DGNum/infrastructure
11
6
Fork 2
Code Issues 20 Pull requests 14 Projects 1 Releases Packages Wiki Activity Actions

chore: Refactor meta to a module architecture

Browse source 
Get rid of the weird half nix half module stuff.
This commit is contained in:
sinavir 2025-01-08 19:58:17 +01:00 • committed by Tom Hubrecht
parent 9d24c766f3
commit e0759140cc
Signed by: thubrecht
SSH key fingerprint: SHA256:CYNvFo44Ar9qCNnWNnvJVhs0QXO9AZjOLlPeWcSij3Q
39 changed files with 712 additions and 663 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -98,7 +98,7 @@ The general metadata is declared in `meta/nodes.nix`, the main values to declare
Create the directory `secrets` in the configuration folder, and add a `secrets.nix` file containing : Create the directory `secrets` in the configuration folder, and add a `secrets.nix` file containing :
```nix ```nix
(import ../../../keys).mkSecrets [ "host02" ] [ (import ../../../keys.nix).mkSecrets [ "host02" ] [
# List of secrets for host02 # List of secrets for host02
] ]
``` ```

4
default.nix
View file

@ -4,8 +4,8 @@
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ {
sources ? import ./npins, sources ? import ./sources.nix,
pkgs ? import sources.nixos-unstable { }, pkgs ? sources.bootstrapNixpkgs,
}: }:
let let

86
hive.nix
View file

@ -4,45 +4,33 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
# TODO: change comments to ### \n # [text] \n #
let let
sources' = import ./npins; ### Init some tooling
# Patch sources directly sources = import ./sources.nix;
sources =
builtins.mapAttrs (patch.base { pkgs = import sources'.nixos-unstable { }; }).applyPatches' inherit (sources) bootstrapNixpkgs;
sources';
lib = bootstrapNixpkgs.lib.extend (_: _: {
extra = import ./lib/nix-lib;
});
nix-lib = lib.extra; # TODO: Assess perf penalty of fixed point
# TODO same but using bootstrapnixpkgs for nix-lib instanciation
# original statement: import ./lib/nix-lib;
nix-lib = import ./lib/nix-lib;
inherit (nix-lib) mapSingleFuse; inherit (nix-lib) mapSingleFuse;
patch = import ./lib/nix-patches { patchFile = ./patches; }; ### Let's build meta
metadata = (import ./meta) lib;
nodes' = import ./meta/nodes; nodes = builtins.attrNames metadata.nodes;
nodes = builtins.attrNames nodes';
mkNode = node: { ### Nixpkgs instanciation
deployment.systemType = system node;
};
nixpkgs' = import ./meta/nixpkgs.nix; nixpkgs' = import ./meta/nixpkgs.nix;
# All supported nixpkgs versions × systems, instanciated
nixpkgs = mapSingleFuse (s: mapSingleFuse (mkSystemNixpkgs s) nixpkgs'.versions) nixpkgs'.systems;
# Get the configured nixos version for the node,
# defaulting to the one defined in meta/nixpkgs
version = node: nodes'.${node}.nixpkgs.version;
system = node: nodes'.${node}.nixpkgs.system;
category = node: nixpkgs'.categories.${system node};
nodePkgs = node: nixpkgs.${system node}.${version node};
# Builds a patched version of nixpkgs, only as the source
mkNixpkgs' =
v:
patch.mkNixpkgsSrc rec {
src = sources'.${name};
name = "nixos-${v}";
};
# Build up the nixpkgs configuration for Liminix embedded systems # Build up the nixpkgs configuration for Liminix embedded systems
mkLiminixConfig = mkLiminixConfig =
@ -58,20 +46,34 @@ let
}; };
}; };
# Build up the arguments to instantiate a nixpkgs given a system and a version. # Build up the arguments to instantiate a nixpkgs given a system and a version.
mkNixpkgsConfig = mkNixpkgsConfig =
system: system:
{ {
nixos = _: { }; nixos = _: { }; # TODO: add nix-pkgs overlay here
zyxel-nwa50ax = mkLiminixConfig system; zyxel-nwa50ax = mkLiminixConfig system;
netconf = _: { }; netconf = _: { };
} }
.${system} or (throw "Unknown system: ${system} for nixpkgs configuration instantiation"); .${system} or (throw "Unknown system: ${system} for nixpkgs configuration instantiation");
# Instanciates the required nixpkgs version # Instanciates the required nixpkgs version
mkSystemNixpkgs = system: version: import (mkNixpkgs' version) (mkNixpkgsConfig system version); mkSystemNixpkgs = system: version:
import sources."nixos-${version}" (mkNixpkgsConfig system version);
### # All supported nixpkgs versions × systems, instanciated
nixpkgs = mapSingleFuse (s: mapSingleFuse (mkSystemNixpkgs s) nixpkgs'.versions) nixpkgs'.systems;
# Get the configured nixos version for the node,
# defaulting to the one defined in meta/nixpkgs
version = node: metadata.nodes.${node}.nixpkgs.version;
system = node: metadata.nodes.${node}.nixpkgs.system;
category = node: nixpkgs'.categories.${system node};
nodePkgs = node: nixpkgs.${system node}.${version node};
##########
# Function to create arguments based on the node # Function to create arguments based on the node
# #
mkArgs = node: rec { mkArgs = node: rec {
@ -80,11 +82,19 @@ let
}; };
sourcePkgs = nodePkgs node; sourcePkgs = nodePkgs node;
meta = (import ./meta) lib; meta = metadata;
nodeMeta = meta.nodes.${node}; nodeMeta = metadata.nodes.${node};
nodePath = "machines/${category node}/${node}"; nodePath = "machines/${category node}/${node}";
}; };
##########
# Module for each node (quite empty since almost everything is in the default module)
#
mkNode = node: {
deployment.systemType = system node;
};
in in
{ {
@ -95,7 +105,10 @@ in
specialArgs = { specialArgs = {
inherit nixpkgs sources; inherit nixpkgs sources;
dgn-keys = import ./keys; dgn-keys = import ./lib/keys {
meta = metadata;
inherit lib;
};
}; };
nodeSpecialArgs = mapSingleFuse mkArgs nodes; nodeSpecialArgs = mapSingleFuse mkArgs nodes;
@ -219,5 +232,6 @@ in
}; };
}; };
}; };
} }
// (mapSingleFuse mkNode nodes) // (mapSingleFuse mkNode nodes)

