feat(dns01): init

Reviewed-on: #5
Co-authored-by: Constantin Gierczak--Galle <git.cst1@mailbox.org>
Co-committed-by: Constantin Gierczak--Galle <git.cst1@mailbox.org>

machines/dns01/_configuration.nix

@@ -0,0 +1,39 @@
+{ lib, ... }:
+
+lib.extra.mkConfig {
+  enabledModules = [
+    # List of modules to enable
+  ];
+
+  enabledServices = [
+    # List of services to enable
+    "nsd"
+  ];
+
+  extraConfig = {
+    users.users.root.openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMBW7rTtfZL9wtrpCVgariKdpN60/VeAzXkh9w3MwbO julien@enigma"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrijwPlb7KQkYPLznMPVzPPT69cLzhEsJzZi9tmxzTh cst1@x270"
+    ];
+    systemd.network = {
+      config.routeTables = {
+        he = 100;
+        mwan = 110;
+      };
+      networks = {
+        "10-ens18" = {
+          name = "ens18";
+
+          networkConfig = {
+            Description = "ENS uplink";
+            Address = [ "129.199.146.102/24" ];
+            Gateway = "129.199.146.254";
+            LLDP = true;
+          };
+        };
+      };
+    };
+  };
+
+  root = ./.;
+}

machines/dns01/_hardware-configuration.nix

@@ -0,0 +1,34 @@
+{ lib, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot = {
+    loader.systemd-boot.enable = true;
+    initrd.kernelModules = [ ];
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+    initrd.availableKernelModules = [
+      "ata_piix"
+      "uhci_hcd"
+      "virtio_pci"
+      "virtio_scsi"
+      "sd_mod"
+      "sr_mod"
+    ];
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-partlabel/disk-sda-root";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-partlabel/disk-sda-ESP";
+    fsType = "vfat";
+  };
+
+  networking.useDHCP = lib.mkDefault false;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

machines/dns01/beta.dgnum.eu.nix

@@ -0,0 +1,22 @@
+{ dns, ... }:
+
+with dns.lib.combinators;
+{
+  SOA = {
+    nameServer = "ns1";
+    adminEmail = "webmaster@dgnum.eu";
+    serial = 2019030800;
+  };
+
+  NS = [
+    # TODO: add nameservers with GLUE and everything
+  ];
+
+  #A = [ "203.0.113.1" ];
+  #AAAA = [ "4321:0:1:2:3:4:567:89ab" ];
+
+  subdomains = {
+    photoprism = host "129.199.146.101" null;
+    immich = host "129.199.146.101" null;
+  };
+}

machines/dns01/nsd.nix

@@ -0,0 +1,22 @@
+{ sources, ... }:
+
+let
+  dns = import sources.dns-nix { };
+in
+{
+  services.nsd = {
+    enable = true;
+    zones = {
+      "beta.dgnum.eu" = {
+        # provideXFR = [ ... ];
+        # notify = [ ... ];
+        data = dns.lib.toString "beta.dgnum.eu" (import ./beta.dgnum.eu.nix { inherit dns; });
+      };
+    };
+  };
+  networking = {
+    firewall = {
+      allowedUDPPorts = [ 53 ];
+    };
+  };
+}

machines/dns01/secrets/secrets.nix

@@ -0,0 +1,3 @@
+(import ../../../keys).mkSecrets [ "dns01" ] [
+  # List of secrets for router02
+]

machines/krz01/_configuration.nix

@@ -7,6 +7,9 @@ lib.extra.mkConfig {
 
   enabledServices = [
     # INFO: This list needs to stay sorted alphabetically
+    # Machine learning API machine
+    # "microvm-ml01"
+    # "microvm-router01"
     "nvidia-tesla-k80"
     "ollama"
     "whisper"

machines/krz01/microvm-ml01.nix

@@ -0,0 +1,22 @@
+_: {
+  microvm.autostart = [ "ml01" ];
+  microvm.vms.ml01 = {
+    config = {
+      networking.hostName = "ml01";
+      microvm = {
+        hypervisor = "cloud-hypervisor";
+        vcpu = 4;
+        mem = 4096;
+        balloonMem = 2048;
+        shares = [
+          {
+            source = "/nix/store";
+            mountPoint = "/nix/.ro-store";
+            tag = "ro-store";
+            proto = "virtiofs";
+          }
+        ];
+      };
+    };
+  };
+}

