DGNum/infrastructure
11
6
Fork 2
Code Issues 20 Pull requests 14 Projects 1 Releases Packages Wiki Activity Actions

chore: Refactor meta to a module architecture

Browse source 
Get rid of the weird half nix half module stuff.
This commit is contained in:
sinavir 2025-01-08 19:58:17 +01:00 • committed by Tom Hubrecht
parent 9d24c766f3
commit e0759140cc
Signed by: thubrecht
SSH key fingerprint: SHA256:CYNvFo44Ar9qCNnWNnvJVhs0QXO9AZjOLlPeWcSij3Q
39 changed files with 712 additions and 663 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -98,7 +98,7 @@ The general metadata is declared in `meta/nodes.nix`, the main values to declare
Create the directory `secrets` in the configuration folder, and add a `secrets.nix` file containing :
```nix
(import ../../../keys).mkSecrets [ "host02" ] [
(import ../../../keys.nix).mkSecrets [ "host02" ] [
# List of secrets for host02
]
```

4
default.nix
View file

@ -4,8 +4,8 @@
# SPDX-License-Identifier: EUPL-1.2
{
sources ? import ./npins,
pkgs ? import sources.nixos-unstable { },
sources ? import ./sources.nix,
pkgs ? sources.bootstrapNixpkgs,
}:
let

86
hive.nix
View file

@ -4,45 +4,33 @@
#
# SPDX-License-Identifier: EUPL-1.2
# TODO: change comments to ### \n # [text] \n #
let
sources' = import ./npins;
### Init some tooling
# Patch sources directly
sources =
builtins.mapAttrs (patch.base { pkgs = import sources'.nixos-unstable { }; }).applyPatches'
sources';
sources = import ./sources.nix;
inherit (sources) bootstrapNixpkgs;
lib = bootstrapNixpkgs.lib.extend (_: _: {
extra = import ./lib/nix-lib;
});
nix-lib = lib.extra; # TODO: Assess perf penalty of fixed point
# TODO same but using bootstrapnixpkgs for nix-lib instanciation
# original statement: import ./lib/nix-lib;
nix-lib = import ./lib/nix-lib;
inherit (nix-lib) mapSingleFuse;
patch = import ./lib/nix-patches { patchFile = ./patches; };
### Let's build meta
metadata = (import ./meta) lib;
nodes' = import ./meta/nodes;
nodes = builtins.attrNames nodes';
nodes = builtins.attrNames metadata.nodes;
mkNode = node: {
deployment.systemType = system node;
};
### Nixpkgs instanciation
nixpkgs' = import ./meta/nixpkgs.nix;
# All supported nixpkgs versions × systems, instanciated
nixpkgs = mapSingleFuse (s: mapSingleFuse (mkSystemNixpkgs s) nixpkgs'.versions) nixpkgs'.systems;
# Get the configured nixos version for the node,
# defaulting to the one defined in meta/nixpkgs
version = node: nodes'.${node}.nixpkgs.version;
system = node: nodes'.${node}.nixpkgs.system;
category = node: nixpkgs'.categories.${system node};
nodePkgs = node: nixpkgs.${system node}.${version node};
# Builds a patched version of nixpkgs, only as the source
mkNixpkgs' =
v:
patch.mkNixpkgsSrc rec {
src = sources'.${name};
name = "nixos-${v}";
};
# Build up the nixpkgs configuration for Liminix embedded systems
mkLiminixConfig =
@ -58,20 +46,34 @@ let
};
};
# Build up the arguments to instantiate a nixpkgs given a system and a version.
mkNixpkgsConfig =
system:
{
nixos = _: { };
nixos = _: { }; # TODO: add nix-pkgs overlay here
zyxel-nwa50ax = mkLiminixConfig system;
netconf = _: { };
}
.${system} or (throw "Unknown system: ${system} for nixpkgs configuration instantiation");
# Instanciates the required nixpkgs version
mkSystemNixpkgs = system: version: import (mkNixpkgs' version) (mkNixpkgsConfig system version);
mkSystemNixpkgs = system: version:
import sources."nixos-${version}" (mkNixpkgsConfig system version);
###
# All supported nixpkgs versions × systems, instanciated
nixpkgs = mapSingleFuse (s: mapSingleFuse (mkSystemNixpkgs s) nixpkgs'.versions) nixpkgs'.systems;
# Get the configured nixos version for the node,
# defaulting to the one defined in meta/nixpkgs
version = node: metadata.nodes.${node}.nixpkgs.version;
system = node: metadata.nodes.${node}.nixpkgs.system;
category = node: nixpkgs'.categories.${system node};
nodePkgs = node: nixpkgs.${system node}.${version node};
##########
# Function to create arguments based on the node
#
mkArgs = node: rec {
@ -80,11 +82,19 @@ let
};
sourcePkgs = nodePkgs node;
meta = (import ./meta) lib;
meta = metadata;
nodeMeta = meta.nodes.${node};
nodeMeta = metadata.nodes.${node};
nodePath = "machines/${category node}/${node}";
};
##########
# Module for each node (quite empty since almost everything is in the default module)
#
mkNode = node: {
deployment.systemType = system node;
};
in
{
@ -95,7 +105,10 @@ in
specialArgs = {
inherit nixpkgs sources;
dgn-keys = import ./keys;
dgn-keys = import ./lib/keys {
meta = metadata;
inherit lib;
};
};
nodeSpecialArgs = mapSingleFuse mkArgs nodes;
@ -219,5 +232,6 @@ in
};
};
};
}
// (mapSingleFuse mkNode nodes)