4
iso/configuration.nix
View file

@ -5,9 +5,9 @@
{ lib, pkgs, ... }: { lib, pkgs, ... }:
let let
dgn-keys = import ../keys; dgn-keys = import ../keys.nix;
dgn-members = (import ../meta lib).organization.groups.root; dgn-members = (import ../meta lib).config.organization.groups.root;
in in
{ {

13
keys.nix Normal file
View file

@ -0,0 +1,13 @@
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
let
_sources = import ../npins;
inherit (import _sources.nixpkgs { }) lib;
meta = (import ../meta lib).config;
in
import ./lib/keys { inherit meta lib; }

38
keys/default.nix → lib/keys/default.nix
View file

@ -1,20 +1,15 @@
# SPDX-FileCopyrightText: 2024 Ryan Lahfa <ryan.lahfa@dgnum.eu>
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu> # SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
# SPDX-FileContributor: Maurice Debray <maurice.debray@dgnum.eu>
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ meta, lib }:
let let
_sources = import ../npins; inherit (import ../nix-lib) setDefault unique;
inherit (import _sources.nixos-unstable { }) lib;
meta = import ../meta lib;
inherit (import ../lib/nix-lib) setDefault unique;
getAttr = lib.flip builtins.getAttr; getAttr = lib.flip builtins.getAttr;
in in
rec { rec {
_memberKeys = builtins.mapAttrs (_: v: v.sshKeys) meta.organization.members; _memberKeys = builtins.mapAttrs (_: v: v.sshKeys) meta.organization.members;
_builderKeys = builtins.mapAttrs (_: v: v.builderKeys) meta.organization.members; _builderKeys = builtins.mapAttrs (_: v: v.builderKeys) meta.organization.members;
@ -32,22 +27,25 @@ rec {
# List of keys for the root group # List of keys for the root group
rootKeys = getMemberKeys meta.organization.groups.root; rootKeys = getMemberKeys meta.organization.groups.root;
# All keys that can access a node # All admins for a node
getNodeKeys' = getNodeAdmins =
node: node:
let meta.organization.groups.root
names = [ node ] ++ ++ meta.nodes.${node}.admins
meta.nodes.${node}.admins ++ (builtins.concatMap (g: meta.organization.groups.${g}) meta.nodes.${node}.adminGroups);
++ (builtins.concatMap (g: meta.organization.groups.${g}) meta.nodes.${node}.adminGroups);
in # All keys needed for secret encryption
unique (getMemberKeys names ++ getNodeKeys [ node ]); getSecretKeys = node: unique (getMemberKeys (getNodeAdmins node) ++ getNodeKeys [ node ]);
# List of keys for all machines wide secrets # List of keys for all machines wide secrets
machineKeys = rootKeys ++ (getNodeKeys (builtins.attrNames meta.nodes)); machineKeys = rootKeys ++ (getNodeKeys (builtins.attrNames meta.nodes));
mkSecrets = nodes: setDefault { publicKeys = unique (builtins.concatMap getNodeKeys' nodes); }; mkSecrets = nodes: setDefault { publicKeys = unique (builtins.concatMap getSecretKeys nodes); };
machineKeysBySystem = system: machineKeysBySystem =
system:
rootKeys rootKeys
++ (getNodeKeys (builtins.attrNames (lib.filterAttrs (_: v: v.nixpkgs.system == system) meta.nodes))); ++ (getNodeKeys (
builtins.attrNames (lib.filterAttrs (_: v: v.nixpkgs.system == system) meta.nodes)
));
} }

2
machines/nixos/bridge01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "bridge01" ] [ "bridge01" ]
[ [
# List of secrets for bridge01 # List of secrets for bridge01

2
machines/nixos/build01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "build01" ] [ "build01" ]
[ [
"forgejo_runners-token_file" "forgejo_runners-token_file"

4
machines/nixos/compute01/extranix/default.nix
View file

@ -5,6 +5,7 @@
{ {
lib, lib,
sources, sources,
dgn-keys,
... ...
}: }:
let let
@ -68,6 +69,9 @@ in
meta = { meta = {
organization.groups.root = [ ]; organization.groups.root = [ ];
}; };
dgn-keys = dgn-keys // {
getNodeAdmins = _: [ ];
};
}; };
path-translations = [ path-translations = [
{ {

2
machines/nixos/compute01/kanidm/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../../keys).mkSecrets (import ../../../../../keys.nix).mkSecrets
[ "compute01" ] [ "compute01" ]
[ [
"kanidm-password_admin" "kanidm-password_admin"

2
machines/nixos/compute01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "compute01" ] [ "compute01" ]
[ [
# List of secrets for compute01 # List of secrets for compute01

2
machines/nixos/geo01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "geo01" ] [ "geo01" ]
[ [
# List of secrets for geo01 # List of secrets for geo01

2
machines/nixos/geo02/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "geo02" ] [ "geo02" ]
[ [
# List of secrets for geo02 # List of secrets for geo02

2
machines/nixos/hypervisor01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifer: EUPL-1.2 # SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "hypervisor01" ] [ "hypervisor01" ]
[ [

2
machines/nixos/hypervisor02/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifer: EUPL-1.2 # SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "hypervisor02" ] [ "hypervisor02" ]
[ [

2
machines/nixos/hypervisor03/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifer: EUPL-1.2 # SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "hypervisor03" ] [ "hypervisor03" ]
[ [

2
machines/nixos/rescue01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "rescue01" ] [ "rescue01" ]
[ [
# List of secrets for rescue01 # List of secrets for rescue01

