment.targetHost = "geo01.dgnum";
stateVersion = "24.05";
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
geo02 = {
site = "oik01";
deployment.tags = [ "geo" ];
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNXaCS0/Nsu5npqQk1TP6wMHCVIOaj4pblp2tIg6Ket" ];
hashedPassword = "$y$j9T$Q4fbMpSm9beWu4DPNAR9t0$dx/1pH4GPY72LpS5ZiECXAZFDdxwmIywztsX.qo2VVA";
deployment.targetHost = "geo02.dgnum";
stateVersion = "24.05";
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
hypervisor01 = {
site = "pot01";
hashedPassword = "$y$j9T$Yw.M.epJj/sakb4Gq/9WV0$P85aQPo/FmFM1.ap413UL3vlGk3mavHwmaALKKDd4n.";
stateVersion = "24.11";
nixpkgs = {
version = "24.11";
system = "nixos";
};
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINPE0typcnvSioMfdLUloIfR5zcf/X0k6201xMHoQBCr" ];
adminGroups = [ "hypervisors" ];
deployment = {
targetHost = "hypervisor01.dgnum";
};
};
hypervisor02 = {
site = "pot01";
hashedPassword = "$y$j9T$Zu98DVlKq7KP5GmIHOwBy1$Bd7W6LstWDm8zjbZ9JSPLnhMFPmZgmU4e7t7u6EhavA";
stateVersion = "24.11";
nixpkgs = {
version = "24.11";
system = "nixos";
};
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPETkWlOfESXQic+HgfGLV/T4Nqg0WjdDbEqtgDwkH+S" ];
adminGroups = [ "hypervisors" ];
deployment = {
targetHost = "hypervisor02.dgnum";
};
};
hypervisor03 = {
site = "pot01";
hashedPassword = "$y$j9T$plTv9.UwmkTODagd4docj0$3zd35wPSsamygiYngwfDGICapKbx5UbzyLBhAwOUSfC";
stateVersion = "24.11";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFLF0mxSGitsDE3/YXfrHNjtOMUt4HT2MbryyUKPLSBI" ];
nixpkgs = {
version = "24.11";
system = "nixos";
};
adminGroups = [ "hypervisors" ];
deployment = {
targetHost = "hypervisor03.dgnum";
};
};
rescue01 = {
site = "luj01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJa02Annu8o7ggPjTH/9ttotdNGyghlWfU9E8pnuLUf" ];
deployment.targetHost = "v6.rescue01.luj01.infra.dgnum.eu";
hashedPassword = "$y$j9T$nqoMMu/axrD0m8AlUFdbs.$UFVmIdPAOHBe2jJv5HJJTcDgINC7LTnSGRQNs9zS1mC";
stateVersion = "23.11";
vm-cluster = "Hyperviseur Luj";
nixpkgs = {
version = "24.11";
system = "nixos";
};
nix-modules = [
"services/netbird/server.nix"
]; ];
}; };
nixpkgs = { storage01 = {
version = "24.11"; site = "pav01";
system = "nixos";
};
};
build01 = { sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA0s+rPcEcfWCqZ4B2oJiWT/60awOI8ijL1rtDM2glXZ" ];
site = "pot01";
hashedPassword = "$y$j9T$n83qOn1OkQhFwQe50tPM11$jZ1tvgqMTcp4HLGEfJmTMsf0NnRUYQkzco9vibWTpU2"; hashedPassword = "$y$j9T$tvRu1EJ9MwDSvEm0ogwe70$bKSw6nNteN0L3NOy2Yix7KlIvO/oROQmQ.Ynq002Fg8";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYJcEMQpOyKInqtd2/brnSQuzwgv6fNPlTSQx9tcvPu" ]; stateVersion = "23.11";
stateVersion = "24.11"; nixpkgs = {
version = "24.11";
system = "nixos";
};
nixpkgs = { nix-modules = [
version = "24.11"; "services/forgejo-nix-runners"
system = "nixos"; "services/netbird/server.nix"
};
admins = [ "ecoppens" ];
deployment = {
targetHost = "build01.dgnum";
};
};
compute01 = {
site = "pav01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/YluSVS+4h3oV8CIUj0OmquyJXju8aEQy0Jz210vTu" ];
hashedPassword = "$y$j9T$2nxZHq84G7fWvWMEaGavE/$0ADnmD9qMpXJJ.rWWH9086EakvZ3wAg0mSxZYugOf3C";
stateVersion = "23.05";