machines/krz01/microvm-router01.nix

@@ -0,0 +1,16 @@
+_: {
+  microvm.autostart = [ "router01" ];
+  microvm.vms.router01 = {
+    config = {
+      networking.hostName = "router01";
+      microvm.shares = [
+        {
+          source = "/nix/store";
+          mountPoint = "/nix/.ro-store";
+          tag = "ro-store";
+          proto = "virtiofs";
+        }
+      ];
+    };
+  };
+}

machines/photo01/_configuration.nix

@@ -0,0 +1,55 @@
+# TODO: revamp to use the same framework as the other VMs
+{ pkgs, ... }:
+
+let
+  address = "129.199.146.101";
+in
+{
+  imports = [
+    ./_hardware-configuration.nix
+
+    ./immich.nix
+    ./nginx.nix
+    ./photoprism.nix
+  ];
+  deployment.targetHost = address;
+
+  networking = {
+    firewall.allowedTCPPorts = [
+      22
+      80
+      443
+      8007
+    ];
+    firewall.allowedUDPPorts = [ ];
+    useNetworkd = true;
+  };
+
+  time.timeZone = "Europe/Paris";
+  environment.systemPackages = with pkgs; [ neovim ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMBW7rTtfZL9wtrpCVgariKdpN60/VeAzXkh9w3MwbO julien@enigma"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrijwPlb7KQkYPLznMPVzPPT69cLzhEsJzZi9tmxzTh cst1@x270"
+  ];
+
+  security.acme.acceptTerms = true;
+
+  systemd.network = {
+    config.routeTables = {
+      he = 100;
+      mwan = 110;
+    };
+    networks = {
+      "10-ens18" = {
+        name = "ens18";
+
+        networkConfig = {
+          Description = "ENS uplink";
+          Address = [ "129.199.146.101/24" ];
+          Gateway = "129.199.146.254";
+          LLDP = true;
+        };
+      };
+    };
+  };
+}

machines/photo01/_hardware-configuration.nix

@@ -0,0 +1,34 @@
+{ lib, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot = {
+    loader.systemd-boot.enable = true;
+    initrd.kernelModules = [ ];
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+    initrd.availableKernelModules = [
+      "ata_piix"
+      "uhci_hcd"
+      "virtio_pci"
+      "virtio_scsi"
+      "sd_mod"
+      "sr_mod"
+    ];
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-partlabel/disk-sda-root";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-partlabel/disk-sda-ESP";
+    fsType = "vfat";
+  };
+
+  networking.useDHCP = lib.mkDefault false;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

machines/photo01/immich.nix

@@ -0,0 +1,16 @@
+{
+  services.immich = {
+    enable = true;
+    # NOTE: default port changes in a later version
+    port = 3001;
+    machine-learning.enable = true;
+    host = "localhost";
+  };
+
+  services.nginx.virtualHosts."immich.cgiga.fr" = {
+    enableACME = true;
+    forceSSL = true;
+    serverAliases = [ ];
+    locations."/".proxyPass = "http://localhost:3001/";
+  };
+}

machines/photo01/nginx.nix

@@ -0,0 +1,10 @@
+{
+  services.nginx = {
+    enable = true;
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedProxySettings = true;
+    clientMaxBodySize = "500m";
+  };
+}

machines/photo01/openssh.nix

@@ -0,0 +1,8 @@
+{
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+    };
+  };
+}

machines/photo01/photoprism.nix

@@ -0,0 +1,54 @@
+{ pkgs, ... }:
+
+{
+  services = {
+    photoprism = {
+      enable = true;
+      port = 2342;
+      settings = {
+        PHOTOPRISM_DEFAULT_LOCALE = "fr";
+        PHOTOPRISM_ADMIN_USERNAME = "admin";
+        PHOHOPRISM_SITE_URL = "https://photoprism.cgiga.fr";
+        PHOTOPRISM_SITE_CAPTION = "PhotoPrism";
+
+        # DB access config
+        PHOTOPRISM_DATABASE_DRIVER = "mysql";
+        PHOTOPRISM_DATABASE_NAME = "photoprism";
+        PHOTOPRISM_DATABASE_SERVER = "/run/mysqld/mysqld.sock";
+        PHOTOPRISM_DATABASE_USER = "photoprism";
+      };
+
+      originalsPath = "/data/photos";
+
+      address = "localhost";
+
+      #importPath = "/photoprism/imports";
+      passwordFile = "/passwords/photoprism";
+    };
+
+    mysql = {
+      enable = true;
+      dataDir = "/data/mysql";
+      package = pkgs.mariadb;
+      ensureDatabases = [ "photoprism" ];
+      ensureUsers = [
+        {
+          name = "photoprism";
+          ensurePermissions = {
+            "photoprism.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+
+    nginx.virtualHosts."photoprism.cgiga.fr" = {
+      enableACME = true;
+      forceSSL = true;
+      serverAliases = [ ];
+      locations."/" = {
+        proxyPass = "http://localhost:2342/";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}