2
machines/nixos/storage01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "storage01" ] [ "storage01" ]
[ [
# List of secrets for storage01 # List of secrets for storage01

3
machines/nixos/tower01/secrets/secrets.nix
View file

@ -2,7 +2,8 @@
# #
# SPDX-License-Identifer: EUPL-1.2 # SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "tower01" ] [ "tower01" ]
[ [
] ]

2
machines/nixos/vault01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "vault01" ] [ "vault01" ]
[ [
# List of secrets for vault01 # List of secrets for vault01

2
machines/nixos/web01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "web01" ] [ "web01" ]
[ [
# List of secrets for web01 # List of secrets for web01

2
machines/nixos/web02/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "web02" ] [ "web02" ]
[ [
# List of secrets for web02 # List of secrets for web02

2
machines/nixos/web03/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "web03" ] [ "web03" ]
[ [
# List of secrets for web03 # List of secrets for web03

8
meta/default.nix
View file

@ -12,11 +12,9 @@ lib:
(lib.evalModules { (lib.evalModules {
modules = [ modules = [
./options.nix ./options.nix
{ ./network.nix
network = import ./network.nix; ./nodes
nodes = import ./nodes; ./organization.nix
organization = import ./organization.nix;
}
]; ];
class = "dgnumMeta"; class = "dgnumMeta";
}).config }).config