nix-modules = [ "services/stirling-pdf" ];
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
geo01 = {
site = "oik01";
deployment.tags = [ "geo" ];
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEl6Pubbau+usQkemymoSKrTBbrX8JU5m5qpZbhNx8p4" ];
hashedPassword = "$y$j9T$2XmDpJu.QLhV57yYCh5Lf1$LK.X0HKB02Q0Ujvhj5nIofW2IRrIAL/Uxnvl9AXM1L8";
deployment.targetHost = "geo01.dgnum";
stateVersion = "24.05";
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
geo02 = {
site = "oik01";
deployment.tags = [ "geo" ];
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNXaCS0/Nsu5npqQk1TP6wMHCVIOaj4pblp2tIg6Ket" ];
hashedPassword = "$y$j9T$Q4fbMpSm9beWu4DPNAR9t0$dx/1pH4GPY72LpS5ZiECXAZFDdxwmIywztsX.qo2VVA";
deployment.targetHost = "geo02.dgnum";
stateVersion = "24.05";
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
hypervisor01 = {
site = "pot01";
hashedPassword = "$y$j9T$Yw.M.epJj/sakb4Gq/9WV0$P85aQPo/FmFM1.ap413UL3vlGk3mavHwmaALKKDd4n.";
stateVersion = "24.11";
nixpkgs = {
version = "24.11";
system = "nixos";
};
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINPE0typcnvSioMfdLUloIfR5zcf/X0k6201xMHoQBCr" ];
adminGroups = [ "hypervisors" ];
deployment = {
targetHost = "hypervisor01.dgnum";
};
};
hypervisor02 = {
site = "pot01";
hashedPassword = "$y$j9T$Zu98DVlKq7KP5GmIHOwBy1$Bd7W6LstWDm8zjbZ9JSPLnhMFPmZgmU4e7t7u6EhavA";
stateVersion = "24.11";
nixpkgs = {
version = "24.11";
system = "nixos";
};
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPETkWlOfESXQic+HgfGLV/T4Nqg0WjdDbEqtgDwkH+S" ];
adminGroups = [ "hypervisors" ];
deployment = {
targetHost = "hypervisor02.dgnum";
};
};
hypervisor03 = {
site = "pot01";
hashedPassword = "$y$j9T$plTv9.UwmkTODagd4docj0$3zd35wPSsamygiYngwfDGICapKbx5UbzyLBhAwOUSfC";
stateVersion = "24.11";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFLF0mxSGitsDE3/YXfrHNjtOMUt4HT2MbryyUKPLSBI" ];
nixpkgs = {
version = "24.11";
system = "nixos";
};
adminGroups = [ "hypervisors" ];
deployment = {
targetHost = "hypervisor03.dgnum";
};
};
rescue01 = {
site = "luj01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJa02Annu8o7ggPjTH/9ttotdNGyghlWfU9E8pnuLUf" ];
deployment.targetHost = "v6.rescue01.luj01.infra.dgnum.eu";
hashedPassword = "$y$j9T$nqoMMu/axrD0m8AlUFdbs.$UFVmIdPAOHBe2jJv5HJJTcDgINC7LTnSGRQNs9zS1mC";
stateVersion = "23.11";
vm-cluster = "Hyperviseur Luj";
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
storage01 = {
site = "pav01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA0s+rPcEcfWCqZ4B2oJiWT/60awOI8ijL1rtDM2glXZ" ];
hashedPassword = "$y$j9T$tvRu1EJ9MwDSvEm0ogwe70$bKSw6nNteN0L3NOy2Yix7KlIvO/oROQmQ.Ynq002Fg8";
stateVersion = "23.11";
nixpkgs = {
version = "24.11";
system = "nixos";
};
nix-modules = [
"services/netbird/server.nix"
];
};
tower01 = {
site = "oik01";
hashedPassword = "$y$j9T$axihKDa.CrYcyoamJWxBq1$bl4TfropTrwLqMy6XK0DKkWRyx9b74kyI/ukE8X5iiD";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVpR+TMRLGAfhn7Q0C3tKOydYYjfoC/e1ZYbKpby01Z"
];
stateVersion = "24.11";
nixpkgs = {
version = "24.11";
system = "nixos";
};
deployment = {
sshOptions = [
"-J"
"root@vault01.hyp01.infra.dgnum.eu"
]; ];
}; };
