From e0759140cc7d8fbf8b8c1d981c4a736e3979c730 Mon Sep 17 00:00:00 2001 From: sinavir Date: Wed, 8 Jan 2025 19:58:17 +0100 Subject: [PATCH] chore: Refactor meta to a module architecture Get rid of the weird half nix half module stuff. --- README.md | 2 +- default.nix | 4 +- hive.nix | 88 +-- iso/configuration.nix | 4 +- keys.nix | 13 + {keys => lib/keys}/default.nix | 38 +- machines/nixos/bridge01/secrets/secrets.nix | 2 +- machines/nixos/build01/secrets/secrets.nix | 2 +- machines/nixos/compute01/extranix/default.nix | 4 + .../compute01/kanidm/secrets/secrets.nix | 2 +- machines/nixos/compute01/secrets/secrets.nix | 2 +- machines/nixos/geo01/secrets/secrets.nix | 2 +- machines/nixos/geo02/secrets/secrets.nix | 2 +- .../nixos/hypervisor01/secrets/secrets.nix | 2 +- .../nixos/hypervisor02/secrets/secrets.nix | 2 +- .../nixos/hypervisor03/secrets/secrets.nix | 2 +- machines/nixos/rescue01/secrets/secrets.nix | 2 +- machines/nixos/storage01/secrets/secrets.nix | 2 +- machines/nixos/tower01/secrets/secrets.nix | 3 +- machines/nixos/vault01/secrets/secrets.nix | 2 +- machines/nixos/web01/secrets/secrets.nix | 2 +- machines/nixos/web02/secrets/secrets.nix | 2 +- machines/nixos/web03/secrets/secrets.nix | 2 +- meta/default.nix | 8 +- meta/network.nix | 488 ++++++++--------- meta/nodes/default.nix | 13 +- meta/nodes/liminix.nix | 18 +- meta/nodes/netconf.nix | 110 ++-- meta/nodes/nixos.nix | 501 +++++++++--------- meta/organization.nix | 2 + meta/verify.nix | 4 +- modules/nixos/dgn-access-control.nix | 10 +- modules/nixos/dgn-backups/keys/secrets.nix | 2 +- .../dgn-netbox-agent/secrets/secrets.nix | 2 +- modules/nixos/dgn-notify/secrets.nix | 2 +- modules/nixos/dgn-records/secrets.nix | 2 +- modules/nixos/dgn-s3/secrets.nix | 2 +- sources.nix | 23 + workflows/eval-nodes.nix | 2 +- 39 files changed, 712 insertions(+), 663 deletions(-) create mode 100644 keys.nix rename {keys => lib/keys}/default.nix (58%) create mode 100644 sources.nix diff --git a/README.md b/README.md index 0090a04..a722caf 100644 --- a/README.md +++ b/README.md @@ -98,7 +98,7 @@ The general metadata is declared in `meta/nodes.nix`, the main values to declare Create the directory `secrets` in the configuration folder, and add a `secrets.nix` file containing : ```nix -(import ../../../keys).mkSecrets [ "host02" ] [ +(import ../../../keys.nix).mkSecrets [ "host02" ] [ # List of secrets for host02 ] ``` diff --git a/default.nix b/default.nix index 4bf0416..97d6005 100644 --- a/default.nix +++ b/default.nix @@ -4,8 +4,8 @@ # SPDX-License-Identifier: EUPL-1.2 { - sources ? import ./npins, - pkgs ? import sources.nixos-unstable { }, + sources ? import ./sources.nix, + pkgs ? sources.bootstrapNixpkgs, }: let diff --git a/hive.nix b/hive.nix index df57365..b23b83f 100644 --- a/hive.nix +++ b/hive.nix @@ -4,45 +4,33 @@ # # SPDX-License-Identifier: EUPL-1.2 +# TODO: change comments to ### \n # [text] \n # + let - sources' = import ./npins; + ### Init some tooling - # Patch sources directly - sources = - builtins.mapAttrs (patch.base { pkgs = import sources'.nixos-unstable { }; }).applyPatches' - sources'; + sources = import ./sources.nix; + + inherit (sources) bootstrapNixpkgs; + + lib = bootstrapNixpkgs.lib.extend (_: _: { + extra = import ./lib/nix-lib; + }); + + nix-lib = lib.extra; # TODO: Assess perf penalty of fixed point + # TODO same but using bootstrapnixpkgs for nix-lib instanciation + # original statement: import ./lib/nix-lib; - nix-lib = import ./lib/nix-lib; inherit (nix-lib) mapSingleFuse; - patch = import ./lib/nix-patches { patchFile = ./patches; }; + ### Let's build meta + metadata = (import ./meta) lib; - nodes' = import ./meta/nodes; - nodes = builtins.attrNames nodes'; + nodes = builtins.attrNames metadata.nodes; - mkNode = node: { - deployment.systemType = system node; - }; + ### Nixpkgs instanciation nixpkgs' = import ./meta/nixpkgs.nix; - # All supported nixpkgs versions × systems, instanciated - nixpkgs = mapSingleFuse (s: mapSingleFuse (mkSystemNixpkgs s) nixpkgs'.versions) nixpkgs'.systems; - - # Get the configured nixos version for the node, - # defaulting to the one defined in meta/nixpkgs - version = node: nodes'.${node}.nixpkgs.version; - system = node: nodes'.${node}.nixpkgs.system; - category = node: nixpkgs'.categories.${system node}; - - nodePkgs = node: nixpkgs.${system node}.${version node}; - - # Builds a patched version of nixpkgs, only as the source - mkNixpkgs' = - v: - patch.mkNixpkgsSrc rec { - src = sources'.${name}; - name = "nixos-${v}"; - }; # Build up the nixpkgs configuration for Liminix embedded systems mkLiminixConfig = @@ -58,21 +46,35 @@ let }; }; + # Build up the arguments to instantiate a nixpkgs given a system and a version. mkNixpkgsConfig = system: { - nixos = _: { }; + nixos = _: { }; # TODO: add nix-pkgs overlay here zyxel-nwa50ax = mkLiminixConfig system; netconf = _: { }; } .${system} or (throw "Unknown system: ${system} for nixpkgs configuration instantiation"); # Instanciates the required nixpkgs version - mkSystemNixpkgs = system: version: import (mkNixpkgs' version) (mkNixpkgsConfig system version); + mkSystemNixpkgs = system: version: + import sources."nixos-${version}" (mkNixpkgsConfig system version); - ### - # Function to create arguments based on the node + # All supported nixpkgs versions × systems, instanciated + nixpkgs = mapSingleFuse (s: mapSingleFuse (mkSystemNixpkgs s) nixpkgs'.versions) nixpkgs'.systems; + + + # Get the configured nixos version for the node, + # defaulting to the one defined in meta/nixpkgs + version = node: metadata.nodes.