DGNum/infrastructure
11
6
Fork 2
Code Issues 20 Pull requests 15 Projects 1 Releases Packages Wiki Activity Actions

meta rework #230

Closed
mdebray wants to merge 3 commits from meta_rework into main
pull from: meta_rework
merge into: DGNum:main
Conversation 6 Commits 3 Files changed 45 +952 -848
45 changed files with 952 additions and 848 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
README.md
View file

@ -98,7 +98,7 @@ The general metadata is declared in `meta/nodes.nix`, the main values to declare
Create the directory `secrets` in the configuration folder, and add a `secrets.nix` file containing : Create the directory `secrets` in the configuration folder, and add a `secrets.nix` file containing :
```nix ```nix
(import ../../../keys).mkSecrets [ "host02" ] [ (import ../../../keys.nix).mkSecrets [ "host02" ] [
# List of secrets for host02 # List of secrets for host02
] ]
``` ```

4
default.nix
View file

@ -4,8 +4,8 @@
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ {
sources ? import ./npins, sources ? import ./sources.nix,
pkgs ? import sources.nixos-unstable { }, pkgs ? sources.bootstrapNixpkgs,
}: }:
let let

82
hive.nix
View file

@ -4,45 +4,25 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
# TODO: change comments to ### \n # [text] \n #
let let
sources' = import ./npins; ### Init some tooling
# Patch sources directly sources = import ./sources.nix;
sources =
builtins.mapAttrs (patch.base { pkgs = import sources'.nixos-unstable { }; }).applyPatches'
sources';
nix-lib = import ./lib/nix-lib; lib = sources.fullLib;
inherit (nix-lib) mapSingleFuse;
patch = import ./lib/nix-patches { patchFile = ./patches; }; inherit (lib.extra) mapSingleFuse;
nodes' = import ./meta/nodes; ### Let's build meta
nodes = builtins.attrNames nodes'; metadata = (import ./meta) lib;
mkNode = node: { nodes = builtins.attrNames metadata.nodes;
deployment.systemType = system node;
}; ### Nixpkgs instanciation
nixpkgs' = import ./meta/nixpkgs.nix; nixpkgs' = import ./meta/nixpkgs.nix;
# All supported nixpkgs versions × systems, instanciated
nixpkgs = mapSingleFuse (s: mapSingleFuse (mkSystemNixpkgs s) nixpkgs'.versions) nixpkgs'.systems;
# Get the configured nixos version for the node,
# defaulting to the one defined in meta/nixpkgs
version = node: nodes'.${node}.nixpkgs.version;
system = node: nodes'.${node}.nixpkgs.system;
category = node: nixpkgs'.categories.${system node};
nodePkgs = node: nixpkgs.${system node}.${version node};
# Builds a patched version of nixpkgs, only as the source
mkNixpkgs' =
v:
patch.mkNixpkgsSrc rec {
src = sources'.${name};
name = "nixos-${v}";
};
# Build up the nixpkgs configuration for Liminix embedded systems # Build up the nixpkgs configuration for Liminix embedded systems
mkLiminixConfig = mkLiminixConfig =
@ -62,29 +42,47 @@ let
mkNixpkgsConfig = mkNixpkgsConfig =
system: system:
{ {
nixos = _: { }; nixos = _: { }; # TODO: add nix-pkgs overlay here
zyxel-nwa50ax = mkLiminixConfig system; zyxel-nwa50ax = mkLiminixConfig system;
netconf = _: { }; netconf = _: { };
} }
.${system} or (throw "Unknown system: ${system} for nixpkgs configuration instantiation"); .${system} or (throw "Unknown system: ${system} for nixpkgs configuration instantiation");
# Instanciates the required nixpkgs version # Instanciates the required nixpkgs version
mkSystemNixpkgs = system: version: import (mkNixpkgs' version) (mkNixpkgsConfig system version); mkSystemNixpkgs =
system: version: import sources."nixos-${version}" (mkNixpkgsConfig system version);
### # All supported nixpkgs versions × systems, instanciated
nixpkgs = mapSingleFuse (s: mapSingleFuse (mkSystemNixpkgs s) nixpkgs'.versions) nixpkgs'.systems;
# Get the configured nixos version for the node,
# defaulting to the one defined in meta/nixpkgs
version = node: metadata.nodes.${node}.nixpkgs.version;
system = node: metadata.nodes.${node}.nixpkgs.system;
category = node: nixpkgs'.categories.${system node};
nodePkgs = node: nixpkgs.${system node}.${version node};
##########
# Function to create arguments based on the node # Function to create arguments based on the node
# #
mkArgs = node: rec { mkArgs = node: rec {
lib = sourcePkgs.lib // { lib = sourcePkgs.lib.extend sources.libOverlay;
extra = nix-lib;
};
sourcePkgs = nodePkgs node; sourcePkgs = nodePkgs node;
meta = (import ./meta) lib; meta = metadata;
nodeMeta = meta.nodes.${node}; nodeMeta = metadata.nodes.${node};
nodePath = "machines/${category node}/${node}"; nodePath = "machines/${category node}/${node}";
}; };
##########
# Module for each node (quite empty since almost everything is in the default module)
#
mkNode = node: {
deployment.systemType = system node;
};
in in
{ {
@ -95,7 +93,10 @@ in
specialArgs = { specialArgs = {
inherit nixpkgs sources; inherit nixpkgs sources;
dgn-keys = import ./keys; dgn-keys = import ./lib/keys {
meta = metadata;
inherit lib;
};
}; };
nodeSpecialArgs = mapSingleFuse mkArgs nodes; nodeSpecialArgs = mapSingleFuse mkArgs nodes;
@ -219,5 +220,6 @@ in
}; };
}; };
}; };
} }
// (mapSingleFuse mkNode nodes) // (mapSingleFuse mkNode nodes)

4
iso/configuration.nix
View file

@ -5,9 +5,9 @@
{ lib, pkgs, ... }: { lib, pkgs, ... }:
let let
dgn-keys = import ../keys; dgn-keys = import ../keys.nix;
dgn-members = (import ../meta lib).organization.groups.root; dgn-members = (import ../meta lib).config.organization.groups.root;
in in
{ {

13
keys.nix Normal file
View file

@ -0,0 +1,13 @@
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
let
sources = import ./sources.nix;
lib = sources.fullLib;
meta = (import ../meta lib).config;
in
import ./lib/keys { inherit meta lib; }

