diff --git a/machines/rescue01/_configuration.nix b/machines/rescue01/_configuration.nix new file mode 100644 index 0000000..f11afbf --- /dev/null +++ b/machines/rescue01/_configuration.nix @@ -0,0 +1,23 @@ +{ lib, ... }: + +lib.extra.mkConfig { + enabledModules = [ + # List of modules to enable + "dgn-fail2ban" + ]; + + enabledServices = [ + # List of services to enable + ]; + + extraConfig = { + dgn-fail2ban.jails = lib.extra.enableAttrs' "enabled" [ + "sshd-bruteforce" + "sshd-timeout" + ]; + + services.netbird.enable = true; + }; + + root = ./.; +} diff --git a/machines/rescue01/_hardware-configuration.nix b/machines/rescue01/_hardware-configuration.nix new file mode 100644 index 0000000..5593e39 --- /dev/null +++ b/machines/rescue01/_hardware-configuration.nix @@ -0,0 +1,41 @@ +{ lib, modulesPath, ... }: + +{ + imports = [ (modulesPath + "/profiles/qemu-guest.nix") ]; + + boot = { + initrd.availableKernelModules = [ + "ata_piix" + "uhci_hcd" + "virtio_pci" + "virtio_scsi" + "sd_mod" + "sr_mod" + ]; + initrd.kernelModules = [ ]; + # hack to avoid intel_kvm that is set in dgn-hardware + kernelModules = lib.mkForce [ ]; + extraModulePackages = [ ]; + }; + + fileSystems."/" = { + device = "/dev/disk/by-uuid/ed02dfb7-7071-4852-9bb6-f3bd965e0234"; + fsType = "ext4"; + }; + + fileSystems."/boot" = { + device = "/dev/disk/by-uuid/5781-E6CA"; + fsType = "vfat"; + }; + + swapDevices = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.ens18.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/machines/rescue01/secrets/secrets.nix b/machines/rescue01/secrets/secrets.nix new file mode 100644 index 0000000..47020b5 --- /dev/null +++ b/machines/rescue01/secrets/secrets.nix @@ -0,0 +1,5 @@ +let + lib = import ../../../lib { }; + publicKeys = lib.getNodeKeys "rescue01"; +in +lib.setDefault { inherit publicKeys; } [ ] diff --git a/meta/infrastructure.nix b/meta/infrastructure.nix index 3f1944f..8968307 100644 --- a/meta/infrastructure.nix +++ b/meta/infrastructure.nix @@ -14,6 +14,9 @@ "vault01" ]; + # Luj's infra + par03 = [ "rescue01" ]; + # VMs du SPI/NPS/Whatever dmi01 = [ "web01" diff --git a/meta/network.nix b/meta/network.nix index 8b4595e..479d1d5 100644 --- a/meta/network.nix +++ b/meta/network.nix @@ -188,4 +188,25 @@ builtins.mapAttrs mkNet { hostId = "b431ca10"; }; + + rescue01 = { + interfaces = { + ens18 = { + ipv6 = [ + { + address = "2a01:e0a:de4:a0e1:2d73:2a7e:18db:5728"; + prefixLength = 64; + } + ]; + ipv4 = [ + { + address = "192.168.0.232"; + prefixLength = 21; + } + ]; + gateways = [ "192.168.0.1" ]; + }; + }; + hostId = "007f0200"; + }; } diff --git a/meta/nodes.nix b/meta/nodes.nix index 16ac0ad..b823393 100644 --- a/meta/nodes.nix +++ b/meta/nodes.nix @@ -62,4 +62,8 @@ builtins.mapAttrs mkNode { stateVersion = "24.05"; nixpkgs = "unstable"; }; + + rescue01 = { + stateVersion = "23.11"; + }; }