admins = [ "ecoppens" ]; tower01 = {
}; site = "oik01";
vault01 = { hashedPassword = "$y$j9T$axihKDa.CrYcyoamJWxBq1$bl4TfropTrwLqMy6XK0DKkWRyx9b74kyI/ukE8X5iiD";
site = "hyp01";
deployment.targetHost = "vault01.hyp01.infra.dgnum.eu";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJA6VA7LENvTRlKdcrqt8DxDOPvX3bg3Gjy9mNkdFEW" ]; sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVpR+TMRLGAfhn7Q0C3tKOydYYjfoC/e1ZYbKpby01Z"
];
hashedPassword = "$y$j9T$5osXVNxCDxu3jIndcyh7G.$UrjiDRpMu3W59tKHLGNdLWllZh.4p8IM4sBS5SrNrN1"; stateVersion = "24.11";
stateVersion = "23.11"; nixpkgs = {
version = "24.11";
system = "nixos";
};
nixpkgs = { admins = [ "ecoppens" ];
version = "24.11";
system = "nixos";
}; };
adminGroups = [ "fai" ]; vault01 = {
}; site = "hyp01";
deployment.targetHost = "vault01.hyp01.infra.dgnum.eu";
web01 = { sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJA6VA7LENvTRlKdcrqt8DxDOPvX3bg3Gjy9mNkdFEW" ];
site = "rat01";
deployment.tags = [ "web" ]; hashedPassword = "$y$j9T$5osXVNxCDxu3jIndcyh7G.$UrjiDRpMu3W59tKHLGNdLWllZh.4p8IM4sBS5SrNrN1";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPR+lewuJ/zhCyizJGJOH1UaAB699ItNKEaeuoK57LY5" ]; stateVersion = "23.11";
hashedPassword = "$y$j9T$9YqXO93VJE/GP3z8Sh4h51$hrBsEPL2O1eP/wBZTrNT8XV906V4JKbQ0g04IWBcyd2"; nixpkgs = {
version = "24.11";
system = "nixos";
};
stateVersion = "23.05"; adminGroups = [ "fai" ];
vm-cluster = "Hyperviseur NPS";
nixpkgs = {
version = "24.11";
system = "nixos";
}; };
};
web02 = { web01 = {
site = "rat01"; site = "rat01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID+QDE+GgZs6zONHvzRW15BzGJNW69k2BFZgB/Zh/tLX" ]; deployment.tags = [ "web" ];
hashedPassword = "$y$j9T$p42UVNy78PykkQOjPwXNJ/$B/zCUOrHXVSFGUY63wnViMiSmU2vCWsiX0y62qqgNQ5"; sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPR+lewuJ/zhCyizJGJOH1UaAB699ItNKEaeuoK57LY5" ];
stateVersion = "24.05"; hashedPassword = "$y$j9T$9YqXO93VJE/GP3z8Sh4h51$hrBsEPL2O1eP/wBZTrNT8XV906V4JKbQ0g04IWBcyd2";
vm-cluster = "Hyperviseur NPS";
nixpkgs = { stateVersion = "23.05";
version = "24.11"; vm-cluster = "Hyperviseur NPS";
system = "nixos";
nixpkgs = {
version = "24.11";
system = "nixos";
};
}; };
};
web03 = { web02 = {
site = "rat01"; site = "rat01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrWsMEfK86iaO9SubMqE2UvZNtHkLY5VUod/bbqKC0L" ]; sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID+QDE+GgZs6zONHvzRW15BzGJNW69k2BFZgB/Zh/tLX" ];
hashedPassword = "$y$j9T$Un/tcX5SPKNXG.sy/BcTa.$kyNHELjb1GAOWnauJfcjyVi5tacWcuEBKflZDCUC6x4"; hashedPassword = "$y$j9T$p42UVNy78PykkQOjPwXNJ/$B/zCUOrHXVSFGUY63wnViMiSmU2vCWsiX0y62qqgNQ5";
stateVersion = "24.05"; stateVersion = "24.05";
vm-cluster = "Hyperviseur NPS"; vm-cluster = "Hyperviseur NPS";
nixpkgs = { nixpkgs = {
version = "24.11"; version = "24.11";
system = "nixos"; system = "nixos";
};
};
web03 = {
site = "rat01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrWsMEfK86iaO9SubMqE2UvZNtHkLY5VUod/bbqKC0L" ];
hashedPassword = "$y$j9T$Un/tcX5SPKNXG.sy/BcTa.$kyNHELjb1GAOWnauJfcjyVi5tacWcuEBKflZDCUC6x4";
stateVersion = "24.05";
vm-cluster = "Hyperviseur NPS";
nixpkgs = {
version = "24.11";
system = "nixos";
};
}; };
}; };
} }