4
iso/configuration.nix
View file

@ -5,9 +5,9 @@
{ lib, pkgs, ... }:
let
dgn-keys = import ../keys;
dgn-keys = import ../keys.nix;
dgn-members = (import ../meta lib).organization.groups.root;
dgn-members = (import ../meta lib).config.organization.groups.root;
in
{

13
keys.nix Normal file
View file

@ -0,0 +1,13 @@
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
let
_sources = import ../npins;
inherit (import _sources.nixpkgs { }) lib;
meta = (import ../meta lib).config;
in
import ./lib/keys { inherit meta lib; }

36
keys/default.nix → lib/keys/default.nix
View file

@ -1,20 +1,15 @@
# SPDX-FileCopyrightText: 2024 Ryan Lahfa <ryan.lahfa@dgnum.eu>
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
# SPDX-FileContributor: Maurice Debray <maurice.debray@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
{ meta, lib }:
let
_sources = import ../npins;
inherit (import _sources.nixos-unstable { }) lib;
meta = import ../meta lib;
inherit (import ../lib/nix-lib) setDefault unique;
inherit (import ../nix-lib) setDefault unique;
getAttr = lib.flip builtins.getAttr;
in
rec {
_memberKeys = builtins.mapAttrs (_: v: v.sshKeys) meta.organization.members;
_builderKeys = builtins.mapAttrs (_: v: v.builderKeys) meta.organization.members;
@ -32,22 +27,25 @@ rec {
# List of keys for the root group
rootKeys = getMemberKeys meta.organization.groups.root;
# All keys that can access a node
getNodeKeys' =
# All admins for a node
getNodeAdmins =
node:
let
names = [ node ] ++
meta.nodes.${node}.admins
meta.organization.groups.root
++ meta.nodes.${node}.admins
++ (builtins.concatMap (g: meta.organization.groups.${g}) meta.nodes.${node}.adminGroups);
in
unique (getMemberKeys names ++ getNodeKeys [ node ]);
# All keys needed for secret encryption
getSecretKeys = node: unique (getMemberKeys (getNodeAdmins node) ++ getNodeKeys [ node ]);
# List of keys for all machines wide secrets
machineKeys = rootKeys ++ (getNodeKeys (builtins.attrNames meta.nodes));
mkSecrets = nodes: setDefault { publicKeys = unique (builtins.concatMap getNodeKeys' nodes); };
mkSecrets = nodes: setDefault { publicKeys = unique (builtins.concatMap getSecretKeys nodes); };
machineKeysBySystem = system:
machineKeysBySystem =
system:
rootKeys
++ (getNodeKeys (builtins.attrNames (lib.filterAttrs (_: v: v.nixpkgs.system == system) meta.nodes)));
++ (getNodeKeys (
builtins.attrNames (lib.filterAttrs (_: v: v.nixpkgs.system == system) meta.nodes)
));
}