111
keys/default.nix
View file

@ -1,111 +0,0 @@
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
let
_sources = import ../npins;
inherit (import _sources.nixos-unstable { }) lib;
meta = import ../meta lib;
getAttr = flip builtins.getAttr;
inherit (import ../lib/nix-lib) flip setDefault unique;
in
rec {
# WARNING: When updating this list, make sure that the nodes and members are alphabetically sorted
# If not, you will face an angry maintainer
_keys = {
# SSH keys of the nodes
bridge01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5bS3iBXz8wycBnTvI5Qi79WLu0h4IVv/EOdKYbP5y7" ];
build01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYJcEMQpOyKInqtd2/brnSQuzwgv6fNPlTSQx9tcvPu" ];
compute01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/YluSVS+4h3oV8CIUj0OmquyJXju8aEQy0Jz210vTu" ];
geo01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEl6Pubbau+usQkemymoSKrTBbrX8JU5m5qpZbhNx8p4" ];
geo02 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNXaCS0/Nsu5npqQk1TP6wMHCVIOaj4pblp2tIg6Ket" ];
hypervisor01 = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINPE0typcnvSioMfdLUloIfR5zcf/X0k6201xMHoQBCr"
];
hypervisor02 = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPETkWlOfESXQic+HgfGLV/T4Nqg0WjdDbEqtgDwkH+S"
];
hypervisor03 = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFLF0mxSGitsDE3/YXfrHNjtOMUt4HT2MbryyUKPLSBI"
];
rescue01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJa02Annu8o7ggPjTH/9ttotdNGyghlWfU9E8pnuLUf" ];
storage01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA0s+rPcEcfWCqZ4B2oJiWT/60awOI8ijL1rtDM2glXZ" ];
tower01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVpR+TMRLGAfhn7Q0C3tKOydYYjfoC/e1ZYbKpby01Z" ];
vault01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJA6VA7LENvTRlKdcrqt8DxDOPvX3bg3Gjy9mNkdFEW" ];
web01 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPR+lewuJ/zhCyizJGJOH1UaAB699ItNKEaeuoK57LY5" ];
web02 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID+QDE+GgZs6zONHvzRW15BzGJNW69k2BFZgB/Zh/tLX" ];
web03 = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrWsMEfK86iaO9SubMqE2UvZNtHkLY5VUod/bbqKC0L" ];
# SSH keys of the DGNum members
agroudiev = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDgyt3ntpcoI/I2n97R1hzjBiNL6R98S73fSi7pkSE/8mQbI8r9GzsPUBcxQ+tIg0FgwkLxTwF8DwLf0E+Le/rPznxBS5LUQaAktSQSrxz/IIID1+jN8b03vf5PjfKS8H2Tu3Q8jZXa8HNsj3cpySpGMqGrE3ieUmknd/YfppRRf+wM4CsGKZeS3ZhB9oZi3Jn22A0U/17AOJTnv4seq+mRZWRQt3pvQvpp8/2M7kEqizie/gTr/DnwxUr45wisqYYH4tat9Cw6iDr7LK10VCrK37BfFagMIZ08Hkh3c46jghjYNQWe+mBUWJByWYhTJ0AtYrbaYeUV1HVYbsRJ6bNx25K6794QQPaE/vc2Z/VK/ILgvJ+9myFSAWVylCWdyYpwUu07RH/jDBl2aqH62ESwAG7SDUUcte6h9N+EryAQLWc8OhsGAYLpshhBpiqZwzX90m+nkbhx1SqMbtt6TS+RPDEHKFYn8E6FBrf1FK34482ndq/hHXZ88mqzGb1nOnM="
];
catvayor = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA16foz+XzwKwyIR4wFgNIAE3Y7AfXyEsUZFVVz8Rie catvayor@katvayor"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFfIJ8BToZ9EDxBsEJXQhUju7gm+rUDjGCNMvFSZCl1o openpgp:0x5CADCA1B"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdOxx4I8BSbYPdouvuzDepwTwzQzGSBCNIV8TB5dduT openpgp:0xF6018131"
];
cst1 = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrijwPlb7KQkYPLznMPVzPPT69cLzhEsJzZi9tmxzTh cst1@x270"
];
ecoppens = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGmU7yEOCGuGNt4PlQbzd0Cms1RePpo8yEA7Ij/+TdA" ];
gdd = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICE7TN5NQKGojNGIeTFiHjLHTDQGT8i05JFqX/zLW2zc"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFbkPWWZzOBaRdx4+7xQUgxDwuncSl2fxAeVuYfVUPZ"
];
jemagius = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOoxmou5OU74GgpIUkhVt6GiB+O9Jy4ge0TwK5MDFJ2F"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxQX0JLRah3GfIOkua4ZhEJhp5Ykv55RO0SPrSUwCBs5arnALg8gq12YLr09t4bzW/NA9/jn7flhh4S54l4RwBUhmV4JSQhGu71KGhfOj5ZBkDoSyYqzbu206DfZP5eQonSmjfP6XghcWOr/jlBzw9YAAQkFxsQgXEkr4kdn0ZXfZGz6b0t3YUjYIuDNbptFsGz2V9iQVy1vnxrjnLSfc25j4et8z729Vpy4M7oCaE6a6hgon4V1jhVbg43NAE5gu2eYFAPIzO3E7ZI8WjyLu1wtOBClk1f+HMen3Tr+SX2PXmpPGb+I2fAkbzu/C4X/M3+2bL1dYjxuvQhvvpAjxFwmdoXW4gWJ3J/FRiFrKsiAY0rYC+yi8SfacJWCv4EEcV/yQ4gYwpmU9xImLaro6w5cOHGCqrzYqjZc4Wi6AWFGeBSNzNs9PXLgMRWeUyiIDOFnSep2ebZeVjTB16m+o/YDEhE10uX9kCCx3Dy/41iJ1ps7V4JWGFsr0Fqaz8mu8="
];
luj = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMBW7rTtfZL9wtrpCVgariKdpN60/VeAzXkh9w3MwbO julien@enigma"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGa+7n7kNzb86pTqaMn554KiPrkHRGeTJ0asY1NjSbpr julien@tower"
];
mboyer = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGYnwZaFYvUxtJeNvpaA20rLfq8fOO4dFp7cIXsD8YNx" ];
mdebray = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEpwF+XD3HgX64kqD42pcEZRNYAWoO4YNiOm5KO4tH6o maurice@polaris"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdDnSl3cyWil+S5JiyGqOvBR3wVh+lduw58S5WvraoL maurice@fekda"
];
raito = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcEkYM1r8QVNM/G5CxJInEdoBCWjEHHDdHlzDYNSUIdHHsn04QY+XI67AdMCm8w30GZnLUIj5RiJEWXREUApby0GrfxGGcy8otforygfgtmuUKAUEHdU2MMwrQI7RtTZ8oQ0USRGuqvmegxz3l5caVU7qGvBllJ4NUHXrkZSja2/51vq80RF4MKkDGiz7xUTixI2UcBwQBCA/kQedKV9G28EH+1XfvePqmMivZjl+7VyHsgUVj9eRGA1XWFw59UPZG8a7VkxO/Eb3K9NF297HUAcFMcbY6cPFi9AaBgu3VC4eetDnoN/+xT1owiHi7BReQhGAy/6cdf7C/my5ehZwD"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0xMwWedkKosax9+7D2OlnMxFL/eV4CvFZLsbLptpXr"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKiXXYkhRh+s7ixZ8rvG8ntIqd6FELQ9hh7HoaHQJRPU"
];
thubrecht = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+EZXYziiaynJX99EW8KesnmRTZMof3BoIs3mdEl8L3"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHL4M4HKjs4cjRAYRk9pmmI8U0R4+T/jQh6Fxp/i1Eoy"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPM1jpXR7BWQa7Sed7ii3SbvIPRRlKb3G91qC0vOwfJn"
];
};
getKeys = ls: builtins.concatLists (builtins.map (getAttr _keys) ls);
mkSecrets =
nodes: setDefault { publicKeys = unique (rootKeys ++ (builtins.concatMap getNodeKeys' nodes)); };
getNodeKeys' =
node:
let
names = builtins.foldl' (names: group: names ++ meta.organization.groups.${group}) (
meta.nodes.${node}.admins ++ [ node ]
) meta.nodes.${node}.adminGroups;
in
unique (getKeys names);
getNodeKeys = node: rootKeys ++ getNodeKeys' node;
# List of keys for the root group
rootKeys = getKeys meta.organization.groups.root;
# List of 'machine' keys
machineKeys = rootKeys ++ (getKeys (builtins.attrNames meta.nodes));
nixosMachineKeys =
rootKeys
++ (getKeys (builtins.attrNames (lib.filterAttrs (_: v: v.nixpkgs.system == "nixos") meta.nodes)));
}