296
meta/organization.nix
View file

@ -13,164 +13,166 @@
*/ */
{ {
members = { organization = {
agroudiev = { members = {
name = "Antoine Groudiev"; agroudiev = {
email = "antoine.groudiev@dgnum.eu"; name = "Antoine Groudiev";
sshKeys = [ email = "antoine.groudiev@dgnum.eu";
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDgyt3ntpcoI/I2n97R1hzjBiNL6R98S73fSi7pkSE/8mQbI8r9GzsPUBcxQ+tIg0FgwkLxTwF8DwLf0E+Le/rPznxBS5LUQaAktSQSrxz/IIID1+jN8b03vf5PjfKS8H2Tu3Q8jZXa8HNsj3cpySpGMqGrE3ieUmknd/YfppRRf+wM4CsGKZeS3ZhB9oZi3Jn22A0U/17AOJTnv4seq+mRZWRQt3pvQvpp8/2M7kEqizie/gTr/DnwxUr45wisqYYH4tat9Cw6iDr7LK10VCrK37BfFagMIZ08Hkh3c46jghjYNQWe+mBUWJByWYhTJ0AtYrbaYeUV1HVYbsRJ6bNx25K6794QQPaE/vc2Z/VK/ILgvJ+9myFSAWVylCWdyYpwUu07RH/jDBl2aqH62ESwAG7SDUUcte6h9N+EryAQLWc8OhsGAYLpshhBpiqZwzX90m+nkbhx1SqMbtt6TS+RPDEHKFYn8E6FBrf1FK34482ndq/hHXZ88mqzGb1nOnM=" sshKeys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDgyt3ntpcoI/I2n97R1hzjBiNL6R98S73fSi7pkSE/8mQbI8r9GzsPUBcxQ+tIg0FgwkLxTwF8DwLf0E+Le/rPznxBS5LUQaAktSQSrxz/IIID1+jN8b03vf5PjfKS8H2Tu3Q8jZXa8HNsj3cpySpGMqGrE3ieUmknd/YfppRRf+wM4CsGKZeS3ZhB9oZi3Jn22A0U/17AOJTnv4seq+mRZWRQt3pvQvpp8/2M7kEqizie/gTr/DnwxUr45wisqYYH4tat9Cw6iDr7LK10VCrK37BfFagMIZ08Hkh3c46jghjYNQWe+mBUWJByWYhTJ0AtYrbaYeUV1HVYbsRJ6bNx25K6794QQPaE/vc2Z/VK/ILgvJ+9myFSAWVylCWdyYpwUu07RH/jDBl2aqH62ESwAG7SDUUcte6h9N+EryAQLWc8OhsGAYLpshhBpiqZwzX90m+nkbhx1SqMbtt6TS+RPDEHKFYn8E6FBrf1FK34482ndq/hHXZ88mqzGb1nOnM="
];
};
catvayor = {
name = "Lubin Bailly";
email = "catvayor@dgnum.eu";
username = "lbailly";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA16foz+XzwKwyIR4wFgNIAE3Y7AfXyEsUZFVVz8Rie catvayor@katvayor"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFfIJ8BToZ9EDxBsEJXQhUju7gm+rUDjGCNMvFSZCl1o openpgp:0x5CADCA1B"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdOxx4I8BSbYPdouvuzDepwTwzQzGSBCNIV8TB5dduT openpgp:0xF6018131"
];
};
cst1 = {
name = "Constantin Gierczak--Galle";
email = "cst1@dgnum.eu";
username = "cgierczakgalle";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrijwPlb7KQkYPLznMPVzPPT69cLzhEsJzZi9tmxzTh cst1@x270"
];
};
ecoppens = {
name = "Elias Coppens";
email = "ecoppens@dgnum.eu";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGmU7yEOCGuGNt4PlQbzd0Cms1RePpo8yEA7Ij/+TdA" ];
};
jemagius = {
name = "Jean-Marc Gailis";
email = "jm@dgnum.eu";