488
meta/network.nix
View file

@ -6,304 +6,306 @@
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ {
bridge01 = { network = {
hostId = "f57f3ba0"; bridge01 = {
hostId = "f57f3ba0";
interfaces = { }; interfaces = { };
netbirdIp = null; netbirdIp = null;
};
build01 = {
interfaces = {
enp35s0f0np0 = {
ipv4 = [
{
address = "10.0.254.21";
prefixLength = 24;
}
];
gateways = [ "10.0.254.1" ];
enableDefaultDNS = true;
};
}; };
hostId = "adb676ce"; build01 = {
netbirdIp = "100.80.31.249"; interfaces = {
}; enp35s0f0np0 = {
ipv4 = [
{
address = "10.0.254.21";
prefixLength = 24;
}
];
compute01 = { gateways = [ "10.0.254.1" ];
interfaces = { enableDefaultDNS = true;
eno1 = { };
ipv4 = [
{
address = "129.199.146.147";
prefixLength = 24;
}
{
address = "192.168.1.147";
prefixLength = 24;
}
];
gateways = [ "129.199.146.254" ];
enableDefaultDNS = true;
}; };
hostId = "adb676ce";
netbirdIp = "100.80.31.249";
}; };
hostId = "8df60941"; compute01 = {
netbirdIp = "100.80.75.197"; interfaces = {
}; eno1 = {
ipv4 = [
{
address = "129.199.146.147";
prefixLength = 24;
}
{
address = "192.168.1.147";
prefixLength = 24;
}
];
geo01 = { gateways = [ "129.199.146.254" ];
interfaces = { enableDefaultDNS = true;
eno1 = { };
ipv4 = [
{
address = "129.199.210.194";
prefixLength = 24;
}
];
gateways = [ "129.199.210.254" ];
dns = [
"129.199.96.11"
"129.199.72.99"
];
}; };
hostId = "8df60941";
netbirdIp = "100.80.75.197";
}; };
hostId = "b88fee0c"; geo01 = {
netbirdIp = "100.80.8.66"; interfaces = {
}; eno1 = {
ipv4 = [
{
address = "129.199.210.194";
prefixLength = 24;
}
];
geo02 = { gateways = [ "129.199.210.254" ];
interfaces = {
eno1 = {
ipv4 = [
{
address = "129.199.210.69";
prefixLength = 24;
}
];
gateways = [ "129.199.210.254" ]; dns = [
"129.199.96.11"
dns = [ "129.199.72.99"
"129.199.96.11" ];
"129.199.72.99" };
];
}; };
hostId = "b88fee0c";
netbirdIp = "100.80.8.66";
}; };
hostId = "45d65237"; geo02 = {
netbirdIp = "100.80.233.249"; interfaces = {
}; eno1 = {
ipv4 = [
{
address = "129.199.210.69";
prefixLength = 24;
}
];
hypervisor01 = { gateways = [ "129.199.210.254" ];
interfaces = {
eno4 = {
ipv4 = [
{
address = "10.0.254.11";
prefixLength = 24;
}
];
gateways = [ "10.0.254.1" ]; dns = [
enableDefaultDNS = true; "129.199.96.11"
"129.199.72.99"
];
};
}; };
hostId = "45d65237";
netbirdIp = "100.80.233.249";
}; };
hostId = "4dbbd76a"; hypervisor01 = {
netbirdIp = "100.80.242.115"; interfaces = {
}; eno4 = {
ipv4 = [
{
address = "10.0.254.11";
prefixLength = 24;
}
];
hypervisor02 = { gateways = [ "10.0.254.1" ];
interfaces = { enableDefaultDNS = true;
eno4 = { };
ipv4 = [
{
address = "10.0.254.12";
prefixLength = 24;
}
];
gateways = [ "10.0.254.1" ];
enableDefaultDNS = true;
}; };
hostId = "4dbbd76a";
netbirdIp = "100.80.242.115";
}; };
hostId = "d0b48483"; hypervisor02 = {
netbirdIp = "100.80.37.202"; interfaces = {
}; eno4 = {
ipv4 = [
{
address = "10.0.254.12";
prefixLength = 24;
}
];
hypervisor03 = { gateways = [ "10.0.254.1" ];
interfaces = { enableDefaultDNS = true;
eno4 = { };
ipv4 = [
{
address = "10.0.254.13";
prefixLength = 24;
}
];
gateways = [ "10.0.254.1" ];
enableDefaultDNS = true;
}; };
hostId = "d0b48483";
netbirdIp = "100.80.37.202";
}; };
hostId = "1c407ea8"; hypervisor03 = {
netbirdIp = "100.80.58.178"; interfaces = {
}; eno4 = {
ipv4 = [
{
address = "10.0.254.13";
prefixLength = 24;
}
];
rescue01 = { gateways = [ "10.0.254.1" ];
interfaces = { enableDefaultDNS = true;
ens18 = { };
ipv6 = [
{
address = "2a01:e0a:de4:a0e1:2d73:2a7e:18db:5728";
prefixLength = 64;
}
];
ipv4 = [
{
address = "192.168.0.232";
prefixLength = 21;
}
];
gateways = [ "192.168.0.1" ];
enableDefaultDNS = true;
}; };
hostId = "1c407ea8";
netbirdIp = "100.80.58.178";
}; };
addresses.ipv4 = [ "82.67.34.230" ]; rescue01 = {
interfaces = {
ens18 = {
ipv6 = [
{
address = "2a01:e0a:de4:a0e1:2d73:2a7e:18db:5728";
prefixLength = 64;
}
];
hostId = "007f0200"; ipv4 = [
netbirdIp = "100.80.97.140"; {
}; address = "192.168.0.232";
prefixLength = 21;
storage01 = { }
interfaces = { ];
eno1 = { gateways = [ "192.168.0.1" ];
ipv4 = [ enableDefaultDNS = true;
{ };
address = "129.199.146.148";
prefixLength = 24;
}
{
address = "192.168.1.148";
prefixLength = 24;
}
];
gateways = [ "129.199.146.254" ];
enableDefaultDNS = true;
}; };
addresses.ipv4 = [ "82.67.34.230" ];
hostId = "007f0200";
netbirdIp = "100.80.97.140";
}; };
hostId = "d4e7c369"; storage01 = {
netbirdIp = "100.80.156.154"; interfaces = {
}; eno1 = {
ipv4 = [
{
address = "129.199.146.148";
prefixLength = 24;
}
{
address = "192.168.1.148";
prefixLength = 24;
}
];
tower01 = { gateways = [ "129.199.146.254" ];
interfaces = { enableDefaultDNS = true;
eno2 = { };
ipv4 = [
{
address = "129.199.210.119";
prefixLength = 24;
}
];
gateways = [ "129.199.210.254" ];
dns = [
"129.199.96.11"
"129.199.72.99"
];
}; };
hostId = "d4e7c369";
netbirdIp = "100.80.156.154";
}; };
hostId = "7874d06e"; tower01 = {
netbirdIp = "100.80.185.124"; interfaces = {
}; eno2 = {
ipv4 = [
{
address = "129.199.210.119";
prefixLength = 24;
}
];
vault01 = { gateways = [ "129.199.210.254" ];
interfaces = {
vlan-uplink-cri = { dns = [
ipv4 = [ "129.199.96.11"
{ "129.199.72.99"
# see also machines/vault01/networking.nix ];
address = "129.199.195.129"; };
prefixLength = 32;
}
];
gateways = [ ];
enableDefaultDNS = true;
}; };
hostId = "7874d06e";
netbirdIp = "100.80.185.124";
}; };
hostId = "e83b600d"; vault01 = {
netbirdIp = "100.80.255.180"; interfaces = {
}; vlan-uplink-cri = {
ipv4 = [
web01 = { {
interfaces = { # see also machines/vault01/networking.nix
ens3 = { address = "129.199.195.129";
ipv4 = [ prefixLength = 32;
{ }
address = "129.199.129.53"; ];
prefixLength = 24; gateways = [ ];
} enableDefaultDNS = true;
]; };
gateways = [ "129.199.129.1" ];
enableDefaultDNS = true;
}; };
hostId = "e83b600d";
netbirdIp = "100.80.255.180";
}; };
hostId = "050df79e"; web01 = {
netbirdIp = "100.80.77.90"; interfaces = {
}; ens3 = {
ipv4 = [
{
address = "129.199.129.53";
prefixLength = 24;
}
];
web02 = { gateways = [ "129.199.129.1" ];
interfaces = { enableDefaultDNS = true;
ens3 = { };
ipv4 = [
{
address = "129.199.129.235";
prefixLength = 24;
}
];
gateways = [ "129.199.129.1" ];
enableDefaultDNS = true;
}; };
hostId = "050df79e";
netbirdIp = "100.80.77.90";
}; };
hostId = "b431ca10"; web02 = {
netbirdIp = null; # web02 is not to be connected on the VPN interfaces = {
}; ens3 = {
ipv4 = [
{
address = "129.199.129.235";
prefixLength = 24;
}
];
web03 = { gateways = [ "129.199.129.1" ];
interfaces = { enableDefaultDNS = true;
enp1s0 = { };
ipv4 = [
{
address = "129.199.129.223";
prefixLength = 24;
}
];
gateways = [ "129.199.129.1" ];
enableDefaultDNS = true;
}; };
hostId = "b431ca10";
netbirdIp = null; # web02 is not to be connected on the VPN
}; };
hostId = "8afc7749"; web03 = {
netbirdIp = "100.80.157.46"; interfaces = {
enp1s0 = {
ipv4 = [
{
address = "129.199.129.223";
prefixLength = 24;
}
];
gateways = [ "129.199.129.1" ];
enableDefaultDNS = true;
};
};
hostId = "8afc7749";
netbirdIp = "100.80.157.46";
};
}; };
} }

13
meta/nodes/default.nix
View file

@ -2,9 +2,10 @@
# SPDX-FileContributor: Ryan Lahfa <ryan.lahfa@dgnum.eu> # SPDX-FileContributor: Ryan Lahfa <ryan.lahfa@dgnum.eu>
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{
builtins.foldl' (nodes: path: nodes // import path) { } [ imports = [
./liminix.nix ./liminix.nix
./nixos.nix ./nixos.nix
./netconf.nix ./netconf.nix
] ];
}