47
lib/keys/default.nix Normal file
View file

@ -0,0 +1,47 @@
# SPDX-FileCopyrightText: 2024 Ryan Lahfa <ryan.lahfa@dgnum.eu>
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
# SPDX-FileContributor: Maurice Debray <maurice.debray@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
{ meta, lib }:
let
inherit (lib.extra) setDefault unique;
getAttr = lib.flip builtins.getAttr;
in
rec {
_memberKeys = builtins.mapAttrs (_: v: v.sshKeys) meta.organization.members;
_nodeKeys = builtins.mapAttrs (_: v: v.sshKeys) meta.nodes;
# Get keys of the users
getMemberKeys = name: builtins.concatLists (builtins.map (getAttr _memberKeys) name);
# Get keys of the ssh server
getNodeKeys = name: builtins.concatLists (builtins.map (getAttr _nodeKeys) name);
# List of keys for the root group
rootKeys = getMemberKeys meta.organization.groups.root;
# All admins for a node
getNodeAdmins =
node:
meta.organization.groups.root
++ meta.nodes.${node}.admins
++ (builtins.concatMap (g: meta.organization.groups.${g}) meta.nodes.${node}.adminGroups);
mdebray marked this conversation as resolved Outdated
thubrecht commented 2025-01-16 12:44:33 +01:00
Outdated
Review
Copy link

Tu oublies complètement adminGroups

Tu oublies complètement `adminGroups`
# All keys needed for secret encryption
getSecretKeys = node: unique (getMemberKeys (getNodeAdmins node) ++ getNodeKeys [ node ]);
# List of keys for all machines wide secrets
machineKeys = rootKeys ++ (getNodeKeys (builtins.attrNames meta.nodes));
mkSecrets = nodes: setDefault { publicKeys = unique (builtins.concatMap getSecretKeys nodes); };
machineKeysBySystem =
system:
rootKeys
++ (getNodeKeys (
builtins.attrNames (lib.filterAttrs (_: v: v.nixpkgs.system == system) meta.nodes)
));
}

17
lib/nix-lib/default.nix
View file

@ -2,17 +2,13 @@
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu> # SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ lib }:
let
# Reimplement optional functions
_optional =
default: b: value:
if b then value else default;
in
rec { rec {
inherit (import ./nixpkgs.nix) inherit (lib)
flip flip
optionals
optionalString
hasPrefix hasPrefix
recursiveUpdate recursiveUpdate
splitString splitString
@ -112,11 +108,8 @@ rec {
subAttrs = attrs: builtins.map (subAttr attrs); subAttrs = attrs: builtins.map (subAttr attrs);
optionalList = _optional [ ]; optionalList = optionals;
optionalAttrs = _optional { };
optionalString = _optional "";
/* /*
Same as fuseAttrs but using `lib.recursiveUpdate` to merge attribute Same as fuseAttrs but using `lib.recursiveUpdate` to merge attribute
sets together. sets together.

2
machines/nixos/bridge01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "bridge01" ] [ "bridge01" ]
[ [
# List of secrets for bridge01 # List of secrets for bridge01

2
machines/nixos/build01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "build01" ] [ "build01" ]
[ [
"forgejo_runners-token_file" "forgejo_runners-token_file"

4
machines/nixos/compute01/extranix/default.nix
View file

@ -5,6 +5,7 @@
{ {
lib, lib,
sources, sources,
dgn-keys,
... ...
}: }:
let let
@ -68,6 +69,9 @@ in
meta = { meta = {
organization.groups.root = [ ]; organization.groups.root = [ ];
}; };
dgn-keys = dgn-keys // {
getNodeAdmins = _: [ ];
};
}; };
path-translations = [ path-translations = [
{ {

2
machines/nixos/compute01/kanidm/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../../keys).mkSecrets (import ../../../../../keys.nix).mkSecrets
[ "compute01" ] [ "compute01" ]
[ [
"kanidm-password_admin" "kanidm-password_admin"

2
machines/nixos/compute01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "compute01" ] [ "compute01" ]
[ [
# List of secrets for compute01 # List of secrets for compute01

2
machines/nixos/geo01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "geo01" ] [ "geo01" ]
[ [
# List of secrets for geo01 # List of secrets for geo01

2
machines/nixos/geo02/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "geo02" ] [ "geo02" ]
[ [
# List of secrets for geo02 # List of secrets for geo02

2
machines/nixos/hypervisor01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifer: EUPL-1.2 # SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "hypervisor01" ] [ "hypervisor01" ]
[ [

2
machines/nixos/hypervisor02/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifer: EUPL-1.2 # SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "hypervisor02" ] [ "hypervisor02" ]
[ [