username = "jgailis";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOoxmou5OU74GgpIUkhVt6GiB+O9Jy4ge0TwK5MDFJ2F"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxQX0JLRah3GfIOkua4ZhEJhp5Ykv55RO0SPrSUwCBs5arnALg8gq12YLr09t4bzW/NA9/jn7flhh4S54l4RwBUhmV4JSQhGu71KGhfOj5ZBkDoSyYqzbu206DfZP5eQonSmjfP6XghcWOr/jlBzw9YAAQkFxsQgXEkr4kdn0ZXfZGz6b0t3YUjYIuDNbptFsGz2V9iQVy1vnxrjnLSfc25j4et8z729Vpy4M7oCaE6a6hgon4V1jhVbg43NAE5gu2eYFAPIzO3E7ZI8WjyLu1wtOBClk1f+HMen3Tr+SX2PXmpPGb+I2fAkbzu/C4X/M3+2bL1dYjxuvQhvvpAjxFwmdoXW4gWJ3J/FRiFrKsiAY0rYC+yi8SfacJWCv4EEcV/yQ4gYwpmU9xImLaro6w5cOHGCqrzYqjZc4Wi6AWFGeBSNzNs9PXLgMRWeUyiIDOFnSep2ebZeVjTB16m+o/YDEhE10uX9kCCx3Dy/41iJ1ps7V4JWGFsr0Fqaz8mu8="
];
};
luj = {
name = "Julien Malka";
email = "luj@dgnum.eu";
username = "jmalka";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMBW7rTtfZL9wtrpCVgariKdpN60/VeAzXkh9w3MwbO julien@enigma"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGa+7n7kNzb86pTqaMn554KiPrkHRGeTJ0asY1NjSbpr julien@tower"
];
};
mboyer = {
name = "Matthieu Boyer";
email = "matthieu.boyer@dgnum.eu";
username = "mboyer02";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGYnwZaFYvUxtJeNvpaA20rLfq8fOO4dFp7cIXsD8YNx" ];
};
mdebray = {
name = "Maurice Debray";
email = "maurice.debray@dgnum.eu";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEpwF+XD3HgX64kqD42pcEZRNYAWoO4YNiOm5KO4tH6o maurice@polaris"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdDnSl3cyWil+S5JiyGqOvBR3wVh+lduw58S5WvraoL maurice@fekda"
];
};
raito = {
name = "Ryan Lahfa";
email = "ryan@dgnum.eu";
username = "rlahfa";
sshKeys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcEkYM1r8QVNM/G5CxJInEdoBCWjEHHDdHlzDYNSUIdHHsn04QY+XI67AdMCm8w30GZnLUIj5RiJEWXREUApby0GrfxGGcy8otforygfgtmuUKAUEHdU2MMwrQI7RtTZ8oQ0USRGuqvmegxz3l5caVU7qGvBllJ4NUHXrkZSja2/51vq80RF4MKkDGiz7xUTixI2UcBwQBCA/kQedKV9G28EH+1XfvePqmMivZjl+7VyHsgUVj9eRGA1XWFw59UPZG8a7VkxO/Eb3K9NF297HUAcFMcbY6cPFi9AaBgu3VC4eetDnoN/+xT1owiHi7BReQhGAy/6cdf7C/my5ehZwD"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0xMwWedkKosax9+7D2OlnMxFL/eV4CvFZLsbLptpXr"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKiXXYkhRh+s7ixZ8rvG8ntIqd6FELQ9hh7HoaHQJRPU"
];
};
thubrecht = {
name = "Tom Hubrecht";
email = "tom.hubrecht@dgnum.eu";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+EZXYziiaynJX99EW8KesnmRTZMof3BoIs3mdEl8L3"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHL4M4HKjs4cjRAYRk9pmmI8U0R4+T/jQh6Fxp/i1Eoy"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPM1jpXR7BWQa7Sed7ii3SbvIPRRlKb3G91qC0vOwfJn"