18
meta/nodes/liminix.nix
View file

@ -16,17 +16,19 @@
# } # }
{ {
ap01 = { nodes = {
site = "unknown"; ap01 = {
adminGroups = [ "fai" ]; site = "unknown";
adminGroups = [ "fai" ];
hashedPassword = "$y$j9T$DMOQEWOYFHjNS0myrXp4x/$MG33VSdXGvib.99eN.AbvyVdNNJw4ERjAwK4.ULJe/A"; hashedPassword = "$y$j9T$DMOQEWOYFHjNS0myrXp4x/$MG33VSdXGvib.99eN.AbvyVdNNJw4ERjAwK4.ULJe/A";
stateVersion = null; stateVersion = null;
nixpkgs = { nixpkgs = {
system = "zyxel-nwa50ax"; system = "zyxel-nwa50ax";
version = "24.05"; version = "24.05";
};
}; };
}; };
} }

110
meta/nodes/netconf.nix
View file

@ -2,78 +2,80 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ {
netcore01 = { nodes = {
site = "pot01"; netcore01 = {
site = "pot01";
hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0"; hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0";
stateVersion = null; stateVersion = null;
adminGroups = [ "fai" ]; adminGroups = [ "fai" ];
deployment = { deployment = {
targetHost = "fd26:baf9:d250:8000::100f"; targetHost = "fd26:baf9:d250:8000::100f";
sshOptions = [ sshOptions = [
"-J" "-J"
"root@vault01.hyp01.infra.dgnum.eu" "root@vault01.hyp01.infra.dgnum.eu"
"-p" "-p"
"830" "830"
]; ];
};
nixpkgs = {
version = "24.05"; # FIXME: meaningless
system = "netconf";
};
}; };
nixpkgs = { netcore02 = {
version = "24.05"; # FIXME: meaningless site = "hyp01";
system = "netconf";
};
};
netcore02 = { hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0";
site = "hyp01";
hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0"; stateVersion = null;
stateVersion = null; adminGroups = [ "fai" ];
adminGroups = [ "fai" ]; deployment = {
targetHost = "fd26:baf9:d250:8000::1001";
sshOptions = [
"-J"
"root@vault01.hyp01.infra.dgnum.eu"
"-p"
"830"
];
};
deployment = { nixpkgs = {
targetHost = "fd26:baf9:d250:8000::1001"; version = "24.05"; # FIXME: meaningless
sshOptions = [ system = "netconf";
"-J" };
"root@vault01.hyp01.infra.dgnum.eu"
"-p"
"830"
];
}; };
nixpkgs = { netaccess01 = {
version = "24.05"; # FIXME: meaningless site = "hyp02";
system = "netconf";
};
};
netaccess01 = { hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0";
site = "hyp02";
hashedPassword = "$6$BKetIIfT$JVyE0B7F4O.fJwQFu5jVrVExAZROrEMLW5HkDkhjMShJ9cRIgxSm2VM9OThDowsnLmAewqDN7eAY.EQt4UR4U0"; stateVersion = null;
stateVersion = null; adminGroups = [ "fai" ];
adminGroups = [ "fai" ]; deployment = {
targetHost = "fd26:baf9:d250:8000::2001";
sshOptions = [
"-J"
"root@vault01.hyp01.infra.dgnum.eu"
"-p"
"830"
];
};
deployment = { nixpkgs = {
targetHost = "fd26:baf9:d250:8000::2001"; version = "24.05"; # FIXME: meaningless
sshOptions = [ system = "netconf";
"-J" };
"root@vault01.hyp01.infra.dgnum.eu"
"-p"
"830"
];
};
nixpkgs = {
version = "24.05"; # FIXME: meaningless
system = "netconf";
}; };
}; };
} }