${node}.nixpkgs.version; + system = node: metadata.nodes.${node}.nixpkgs.system; + category = node: nixpkgs'.categories.${system node}; + + nodePkgs = node: nixpkgs.${system node}.${version node}; + + ########## + # Function to create arguments based on the node # mkArgs = node: rec { lib = sourcePkgs.lib // { @@ -80,11 +82,19 @@ let }; sourcePkgs = nodePkgs node; - meta = (import ./meta) lib; + meta = metadata; - nodeMeta = meta.nodes.${node}; + nodeMeta = metadata.nodes.${node}; nodePath = "machines/${category node}/${node}"; }; + + ########## + # Module for each node (quite empty since almost everything is in the default module) + # + mkNode = node: { + deployment.systemType = system node; + }; + in { @@ -95,7 +105,10 @@ in specialArgs = { inherit nixpkgs sources; - dgn-keys = import ./keys; + dgn-keys = import ./lib/keys { + meta = metadata; + inherit lib; + }; }; nodeSpecialArgs = mapSingleFuse mkArgs nodes; @@ -219,5 +232,6 @@ in }; }; }; + } // (mapSingleFuse mkNode nodes) diff --git a/iso/configuration.nix b/iso/configuration.nix index aad91fa..aac4324 100644 --- a/iso/configuration.nix +++ b/iso/configuration.nix @@ -5,9 +5,9 @@ { lib, pkgs, ... }: let - dgn-keys = import ../keys; + dgn-keys = import ../keys.nix; - dgn-members = (import ../meta lib).organization.groups.root; + dgn-members = (import ../meta lib).config.organization.groups.root; in { diff --git a/keys.nix b/keys.nix new file mode 100644 index 0000000..7945d52 --- /dev/null +++ b/keys.nix @@ -0,0 +1,13 @@ +# SPDX-FileCopyrightText: 2024 Tom Hubrecht +# +# SPDX-License-Identifier: EUPL-1.2 + +let + _sources = import ../npins; + + inherit (import _sources.nixpkgs { }) lib; + + meta = (import ../meta lib).config; + +in + import ./lib/keys { inherit meta lib; } diff --git a/keys/default.nix b/lib/keys/default.nix similarity index 58% rename from keys/default.nix rename to lib/keys/default.nix index cc13c3c..1ecdb23 100644 --- a/keys/default.nix +++ b/lib/keys/default.nix @@ -1,20 +1,15 @@ +# SPDX-FileCopyrightText: 2024 Ryan Lahfa # SPDX-FileCopyrightText: 2024 Tom Hubrecht +# SPDX-FileContributor: Maurice Debray # # SPDX-License-Identifier: EUPL-1.2 +{ meta, lib }: let - _sources = import ../npins; - - inherit (import _sources.nixos-unstable { }) lib; - - meta = import ../meta lib; - - inherit (import ../lib/nix-lib) setDefault unique; + inherit (import ../nix-lib) setDefault unique; getAttr = lib.flip builtins.getAttr; - in - rec { _memberKeys = builtins.mapAttrs (_: v: v.sshKeys) meta.organization.members; _builderKeys = builtins.mapAttrs (_: v: v.builderKeys) meta.organization.members; @@ -32,22 +27,25 @@ rec { # List of keys for the root group rootKeys = getMemberKeys meta.organization.groups.root; - # All keys that can access a node - getNodeKeys' = + # All admins for a node + getNodeAdmins = node: - let - names = [ node ] ++ - meta.nodes.${node}.admins - ++ (builtins.concatMap (g: meta.organization.groups.${g}) meta.nodes.${node}.adminGroups); - in - unique (getMemberKeys names ++ getNodeKeys [ node ]); + meta.organization.groups.root + ++ meta.nodes.${node}.admins + ++ (builtins.concatMap (g: meta.organization.groups.${g}) meta.nodes.${node}.adminGroups); + + # All keys needed for secret encryption + getSecretKeys = node: unique (getMemberKeys (getNodeAdmins node) ++ getNodeKeys [ node ]); # List of keys for all machines wide secrets machineKeys = rootKeys ++ (getNodeKeys (builtins.attrNames meta.nodes)); - mkSecrets = nodes: setDefault { publicKeys = unique (builtins.concatMap getNodeKeys' nodes); }; + mkSecrets = nodes: setDefault { publicKeys = unique (builtins.concatMap getSecretKeys nodes); }; - machineKeysBySystem = system: + machineKeysBySystem = + system: rootKeys - ++ (getNodeKeys (builtins.attrNames (lib.filterAttrs (_: v: v.nixpkgs.system == system) meta.nodes))); + ++ (getNodeKeys ( + builtins.attrNames (lib.filterAttrs (_: v: v.nixpkgs.system == system) meta.nodes) + )); } diff --git a/machines/nixos/bridge01/secrets/secrets.nix b/machines/nixos/bridge01/secrets/secrets.nix index 78adcca..a63c32d 100644 --- a/machines/nixos/bridge01/secrets/secrets.nix +++ b/machines/nixos/bridge01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "bridge01" ] [ # List of secrets for bridge01 diff --git a/machines/nixos/build01/secrets/secrets.nix b/machines/nixos/build01/secrets/secrets.nix index f234224..3da9805 100644 --- a/machines/nixos/build01/secrets/secrets.nix +++ b/machines/nixos/build01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "build01" ] [ "forgejo_runners-token_file" diff --git a/machines/nixos/compute01/extranix/default.nix b/machines/nixos/compute01/extranix/default.nix index 3d77d2d..e8be054 100644 --- a/machines/nixos/compute01/extranix/default.nix +++ b/machines/nixos/compute01/extranix/default.nix @@ -5,6 +5,7 @@ { lib, sources, + dgn-keys, ... }: let @@ -68,6 +69,9 @@ in meta = { organization.groups.root = [ ]; }; + dgn-keys = dgn-keys // { + getNodeAdmins = _: [ ]; + }; }; path-translations = [ { diff --git a/machines/nixos/compute01/kanidm/secrets/secrets.nix b/machines/nixos/compute01/kanidm/secrets/secrets.nix index c424c1b..3229f76 100644 --- a/machines/nixos/compute01/kanidm/secrets/secrets.nix +++ b/machines/nixos/compute01/kanidm/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../../keys).mkSecrets +(import ../../../../../keys.nix).mkSecrets [ "compute01" ] [ "kanidm-password_admin" diff --git a/machines/nixos/compute01/secrets/secrets.nix b/machines/nixos/compute01/secrets/secrets.nix index d575bbf..00e0f39 100644 --- a/machines/nixos/compute01/secrets/secrets.nix +++ b/machines/nixos/compute01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "compute01" ] [ # List of secrets for compute01 diff --git a/machines/nixos/geo01/secrets/secrets.nix b/machines/nixos/geo01/secrets/secrets.nix index fb7ffd4..7813f07 100644 --- a/machines/nixos/geo01/secrets/secrets.nix +++ b/machines/nixos/geo01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "geo01" ] [ # List of secrets for geo01 diff --git a/machines/nixos/geo02/secrets/secrets.nix b/machines/nixos/geo02/secrets/secrets.nix index a4b84cb..77e9535 100644 --- a/machines/nixos/geo02/secrets/secrets.nix +++ b/machines/nixos/geo02/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "geo02" ] [ # List of secrets for geo02 diff --git a/machines/nixos/hypervisor01/secrets/secrets.nix b/machines/nixos/hypervisor01/secrets/secrets.nix index 02ef5f5..e86e467 100644 --- a/machines/nixos/hypervisor01/secrets/secrets.nix +++ b/machines/nixos/hypervisor01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifer: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "hypervisor01" ] [ diff --git a/machines/nixos/hypervisor02/secrets/secrets.nix b/machines/nixos/hypervisor02/secrets/secrets.nix index 1c3dae5..8d5f6fc 100644 --- a/machines/nixos/hypervisor02/secrets/secrets.nix +++ b/machines/nixos/hypervisor02/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifer: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "hypervisor02" ] [ diff --git a/machines/nixos/hypervisor03/secrets/secrets.nix b/machines/nixos/hypervisor03/secrets/secrets.nix index ad06613..02d6078 100644 --- a/machines/nixos/hypervisor03/secrets/secrets.nix +++ b/machines/nixos/hypervisor03/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifer: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "hypervisor03" ] [ diff --git a/machines/nixos/rescue01/secrets/secrets.nix b/machines/nixos/rescue01/secrets/secrets.nix index bd9fae1..b75f14d 100644 --- a/machines/nixos/rescue01/secrets/secrets.nix +++ b/machines/nixos/rescue01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "rescue01" ] [ # List of secrets for rescue01 diff --git a/machines/nixos/storage01/secrets/secrets.nix b/machines/nixos/storage01/secrets/secrets.nix index 94ef3cf..d0d9e85 100644 --- a/machines/nixos/storage01/secrets/secrets.nix +++ b/machines/nixos/storage01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "storage01" ] [ # List of secrets for storage01 diff --git a/machines/nixos/tower01/secrets/secrets.nix b/machines/nixos/tower01/secrets/secrets.nix index fc08f6d..d95317e 100644 --- a/machines/nixos/tower01/secrets/secrets.nix +++ b/machines/nixos/tower01/secrets/secrets.nix @@ -2,7 +2,8 @@ # # SPDX-License-Identifer: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "tower01" ] [ + ] diff --git a/machines/nixos/vault01/secrets/secrets.nix b/machines/nixos/vault01/secrets/secrets.nix index 5453626..f93ee25 100644 --- a/machines/nixos/vault01/secrets/secrets.nix +++ b/machines/nixos/vault01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "vault01" ] [ # List of secrets for vault01 diff --git a/machines/nixos/web01/secrets/secrets.nix b/machines/nixos/web01/secrets/secrets.nix index 7935c7c..6305b11 100644 --- a/machines/nixos/web01/secrets/secrets.nix +++ b/machines/nixos/web01/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "web01" ] [ # List of secrets for web01 diff --git a/machines/nixos/web02/secrets/secrets.nix b/machines/nixos/web02/secrets/secrets.nix index 43ffc58..a7db18d 100644 --- a/machines/nixos/web02/secrets/secrets.nix +++ b/machines/nixos/web02/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "web02" ] [ # List of secrets for web02 diff --git a/machines/nixos/web03/secrets/secrets.nix b/machines/nixos/web03/secrets/secrets.nix index 36db49f..b365c92 100644 --- a/machines/nixos/web03/secrets/secrets.nix +++ b/machines/nixos/web03/secrets/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ "web03" ] [ # List of secrets for web03 diff --git a/meta/default.nix b/meta/default.nix index b2e07b1..2199e0b 100644 --- a/meta/default.nix +++ b/meta/default.nix @@ -12,11 +12,9 @@ lib: (lib.evalModules { modules = [ ./options.nix - { - network = import ./network.nix; - nodes = import ./nodes; - organization = import ./organization.nix; - } + ./network.nix + ./nodes + ./organization.nix ]; class = "dgnumMeta"; }).config diff --git a/meta/network.nix b/meta/network.nix index 69cf8b5..f0d904a 100644 --- a/meta/network.nix +++ b/meta/network.nix @@ -6,304 +6,306 @@ # SPDX-License-Identifier: EUPL-1.2 { - bridge01 = { - hostId = "f57f3ba0"; + network = { + bridge01 = { + hostId = "f57f3ba0"; - interfaces = { }; - netbirdIp = null; - }; - - build01 = { - interfaces = { - enp35s0f0np0 = { - ipv4 = [ - { - address = "10.0.254.21"; - prefixLength = 24; - } - ]; - - gateways = [ "10.0.254.1" ]; - enableDefaultDNS = true; - }; + interfaces = { }; + netbirdIp = null; }; - hostId = "adb676ce"; - netbirdIp = "100.80.31.249"; - }; + build01 = { + interfaces = { + enp35s0f0np0 = { + ipv4 = [ + { + address = "10.0.254.21"; + prefixLength = 24; + } + ]; - compute01 = { - interfaces = { - eno1 = { - ipv4 = [ - { - address = "129.199.146.147"; - prefixLength = 24; - } - { - address = "192.168.1.147"; - prefixLength = 24; - } - ]; - - gateways = [ "129.199.146.254" ]; - enableDefaultDNS = true; + gateways = [ "10.0.254.1" ]; + enableDefaultDNS = true; + }; }; + + hostId = "adb676ce"; + netbirdIp = "100.80.31.249"; }; - hostId = "8df60941"; - netbirdIp = "100.80.75.197"; - }; + compute01 = { + interfaces = { + eno1 = { + ipv4 = [ + { + address = "129.199.146.147"; + prefixLength = 24; + } + { + address = "192.168.1.147"; + prefixLength = 24; + } + ]; - geo01 = { - interfaces = { - eno1 = { - ipv4 = [ - { - address = "129.199.210.194"; - prefixLength = 24; - } - ]; - - gateways = [ "129.199.210.254" ]; - - dns = [ - "129.199.96.11" - "129.199.72.99" - ]; + gateways = [ "129.199.146.254" ]; + enableDefaultDNS = true; + }; }; + + hostId = "8df60941"; + netbirdIp = "100.80.75.197"; }; - hostId = "b88fee0c"; - netbirdIp = "100.80.8.66"; - }; + geo01 = { + interfaces = { + eno1 = { + ipv4 = [ + { + address = "129.199.210.194"; + prefixLength = 24; + } + ]; - geo02 = { - interfaces = { - eno1 = { - ipv4 = [ - { - address = "129.199.210.69"; - prefixLength = 24; - } - ]; + gateways = [ "129.199.210.254" ]; - gateways = [ "129.199.210.254" ]; - - dns = [ - "129.199.96.11" - "129.199.72.99" - ]; + dns = [ + "129.199.96.11" + "129.199.72.99" + ]; + }; }; + + hostId = "b88fee0c"; + netbirdIp = "100.80.8.66"; }; - hostId = "45d65237"; - netbirdIp = "100.80.233.249"; - }; + geo02 = { + interfaces = { + eno1 = { + ipv4 = [ + { + address = "129.199.210.69"; + prefixLength = 24; + } + ]; - hypervisor01 = { - interfaces = { - eno4 = { - ipv4 = [ - { - address = "10.0.254.11"; - prefixLength = 24; - } - ]; + gateways = [ "129.199.210.254" ]; - gateways = [ "10.0.254.1" ]; - enableDefaultDNS = true; + dns = [ + "129.199.96.11" + "129.199.72.99" + ]; + }; }; + + hostId = "45d65237"; + netbirdIp = "100.80.233.249"; }; - hostId = "4dbbd76a"; - netbirdIp = "100.80.242.115"; - }; + hypervisor01 = { + interfaces = { + eno4 = { + ipv4 = [ + { + address = "10.0.254.11"; + prefixLength = 24; + } + ]; - hypervisor02 = { - interfaces = { - eno4 = { - ipv4 = [ - { - address = "10.0.254.12"; - prefixLength = 24; - } - ]; - - gateways = [ "10.0.254.1" ]; - enableDefaultDNS = true; + gateways = [ "10.0.254.1" ]; + enableDefaultDNS = true; + }; }; + + hostId = "4dbbd76a"; + netbirdIp = "100.80.242.115"; }; - hostId = "d0b48483"; - netbirdIp = "100.80.37.202"; - }; + hypervisor02 = { + interfaces = { + eno4 = { + ipv4 = [ + { + address = "10.0.254.12"; + prefixLength = 24; + } + ]; - hypervisor03 = { - interfaces = { - eno4 = { - ipv4 = [ - { - address = "10.0.254.13"; - prefixLength = 24; - } - ]; - - gateways = [ "10.0.254.1" ]; - enableDefaultDNS = true; + gateways = [ "10.0.254.1" ]; + enableDefaultDNS = true; + }; }; + + hostId = "d0b48483"; + netbirdIp = "100.80.37.202"; }; - hostId = "1c407ea8"; - netbirdIp = "100.80.58.178"; - }; + hypervisor03 = { + interfaces = { + eno4 = { + ipv4 = [ + { + address = "10.0.254.13"; + prefixLength = 24; + } + ]; - rescue01 = { - interfaces = { - ens18 = { - ipv6 = [ - { - address = "2a01:e0a:de4:a0e1:2d73:2a7e:18db:5728"; - prefixLength = 64; - } - ]; - - ipv4 = [ - { - address = "192.168.0.232"; - prefixLength = 21; - } - ]; - gateways = [ "192.168.0.1" ]; - enableDefaultDNS = true; + gateways = [ "10.0.254.1" ]; + enableDefaultDNS = true; + }; }; + + hostId = "1c407ea8"; + netbirdIp = "100.80.58.178"; }; - addresses.ipv4 = [ "82.67.34.230" ]; + rescue01 = { + interfaces = { + ens18 = { + ipv6 = [ + { + address = "2a01:e0a:de4:a0e1:2d73:2a7e:18db:5728"; + prefixLength = 64; + } + ]; - hostId = "007f0200"; - netbirdIp = "100.80.97.140"; - }; - - storage01 = { - interfaces = { - eno1 = { - ipv4 = [ - { - address = "129.199.146.148"; - prefixLength = 24; - } - { - address = "192.168.1.148"; - prefixLength = 24; - } - ]; - - gateways = [ "129.199.146.254" ]; - enableDefaultDNS = true; + ipv4 = [ + { + address = "192.168.0.232"; + prefixLength = 21; + } + ]; + gateways = [ "192.168.0.1" ]; + enableDefaultDNS = true; + }; }; + + addresses.ipv4 = [ "82.67.34.230" ]; + + hostId = "007f0200"; + netbirdIp = "100.80.97.140"; }; - hostId = "d4e7c369"; - netbirdIp = "100.80.156.154"; - }; + storage01 = { + interfaces = { + eno1 = { + ipv4 = [ + { + address = "129.199.146.148"; + prefixLength = 24; + } + { + address = "192.168.1.148"; + prefixLength = 24; + } + ]; - tower01 = { - interfaces = { - eno2 = { - ipv4 = [ - { - address = "129.199.210.119"; - prefixLength = 24; - } - ]; - - gateways = [ "129.199.210.254" ]; - - dns = [ - "129.199.96.11" - "129.199.72.99" - ]; + gateways = [ "129.199.146.254" ]; + enableDefaultDNS = true; + }; }; + + hostId = "d4e7c369"; + netbirdIp = "100.80.156.154"; }; - hostId = "7874d06e"; - netbirdIp = "100.80.185.124"; - }; + tower01 = { + interfaces = { + eno2 = { + ipv4 = [ + { + address = "129.199.210.119"; + prefixLength = 24; + } + ]; - vault01 = { - interfaces = { - vlan-uplink-cri = { - ipv4 = [ - { - # see also machines/vault01/networking.nix - address = "129.199.195.129"; - prefixLength = 32; - } - ]; - gateways = [ ]; - enableDefaultDNS = true; + gateways = [ "129.199.210.254" ]; + + dns = [ + "129.199.96.11" + "129.199.72.99" + ]; + }; }; + + hostId = "7874d06e"; + netbirdIp = "100.80.185.124"; }; - hostId = "e83b600d"; - netbirdIp = "100.80.255.180"; - }; - - web01 = { - interfaces = { - ens3 = { - ipv4 = [ - { - address = "129.199.129.53"; - prefixLength = 24; - } - ]; - - gateways = [ "129.199.129.1" ]; - enableDefaultDNS = true; + vault01 = { + interfaces = { + vlan-uplink-cri = { + ipv4 = [ + { + # see also machines/vault01/networking.nix + address = "129.199.195.129"; + prefixLength = 32; + } + ]; + gateways = [ ]; + enableDefaultDNS = true; + }; }; + + hostId = "e83b600d"; + netbirdIp = "100.80.255.180"; }; - hostId = "050df79e"; - netbirdIp = "100.80.77.90"; - }; + web01 = { + interfaces = { + ens3 = { + ipv4 = [ + { + address = "129.199.129.53"; + prefixLength = 24; + } + ]; - web02 = { - interfaces = { - ens3 = { - ipv4 = [ - { - address = "129.199.129.235"; - prefixLength = 24; - } - ]; - - gateways = [ "129.199.129.1" ]; - enableDefaultDNS = true; + gateways = [ "129.199.129.1" ]; + enableDefaultDNS = true; + }; }; + + hostId = "050df79e"; + netbirdIp = "100.80.77.90"; }; - hostId = "b431ca10"; - netbirdIp = null; # web02 is not to be connected on the VPN - }; + web02 = { + interfaces = { + ens3 = { + ipv4 = [ + { + address = "129.199.129.235"; + prefixLength = 24; + } + ]; - web03 = { - interfaces = { - enp1s0 = { - ipv4 = [ - { - address = "129.199.129.223"; - prefixLength = 24; - } - ]; - - gateways = [ "129.199.129.1" ]; - enableDefaultDNS = true; + gateways = [ "129.199.129.1" ]; + enableDefaultDNS = true; + }; }; + + hostId = "b431ca10"; + netbirdIp = null; # web02 is not to be connected on the VPN }; - hostId = "8afc7749"; - netbirdIp = "100.80.157.46"; + web03 = { + interfaces = { + enp1s0 = { + ipv4 = [ + { + address = "129.199.129.223"; + prefixLength = 24; + } + ]; + + gateways = [ "129.199.129.1" ]; + enableDefaultDNS = true; + }; + }; + + hostId = "8afc7749"; + netbirdIp = "100.80.157.46"; + }; }; } diff --git a/meta/nodes/default.nix b/meta/nodes/default.nix index e5caf35..ec94bef 100644 --- a/meta/nodes/default.nix +++ b/meta/nodes/default.nix @@ -2,9 +2,10 @@ # SPDX-FileContributor: Ryan Lahfa # # SPDX-License-Identifier: EUPL-1.2 - -builtins.foldl' (nodes: path: nodes // import path) { } [ - ./liminix.nix - ./nixos.nix - ./netconf.nix -] +{ + imports = [ + ./liminix.nix + ./nixos.nix + ./netconf.nix + ]; +} diff --git a/meta/nodes/liminix.nix b/meta/nodes/liminix.nix index 5c6e952..7618c92 100644 --- a/meta/nodes/liminix.nix +++ b/meta/nodes/liminix.nix @@ -16,17 +16,19 @@ # } { - ap01 = { - site = "unknown"; - adminGroups = [ "fai" ]; + nodes = { + ap01 = { + site = "unknown"; + adminGroups = [ "fai" ]; - hashedPassword = "$y$j9T$DMOQEWOYFHjNS0myrXp4x/$MG33VSdXGvib.99eN.AbvyVdNNJw4ERjAwK4.ULJe/A"; + hashedPassword = "$y$j9T$DMOQEWOYFHjNS0myrXp4x/$MG33VSdXGvib.99eN.AbvyVdNNJw4ERjAwK4.ULJe/A"; - stateVersion = null; + stateVersion = null; - nixpkgs = { - system = "zyxel-nwa50ax"; - version = "24.05"; + nixpkgs = { + system = "zyxel-nwa50ax"; + version = "24.05"; + }; }; }; } diff --git a/meta/nodes/netconf.nix b/meta/nodes/netconf.nix index 722074d..63fc4fe 100644 --- a/meta/nodes/netconf.nix +++ b/meta/nodes/netconf.nix @@ -2,78 +2,80 @@ # # SPDX-License-Identifier: EUPL-1.2 { - netcore01 = { - site = "pot01"; + nodes = { + netcore01 = { + site = "pot01"; - hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0"; + hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0"; - stateVersion = null; + stateVersion = null; - adminGroups = [ "fai" ]; + adminGroups = [ "fai" ]; - deployment = { - targetHost = "fd26:baf9:d250:8000::100f"; - sshOptions = [ - "-J" - "root@vault01.hyp01.infra.dgnum.eu" - "-p" - "830" - ]; + deployment = { + targetHost = "fd26:baf9:d250:8000::100f"; + sshOptions = [ + "-J" + "root@vault01.hyp01.infra.dgnum.eu" + "-p" + "830" + ]; + }; + + nixpkgs = { + version = "24.05"; # FIXME: meaningless + system = "netconf"; + }; }; - nixpkgs = { - version = "24.05"; # FIXME: meaningless - system = "netconf"; - }; - }; + netcore02 = { + site = "hyp01"; - netcore02 = { - site = "hyp01"; + hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0"; - hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0"; + stateVersion = null; - stateVersion = null; + adminGroups = [ "fai" ]; - adminGroups = [ "fai" ]; + deployment = { + targetHost = "fd26:baf9:d250:8000::1001"; + sshOptions = [ + "-J" + "root@vault01.hyp01.infra.dgnum.eu" + "-p" + "830" + ]; + }; - deployment = { - targetHost = "fd26:baf9:d250:8000::1001"; - sshOptions = [ - "-J" - "root@vault01.hyp01.infra.dgnum.eu" - "-p" - "830" - ]; + nixpkgs = { + version = "24.05"; # FIXME: meaningless + system = "netconf"; + }; }; - nixpkgs = { - version = "24.05"; # FIXME: meaningless - system = "netconf"; - }; - }; + netaccess01 = { + site = "hyp02"; - netaccess01 = { - site = "hyp02"; + hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0"; - hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0"; + stateVersion = null; - stateVersion = null; + adminGroups = [ "fai" ]; - adminGroups = [ "fai" ]; + deployment = { + targetHost = "fd26:baf9:d250:8000::2001"; + sshOptions = [ + "-J" + "root@vault01.hyp01.infra.dgnum.eu" + "-p" + "830" + ]; + }; - deployment = { - targetHost = "fd26:baf9:d250:8000::2001"; - sshOptions = [ - "-J" - "root@vault01.hyp01.infra.dgnum.eu" - "-p" - "830" - ]; - }; - - nixpkgs = { - version = "24.05"; # FIXME: meaningless - system = "netconf"; + nixpkgs = { + version = "24.05"; # FIXME: meaningless + system = "netconf"; + }; }; }; } diff --git a/meta/nodes/nixos.nix b/meta/nodes/nixos.nix index b8bed4d..c6f1b0b 100644 --- a/meta/nodes/nixos.nix +++ b/meta/nodes/nixos.nix @@ -26,299 +26,294 @@ - luj01 -> VM de Luj */ { - bridge01 = { - site = "hyp01"; + nodes = { + bridge01 = { + site = "hyp01"; - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5bS3iBXz8wycBnTvI5Qi79WLu0h4IVv/EOdKYbP5y7" ]; + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5bS3iBXz8wycBnTvI5Qi79WLu0h4IVv/EOdKYbP5y7" ]; - hashedPassword = "$y$j9T$EPJdz70kselouXAVUmAH01$8nYbUBY9NPTMfYigegY0qFSdxJwhqzW8sFacDqEYCP5"; + hashedPassword = "$y$j9T$EPJdz70kselouXAVUmAH01$8nYbUBY9NPTMfYigegY0qFSdxJwhqzW8sFacDqEYCP5"; - stateVersion = "24.05"; + stateVersion = "24.05"; - adminGroups = [ "fai" ]; + adminGroups = [ "fai" ]; - deployment = { - targetHost = "fd26:baf9:d250:8000::ffff"; - sshOptions = [ - "-J" - "root@vault01.hyp01.infra.dgnum.eu" + deployment = { + targetHost = "fd26:baf9:d250:8000::ffff"; + sshOptions = [ + "-J" + "root@vault01.hyp01.infra.dgnum.eu" + ]; + }; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + }; + + build01 = { + site = "pot01"; + + hashedPassword = "$y$j9T$n83qOn1OkQhFwQe50tPM11$jZ1tvgqMTcp4HLGEfJmTMsf0NnRUYQkzco9vibWTpU2"; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYJcEMQpOyKInqtd2/brnSQuzwgv6fNPlTSQx9tcvPu" ]; + + stateVersion = "24.11"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + + admins = [ "ecoppens" ]; + + deployment = { + targetHost = "build01.dgnum"; + }; + }; + + compute01 = { + site = "pav01"; + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/YluSVS+4h3oV8CIUj0OmquyJXju8aEQy0Jz210vTu" ]; + + hashedPassword = "$y$j9T$2nxZHq84G7fWvWMEaGavE/$0ADnmD9qMpXJJ.rWWH9086EakvZ3wAg0mSxZYugOf3C"; + + stateVersion = "23.05"; + nix-modules = [ "services/stirling-pdf" ]; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + }; + + geo01 = { + site = "oik01"; + deployment.tags = [ "geo" ]; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEl6Pubbau+usQkemymoSKrTBbrX8JU5m5qpZbhNx8p4" ]; + + hashedPassword = "$y$j9T$2XmDpJu.QLhV57yYCh5Lf1$LK.X0HKB02Q0Ujvhj5nIofW2IRrIAL/Uxnvl9AXM1L8"; + + deployment.targetHost = "geo01.dgnum"; + + stateVersion = "24.05"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + }; + + geo02 = { + site = "oik01"; + deployment.tags = [ "geo" ]; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNXaCS0/Nsu5npqQk1TP6wMHCVIOaj4pblp2tIg6Ket" ]; + + hashedPassword = "$y$j9T$Q4fbMpSm9beWu4DPNAR9t0$dx/1pH4GPY72LpS5ZiECXAZFDdxwmIywztsX.qo2VVA"; + + deployment.targetHost = "geo02.dgnum"; + + stateVersion = "24.05"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + }; + + hypervisor01 = { + site = "pot01"; + + hashedPassword = "$y$j9T$Yw.M.epJj/sakb4Gq/9WV0$P85aQPo/FmFM1.ap413UL3vlGk3mavHwmaALKKDd4n."; + + stateVersion = "24.11"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINPE0typcnvSioMfdLUloIfR5zcf/X0k6201xMHoQBCr" ]; + + adminGroups = [ "hypervisors" ]; + + deployment = { + targetHost = "hypervisor01.dgnum"; + }; + }; + + hypervisor02 = { + site = "pot01"; + + hashedPassword = "$y$j9T$Zu98DVlKq7KP5GmIHOwBy1$Bd7W6LstWDm8zjbZ9JSPLnhMFPmZgmU4e7t7u6EhavA"; + + stateVersion = "24.11"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPETkWlOfESXQic+HgfGLV/T4Nqg0WjdDbEqtgDwkH+S" ]; + + adminGroups = [ "hypervisors" ]; + + deployment = { + targetHost = "hypervisor02.dgnum"; + }; + }; + + hypervisor03 = { + site = "pot01"; + + hashedPassword = "$y$j9T$plTv9.UwmkTODagd4docj0$3zd35wPSsamygiYngwfDGICapKbx5UbzyLBhAwOUSfC"; + + stateVersion = "24.11"; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFLF0mxSGitsDE3/YXfrHNjtOMUt4HT2MbryyUKPLSBI" ]; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + + adminGroups = [ "hypervisors" ]; + + deployment = { + targetHost = "hypervisor03.dgnum"; + }; + }; + + rescue01 = { + site = "luj01"; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJa02Annu8o7ggPjTH/9ttotdNGyghlWfU9E8pnuLUf" ]; + + deployment.targetHost = "v6.rescue01.luj01.infra.dgnum.eu"; + + hashedPassword = "$y$j9T$nqoMMu/axrD0m8AlUFdbs.$UFVmIdPAOHBe2jJv5HJJTcDgINC7LTnSGRQNs9zS1mC"; + + stateVersion = "23.11"; + vm-cluster = "Hyperviseur Luj"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + + nix-modules = [ + "services/netbird/server.nix" ]; }; - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - }; + storage01 = { + site = "pav01"; - build01 = { - site = "pot01"; + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA0s+rPcEcfWCqZ4B2oJiWT/60awOI8ijL1rtDM2glXZ" ]; - hashedPassword = "$y$j9T$n83qOn1OkQhFwQe50tPM11$jZ1tvgqMTcp4HLGEfJmTMsf0NnRUYQkzco9vibWTpU2"; + hashedPassword = "$y$j9T$tvRu1EJ9MwDSvEm0ogwe70$bKSw6nNteN0L3NOy2Yix7KlIvO/oROQmQ.Ynq002Fg8"; - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYJcEMQpOyKInqtd2/brnSQuzwgv6fNPlTSQx9tcvPu" ]; + stateVersion = "23.11"; - stateVersion = "24.11"; + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - - admins = [ "ecoppens" ]; - - deployment = { - targetHost = "build01.dgnum"; - }; - }; - - compute01 = { - site = "pav01"; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/YluSVS+4h3oV8CIUj0OmquyJXju8aEQy0Jz210vTu" ]; - - hashedPassword = "$y$j9T$2nxZHq84G7fWvWMEaGavE/$0ADnmD9qMpXJJ.rWWH9086EakvZ3wAg0mSxZYugOf3C"; - - stateVersion = "23.05"; - nix-modules = [ "services/stirling-pdf" ]; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - }; - - geo01 = { - site = "oik01"; - deployment.tags = [ "geo" ]; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEl6Pubbau+usQkemymoSKrTBbrX8JU5m5qpZbhNx8p4" ]; - - hashedPassword = "$y$j9T$2XmDpJu.QLhV57yYCh5Lf1$LK.X0HKB02Q0Ujvhj5nIofW2IRrIAL/Uxnvl9AXM1L8"; - - deployment.targetHost = "geo01.dgnum"; - - stateVersion = "24.05"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - }; - - geo02 = { - site = "oik01"; - deployment.tags = [ "geo" ]; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNXaCS0/Nsu5npqQk1TP6wMHCVIOaj4pblp2tIg6Ket" ]; - - hashedPassword = "$y$j9T$Q4fbMpSm9beWu4DPNAR9t0$dx/1pH4GPY72LpS5ZiECXAZFDdxwmIywztsX.qo2VVA"; - - deployment.targetHost = "geo02.dgnum"; - - stateVersion = "24.05"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - }; - - hypervisor01 = { - site = "pot01"; - - hashedPassword = "$y$j9T$Yw.M.epJj/sakb4Gq/9WV0$P85aQPo/FmFM1.ap413UL3vlGk3mavHwmaALKKDd4n."; - - stateVersion = "24.11"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINPE0typcnvSioMfdLUloIfR5zcf/X0k6201xMHoQBCr" ]; - - adminGroups = [ "hypervisors" ]; - - deployment = { - targetHost = "hypervisor01.dgnum"; - }; - }; - - hypervisor02 = { - site = "pot01"; - - hashedPassword = "$y$j9T$Zu98DVlKq7KP5GmIHOwBy1$Bd7W6LstWDm8zjbZ9JSPLnhMFPmZgmU4e7t7u6EhavA"; - - stateVersion = "24.11"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPETkWlOfESXQic+HgfGLV/T4Nqg0WjdDbEqtgDwkH+S" ]; - - adminGroups = [ "hypervisors" ]; - - deployment = { - targetHost = "hypervisor02.dgnum"; - }; - }; - - hypervisor03 = { - site = "pot01"; - - hashedPassword = "$y$j9T$plTv9.UwmkTODagd4docj0$3zd35wPSsamygiYngwfDGICapKbx5UbzyLBhAwOUSfC"; - - stateVersion = "24.11"; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFLF0mxSGitsDE3/YXfrHNjtOMUt4HT2MbryyUKPLSBI" ]; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - - adminGroups = [ "hypervisors" ]; - - deployment = { - targetHost = "hypervisor03.dgnum"; - }; - }; - - rescue01 = { - site = "luj01"; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJa02Annu8o7ggPjTH/9ttotdNGyghlWfU9E8pnuLUf" ]; - - deployment.targetHost = "v6.rescue01.luj01.infra.dgnum.eu"; - - hashedPassword = "$y$j9T$nqoMMu/axrD0m8AlUFdbs.$UFVmIdPAOHBe2jJv5HJJTcDgINC7LTnSGRQNs9zS1mC"; - - stateVersion = "23.11"; - vm-cluster = "Hyperviseur Luj"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - - nix-modules = [ - "services/netbird/server.nix" - ]; - }; - - storage01 = { - site = "pav01"; - - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA0s+rPcEcfWCqZ4B2oJiWT/60awOI8ijL1rtDM2glXZ" ]; - - hashedPassword = "$y$j9T$tvRu1EJ9MwDSvEm0ogwe70$bKSw6nNteN0L3NOy2Yix7KlIvO/oROQmQ.Ynq002Fg8"; - - stateVersion = "23.11"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - - nix-modules = [ - "services/netbird/server.nix" - ]; - }; - - tower01 = { - site = "oik01"; - - hashedPassword = "$y$j9T$axihKDa.CrYcyoamJWxBq1$bl4TfropTrwLqMy6XK0DKkWRyx9b74kyI/ukE8X5iiD"; - - sshKeys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVpR+TMRLGAfhn7Q0C3tKOydYYjfoC/e1ZYbKpby01Z" - ]; - - stateVersion = "24.11"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; - }; - - deployment = { - sshOptions = [ - "-J" - "root@vault01.hyp01.infra.dgnum.eu" + nix-modules = [ + "services/forgejo-nix-runners" + "services/netbird/server.nix" ]; }; - admins = [ "ecoppens" ]; - }; + tower01 = { + site = "oik01"; - vault01 = { - site = "hyp01"; - deployment.targetHost = "vault01.hyp01.infra.dgnum.eu"; + hashedPassword = "$y$j9T$axihKDa.CrYcyoamJWxBq1$bl4TfropTrwLqMy6XK0DKkWRyx9b74kyI/ukE8X5iiD"; - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJA6VA7LENvTRlKdcrqt8DxDOPvX3bg3Gjy9mNkdFEW" ]; + sshKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVpR+TMRLGAfhn7Q0C3tKOydYYjfoC/e1ZYbKpby01Z" + ]; - hashedPassword = "$y$j9T$5osXVNxCDxu3jIndcyh7G.$UrjiDRpMu3W59tKHLGNdLWllZh.4p8IM4sBS5SrNrN1"; + stateVersion = "24.11"; - stateVersion = "23.11"; + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; - nixpkgs = { - version = "24.11"; - system = "nixos"; + admins = [ "ecoppens" ]; }; - adminGroups = [ "fai" ]; - }; + vault01 = { + site = "hyp01"; + deployment.targetHost = "vault01.hyp01.infra.dgnum.eu"; - web01 = { - site = "rat01"; + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJA6VA7LENvTRlKdcrqt8DxDOPvX3bg3Gjy9mNkdFEW" ]; - deployment.tags = [ "web" ]; + hashedPassword = "$y$j9T$5osXVNxCDxu3jIndcyh7G.$UrjiDRpMu3W59tKHLGNdLWllZh.4p8IM4sBS5SrNrN1"; - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPR+lewuJ/zhCyizJGJOH1UaAB699ItNKEaeuoK57LY5" ]; + stateVersion = "23.11"; - hashedPassword = "$y$j9T$9YqXO93VJE/GP3z8Sh4h51$hrBsEPL2O1eP/wBZTrNT8XV906V4JKbQ0g04IWBcyd2"; + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; - stateVersion = "23.05"; - vm-cluster = "Hyperviseur NPS"; - - nixpkgs = { - version = "24.11"; - system = "nixos"; + adminGroups = [ "fai" ]; }; - }; - web02 = { - site = "rat01"; + web01 = { + site = "rat01"; - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID+QDE+GgZs6zONHvzRW15BzGJNW69k2BFZgB/Zh/tLX" ]; + deployment.tags = [ "web" ]; - hashedPassword = "$y$j9T$p42UVNy78PykkQOjPwXNJ/$B/zCUOrHXVSFGUY63wnViMiSmU2vCWsiX0y62qqgNQ5"; + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPR+lewuJ/zhCyizJGJOH1UaAB699ItNKEaeuoK57LY5" ]; - stateVersion = "24.05"; - vm-cluster = "Hyperviseur NPS"; + hashedPassword = "$y$j9T$9YqXO93VJE/GP3z8Sh4h51$hrBsEPL2O1eP/wBZTrNT8XV906V4JKbQ0g04IWBcyd2"; - nixpkgs = { - version = "24.11"; - system = "nixos"; + stateVersion = "23.05"; + vm-cluster = "Hyperviseur NPS"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; }; - }; - web03 = { - site = "rat01"; + web02 = { + site = "rat01"; - sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrWsMEfK86iaO9SubMqE2UvZNtHkLY5VUod/bbqKC0L" ]; + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID+QDE+GgZs6zONHvzRW15BzGJNW69k2BFZgB/Zh/tLX" ]; - hashedPassword = "$y$j9T$Un/tcX5SPKNXG.sy/BcTa.