2
machines/nixos/hypervisor03/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifer: EUPL-1.2 # SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "hypervisor03" ] [ "hypervisor03" ]
[ [

2
machines/nixos/rescue01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "rescue01" ] [ "rescue01" ]
[ [
# List of secrets for rescue01 # List of secrets for rescue01

2
machines/nixos/storage01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "storage01" ] [ "storage01" ]
[ [
# List of secrets for storage01 # List of secrets for storage01

3
machines/nixos/tower01/secrets/secrets.nix
View file

@ -2,7 +2,8 @@
# #
# SPDX-License-Identifer: EUPL-1.2 # SPDX-License-Identifer: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "tower01" ] [ "tower01" ]
[ [
] ]

2
machines/nixos/vault01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "vault01" ] [ "vault01" ]
[ [
# List of secrets for vault01 # List of secrets for vault01

2
machines/nixos/web01/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "web01" ] [ "web01" ]
[ [
# List of secrets for web01 # List of secrets for web01

2
machines/nixos/web02/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "web02" ] [ "web02" ]
[ [
# List of secrets for web02 # List of secrets for web02

2
machines/nixos/web03/secrets/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ "web03" ] [ "web03" ]
[ [
# List of secrets for web03 # List of secrets for web03

8
meta/default.nix
View file

@ -12,11 +12,9 @@ lib:
(lib.evalModules { (lib.evalModules {
modules = [ modules = [
./options.nix ./options.nix
{ ./network.nix
network = import ./network.nix; ./nodes
nodes = import ./nodes; ./organization.nix
organization = import ./organization.nix;
}
]; ];
class = "dgnumMeta"; class = "dgnumMeta";
}).config }).config

2
meta/network.nix
View file

@ -6,6 +6,7 @@
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ {
network = {
bridge01 = { bridge01 = {
hostId = "f57f3ba0"; hostId = "f57f3ba0";
@ -306,4 +307,5 @@
hostId = "8afc7749"; hostId = "8afc7749";
netbirdIp = "100.80.157.46"; netbirdIp = "100.80.157.46";
}; };
};
} }

7
meta/nodes/default.nix
View file

@ -2,9 +2,10 @@
# SPDX-FileContributor: Ryan Lahfa <ryan.lahfa@dgnum.eu> # SPDX-FileContributor: Ryan Lahfa <ryan.lahfa@dgnum.eu>
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{
builtins.foldl' (nodes: path: nodes // import path) { } [ imports = [
./liminix.nix ./liminix.nix
./nixos.nix ./nixos.nix
./netconf.nix ./netconf.nix
] ];
}

2
meta/nodes/liminix.nix
View file

@ -16,6 +16,7 @@
# } # }
{ {
nodes = {
ap01 = { ap01 = {
site = "unknown"; site = "unknown";
adminGroups = [ "fai" ]; adminGroups = [ "fai" ];
@ -29,4 +30,5 @@
version = "24.05"; version = "24.05";
}; };
}; };
};
} }

2
meta/nodes/netconf.nix
View file

@ -2,6 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ {
nodes = {
netcore02 = { netcore02 = {
site = "hyp01"; site = "hyp01";
@ -46,4 +47,5 @@
# system = "netconf"; # system = "netconf";
# }; # };
# }; # };
};
} }