501
meta/nodes/nixos.nix
View file

@ -26,299 +26,294 @@
- luj01 -> VM de Luj - luj01 -> VM de Luj
*/ */
{ {
bridge01 = { nodes = {
site = "hyp01"; bridge01 = {
site = "hyp01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5bS3iBXz8wycBnTvI5Qi79WLu0h4IVv/EOdKYbP5y7" ]; sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5bS3iBXz8wycBnTvI5Qi79WLu0h4IVv/EOdKYbP5y7" ];
hashedPassword = "$y$j9T$EPJdz70kselouXAVUmAH01$8nYbUBY9NPTMfYigegY0qFSdxJwhqzW8sFacDqEYCP5"; hashedPassword = "$y$j9T$EPJdz70kselouXAVUmAH01$8nYbUBY9NPTMfYigegY0qFSdxJwhqzW8sFacDqEYCP5";
stateVersion = "24.05"; stateVersion = "24.05";
adminGroups = [ "fai" ]; adminGroups = [ "fai" ];
deployment = { deployment = {
targetHost = "fd26:baf9:d250:8000::ffff"; targetHost = "fd26:baf9:d250:8000::ffff";
sshOptions = [ sshOptions = [
"-J" "-J"
"root@vault01.hyp01.infra.dgnum.eu" "root@vault01.hyp01.infra.dgnum.eu"
];
};
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
build01 = {
site = "pot01";
hashedPassword = "$y$j9T$n83qOn1OkQhFwQe50tPM11$jZ1tvgqMTcp4HLGEfJmTMsf0NnRUYQkzco9vibWTpU2";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYJcEMQpOyKInqtd2/brnSQuzwgv6fNPlTSQx9tcvPu" ];
stateVersion = "24.11";
nixpkgs = {
version = "24.11";
system = "nixos";
};
admins = [ "ecoppens" ];
deployment = {
targetHost = "build01.dgnum";
};
};
compute01 = {
site = "pav01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/YluSVS+4h3oV8CIUj0OmquyJXju8aEQy0Jz210vTu" ];
hashedPassword = "$y$j9T$2nxZHq84G7fWvWMEaGavE/$0ADnmD9qMpXJJ.rWWH9086EakvZ3wAg0mSxZYugOf3C";
stateVersion = "23.05";
nix-modules = [ "services/stirling-pdf" ];
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
geo01 = {
site = "oik01";
deployment.tags = [ "geo" ];
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEl6Pubbau+usQkemymoSKrTBbrX8JU5m5qpZbhNx8p4" ];
hashedPassword = "$y$j9T$2XmDpJu.QLhV57yYCh5Lf1$LK.X0HKB02Q0Ujvhj5nIofW2IRrIAL/Uxnvl9AXM1L8";
deployment.targetHost = "geo01.dgnum";
stateVersion = "24.05";
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
geo02 = {
site = "oik01";
deployment.tags = [ "geo" ];
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNXaCS0/Nsu5npqQk1TP6wMHCVIOaj4pblp2tIg6Ket" ];
hashedPassword = "$y$j9T$Q4fbMpSm9beWu4DPNAR9t0$dx/1pH4GPY72LpS5ZiECXAZFDdxwmIywztsX.qo2VVA";
deployment.targetHost = "geo02.dgnum";
stateVersion = "24.05";
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
hypervisor01 = {
site = "pot01";
hashedPassword = "$y$j9T$Yw.M.epJj/sakb4Gq/9WV0$P85aQPo/FmFM1.ap413UL3vlGk3mavHwmaALKKDd4n.";
stateVersion = "24.11";
nixpkgs = {
version = "24.11";
system = "nixos";
};
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINPE0typcnvSioMfdLUloIfR5zcf/X0k6201xMHoQBCr" ];
adminGroups = [ "hypervisors" ];
deployment = {
targetHost = "hypervisor01.dgnum";
};
};
hypervisor02 = {
site = "pot01";
hashedPassword = "$y$j9T$Zu98DVlKq7KP5GmIHOwBy1$Bd7W6LstWDm8zjbZ9JSPLnhMFPmZgmU4e7t7u6EhavA";
stateVersion = "24.11";
nixpkgs = {
version = "24.11";
system = "nixos";
};
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPETkWlOfESXQic+HgfGLV/T4Nqg0WjdDbEqtgDwkH+S" ];
adminGroups = [ "hypervisors" ];
deployment = {
targetHost = "hypervisor02.dgnum";
};
};
hypervisor03 = {
site = "pot01";
hashedPassword = "$y$j9T$plTv9.UwmkTODagd4docj0$3zd35wPSsamygiYngwfDGICapKbx5UbzyLBhAwOUSfC";
stateVersion = "24.11";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFLF0mxSGitsDE3/YXfrHNjtOMUt4HT2MbryyUKPLSBI" ];
nixpkgs = {
version = "24.11";
system = "nixos";
};
adminGroups = [ "hypervisors" ];
deployment = {
targetHost = "hypervisor03.dgnum";
};
};
rescue01 = {
site = "luj01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJa02Annu8o7ggPjTH/9ttotdNGyghlWfU9E8pnuLUf" ];
deployment.targetHost = "v6.rescue01.luj01.infra.dgnum.eu";
hashedPassword = "$y$j9T$nqoMMu/axrD0m8AlUFdbs.$UFVmIdPAOHBe2jJv5HJJTcDgINC7LTnSGRQNs9zS1mC";
stateVersion = "23.11";
vm-cluster = "Hyperviseur Luj";
nixpkgs = {
version = "24.11";
system = "nixos";
};
nix-modules = [
"services/netbird/server.nix"
]; ];
}; };
nixpkgs = { storage01 = {
version = "24.11"; site = "pav01";
system = "nixos";
};
};
build01 = { sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA0s+rPcEcfWCqZ4B2oJiWT/60awOI8ijL1rtDM2glXZ" ];
site = "pot01";
hashedPassword = "$y$j9T$n83qOn1OkQhFwQe50tPM11$jZ1tvgqMTcp4HLGEfJmTMsf0NnRUYQkzco9vibWTpU2"; hashedPassword = "$y$j9T$tvRu1EJ9MwDSvEm0ogwe70$bKSw6nNteN0L3NOy2Yix7KlIvO/oROQmQ.Ynq002Fg8";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYJcEMQpOyKInqtd2/brnSQuzwgv6fNPlTSQx9tcvPu" ]; stateVersion = "23.11";
stateVersion = "24.11"; nixpkgs = {
version = "24.11";
system = "nixos";
};
nixpkgs = { nix-modules = [
version = "24.11"; "services/forgejo-nix-runners"
system = "nixos"; "services/netbird/server.nix"
};
admins = [ "ecoppens" ];
deployment = {
targetHost = "build01.dgnum";
};
};
compute01 = {
site = "pav01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/YluSVS+4h3oV8CIUj0OmquyJXju8aEQy0Jz210vTu" ];
hashedPassword = "$y$j9T$2nxZHq84G7fWvWMEaGavE/$0ADnmD9qMpXJJ.rWWH9086EakvZ3wAg0mSxZYugOf3C";
stateVersion = "23.05";
nix-modules = [ "services/stirling-pdf" ];
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
geo01 = {
site = "oik01";
deployment.tags = [ "geo" ];
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEl6Pubbau+usQkemymoSKrTBbrX8JU5m5qpZbhNx8p4" ];
hashedPassword = "$y$j9T$2XmDpJu.QLhV57yYCh5Lf1$LK.X0HKB02Q0Ujvhj5nIofW2IRrIAL/Uxnvl9AXM1L8";
deployment.targetHost = "geo01.dgnum";
stateVersion = "24.05";
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
geo02 = {
site = "oik01";
deployment.tags = [ "geo" ];
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNXaCS0/Nsu5npqQk1TP6wMHCVIOaj4pblp2tIg6Ket" ];