];
};
};
groups = {
# members of this group are root on all nodes
root = [
"thubrecht"
"raito"
"mdebray"
];
# members of this group are root on the fai infrastructure
fai = [
"catvayor"
"ecoppens"
];
lab = [
"catvayor"
"cst1"
"ecoppens"
];
hypervisors = [
"catvayor"
"ecoppens"
];
nix-builder = [
"catvayor"
"ecoppens"
"mdebray"
"raito"
"thubrecht"
]; ];
}; };
catvayor = { external = {
name = "Lubin Bailly"; dns = [
email = "catvayor@dgnum.eu"; "thubrecht"
username = "lbailly"; "raito"
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA16foz+XzwKwyIR4wFgNIAE3Y7AfXyEsUZFVVz8Rie catvayor@katvayor"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFfIJ8BToZ9EDxBsEJXQhUju7gm+rUDjGCNMvFSZCl1o openpgp:0x5CADCA1B"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdOxx4I8BSbYPdouvuzDepwTwzQzGSBCNIV8TB5dduT openpgp:0xF6018131"
]; ];
email = [ "raito" ];
irc = [ "raito" ];
}; };
cst1 = { services = {
name = "Constantin Gierczak--Galle"; # Démarches Normaliennes
email = "cst1@dgnum.eu"; ds-fr.admins = [
username = "cgierczakgalle"; "thubrecht"
sshKeys = [ "jemagius"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrijwPlb7KQkYPLznMPVzPPT69cLzhEsJzZi9tmxzTh cst1@x270"
]; ];
};
ecoppens = { # Cloud DGNum
name = "Elias Coppens"; nextcloud.admins = [
email = "ecoppens@dgnum.eu"; "thubrecht"
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGmU7yEOCGuGNt4PlQbzd0Cms1RePpo8yEA7Ij/+TdA" ]; "raito"
};
jemagius = {
name = "Jean-Marc Gailis";
email = "jm@dgnum.eu";
username = "jgailis";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOoxmou5OU74GgpIUkhVt6GiB+O9Jy4ge0TwK5MDFJ2F"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxQX0JLRah3GfIOkua4ZhEJhp5Ykv55RO0SPrSUwCBs5arnALg8gq12YLr09t4bzW/NA9/jn7flhh4S54l4RwBUhmV4JSQhGu71KGhfOj5ZBkDoSyYqzbu206DfZP5eQonSmjfP6XghcWOr/jlBzw9YAAQkFxsQgXEkr4kdn0ZXfZGz6b0t3YUjYIuDNbptFsGz2V9iQVy1vnxrjnLSfc25j4et8z729Vpy4M7oCaE6a6hgon4V1jhVbg43NAE5gu2eYFAPIzO3E7ZI8WjyLu1wtOBClk1f+HMen3Tr+SX2PXmpPGb+I2fAkbzu/C4X/M3+2bL1dYjxuvQhvvpAjxFwmdoXW4gWJ3J/FRiFrKsiAY0rYC+yi8SfacJWCv4EEcV/yQ4gYwpmU9xImLaro6w5cOHGCqrzYqjZc4Wi6AWFGeBSNzNs9PXLgMRWeUyiIDOFnSep2ebZeVjTB16m+o/YDEhE10uX9kCCx3Dy/41iJ1ps7V4JWGFsr0Fqaz8mu8="
]; ];
};
luj = { # Netbox DGNum
name = "Julien Malka"; netbox.adminGroups = [
email = "luj@dgnum.eu"; "root"
username = "jmalka"; "fai"