48
meta/nodes/nixos.nix
View file

@ -26,9 +26,12 @@
- luj01 -> VM de Luj - luj01 -> VM de Luj
*/ */
{ {
nodes = {
bridge01 = { bridge01 = {
site = "hyp01"; site = "hyp01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIP5bS3iBXz8wycBnTvI5Qi79WLu0h4IVv/EOdKYbP5y7" ];
hashedPassword = "$y$j9T$EPJdz70kselouXAVUmAH01$8nYbUBY9NPTMfYigegY0qFSdxJwhqzW8sFacDqEYCP5"; hashedPassword = "$y$j9T$EPJdz70kselouXAVUmAH01$8nYbUBY9NPTMfYigegY0qFSdxJwhqzW8sFacDqEYCP5";
stateVersion = "24.05"; stateVersion = "24.05";
@ -54,6 +57,8 @@
hashedPassword = "$y$j9T$n83qOn1OkQhFwQe50tPM11$jZ1tvgqMTcp4HLGEfJmTMsf0NnRUYQkzco9vibWTpU2"; hashedPassword = "$y$j9T$n83qOn1OkQhFwQe50tPM11$jZ1tvgqMTcp4HLGEfJmTMsf0NnRUYQkzco9vibWTpU2";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYJcEMQpOyKInqtd2/brnSQuzwgv6fNPlTSQx9tcvPu" ];
stateVersion = "24.11"; stateVersion = "24.11";
nixpkgs = { nixpkgs = {
@ -70,6 +75,7 @@
compute01 = { compute01 = {
site = "pav01"; site = "pav01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE/YluSVS+4h3oV8CIUj0OmquyJXju8aEQy0Jz210vTu" ];
hashedPassword = "$y$j9T$2nxZHq84G7fWvWMEaGavE/$0ADnmD9qMpXJJ.rWWH9086EakvZ3wAg0mSxZYugOf3C"; hashedPassword = "$y$j9T$2nxZHq84G7fWvWMEaGavE/$0ADnmD9qMpXJJ.rWWH9086EakvZ3wAg0mSxZYugOf3C";
@ -86,8 +92,12 @@
site = "oik01"; site = "oik01";
deployment.tags = [ "geo" ]; deployment.tags = [ "geo" ];
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEl6Pubbau+usQkemymoSKrTBbrX8JU5m5qpZbhNx8p4" ];
hashedPassword = "$y$j9T$2XmDpJu.QLhV57yYCh5Lf1$LK.X0HKB02Q0Ujvhj5nIofW2IRrIAL/Uxnvl9AXM1L8"; hashedPassword = "$y$j9T$2XmDpJu.QLhV57yYCh5Lf1$LK.X0HKB02Q0Ujvhj5nIofW2IRrIAL/Uxnvl9AXM1L8";
deployment.targetHost = "geo01.dgnum";
stateVersion = "24.05"; stateVersion = "24.05";
nixpkgs = { nixpkgs = {
@ -100,8 +110,12 @@
site = "oik01"; site = "oik01";
deployment.tags = [ "geo" ]; deployment.tags = [ "geo" ];
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFNXaCS0/Nsu5npqQk1TP6wMHCVIOaj4pblp2tIg6Ket" ];
hashedPassword = "$y$j9T$Q4fbMpSm9beWu4DPNAR9t0$dx/1pH4GPY72LpS5ZiECXAZFDdxwmIywztsX.qo2VVA"; hashedPassword = "$y$j9T$Q4fbMpSm9beWu4DPNAR9t0$dx/1pH4GPY72LpS5ZiECXAZFDdxwmIywztsX.qo2VVA";
deployment.targetHost = "geo02.dgnum";
stateVersion = "24.05"; stateVersion = "24.05";
nixpkgs = { nixpkgs = {
@ -122,6 +136,8 @@
system = "nixos"; system = "nixos";
}; };
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINPE0typcnvSioMfdLUloIfR5zcf/X0k6201xMHoQBCr" ];
adminGroups = [ "hypervisors" ]; adminGroups = [ "hypervisors" ];
deployment = { deployment = {
@ -141,6 +157,8 @@
system = "nixos"; system = "nixos";
}; };
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPETkWlOfESXQic+HgfGLV/T4Nqg0WjdDbEqtgDwkH+S" ];
adminGroups = [ "hypervisors" ]; adminGroups = [ "hypervisors" ];
deployment = { deployment = {
@ -155,6 +173,8 @@
stateVersion = "24.11"; stateVersion = "24.11";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFLF0mxSGitsDE3/YXfrHNjtOMUt4HT2MbryyUKPLSBI" ];
nixpkgs = { nixpkgs = {
version = "24.11"; version = "24.11";
system = "nixos"; system = "nixos";
@ -170,6 +190,8 @@
rescue01 = { rescue01 = {
site = "luj01"; site = "luj01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJa02Annu8o7ggPjTH/9ttotdNGyghlWfU9E8pnuLUf" ];
deployment.targetHost = "v6.rescue01.luj01.infra.dgnum.eu"; deployment.targetHost = "v6.rescue01.luj01.infra.dgnum.eu";
hashedPassword = "$y$j9T$nqoMMu/axrD0m8AlUFdbs.$UFVmIdPAOHBe2jJv5HJJTcDgINC7LTnSGRQNs9zS1mC"; hashedPassword = "$y$j9T$nqoMMu/axrD0m8AlUFdbs.$UFVmIdPAOHBe2jJv5HJJTcDgINC7LTnSGRQNs9zS1mC";
@ -181,11 +203,16 @@
version = "24.11"; version = "24.11";
system = "nixos"; system = "nixos";
}; };
nix-modules = [
"services/netbird/server.nix"
];
}; };
storage01 = { storage01 = {
site = "pav01"; site = "pav01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA0s+rPcEcfWCqZ4B2oJiWT/60awOI8ijL1rtDM2glXZ" ];
hashedPassword = "$y$j9T$tvRu1EJ9MwDSvEm0ogwe70$bKSw6nNteN0L3NOy2Yix7KlIvO/oROQmQ.Ynq002Fg8"; hashedPassword = "$y$j9T$tvRu1EJ9MwDSvEm0ogwe70$bKSw6nNteN0L3NOy2Yix7KlIvO/oROQmQ.Ynq002Fg8";
stateVersion = "23.11"; stateVersion = "23.11";
@ -196,6 +223,7 @@
}; };
nix-modules = [ nix-modules = [
"services/forgejo-nix-runners"
"services/netbird/server.nix" "services/netbird/server.nix"
]; ];
}; };
@ -205,6 +233,10 @@
hashedPassword = "$y$j9T$axihKDa.CrYcyoamJWxBq1$bl4TfropTrwLqMy6XK0DKkWRyx9b74kyI/ukE8X5iiD"; hashedPassword = "$y$j9T$axihKDa.CrYcyoamJWxBq1$bl4TfropTrwLqMy6XK0DKkWRyx9b74kyI/ukE8X5iiD";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICVpR+TMRLGAfhn7Q0C3tKOydYYjfoC/e1ZYbKpby01Z"
];
stateVersion = "24.11"; stateVersion = "24.11";
nixpkgs = { nixpkgs = {
@ -212,13 +244,6 @@
system = "nixos"; system = "nixos";
}; };
deployment = {
sshOptions = [
"-J"
"root@vault01.hyp01.infra.dgnum.eu"
];
};
admins = [ "ecoppens" ]; admins = [ "ecoppens" ];
}; };
@ -226,6 +251,8 @@
site = "hyp01"; site = "hyp01";
deployment.targetHost = "vault01.hyp01.infra.dgnum.eu"; deployment.targetHost = "vault01.hyp01.infra.dgnum.eu";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAJA6VA7LENvTRlKdcrqt8DxDOPvX3bg3Gjy9mNkdFEW" ];
hashedPassword = "$y$j9T$5osXVNxCDxu3jIndcyh7G.$UrjiDRpMu3W59tKHLGNdLWllZh.4p8IM4sBS5SrNrN1"; hashedPassword = "$y$j9T$5osXVNxCDxu3jIndcyh7G.$UrjiDRpMu3W59tKHLGNdLWllZh.4p8IM4sBS5SrNrN1";
stateVersion = "23.11"; stateVersion = "23.11";
@ -243,6 +270,8 @@
deployment.tags = [ "web" ]; deployment.tags = [ "web" ];
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPR+lewuJ/zhCyizJGJOH1UaAB699ItNKEaeuoK57LY5" ];
hashedPassword = "$y$j9T$9YqXO93VJE/GP3z8Sh4h51$hrBsEPL2O1eP/wBZTrNT8XV906V4JKbQ0g04IWBcyd2"; hashedPassword = "$y$j9T$9YqXO93VJE/GP3z8Sh4h51$hrBsEPL2O1eP/wBZTrNT8XV906V4JKbQ0g04IWBcyd2";
stateVersion = "23.05"; stateVersion = "23.05";
@ -257,6 +286,8 @@
web02 = { web02 = {
site = "rat01"; site = "rat01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID+QDE+GgZs6zONHvzRW15BzGJNW69k2BFZgB/Zh/tLX" ];
hashedPassword = "$y$j9T$p42UVNy78PykkQOjPwXNJ/$B/zCUOrHXVSFGUY63wnViMiSmU2vCWsiX0y62qqgNQ5"; hashedPassword = "$y$j9T$p42UVNy78PykkQOjPwXNJ/$B/zCUOrHXVSFGUY63wnViMiSmU2vCWsiX0y62qqgNQ5";
stateVersion = "24.05"; stateVersion = "24.05";
@ -271,6 +302,8 @@
web03 = { web03 = {
site = "rat01"; site = "rat01";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICrWsMEfK86iaO9SubMqE2UvZNtHkLY5VUod/bbqKC0L" ];
hashedPassword = "$y$j9T$Un/tcX5SPKNXG.sy/BcTa.$kyNHELjb1GAOWnauJfcjyVi5tacWcuEBKflZDCUC6x4"; hashedPassword = "$y$j9T$Un/tcX5SPKNXG.sy/BcTa.$kyNHELjb1GAOWnauJfcjyVi5tacWcuEBKflZDCUC6x4";
stateVersion = "24.05"; stateVersion = "24.05";
@ -281,4 +314,5 @@
system = "nixos"; system = "nixos";
}; };
}; };
};
} }

