The dgnum infrastructure
Find a file
catvayor b8601b0782
Some checks failed
Check meta / check_meta (pull_request) Successful in 17s
Check meta / check_dns (pull_request) Successful in 1m5s
build configuration / build_storage01 (pull_request) Successful in 1m26s
build configuration / build_compute01 (pull_request) Successful in 1m33s
build configuration / build_web02 (pull_request) Successful in 1m20s
build configuration / build_vault01 (pull_request) Successful in 1m47s
build configuration / build_geo02 (pull_request) Successful in 1m14s
build configuration / build_geo01 (pull_request) Successful in 1m14s
lint / check (pull_request) Successful in 29s
build configuration / build_web01 (pull_request) Successful in 2m28s
build configuration / build_bridge01 (pull_request) Successful in 1m18s
build configuration / build_rescue01 (pull_request) Successful in 2m45s
build configuration / push_to_cache_storage01 (pull_request) Failing after 1m19s
build configuration / push_to_cache_compute01 (pull_request) Failing after 1m34s
build configuration / push_to_cache_geo01 (pull_request) Failing after 1m14s
build configuration / push_to_cache_bridge01 (pull_request) Failing after 1m12s
build configuration / push_to_cache_rescue01 (pull_request) Failing after 1m14s
build configuration / push_to_cache_web02 (pull_request) Failing after 3m6s
build configuration / push_to_cache_geo02 (pull_request) Failing after 4m16s
build configuration / push_to_cache_web01 (pull_request) Failing after 5m13s
build configuration / build_web02 (push) Successful in 1m29s
build configuration / build_vault01 (push) Successful in 1m34s
build configuration / build_storage01 (push) Successful in 1m38s
build configuration / build_compute01 (push) Successful in 2m9s
build configuration / build_web01 (push) Successful in 2m10s
lint / check (push) Successful in 25s
build configuration / build_geo01 (push) Successful in 1m30s
build configuration / build_geo02 (push) Successful in 1m29s
build configuration / build_bridge01 (push) Successful in 1m25s
build configuration / build_rescue01 (push) Successful in 1m41s
build configuration / push_to_cache_web02 (push) Successful in 1m32s
build configuration / push_to_cache_storage01 (push) Successful in 1m37s
build configuration / push_to_cache_geo02 (push) Successful in 1m32s
build configuration / push_to_cache_geo01 (push) Successful in 1m40s
build configuration / push_to_cache_compute01 (push) Successful in 2m8s
build configuration / push_to_cache_bridge01 (push) Successful in 1m26s
build configuration / push_to_cache_rescue01 (push) Successful in 1m22s
build configuration / push_to_cache_web01 (push) Successful in 2m59s
feat(nat): desactivating on vlan-apro
2024-09-07 16:09:01 +02:00
.forgejo/workflows fix(workflows): Run lint on pull_requests too 2024-08-17 18:00:10 +02:00
iso feat(iso): Use default nixpkgs version 2024-07-30 11:14:35 +02:00
keys feat(bridge02): Initialize and add instructions to the README 2024-07-10 17:31:04 +02:00
lib chore: pre-commit hooks are supposed to be run.... 2024-03-10 01:03:30 +01:00
machines feat(nat): desactivating on vlan-apro 2024-09-07 16:09:01 +02:00
meta fix(dns): Always end with a . ... 2024-08-30 10:13:33 +02:00
modules fix(reaction): Use the correct netbird space 2024-09-01 23:33:34 +02:00
npins fix(web01): Update calendar 2024-09-04 16:21:26 +02:00
patches feat(git-hooks): Update 2024-07-30 10:36:36 +02:00
scripts feat: Update CI to use tvix-store 2024-07-29 14:31:42 +02:00
.envrc Use direnv 2023-05-22 15:08:43 +02:00
.gitignore fix(infra): remove untrackable file 2024-02-17 22:56:25 +01:00
CONTRIBUTE.md feat(README): Add guidelines for contributions and doc for dev tools 2024-02-23 21:07:20 +01:00
default.nix feat(git-hooks): Update 2024-07-30 10:36:36 +02:00
hive.nix feat(infra): Switch to lix 2024-07-05 14:39:02 +02:00
LICENSE keys: Separate keys and move them 2023-05-22 15:05:12 +02:00
README.md feat(bridge02): Initialize and add instructions to the README 2024-07-10 17:31:04 +02:00
shell.nix fix(npins): Update the version used 2024-07-11 10:33:01 +02:00

❄️ infrastructure

The dgnum infrastructure.

Contributing

Some instruction on how to contribute are available (in french) in /CONTRIBUTE.md. You're expected to read this document before commiting to the repo.

Some documentation for the development tools are provided in the aforementioned file.

Adding a new machine

The first step is to create a minimal viable NixOS host, using tha means necessary. The second step is to find a name for this host, it must be unique from the other hosts.

Tip

For the rest of this part, we assume that the host is named host02

Download the keys

The public SSH keys of host02 have to be saved to keys/machines/host02.keys, preferably only the ssh-ed25519 one.

It can be retreived with :

ssh-keyscan address.of.host02 2>/dev/null | awk '/ssh-ed25519/ {print $2,$3}'

Initialize the machine folder and configuration

  • Create a folder host02 under machines/
  • Copy the hardware configuration file generated by nixos-generate-config to machines/host02/_hardware-configuration.nix
  • Create a machines/host02/_configuration.nix file, it will contain the main configuration options, the basic content of this file should be the following
{ lib, ... }:

lib.extra.mkConfig {
  enabledModules = [
    # List of modules to enable
  ];

  enabledServices = [
    # List of services to enable
  ];

  extraConfig = {
    services.netbird.enable = true;
  };

  root = ./.;
}

Fill in the metadata

Network configuration

The network is declared in meta/network.nix, the necessary hostId value can be generated with :

head -c4 /dev/urandom | od -A none -t x4 | sed 's/ //'

Other details

The general metadata is declared in meta/nodes.nix, the main values to declare are :

  • site, where the node is physically located
  • stateVersion
  • nixpkgs, the nixpkgs version to use

Initialize secrets

Create the directory secrets in the configuration folder, and add a secrets.nix file containing :

let
  lib = import ../../../lib { };
in

lib.setDefault { publicKeys = lib.getNodeKeys "host02"; } [ ]

This will be used for future secret management.

Update encrypted files

Both the Arkheon, Netbox and notification modules have secrets that are deployed on all machines. To make those services work correctly, run in modules/dgn-records, modules/dgn-netbox-agent and modules/dgn-notify :

agenix -r

Commit and create a PR

Once all of this is done, check that the configuration builds correctly :

colmena build --on host02

Apply it, and create a Pull Request.