2
machines/nixos/bridge01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "bridge01" ]
[
# List of secrets for bridge01

2
machines/nixos/build01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "build01" ]
[
"forgejo_runners-token_file"

4
machines/nixos/compute01/extranix/default.nix
View file

@ -5,6 +5,7 @@
{
lib,
sources,
dgn-keys,
...
}:
let
@ -68,6 +69,9 @@ in
meta = {
organization.groups.root = [ ];
};
dgn-keys = dgn-keys // {
getNodeAdmins = _: [ ];
};
};
path-translations = [
{

2
machines/nixos/compute01/kanidm/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../../../keys).mkSecrets
(import ../../../../../keys.nix).mkSecrets
[ "compute01" ]
[
"kanidm-password_admin"

2
machines/nixos/compute01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "compute01" ]
[
# List of secrets for compute01

2
machines/nixos/geo01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "geo01" ]
[
# List of secrets for geo01

2
machines/nixos/geo02/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "geo02" ]
[
# List of secrets for geo02

2
machines/nixos/hypervisor01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "hypervisor01" ]
[

2
machines/nixos/hypervisor02/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "hypervisor02" ]
[

2
machines/nixos/hypervisor03/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "hypervisor03" ]
[

2
machines/nixos/rescue01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "rescue01" ]
[
# List of secrets for rescue01

2
machines/nixos/storage01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "storage01" ]
[
# List of secrets for storage01

3
machines/nixos/tower01/secrets/secrets.nix
View file

@ -2,7 +2,8 @@
#
# SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "tower01" ]
[
]

2
machines/nixos/vault01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "vault01" ]
[
# List of secrets for vault01

2
machines/nixos/web01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "web01" ]
[
# List of secrets for web01

2
machines/nixos/web02/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "web02" ]
[
# List of secrets for web02

2
machines/nixos/web03/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ "web03" ]
[
# List of secrets for web03

8
meta/default.nix
View file

@ -12,11 +12,9 @@ lib:
(lib.evalModules {
modules = [
./options.nix
{
network = import ./network.nix;
nodes = import ./nodes;
organization = import ./organization.nix;
}
./network.nix
./nodes
./organization.nix
];
class = "dgnumMeta";
}).config

2
meta/network.nix
View file

@ -6,6 +6,7 @@
# SPDX-License-Identifier: EUPL-1.2
{
network = {
bridge01 = {
hostId = "f57f3ba0";
@ -306,4 +307,5 @@
hostId = "8afc7749";
netbirdIp = "100.80.157.46";
};
};
}

7
meta/nodes/default.nix
View file

@ -2,9 +2,10 @@
# SPDX-FileContributor: Ryan Lahfa <ryan.lahfa@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
builtins.foldl' (nodes: path: nodes // import path) { } [
{
imports = [
./liminix.nix
./nixos.nix
./netconf.nix
]
];
}

2
meta/nodes/liminix.nix
View file

@ -16,6 +16,7 @@
# }
{
nodes = {
ap01 = {
site = "unknown";
adminGroups = [ "fai" ];
@ -29,4 +30,5 @@
version = "24.05";
};
};
};
}

2
meta/nodes/netconf.nix
View file

@ -2,6 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
{
nodes = {
netcore01 = {
site = "pot01";
@ -76,4 +77,5 @@
system = "netconf";
};
};
};
}

11
meta/nodes/nixos.nix
View file

@ -26,6 +26,7 @@
- luj01 -> VM de Luj
*/
{
nodes = {
bridge01 = {
site = "hyp01";
@ -74,7 +75,6 @@
compute01 = {
site = "pav01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/YluSVS+4h3oV8CIUj0OmquyJXju8aEQy0Jz210vTu" ];
hashedPassword = "$y$j9T$2nxZHq84G7fWvWMEaGavE/$0ADnmD9qMpXJJ.rWWH9086EakvZ3wAg0mSxZYugOf3C";
@ -224,6 +224,7 @@
};
nix-modules = [
"services/forgejo-nix-runners"
"services/netbird/server.nix"
];
};
@ -244,13 +245,6 @@
system = "nixos";
};
deployment = {
sshOptions = [
"-J"
"root@vault01.hyp01.infra.dgnum.eu"
];
};
admins = [ "ecoppens" ];
};
@ -321,4 +315,5 @@
system = "nixos";
};
};
};
}