hashedPassword = "$y$j9T$Q4fbMpSm9beWu4DPNAR9t0$dx/1pH4GPY72LpS5ZiECXAZFDdxwmIywztsX.qo2VVA";
deployment.targetHost = "geo02.dgnum";
stateVersion = "24.05";
nixpkgs = {
version = "24.11";
system = "nixos";
};
};
hypervisor01 = {
site = "pot01";
hashedPassword = "$y$j9T$Yw.M.epJj/sakb4Gq/9WV0$P85aQPo/FmFM1.ap413UL3vlGk3mavHwmaALKKDd4n.";
stateVersion = "24.11";
nixpkgs = {
version = "24.11";
system = "nixos";
};
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINPE0typcnvSioMfdLUloIfR5zcf/X0k6201xMHoQBCr" ];
adminGroups = [ "hypervisors" ];
deployment = {
targetHost = "hypervisor01.dgnum";
};
};
hypervisor02 = {
site = "pot01";
hashedPassword = "$y$j9T$Zu98DVlKq7KP5GmIHOwBy1$Bd7W6LstWDm8zjbZ9JSPLnhMFPmZgmU4e7t7u6EhavA";
stateVersion = "24.11";
nixpkgs = {
version = "24.11";
system = "nixos";
};
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPETkWlOfESXQic+HgfGLV/T4Nqg0WjdDbEqtgDwkH+S" ];
adminGroups = [ "hypervisors" ];
deployment = {
targetHost = "hypervisor02.dgnum";
};
};
hypervisor03 = {
site = "pot01";
hashedPassword = "$y$j9T$plTv9.UwmkTODagd4docj0$3zd35wPSsamygiYngwfDGICapKbx5UbzyLBhAwOUSfC";
stateVersion = "24.11";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFLF0mxSGitsDE3/YXfrHNjtOMUt4HT2MbryyUKPLSBI" ];
nixpkgs = {
version = "24.11";
system = "nixos";
};
adminGroups = [ "hypervisors" ];
deployment = {
targetHost = "hypervisor03.dgnum";
};
};
rescue01 = {
site = "luj01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJa02Annu8o7ggPjTH/9ttotdNGyghlWfU9E8pnuLUf" ];
deployment.targetHost = "v6.rescue01.luj01.infra.dgnum.eu";
hashedPassword = "$y$j9T$nqoMMu/axrD0m8AlUFdbs.$UFVmIdPAOHBe2jJv5HJJTcDgINC7LTnSGRQNs9zS1mC";
stateVersion = "23.11";
vm-cluster = "Hyperviseur Luj";
nixpkgs = {
version = "24.11";
system = "nixos";
};
nix-modules = [
"services/netbird/server.nix"
];
};
storage01 = {
site = "pav01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA0s+rPcEcfWCqZ4B2oJiWT/60awOI8ijL1rtDM2glXZ" ];
hashedPassword = "$y$j9T$tvRu1EJ9MwDSvEm0ogwe70$bKSw6nNteN0L3NOy2Yix7KlIvO/oROQmQ.Ynq002Fg8";
stateVersion = "23.11";
nixpkgs = {
version = "24.11";
system = "nixos";
};
nix-modules = [
"services/netbird/server.nix"
];
};
tower01 = {
site = "oik01";
hashedPassword = "$y$j9T$axihKDa.CrYcyoamJWxBq1$bl4TfropTrwLqMy6XK0DKkWRyx9b74kyI/ukE8X5iiD";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVpR+TMRLGAfhn7Q0C3tKOydYYjfoC/e1ZYbKpby01Z"
];
stateVersion = "24.11";
nixpkgs = {
version = "24.11";
system = "nixos";
};
deployment = {
sshOptions = [
"-J"
"root@vault01.hyp01.infra.dgnum.eu"
]; ];
}; };
admins = [ "ecoppens" ]; tower01 = {
}; site = "oik01";
vault01 = { hashedPassword = "$y$j9T$axihKDa.CrYcyoamJWxBq1$bl4TfropTrwLqMy6XK0DKkWRyx9b74kyI/ukE8X5iiD";
site = "hyp01";
deployment.targetHost = "vault01.hyp01.infra.dgnum.eu";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJA6VA7LENvTRlKdcrqt8DxDOPvX3bg3Gjy9mNkdFEW" ]; sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVpR+TMRLGAfhn7Q0C3tKOydYYjfoC/e1ZYbKpby01Z"
];
hashedPassword = "$y$j9T$5osXVNxCDxu3jIndcyh7G.$UrjiDRpMu3W59tKHLGNdLWllZh.4p8IM4sBS5SrNrN1"; stateVersion = "24.11";
stateVersion = "23.11"; nixpkgs = {
version = "24.11";
system = "nixos";
};
nixpkgs = { admins = [ "ecoppens" ];
version = "24.11";
system = "nixos";
}; };
adminGroups = [ "fai" ]; vault01 = {
}; site = "hyp01";
deployment.targetHost = "vault01.hyp01.infra.dgnum.eu";
web01 = { sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJA6VA7LENvTRlKdcrqt8DxDOPvX3bg3Gjy9mNkdFEW" ];
site = "rat01";
deployment.tags = [ "web" ]; hashedPassword = "$y$j9T$5osXVNxCDxu3jIndcyh7G.$UrjiDRpMu3W59tKHLGNdLWllZh.4p8IM4sBS5SrNrN1";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPR+lewuJ/zhCyizJGJOH1UaAB699ItNKEaeuoK57LY5" ]; stateVersion = "23.11";
hashedPassword = "$y$j9T$9YqXO93VJE/GP3z8Sh4h51$hrBsEPL2O1eP/wBZTrNT8XV906V4JKbQ0g04IWBcyd2"; nixpkgs = {
version = "24.11";
system = "nixos";
};
stateVersion = "23.05"; adminGroups = [ "fai" ];
vm-cluster = "Hyperviseur NPS";
nixpkgs = {
version = "24.11";
system = "nixos";
}; };
};
web02 = { web01 = {
site = "rat01"; site = "rat01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID+QDE+GgZs6zONHvzRW15BzGJNW69k2BFZgB/Zh/tLX" ]; deployment.tags = [ "web" ];
hashedPassword = "$y$j9T$p42UVNy78PykkQOjPwXNJ/$B/zCUOrHXVSFGUY63wnViMiSmU2vCWsiX0y62qqgNQ5"; sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPR+lewuJ/zhCyizJGJOH1UaAB699ItNKEaeuoK57LY5" ];
stateVersion = "24.05"; hashedPassword = "$y$j9T$9YqXO93VJE/GP3z8Sh4h51$hrBsEPL2O1eP/wBZTrNT8XV906V4JKbQ0g04IWBcyd2";
vm-cluster = "Hyperviseur NPS";
nixpkgs = { stateVersion = "23.05";
version = "24.11"; vm-cluster = "Hyperviseur NPS";
system = "nixos";
nixpkgs = {
version = "24.11";
system = "nixos";
};
}; };
};
web03 = { web02 = {
site = "rat01"; site = "rat01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrWsMEfK86iaO9SubMqE2UvZNtHkLY5VUod/bbqKC0L" ]; sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID+QDE+GgZs6zONHvzRW15BzGJNW69k2BFZgB/Zh/tLX" ];
hashedPassword = "$y$j9T$Un/tcX5SPKNXG.sy/BcTa.$kyNHELjb1GAOWnauJfcjyVi5tacWcuEBKflZDCUC6x4"; hashedPassword = "$y$j9T$p42UVNy78PykkQOjPwXNJ/$B/zCUOrHXVSFGUY63wnViMiSmU2vCWsiX0y62qqgNQ5";
stateVersion = "24.05"; stateVersion = "24.05";
vm-cluster = "Hyperviseur NPS"; vm-cluster = "Hyperviseur NPS";
nixpkgs = { nixpkgs = {
version = "24.11"; version = "24.11";
system = "nixos"; system = "nixos";
};
};
web03 = {
site = "rat01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrWsMEfK86iaO9SubMqE2UvZNtHkLY5VUod/bbqKC0L" ];
hashedPassword = "$y$j9T$Un/tcX5SPKNXG.sy/BcTa.$kyNHELjb1GAOWnauJfcjyVi5tacWcuEBKflZDCUC6x4";
stateVersion = "24.05";
vm-cluster = "Hyperviseur NPS";
nixpkgs = {
version = "24.11";
system = "nixos";
};
}; };
}; };
} }