machines/photo01/secrets/secrets.nix

@@ -0,0 +1,3 @@
+(import ../../../keys).mkSecrets [ "photo01" ] [
+  # List of secrets for router02
+]

machines/router02/networking.nix

@@ -40,14 +40,18 @@
         };
         routes = [
           {
-            Destination = "::/0";
-            Table = "he";
-            Scope = "global";
+            routeConfig = {
+              Destination = "::/0";
+              Table = "he";
+              Scope = "global";
+            };
           }
           {
             # Use HE tunnel for router trafic as well
-            Destination = "::/0";
-            Scope = "global";
+            routeConfig = {
+              Destination = "::/0";
+              Scope = "global";
+            };
           }
         ];
         routingPolicyRules = [
@@ -78,31 +82,41 @@
         };
         routes = [
           {
-            Gateway = "2a0b:cbc0:1::215";
-            PreferredSource = "2a0e:e701:1120::1";
+            routeConfig = {
+              Gateway = "2a0b:cbc0:1::215";
+              PreferredSource = "2a0e:e701:1120::1";
+            };
           }
           {
             # Local route
-            Table = "mwan";
-            Destination = "2a0e:e701:1120::/64";
+            routeConfig = {
+              Table = "mwan";
+              Destination = "2a0e:e701:1120::/64";
+            };
           }
           {
             # Default unreachable route for unattributed prefixes of our /48
-            Table = "mwan";
-            Metric = 9999;
-            Destination = "2a0e:e701:1120::/48";
-            Type = "unreachable";
+            routeConfig = {
+              Table = "mwan";
+              Metric = 9999;
+              Destination = "2a0e:e701:1120::/48";
+              Type = "unreachable";
+            };
           }
           {
-            Table = "mwan";
-            Gateway = "2a0b:cbc0:1::215";
-            PreferredSource = "2a0e:e701:1120::1";
+            routeConfig = {
+              Table = "mwan";
+              Gateway = "2a0b:cbc0:1::215";
+              PreferredSource = "2a0e:e701:1120::1";
+            };
           }
           # IPv4
           {
-            Scope = "global";
-            Table = "mwan";
-            Gateway = "10.1.1.49";
+            routeConfig = {
+              Scope = "global";
+              Table = "mwan";
+              Gateway = "10.1.1.49";
+            };
           }
         ];
         routingPolicyRules = [
@@ -151,8 +165,10 @@
         ];
         routes = [
           {
-            Table = "mwan";
-            Destination = "2a0e:e701:1120:1000::/64";
+            routeConfig = {
+              Table = "mwan";
+              Destination = "2a0e:e701:1120:1000::/64";
+            };
           }
         ];
       };
@@ -172,9 +188,11 @@
         ];
         routes = [
           {
-            Table = "he";
-            Scope = "global";
-            Destination = "2001:470:1f13:187::/64";
+            routeConfig = {
+              Table = "he";
+              Scope = "global";
+              Destination = "2001:470:1f13:187::/64";
+            };
           }
         ];
       };

meta/network.nix

@@ -1,4 +1,11 @@
 {
+  dns01 = {
+    interfaces = { };
+
+    addresses.ipv4 = [ "129.199.146.102" ];
+
+    hostId = "1758233d";
+  };
   krz01 = {
     interfaces = {
       vmbr0 = {
@@ -49,4 +56,11 @@
 
     hostId = "144d0f7a";
   };
+  photo01 = {
+    interfaces = { };
+
+    addresses.ipv4 = [ "129.199.146.101" ];
+
+    hostId = "bcf8ff03";
+  };
 }

meta/nodes.nix

@@ -19,7 +19,15 @@
   - luj01 -> VM de Luj
 */
 {
+  dns01 = {
+    site = "pav01";
 