2
meta/organization.nix
View file

@ -13,6 +13,7 @@
*/
{
organization = {
members = {
agroudiev = {
name = "Antoine Groudiev";
@ -197,4 +198,5 @@
# Videos DGNum
peertube.admins = [ "thubrecht" ];
};
};
}

4
meta/verify.nix
View file

@ -6,8 +6,8 @@
# Nix expression to check if meta module is evaluating correctly.
# To do so run `nix-build ./verify.nix`
let
sources = import ../npins;
pkgs = import sources.nixos-unstable { };
sources = import ../sources.nix;
pkgs = sources.bootstrapNixpkgs;
dns = import sources."dns.nix" { inherit pkgs; };
in

10
modules/nixos/dgn-access-control.nix
View file

@ -5,12 +5,11 @@
{
config,
lib,
name,
dgn-keys,
meta,
nodeMeta,
...
}:
let
inherit (lib)
mkDefault
@ -22,11 +21,6 @@ let
types
;
admins =
meta.organization.groups.root
++ nodeMeta.admins
++ (builtins.concatMap (g: meta.organization.groups.${g}) nodeMeta.adminGroups);
cfg = config.dgn-access-control;
in
@ -53,7 +47,7 @@ in
config = mkIf cfg.enable {
# Admins have root access to the node
dgn-access-control.users.root = mkDefault admins;
dgn-access-control.users.root = mkDefault (dgn-keys.getNodeAdmins name);
users.mutableUsers = false;
users.users = builtins.mapAttrs (
username: members:

2
modules/nixos/dgn-backups/keys/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets
(import ../../../../keys.nix).mkSecrets
[ ]
[
"compute01.key"

2
modules/nixos/dgn-netbox-agent/secrets/secrets.nix
View file

@ -2,4 +2,4 @@
#
# SPDX-License-Identifier: EUPL-1.2
{ netbox-agent.publicKeys = (import ../../../../keys).machineKeysBySystem "nixos"; }
{ netbox-agent.publicKeys = (import ../../../../keys.nix).machineKeysBySystem "nixos"; }

2
modules/nixos/dgn-notify/secrets.nix
View file

@ -2,4 +2,4 @@
#
# SPDX-License-Identifier: EUPL-1.2
{ mail.publicKeys = (import ../../../keys).machineKeysBySystem "nixos"; }
{ mail.publicKeys = (import ../../../keys.nix).machineKeysBySystem "nixos"; }

2
modules/nixos/dgn-records/secrets.nix
View file

@ -2,4 +2,4 @@
#
# SPDX-License-Identifier: EUPL-1.2
{ __arkheon-token_file.publicKeys = (import ../../../keys).machineKeysBySystem "nixos"; }
{ __arkheon-token_file.publicKeys = (import ../../../keys.nix).machineKeysBySystem "nixos"; }

2
modules/nixos/dgn-s3/secrets.nix
View file

@ -2,7 +2,7 @@
#
# SPDX-License-Identifier: EUPL-1.2
(import ../../../keys).mkSecrets
(import ../../../keys.nix).mkSecrets
[
"storage01"
"tower01"

23
sources.nix Normal file
View file

@ -0,0 +1,23 @@
# SPDX-FileCopyrightText: 2024 Ryan Lahfa <ryan.lahfa@dgnum.eu>
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
# SPDX-FileContributor: Maurice Debray <maurice.debray@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
let
sources' = import ./npins;
bootstrapNixpkgs = import sources'.nixos-unstable { };
patch = (import ./lib/nix-patches { patchFile = ./patches; }).base {
pkgs = bootstrapNixpkgs;
};
sources = builtins.mapAttrs (
k: src:
patch.applyPatches {
inherit src;
name = k;
}
) sources';
in sources // { bootstrapNixpkgs = bootstrapNixpkgs; unpatchedSources = sources; }

2
workflows/eval-nodes.nix
View file

@ -7,7 +7,7 @@
let
inherit (lib) attrNames genAttrs;
nodes = attrNames (import ../meta/nodes);
nodes = attrNames (import ../meta lib).nodes;
in
{