2
meta/organization.nix
View file

@ -13,6 +13,7 @@
*/ */
{ {
organization = {
members = { members = {
agroudiev = { agroudiev = {
name = "Antoine Groudiev"; name = "Antoine Groudiev";
@ -197,4 +198,5 @@
# Videos DGNum # Videos DGNum
peertube.admins = [ "thubrecht" ]; peertube.admins = [ "thubrecht" ];
}; };
};
} }

4
meta/verify.nix
View file

@ -6,8 +6,8 @@
# Nix expression to check if meta module is evaluating correctly. # Nix expression to check if meta module is evaluating correctly.
# To do so run `nix-build ./verify.nix` # To do so run `nix-build ./verify.nix`
let let
sources = import ../npins; sources = import ../sources.nix;
pkgs = import sources.nixos-unstable { }; pkgs = sources.bootstrapNixpkgs;
dns = import sources."dns.nix" { inherit pkgs; }; dns = import sources."dns.nix" { inherit pkgs; };
in in

10
modules/nixos/dgn-access-control.nix
View file

@ -5,12 +5,11 @@
{ {
config, config,
lib, lib,
name,
dgn-keys, dgn-keys,
meta,
nodeMeta, nodeMeta,
... ...
}: }:
let let
inherit (lib) inherit (lib)
mkDefault mkDefault
@ -22,11 +21,6 @@ let
types types
; ;
admins =
meta.organization.groups.root
++ nodeMeta.admins
++ (builtins.concatMap (g: meta.organization.groups.${g}) nodeMeta.adminGroups);
cfg = config.dgn-access-control; cfg = config.dgn-access-control;
in in
@ -53,7 +47,7 @@ in
config = mkIf cfg.enable { config = mkIf cfg.enable {
# Admins have root access to the node # Admins have root access to the node
dgn-access-control.users.root = mkDefault admins; dgn-access-control.users.root = mkDefault (dgn-keys.getNodeAdmins name);
users.mutableUsers = false; users.mutableUsers = false;
users.users = builtins.mapAttrs ( users.users = builtins.mapAttrs (
username: members: username: members:

2
modules/nixos/dgn-backups/keys/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ ] [ ]
[ [
"compute01.key" "compute01.key"

2
modules/nixos/dgn-netbox-agent/secrets/secrets.nix
View file

@ -2,4 +2,4 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ netbox-agent.publicKeys = (import ../../../../keys).machineKeysBySystem "nixos"; } { netbox-agent.publicKeys = (import ../../../../keys.nix).machineKeysBySystem "nixos"; }

2
modules/nixos/dgn-notify/secrets.nix
View file

@ -2,4 +2,4 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ mail.publicKeys = (import ../../../keys).machineKeysBySystem "nixos"; } { mail.publicKeys = (import ../../../keys.nix).machineKeysBySystem "nixos"; }

2
modules/nixos/dgn-records/secrets.nix
View file

@ -2,4 +2,4 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ __arkheon-token_file.publicKeys = (import ../../../keys).machineKeysBySystem "nixos"; } { __arkheon-token_file.publicKeys = (import ../../../keys.nix).machineKeysBySystem "nixos"; }

2
modules/nixos/dgn-s3/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../keys).mkSecrets (import ../../../keys.nix).mkSecrets
[ [
"storage01" "storage01"
"tower01" "tower01"

23
sources.nix Normal file
View file

@ -0,0 +1,23 @@
# SPDX-FileCopyrightText: 2024 Ryan Lahfa <ryan.lahfa@dgnum.eu>
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
# SPDX-FileContributor: Maurice Debray <maurice.debray@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
let
sources' = import ./npins;
bootstrapNixpkgs = import sources'.nixos-unstable { };
patch = (import ./lib/nix-patches { patchFile = ./patches; }).base {
pkgs = bootstrapNixpkgs;
};
sources = builtins.mapAttrs (
k: src:
patch.applyPatches {
inherit src;
name = k;
}
) sources';
in sources // { bootstrapNixpkgs = bootstrapNixpkgs; unpatchedSources = sources; }

2
workflows/eval-nodes.nix
View file

@ -7,7 +7,7 @@
let let
inherit (lib) attrNames genAttrs; inherit (lib) attrNames genAttrs;
nodes = attrNames (import ../meta/nodes); nodes = attrNames (import ../meta lib).nodes;
in in
{ {