$kyNHELjb1GAOWnauJfcjyVi5tacWcuEBKflZDCUC6x4"; + hashedPassword = "$y$j9T$p42UVNy78PykkQOjPwXNJ/$B/zCUOrHXVSFGUY63wnViMiSmU2vCWsiX0y62qqgNQ5"; - stateVersion = "24.05"; - vm-cluster = "Hyperviseur NPS"; + stateVersion = "24.05"; + vm-cluster = "Hyperviseur NPS"; - nixpkgs = { - version = "24.11"; - system = "nixos"; + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; + }; + + web03 = { + site = "rat01"; + + sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrWsMEfK86iaO9SubMqE2UvZNtHkLY5VUod/bbqKC0L" ]; + + hashedPassword = "$y$j9T$Un/tcX5SPKNXG.sy/BcTa.$kyNHELjb1GAOWnauJfcjyVi5tacWcuEBKflZDCUC6x4"; + + stateVersion = "24.05"; + vm-cluster = "Hyperviseur NPS"; + + nixpkgs = { + version = "24.11"; + system = "nixos"; + }; }; }; } diff --git a/meta/organization.nix b/meta/organization.nix index f7fa9e0..2069909 100644 --- a/meta/organization.nix +++ b/meta/organization.nix @@ -13,6 +13,7 @@ */ { + organization = { members = { agroudiev = { name = "Antoine Groudiev"; @@ -197,4 +198,5 @@ # Videos DGNum peertube.admins = [ "thubrecht" ]; }; + }; } diff --git a/meta/verify.nix b/meta/verify.nix index 2465fac..be168d8 100644 --- a/meta/verify.nix +++ b/meta/verify.nix @@ -6,8 +6,8 @@ # Nix expression to check if meta module is evaluating correctly. # To do so run `nix-build ./verify.nix` let - sources = import ../npins; - pkgs = import sources.nixos-unstable { }; + sources = import ../sources.nix; + pkgs = sources.bootstrapNixpkgs; dns = import sources."dns.nix" { inherit pkgs; }; in diff --git a/modules/nixos/dgn-access-control.nix b/modules/nixos/dgn-access-control.nix index 7fed596..b75a6f4 100644 --- a/modules/nixos/dgn-access-control.nix +++ b/modules/nixos/dgn-access-control.nix @@ -5,12 +5,11 @@ { config, lib, + name, dgn-keys, - meta, nodeMeta, ... }: - let inherit (lib) mkDefault @@ -22,11 +21,6 @@ let types ; - admins = - meta.organization.groups.root - ++ nodeMeta.admins - ++ (builtins.concatMap (g: meta.organization.groups.${g}) nodeMeta.adminGroups); - cfg = config.dgn-access-control; in @@ -53,7 +47,7 @@ in config = mkIf cfg.enable { # Admins have root access to the node - dgn-access-control.users.root = mkDefault admins; + dgn-access-control.users.root = mkDefault (dgn-keys.getNodeAdmins name); users.mutableUsers = false; users.users = builtins.mapAttrs ( username: members: diff --git a/modules/nixos/dgn-backups/keys/secrets.nix b/modules/nixos/dgn-backups/keys/secrets.nix index 64f7d42..be205c4 100644 --- a/modules/nixos/dgn-backups/keys/secrets.nix +++ b/modules/nixos/dgn-backups/keys/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../../keys).mkSecrets +(import ../../../../keys.nix).mkSecrets [ ] [ "compute01.key" diff --git a/modules/nixos/dgn-netbox-agent/secrets/secrets.nix b/modules/nixos/dgn-netbox-agent/secrets/secrets.nix index 66795ca..92ad6c7 100644 --- a/modules/nixos/dgn-netbox-agent/secrets/secrets.nix +++ b/modules/nixos/dgn-netbox-agent/secrets/secrets.nix @@ -2,4 +2,4 @@ # # SPDX-License-Identifier: EUPL-1.2 -{ netbox-agent.publicKeys = (import ../../../../keys).machineKeysBySystem "nixos"; } +{ netbox-agent.publicKeys = (import ../../../../keys.nix).machineKeysBySystem "nixos"; } diff --git a/modules/nixos/dgn-notify/secrets.nix b/modules/nixos/dgn-notify/secrets.nix index 95f7177..92144a7 100644 --- a/modules/nixos/dgn-notify/secrets.nix +++ b/modules/nixos/dgn-notify/secrets.nix @@ -2,4 +2,4 @@ # # SPDX-License-Identifier: EUPL-1.2 -{ mail.publicKeys = (import ../../../keys).machineKeysBySystem "nixos"; } +{ mail.publicKeys = (import ../../../keys.nix).machineKeysBySystem "nixos"; } diff --git a/modules/nixos/dgn-records/secrets.nix b/modules/nixos/dgn-records/secrets.nix index 13a6afd..33eb72c 100644 --- a/modules/nixos/dgn-records/secrets.nix +++ b/modules/nixos/dgn-records/secrets.nix @@ -2,4 +2,4 @@ # # SPDX-License-Identifier: EUPL-1.2 -{ __arkheon-token_file.publicKeys = (import ../../../keys).machineKeysBySystem "nixos"; } +{ __arkheon-token_file.publicKeys = (import ../../../keys.nix).machineKeysBySystem "nixos"; } diff --git a/modules/nixos/dgn-s3/secrets.nix b/modules/nixos/dgn-s3/secrets.nix index 6d17c51..a4dc481 100644 --- a/modules/nixos/dgn-s3/secrets.nix +++ b/modules/nixos/dgn-s3/secrets.nix @@ -2,7 +2,7 @@ # # SPDX-License-Identifier: EUPL-1.2 -(import ../../../keys).mkSecrets +(import ../../../keys.nix).mkSecrets [ "storage01" "tower01" diff --git a/sources.nix b/sources.nix new file mode 100644 index 0000000..1ea96f7 --- /dev/null +++ b/sources.nix @@ -0,0 +1,23 @@ +# SPDX-FileCopyrightText: 2024 Ryan Lahfa +# SPDX-FileCopyrightText: 2024 Tom Hubrecht +# SPDX-FileContributor: Maurice Debray +# +# SPDX-License-Identifier: EUPL-1.2 + +let + sources' = import ./npins; + + bootstrapNixpkgs = import sources'.nixos-unstable { }; + + patch = (import ./lib/nix-patches { patchFile = ./patches; }).base { + pkgs = bootstrapNixpkgs; + }; + + sources = builtins.mapAttrs ( + k: src: + patch.applyPatches { + inherit src; + name = k; + } + ) sources'; +in sources // { bootstrapNixpkgs = bootstrapNixpkgs; unpatchedSources = sources; } diff --git a/workflows/eval-nodes.nix b/workflows/eval-nodes.nix index d7f919f..4a591e1 100644 --- a/workflows/eval-nodes.nix +++ b/workflows/eval-nodes.nix @@ -7,7 +7,7 @@ let inherit (lib) attrNames genAttrs; - nodes = attrNames (import ../meta/nodes); + nodes = attrNames (import ../meta lib).nodes; in {