61
meta/options.nix
View file

@ -22,6 +22,8 @@ let
ints ints
listOf listOf
nullOr nullOr
positive
singleLineStr
str str
submodule submodule
unspecified unspecified
@ -42,6 +44,22 @@ let
}; };
}; };
vpnKeyType = submodule {
options = {
id = mkOption {
type = positive;
description = ''
Unique ID that will be used to guess IP address
'';
};
key = mkOption {
type = str;
description = ''
Public key of the user for this VPN
'';
};
};
};
org = config.organization; org = config.organization;
nixpkgs = import ./nixpkgs.nix; nixpkgs = import ./nixpkgs.nix;
in in
@ -77,6 +95,24 @@ in
WARNING: Must be the same as the ens login! WARNING: Must be the same as the ens login!
''; '';
}; };
sshKeys = lib.mkOption {
type = listOf singleLineStr;
description = ''
A list of verbatim OpenSSH public keys that should be added to the
user's authorized keys.
'';
example = [
"ssh-rsa AAAAB3NzaC1yc2etc/etc/etcjwrsh8e596z6J0l7 example@host"
"ssh-ed25519 AAAAC3NzaCetcetera/etceteraJZMfk3QPfQ foo@bar"
];
};
vpnKeys = mkOption {
type = attrsOf vpnKeyType;
default = { };
description = "Attribute sets to define vpn keys of the user";
};
}; };
} }
) )
@ -179,6 +215,18 @@ in
''; '';
}; };
sshKeys = lib.mkOption {
type = listOf singleLineStr;
default = [ ];
description = ''
A list of verbatim OpenSSH public keys used by the machine ssh server.
'';
example = [
"ssh-rsa AAAAB3NzaC1yc2etc/etc/etcjwrsh8e596z6J0l7 example@host"
"ssh-ed25519 AAAAC3NzaCetcetera/etceteraJZMfk3QPfQ foo@bar"
];
};
admins = mkOption { admins = mkOption {
type = listOf str; type = listOf str;
default = [ ]; default = [ ];
@ -329,6 +377,13 @@ in
IP address of the node in the netbird network. IP address of the node in the netbird network.
''; '';
}; };
vpnKeys = mkOption {
type = attrsOf vpnKeyType;
default = { };
description = "Attribute sets to define vpn keys of the machine";
};
}; };
config = config =
@ -414,12 +469,6 @@ in
(membersExists ( (membersExists (
name: "A member of the external service ${name} admins was not found in the members list." name: "A member of the external service ${name} admins was not found in the members list."
) org.external) ) org.external)
# Check that all members have ssh keys
(builtins.map (name: {
assertion = ((import ../keys)._keys.${name} or [ ]) != [ ];
message = "No ssh keys found for ${name}.";
}) members)
]; ];
}; };
} }

37
meta/organization.nix
View file

@ -13,61 +13,97 @@
*/ */
{ {
organization = {
members = { members = {
agroudiev = { agroudiev = {
name = "Antoine Groudiev"; name = "Antoine Groudiev";
email = "antoine.groudiev@dgnum.eu"; email = "antoine.groudiev@dgnum.eu";
sshKeys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDgyt3ntpcoI/I2n97R1hzjBiNL6R98S73fSi7pkSE/8mQbI8r9GzsPUBcxQ+tIg0FgwkLxTwF8DwLf0E+Le/rPznxBS5LUQaAktSQSrxz/IIID1+jN8b03vf5PjfKS8H2Tu3Q8jZXa8HNsj3cpySpGMqGrE3ieUmknd/YfppRRf+wM4CsGKZeS3ZhB9oZi3Jn22A0U/17AOJTnv4seq+mRZWRQt3pvQvpp8/2M7kEqizie/gTr/DnwxUr45wisqYYH4tat9Cw6iDr7LK10VCrK37BfFagMIZ08Hkh3c46jghjYNQWe+mBUWJByWYhTJ0AtYrbaYeUV1HVYbsRJ6bNx25K6794QQPaE/vc2Z/VK/ILgvJ+9myFSAWVylCWdyYpwUu07RH/jDBl2aqH62ESwAG7SDUUcte6h9N+EryAQLWc8OhsGAYLpshhBpiqZwzX90m+nkbhx1SqMbtt6TS+RPDEHKFYn8E6FBrf1FK34482ndq/hHXZ88mqzGb1nOnM="
];
}; };
catvayor = { catvayor = {
name = "Lubin Bailly"; name = "Lubin Bailly";
email = "catvayor@dgnum.eu"; email = "catvayor@dgnum.eu";
username = "lbailly"; username = "lbailly";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAA16foz+XzwKwyIR4wFgNIAE3Y7AfXyEsUZFVVz8Rie catvayor@katvayor"
mdebray marked this conversation as resolved Outdated
thubrecht commented 2025-01-16 12:40:33 +01:00
Outdated
Review
Copy link