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMBW7rTtfZL9wtrpCVgariKdpN60/VeAzXkh9w3MwbO julien@enigma"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGa+7n7kNzb86pTqaMn554KiPrkHRGeTJ0asY1NjSbpr julien@tower"
]; ];
# Videos DGNum
peertube.admins = [ "thubrecht" ];
}; };
mboyer = {
name = "Matthieu Boyer";
email = "matthieu.boyer@dgnum.eu";
username = "mboyer02";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGYnwZaFYvUxtJeNvpaA20rLfq8fOO4dFp7cIXsD8YNx" ];
};
mdebray = {
name = "Maurice Debray";
email = "maurice.debray@dgnum.eu";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEpwF+XD3HgX64kqD42pcEZRNYAWoO4YNiOm5KO4tH6o maurice@polaris"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdDnSl3cyWil+S5JiyGqOvBR3wVh+lduw58S5WvraoL maurice@fekda"
];
};
raito = {
name = "Ryan Lahfa";
email = "ryan@dgnum.eu";
username = "rlahfa";
sshKeys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcEkYM1r8QVNM/G5CxJInEdoBCWjEHHDdHlzDYNSUIdHHsn04QY+XI67AdMCm8w30GZnLUIj5RiJEWXREUApby0GrfxGGcy8otforygfgtmuUKAUEHdU2MMwrQI7RtTZ8oQ0USRGuqvmegxz3l5caVU7qGvBllJ4NUHXrkZSja2/51vq80RF4MKkDGiz7xUTixI2UcBwQBCA/kQedKV9G28EH+1XfvePqmMivZjl+7VyHsgUVj9eRGA1XWFw59UPZG8a7VkxO/Eb3K9NF297HUAcFMcbY6cPFi9AaBgu3VC4eetDnoN/+xT1owiHi7BReQhGAy/6cdf7C/my5ehZwD"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0xMwWedkKosax9+7D2OlnMxFL/eV4CvFZLsbLptpXr"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKiXXYkhRh+s7ixZ8rvG8ntIqd6FELQ9hh7HoaHQJRPU"
];
};
thubrecht = {
name = "Tom Hubrecht";
email = "tom.hubrecht@dgnum.eu";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+EZXYziiaynJX99EW8KesnmRTZMof3BoIs3mdEl8L3"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHL4M4HKjs4cjRAYRk9pmmI8U0R4+T/jQh6Fxp/i1Eoy"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPM1jpXR7BWQa7Sed7ii3SbvIPRRlKb3G91qC0vOwfJn"
];
};
};
groups = {
# members of this group are root on all nodes
root = [
"thubrecht"
"raito"
"mdebray"
];
# members of this group are root on the fai infrastructure
fai = [
"catvayor"
"ecoppens"
];
lab = [
"catvayor"
"cst1"
"ecoppens"
];
hypervisors = [
"catvayor"
"ecoppens"
];
nix-builder = [
"catvayor"
"ecoppens"
"mdebray"
"raito"
"thubrecht"
];
};
external = {
dns = [
"thubrecht"
"raito"
];
email = [ "raito" ];
irc = [ "raito" ];
};
services = {
# Démarches Normaliennes
ds-fr.admins = [
"thubrecht"
"jemagius"
];
# Cloud DGNum
nextcloud.admins = [
"thubrecht"
"raito"
];
# Netbox DGNum
netbox.adminGroups = [
"root"
"fai"
];
# Videos DGNum
peertube.admins = [ "thubrecht" ];
}; };
} }

