infrastructure/meta
Tom Hubrecht f38841b232
All checks were successful
Check meta / check_meta (pull_request) Successful in 20s
Check meta / check_dns (push) Successful in 20s
Check meta / check_dns (pull_request) Successful in 20s
Check meta / check_meta (push) Successful in 20s
Check workflows / check_workflows (pull_request) Successful in 23s
Run pre-commit on all files / check (push) Successful in 27s
Build all the nodes / bridge01 (pull_request) Successful in 58s
Build all the nodes / geo02 (pull_request) Successful in 1m6s
Build all the nodes / geo01 (pull_request) Successful in 1m9s
Build all the nodes / compute01 (pull_request) Successful in 1m38s
Build all the nodes / rescue01 (pull_request) Successful in 1m12s
Build all the nodes / storage01 (pull_request) Successful in 1m4s
Build all the nodes / vault01 (pull_request) Successful in 1m18s
Run pre-commit on all files / check (pull_request) Successful in 24s
Build all the nodes / web01 (pull_request) Successful in 1m35s
Build all the nodes / web02 (pull_request) Successful in 1m12s
Build all the nodes / web03 (pull_request) Successful in 1m7s
feat(keys): Allow giving sources and meta
This should decrease the number of nixpkgs used
2024-12-06 21:07:14 +01:00
..
default.nix feat(dns): Split out config 2024-02-23 13:06:15 +01:00
dns.nix feat(meta/dns): Add private subdomain linking to the netbird ips 2024-10-31 10:58:07 +01:00
network.nix feat(meta/network): Add web03 netbirdIp 2024-10-23 11:04:28 +02:00
nixpkgs.nix feat(nixpkgs): Update default version 2024-07-05 14:38:33 +02:00
nodes.nix feat(django-apps): Internalize 2024-11-25 23:29:39 +01:00
options.nix feat(keys): Allow giving sources and meta 2024-12-06 21:07:14 +01:00
organization.nix feat(organization): Added Antoine Groudiev and Matthieu Boyer to organization 2024-11-09 22:55:24 +01:00
README.md feat: Upgrade machines to nixos-24.05 2024-07-05 10:54:33 +02:00
verify.nix feat(infra): Internalize nix-lib, and make keys management simpler 2024-10-09 18:58:46 +02:00

Metadata of the DGNum infrastructure

DNS

The DNS configuration of our infrastructure is completely defined with the metadata contained in this folder.

The different machines have records pointing to their IP addresses when they exist:

  • $node.$site.infra.dgnum.eu points IN A $ipv4

  • $node.$site.infra.dgnum.eu points IN AAAA $ipv6

  • v4.$node.$site.infra.dgnum.eu points IN A $ipv4

  • v6.$node.$site.infra.dgnum.eu points IN AAAA $ipv6

Then the services hosted on those machines can be accessed through redirections:

  • $service.dgnum.eu IN CNAME $node.$site.infra.dgnum.eu

or, when targeting only a specific IP protocol:

  • $service4.dgnum.eu IN CNAME ipv4.$node.$site.infra.dgnum.eu
  • $service6.dgnum.eu IN CNAME ipv6.$node.$site.infra.dgnum.eu

Extra records exist for ns, mail configuration, or the main website but shouldn't change or be tinkered with.

Network

The network configuration (except the NetBird vpn) is defined statically.

TODO.

Nixpkgs

Machines can use different versions of NixOS, the supported and default ones are specified here.

How to add a new version

  • Switch to a new branch nixos-$VERSION
  • Run the following command
npins add channel nixos-$VERSION
  • Edit meta/nixpkgs.nix and add $VERSION to the supported version.
  • Read the release notes and check for changes.
  • Update the nodes versions
  • Create a PR so that the CI check that it builds

Nodes

The nodes are declared statically, several options can be configured:

  • deployment, the colmena deployment option
  • stateVersion, the state version of the node
  • nixpkgs, the version of NixOS to use
  • admins, the list of administrators specific to this node, they will be given root access
  • adminGroups, a list of groups whose members will be added to admins
  • site, the physical location of the node
  • vm-cluster, the VM cluster hosting the node when appropriate

Some options are set automatically, for example:

  • deployment.targetHost will be inferred from the network configuration
  • deployment.tags will contain infra-$site, so that a full site can be redeployed at once

Organization

The organization defines the groups and members of the infrastructure team, one day this information will be synchronized in Kanidm.

Members

For a member to be allowed access to a node, they must be defined in the members attribute set, and their SSH keys must be available in the keys folder.

Groups

Groups exist only to simplify the management of accesses:

  • The root group will be given administrator access on all nodes
  • The iso group will have its keys included in the ISOs built from the iso folder

Extra groups can be created at will, to be used in node-specific modules.

Module

The meta configuration can be evaluated as a module, to perform checks on the structure of the data.