Ses nouvelles clés SSH ont été drop durant le rebase

Ses nouvelles clés SSH ont été drop durant le rebase
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFfIJ8BToZ9EDxBsEJXQhUju7gm+rUDjGCNMvFSZCl1o openpgp:0x5CADCA1B"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdOxx4I8BSbYPdouvuzDepwTwzQzGSBCNIV8TB5dduT openpgp:0xF6018131"
];
}; };
cst1 = { cst1 = {
name = "Constantin Gierczak--Galle"; name = "Constantin Gierczak--Galle";
email = "cst1@dgnum.eu"; email = "cst1@dgnum.eu";
username = "cgierczakgalle"; username = "cgierczakgalle";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrijwPlb7KQkYPLznMPVzPPT69cLzhEsJzZi9tmxzTh cst1@x270"
];
}; };
ecoppens = { ecoppens = {
name = "Elias Coppens"; name = "Elias Coppens";
email = "ecoppens@dgnum.eu"; email = "ecoppens@dgnum.eu";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIGmU7yEOCGuGNt4PlQbzd0Cms1RePpo8yEA7Ij/+TdA" ];
}; };
jemagius = { jemagius = {
name = "Jean-Marc Gailis"; name = "Jean-Marc Gailis";
email = "jm@dgnum.eu"; email = "jm@dgnum.eu";
username = "jgailis"; username = "jgailis";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOoxmou5OU74GgpIUkhVt6GiB+O9Jy4ge0TwK5MDFJ2F"
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCxQX0JLRah3GfIOkua4ZhEJhp5Ykv55RO0SPrSUwCBs5arnALg8gq12YLr09t4bzW/NA9/jn7flhh4S54l4RwBUhmV4JSQhGu71KGhfOj5ZBkDoSyYqzbu206DfZP5eQonSmjfP6XghcWOr/jlBzw9YAAQkFxsQgXEkr4kdn0ZXfZGz6b0t3YUjYIuDNbptFsGz2V9iQVy1vnxrjnLSfc25j4et8z729Vpy4M7oCaE6a6hgon4V1jhVbg43NAE5gu2eYFAPIzO3E7ZI8WjyLu1wtOBClk1f+HMen3Tr+SX2PXmpPGb+I2fAkbzu/C4X/M3+2bL1dYjxuvQhvvpAjxFwmdoXW4gWJ3J/FRiFrKsiAY0rYC+yi8SfacJWCv4EEcV/yQ4gYwpmU9xImLaro6w5cOHGCqrzYqjZc4Wi6AWFGeBSNzNs9PXLgMRWeUyiIDOFnSep2ebZeVjTB16m+o/YDEhE10uX9kCCx3Dy/41iJ1ps7V4JWGFsr0Fqaz8mu8="
];
}; };
luj = { luj = {
name = "Julien Malka"; name = "Julien Malka";
email = "luj@dgnum.eu"; email = "luj@dgnum.eu";
username = "jmalka"; username = "jmalka";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMBW7rTtfZL9wtrpCVgariKdpN60/VeAzXkh9w3MwbO julien@enigma"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGa+7n7kNzb86pTqaMn554KiPrkHRGeTJ0asY1NjSbpr julien@tower"
];
}; };
mboyer = { mboyer = {
name = "Matthieu Boyer"; name = "Matthieu Boyer";
email = "matthieu.boyer@dgnum.eu"; email = "matthieu.boyer@dgnum.eu";
username = "mboyer02"; username = "mboyer02";
sshKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGYnwZaFYvUxtJeNvpaA20rLfq8fOO4dFp7cIXsD8YNx" ];
}; };
mdebray = { mdebray = {
name = "Maurice Debray"; name = "Maurice Debray";
email = "maurice.debray@dgnum.eu"; email = "maurice.debray@dgnum.eu";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEpwF+XD3HgX64kqD42pcEZRNYAWoO4YNiOm5KO4tH6o maurice@polaris"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdDnSl3cyWil+S5JiyGqOvBR3wVh+lduw58S5WvraoL maurice@fekda"
];
}; };
raito = { raito = {
name = "Ryan Lahfa"; name = "Ryan Lahfa";
email = "ryan@dgnum.eu"; email = "ryan@dgnum.eu";
username = "rlahfa"; username = "rlahfa";
sshKeys = [
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcEkYM1r8QVNM/G5CxJInEdoBCWjEHHDdHlzDYNSUIdHHsn04QY+XI67AdMCm8w30GZnLUIj5RiJEWXREUApby0GrfxGGcy8otforygfgtmuUKAUEHdU2MMwrQI7RtTZ8oQ0USRGuqvmegxz3l5caVU7qGvBllJ4NUHXrkZSja2/51vq80RF4MKkDGiz7xUTixI2UcBwQBCA/kQedKV9G28EH+1XfvePqmMivZjl+7VyHsgUVj9eRGA1XWFw59UPZG8a7VkxO/Eb3K9NF297HUAcFMcbY6cPFi9AaBgu3VC4eetDnoN/+xT1owiHi7BReQhGAy/6cdf7C/my5ehZwD"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0xMwWedkKosax9+7D2OlnMxFL/eV4CvFZLsbLptpXr"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKiXXYkhRh+s7ixZ8rvG8ntIqd6FELQ9hh7HoaHQJRPU"
];
}; };
thubrecht = { thubrecht = {
name = "Tom Hubrecht"; name = "Tom Hubrecht";
email = "tom.hubrecht@dgnum.eu"; email = "tom.hubrecht@dgnum.eu";
sshKeys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL+EZXYziiaynJX99EW8KesnmRTZMof3BoIs3mdEl8L3"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHL4M4HKjs4cjRAYRk9pmmI8U0R4+T/jQh6Fxp/i1Eoy"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPM1jpXR7BWQa7Sed7ii3SbvIPRRlKb3G91qC0vOwfJn"
];
}; };
}; };
@ -138,4 +174,5 @@
# Videos DGNum # Videos DGNum
peertube.admins = [ "thubrecht" ]; peertube.admins = [ "thubrecht" ];
}; };
};
} }

8
meta/verify.nix
View file

@ -6,8 +6,8 @@
# Nix expression to check if meta module is evaluating correctly. # Nix expression to check if meta module is evaluating correctly.
# To do so run `nix-build ./verify.nix` # To do so run `nix-build ./verify.nix`
let let
sources = import ../npins; sources = import ../sources.nix;
pkgs = import sources.nixos-unstable { }; pkgs = sources.bootstrapNixpkgs;
dns = import sources."dns.nix" { inherit pkgs; }; dns = import sources."dns.nix" { inherit pkgs; };
in in
@ -32,9 +32,7 @@ in
import ./dns.nix { import ./dns.nix {
inherit dns; inherit dns;
lib = pkgs.lib // { lib = sources.fullLib;
extra = import ../lib/nix-lib;
};
} }
) )
); );

2
modules/liminix/dgn-access-control.nix
View file

@ -56,7 +56,7 @@ in
# Admins have root access to the node # Admins have root access to the node
dgn-access-control.users.root = mkDefault admins; dgn-access-control.users.root = mkDefault admins;
users = builtins.mapAttrs (_: members: { users = builtins.mapAttrs (_: members: {
openssh.authorizedKeys.keys = dgn-keys.getKeys members; openssh.authorizedKeys.keys = dgn-keys.getMemberKeys members;
}) cfg.users; }) cfg.users;
}; };
} }

2
modules/netconf/dgn-access-control.nix
View file

@ -56,7 +56,7 @@ in
dgn-access-control.root = mkDefault admins; dgn-access-control.root = mkDefault admins;
system = { system = {
root-authentication = { root-authentication = {
ssh-keys = dgn-keys.getKeys cfg.root; ssh-keys = dgn-keys.getMemberKeys cfg.root;
hashedPasswd = nodeMeta.hashedPassword; hashedPasswd = nodeMeta.hashedPassword;
}; };
services.ssh.root-login = mkDefault "deny-password"; services.ssh.root-login = mkDefault "deny-password";

