The dgnum infrastructure
Find a file
sinavir 11391dc4f2
Some checks failed
Check meta / check_dns (pull_request) Successful in 16s
Check meta / check_meta (pull_request) Successful in 16s
Build all the nodes / ap01 (pull_request) Failing after 18s
Build all the nodes / netcore02 (pull_request) Successful in 21s
Check workflows / check_workflows (pull_request) Failing after 29s
Run pre-commit on all files / pre-commit (push) Successful in 41s
Build the shell / build-shell (pull_request) Successful in 37s
Run pre-commit on all files / pre-commit (pull_request) Successful in 38s
Build all the nodes / hypervisor03 (pull_request) Successful in 1m42s
Build all the nodes / rescue01 (pull_request) Successful in 1m47s
Build all the nodes / geo01 (pull_request) Successful in 2m31s
Build all the nodes / hypervisor02 (pull_request) Successful in 2m43s
Build all the nodes / hypervisor01 (pull_request) Successful in 2m47s
Build all the nodes / build01 (pull_request) Successful in 2m51s
Build all the nodes / bridge01 (pull_request) Successful in 2m54s
Build all the nodes / geo02 (pull_request) Successful in 3m4s
Build all the nodes / web01 (pull_request) Successful in 2m50s
Build all the nodes / vault01 (pull_request) Successful in 2m53s
Build all the nodes / storage01 (pull_request) Successful in 3m11s
Build all the nodes / web02 (pull_request) Successful in 3m1s
Build all the nodes / web03 (pull_request) Successful in 3m3s
Build all the nodes / compute01 (pull_request) Successful in 3m31s
Build all the nodes / tower01 (pull_request) Successful in 4m14s
feat(ap-v01): Add usteer
2025-02-10 09:44:44 +01:00
.forgejo/workflows chore(workflows): Regenerate npins-update 2025-01-16 16:56:39 +01:00
iso chore: Add license and copyright information 2024-12-13 12:41:38 +01:00
keys fix(keys/getKeys): don't fail if no key is specified 2025-01-25 21:44:53 +01:00
lib chore(patches): Add helper function 2025-01-19 23:36:47 +01:00
LICENSES feat(compute01/search): init search.infra and modules/nixos/extranix 2024-12-28 22:25:26 +01:00
machines feat(ap-v01): Add usteer 2025-02-10 09:44:44 +01:00
meta refactor(liminix): Refactor liminix meta nodes 2025-02-06 11:02:44 +01:00
modules chore(django-apps): Sort 2025-01-16 18:51:14 +01:00
npins feat(ap-v01): Add usteer 2025-02-10 09:44:44 +01:00
patches feat(compute01): Deploy pretalx 2025-01-20 01:09:35 +01:00
scripts feat(scripts): Add zyxel exploit script 2025-02-03 13:30:03 +01:00
workflows chore(workflows/npins-update): Update timing 2025-01-15 13:13:44 +01:00
.envrc feat(workflows): Switch to a nix-based definition of workflows 2024-11-11 17:57:23 +01:00
.gitignore fix(infra): remove untrackable file 2024-02-17 22:56:25 +01:00
CONTRIBUTE.md chore: Add license and copyright information 2024-12-13 12:41:38 +01:00
default.nix fix(ap01/radius-secret): Use environment variable for radius secret 2025-01-31 17:35:31 +01:00
hive.nix feat(ap01): WIP 2025-02-04 23:25:57 +01:00
README.md chore: Add license and copyright information 2024-12-13 12:41:38 +01:00
REUSE.toml feat(compute01): Deploy pretalx 2025-01-20 01:09:35 +01:00
shell.nix feat(nix): Use passthru for shells and return to importing the scripts 2024-11-14 22:18:40 +01:00

❄️ infrastructure

The dgnum infrastructure.

Contributing

Some instruction on how to contribute are available (in french) in /CONTRIBUTE.md. You're expected to read this document before commiting to the repo.

Some documentation for the development tools are provided in the aforementioned file.

Using the binary cache

Add the following module to your configuration (and pin this repo using your favorite tool: npins, lon, etc...):

{ lib, ... }:
let
  dgnum-infra = PINNED_PATH_TO_INFRA;
in {
  nix.settings = (import dgnum-infra { }).mkCacheSettings {
    caches = [ "infra" ];
  };
}

Adding a new machine

The first step is to create a minimal viable NixOS host, using tha means necessary. The second step is to find a name for this host, it must be unique from the other hosts.

Tip

For the rest of this part, we assume that the host is named host02

Download the keys

The public SSH keys of host02 have to be saved to keys, preferably only the ssh-ed25519 one.

It can be retreived with :

ssh-keyscan address.of.host02 2>/dev/null | awk '/ssh-ed25519/ {print $2,$3}'

Initialize the machine folder and configuration

  • Create a folder host02 under machines/
  • Copy the hardware configuration file generated by nixos-generate-config to machines/host02/_hardware-configuration.nix
  • Create a machines/host02/_configuration.nix file, it will contain the main configuration options, the basic content of this file should be the following
{ lib, ... }:

lib.extra.mkConfig {
  enabledModules = [
    # List of modules to enable
  ];

  enabledServices = [
    # List of services to enable
  ];

  extraConfig = {
    services.netbird.enable = true;
  };

  root = ./.;
}

Fill in the metadata

Network configuration

The network is declared in meta/network.nix, the necessary hostId value can be generated with :

head -c4 /dev/urandom | od -A none -t x4 | sed 's/ //'

Other details

The general metadata is declared in meta/nodes.nix, the main values to declare are :

  • site, where the node is physically located
  • stateVersion
  • nixpkgs, the nixpkgs version to use

Initialize secrets

Create the directory secrets in the configuration folder, and add a secrets.nix file containing :

(import ../../../keys).mkSecrets [ "host02" ] [
  # List of secrets for host02
]

This will be used for future secret management.

Update encrypted files

Both the Arkheon, Netbox and notification modules have secrets that are deployed on all machines. To make those services work correctly, run in modules/dgn-records, modules/dgn-netbox-agent and modules/dgn-notify :

agenix -r

Commit and create a PR

Once all of this is done, check that the configuration builds correctly :

colmena build --on host02

Apply it, and create a Pull Request.