4
meta/verify.nix
View file

@ -6,8 +6,8 @@
# Nix expression to check if meta module is evaluating correctly. # Nix expression to check if meta module is evaluating correctly.
# To do so run `nix-build ./verify.nix` # To do so run `nix-build ./verify.nix`
let let
sources = import ../npins; sources = import ../sources.nix;
pkgs = import sources.nixos-unstable { }; pkgs = sources.bootstrapNixpkgs;
dns = import sources."dns.nix" { inherit pkgs; }; dns = import sources."dns.nix" { inherit pkgs; };
in in

10
modules/nixos/dgn-access-control.nix
View file

@ -5,12 +5,11 @@
{ {
config, config,
lib, lib,
name,
dgn-keys, dgn-keys,
meta,
nodeMeta, nodeMeta,
... ...
}: }:
let let
inherit (lib) inherit (lib)
mkDefault mkDefault
@ -22,11 +21,6 @@ let
types types
; ;
admins =
meta.organization.groups.root
++ nodeMeta.admins
++ (builtins.concatMap (g: meta.organization.groups.${g}) nodeMeta.adminGroups);
cfg = config.dgn-access-control; cfg = config.dgn-access-control;
in in
@ -53,7 +47,7 @@ in
config = mkIf cfg.enable { config = mkIf cfg.enable {
# Admins have root access to the node # Admins have root access to the node
dgn-access-control.users.root = mkDefault admins; dgn-access-control.users.root = mkDefault (dgn-keys.getNodeAdmins name);
users.mutableUsers = false; users.mutableUsers = false;
users.users = builtins.mapAttrs ( users.users = builtins.mapAttrs (
username: members: username: members:

2
modules/nixos/dgn-backups/keys/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ ] [ ]
[ [
"compute01.key" "compute01.key"

2
modules/nixos/dgn-netbox-agent/secrets/secrets.nix
View file

@ -2,4 +2,4 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ netbox-agent.publicKeys = (import ../../../../keys).machineKeysBySystem "nixos"; } { netbox-agent.publicKeys = (import ../../../../keys.nix).machineKeysBySystem "nixos"; }

2
modules/nixos/dgn-notify/secrets.nix
View file

@ -2,4 +2,4 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ mail.publicKeys = (import ../../../keys).machineKeysBySystem "nixos"; } { mail.publicKeys = (import ../../../keys.nix).machineKeysBySystem "nixos"; }

2
modules/nixos/dgn-records/secrets.nix
View file

@ -2,4 +2,4 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ __arkheon-token_file.publicKeys = (import ../../../keys).machineKeysBySystem "nixos"; } { __arkheon-token_file.publicKeys = (import ../../../keys.nix).machineKeysBySystem "nixos"; }

2
modules/nixos/dgn-s3/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../keys).mkSecrets (import ../../../keys.nix).mkSecrets
[ [
"storage01" "storage01"
"tower01" "tower01"

23
sources.nix Normal file
View file

@ -0,0 +1,23 @@
# SPDX-FileCopyrightText: 2024 Ryan Lahfa <ryan.lahfa@dgnum.eu>
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
# SPDX-FileContributor: Maurice Debray <maurice.debray@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
let
sources' = import ./npins;
bootstrapNixpkgs = import sources'.nixos-unstable { };
patch = (import ./lib/nix-patches { patchFile = ./patches; }).base {
pkgs = bootstrapNixpkgs;
};
sources = builtins.mapAttrs (
k: src:
patch.applyPatches {
inherit src;
name = k;
}
) sources';
in sources // { bootstrapNixpkgs = bootstrapNixpkgs; unpatchedSources = sources; }

2
workflows/eval-nodes.nix
View file

@ -7,7 +7,7 @@
let let
inherit (lib) attrNames genAttrs; inherit (lib) attrNames genAttrs;
nodes = attrNames (import ../meta/nodes); nodes = attrNames (import ../meta lib).nodes;
in in
{ {