12
modules/nixos/dgn-access-control.nix
View file

@ -5,12 +5,11 @@
{ {
config, config,
lib, lib,
name,
dgn-keys, dgn-keys,
meta,
nodeMeta, nodeMeta,
... ...
}: }:
let let
inherit (lib) inherit (lib)
mkDefault mkDefault
@ -22,11 +21,6 @@ let
types types
; ;
admins =
meta.organization.groups.root
++ nodeMeta.admins
++ (builtins.concatMap (g: meta.organization.groups.${g}) nodeMeta.adminGroups);
cfg = config.dgn-access-control; cfg = config.dgn-access-control;
in in
@ -53,13 +47,13 @@ in
config = mkIf cfg.enable { config = mkIf cfg.enable {
# Admins have root access to the node # Admins have root access to the node
dgn-access-control.users.root = mkDefault admins; dgn-access-control.users.root = mkDefault (dgn-keys.getNodeAdmins name);
users.mutableUsers = false; users.mutableUsers = false;
users.users = builtins.mapAttrs ( users.users = builtins.mapAttrs (
username: members: username: members:
{ {
isNormalUser = lib.mkIf (username != "root") true; isNormalUser = lib.mkIf (username != "root") true;
openssh.authorizedKeys.keys = dgn-keys.getKeys members; openssh.authorizedKeys.keys = dgn-keys.getMemberKeys members;
} }
// optionalAttrs (username == "root") { inherit (nodeMeta) hashedPassword; } // optionalAttrs (username == "root") { inherit (nodeMeta) hashedPassword; }
) cfg.users; ) cfg.users;

4
modules/nixos/dgn-backups/default.nix
View file

@ -114,7 +114,7 @@ in
access = [ access = [
{ {
repo = "default"; repo = "default";
keys = dgn-keys.getKeys [ keys = dgn-keys.getNodeKeys [
"compute01" "compute01"
"storage01" "storage01"
"vault01" "vault01"
@ -131,7 +131,7 @@ in
}; };
programs.ssh.knownHosts = programs.ssh.knownHosts =
lib.extra.mapFuse (host: { "${host}.dgnum".publicKey = builtins.head dgn-keys._keys.${host}; }) lib.extra.mapFuse (host: { "${host}.dgnum".publicKey = builtins.head dgn-keys._nodeKeys.${host}; })
[ [
"compute01" "compute01"
"geo01" "geo01"

2
modules/nixos/dgn-backups/keys/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../../keys).mkSecrets (import ../../../../keys.nix).mkSecrets
[ ] [ ]
[ [
"compute01.key" "compute01.key"

2
modules/nixos/dgn-netbox-agent/secrets/secrets.nix
View file

@ -2,4 +2,4 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ netbox-agent.publicKeys = (import ../../../../keys).nixosMachineKeys; } { netbox-agent.publicKeys = (import ../../../../keys.nix).machineKeysBySystem "nixos"; }

2
modules/nixos/dgn-notify/secrets.nix
View file

@ -2,4 +2,4 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ mail.publicKeys = (import ../../../keys).nixosMachineKeys; } { mail.publicKeys = (import ../../../keys.nix).machineKeysBySystem "nixos"; }

2
modules/nixos/dgn-records/secrets.nix
View file

@ -2,4 +2,4 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
{ __arkheon-token_file.publicKeys = (import ../../../keys).nixosMachineKeys; } { __arkheon-token_file.publicKeys = (import ../../../keys.nix).machineKeysBySystem "nixos"; }

2
modules/nixos/dgn-s3/secrets.nix
View file

@ -2,7 +2,7 @@
# #
# SPDX-License-Identifier: EUPL-1.2 # SPDX-License-Identifier: EUPL-1.2
(import ../../../keys).mkSecrets (import ../../../keys.nix).mkSecrets
[ [
"storage01" "storage01"
"tower01" "tower01"

38
sources.nix Normal file
View file

@ -0,0 +1,38 @@
# SPDX-FileCopyrightText: 2024 Ryan Lahfa <ryan.lahfa@dgnum.eu>
# SPDX-FileCopyrightText: 2024 Tom Hubrecht <tom.hubrecht@dgnum.eu>
# SPDX-FileContributor: Maurice Debray <maurice.debray@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2
let
unpatchedSources = import ./npins;
thubrecht commented 2025-01-16 12:41:50 +01:00
Outdated
Review
Copy link

sources et patchedSources plutôt

`sources` et `patchedSources` plutôt
thubrecht commented 2025-01-23 23:45:00 +01:00
Review
Copy link

__rawSources = import ./npins;

__rawSources = import ./npins;
bootstrapNixpkgs = import unpatchedSources.nixos-unstable { };
thubrecht commented 2025-01-23 23:45:36 +01:00
Review
Copy link

pkgs = import __rawSources.nixos-unstable { };

pkgs = import __rawSources.nixos-unstable { };
patch = (import ./lib/nix-patches { patchFile = ./patches; }).base {
pkgs = bootstrapNixpkgs;
thubrecht commented 2025-01-23 23:46:04 +01:00
Review
Copy link

inherit pkgs;

inherit pkgs;
};
sources = builtins.mapAttrs (
k: src:
patch.applyPatches {
inherit src;
name = k;
}
) unpatchedSources;
libOverlay = final: _: {
extra = import ./lib/nix-lib { lib = final; };
};
in
sources
// {
inherit
bootstrapNixpkgs
libOverlay
unpatchedSources
;
fullLib = bootstrapNixpkgs.lib.extend libOverlay;
}
thubrecht commented 2025-01-23 23:54:26 +01:00
Review
Copy link

Okay, en fait ce serait mieux que ce fichier s'appelle bootstrap.nix, et ça donnerait un attrset avec:

rec {
  sources = ...
  pkgs = pkgs // { lib = pkgs.lib.extend overlays.lib; };
  unpatchedSources = ...
  overlays.lib = _: lib: { extra = import ./lib/nix-lib { inherit lib; }; };
}
Okay, en fait ce serait mieux que ce fichier s'appelle `bootstrap.nix`, et ça donnerait un attrset avec: ```nix rec { sources = ... pkgs = pkgs // { lib = pkgs.lib.extend overlays.lib; }; unpatchedSources = ... overlays.lib = _: lib: { extra = import ./lib/nix-lib { inherit lib; }; }; } ```

2
workflows/eval-nodes.nix
View file

@ -7,7 +7,7 @@
let let
inherit (lib) attrNames genAttrs; inherit (lib) attrNames genAttrs;
nodes = attrNames (import ../meta/nodes); nodes = attrNames (import ../meta lib).nodes;
in in
{ {