+    # TODO: 
+    hashedPassword = "$y$j9T$eNZQgDN.J5y7KTG2hXgat1$J1i5tjx5dnSZu.C9B7swXi5zMFIkUnmRrnmyLHFAt8/";
+
+    stateVersion = "24.05";
+    nixpkgs = "24.05";
+  };
   krz01 = {
     site = "pav01";
 
@@ -36,6 +44,15 @@
     stateVersion = "24.05";
     nixpkgs = "24.05";
   };
+  photo01 = {
+    site = "pav01";
+
+    # TODO 
+    hashedPassword = "$y$j9T$aFhOWa05W7VKeKt3Nc.nA1$uBOvG4wf7/yWjwOxO8NLf9ipCsAkS1.5cD2EJpLx57A";
+
+    stateVersion = "24.05";
+    nixpkgs = "unstable";
+  };
   router02 = {
     site = "pav01";
 

npins/sources.json

@@ -25,10 +25,25 @@
       "pre_releases": false,
       "version_upper_bound": null,
       "release_prefix": null,
-      "version": "v1.9.0",
-      "revision": "49a4936cee640e27d74baee6fd1278285d29b100",
-      "url": "https://api.github.com/repos/nix-community/disko/tarball/v1.9.0",
-      "hash": "0j76ar4qz320fakdii4659w5lww8wiz6yb7g47npywqvf2lbp388"
+      "version": "v1.8.0",
+      "revision": "624fd86460e482017ed9c3c3c55a3758c06a4e7f",
+      "url": "https://api.github.com/repos/nix-community/disko/tarball/v1.8.0",
+      "hash": "06ifryv6rw25cz8zda4isczajdgrvcl3aqr145p8njxx5jya2d77"
+    },
+    "dns-nix": {
+      "type": "GitRelease",
+      "repository": {
+        "type": "GitHub",
+        "owner": "nix-community",
+        "repo": "dns.nix"
+      },
+      "pre_releases": false,
+      "version_upper_bound": null,
+      "release_prefix": null,
+      "version": "v1.2.0",
+      "revision": "a3196708a56dee76186a9415c187473b94e6cbae",
+      "url": "https://api.github.com/repos/nix-community/dns.nix/tarball/v1.2.0",
+      "hash": "011b6ahj4qcf7jw009qgbf6k5dvjmgls88khwzgjr9kxlgbypb90"
     },
     "git-hooks": {
       "type": "Git",
@@ -38,9 +53,9 @@
         "repo": "git-hooks.nix"
       },
       "branch": "master",
-      "revision": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
-      "url": "https://github.com/cachix/git-hooks.nix/archive/cd1af27aa85026ac759d5d3fccf650abe7e1bbf0.tar.gz",
-      "hash": "1icl4cz33lkr4bz7fvlf3jppmahgpzij81wfa5any3z7w7b5lnxw"
+      "revision": "1211305a5b237771e13fcca0c51e60ad47326a9a",
+      "url": "https://github.com/cachix/git-hooks.nix/archive/1211305a5b237771e13fcca0c51e60ad47326a9a.tar.gz",
+      "hash": "1qz8d9g7rhwjk4p2x0rx59alsf0dpjrb6kpzs681gi3rjr685ivq"
     },
     "infrastructure": {
       "type": "Git",
@@ -49,9 +64,9 @@
         "url": "https://git.dgnum.eu/DGNum/infrastructure"
       },
       "branch": "main",
-      "revision": "32f68a54a92b3742030d43cb0402ea9de332a004",
+      "revision": "45f2f5905506ad7523bde63ae94d0a3dc19dd604",
       "url": null,
-      "hash": "1wk0wwa74gq35rx77jannkz2y1zlqz2v7ngm0sn6zj9mx9wwp0b2"
+      "hash": "171rwwvx4mq01g1c2rhn6v4hyv5c8g2jzzxmff4qz70yzlhs8806"
     },
     "lix": {
       "type": "Git",
@@ -60,9 +75,9 @@
         "url": "https://git.lix.systems/lix-project/lix.git"
       },
       "branch": "main",
-      "revision": "f116608a20430b8484814300cdf22eebeb75a59f",
+      "revision": "ed9b7f4f84fd60ad8618645cc1bae2d686ff0db6",
       "url": null,
-      "hash": "0hhjx3vk7rchkb4njhsf4vk2f7ipkpqb9jvywm0xcbpwa08xffis"
+      "hash": "05kxga8fs9h4qm0yvp5l7jvsda7hzqs7rvxcn8r52dqg3c80hva9"
     },
     "lix-module": {
       "type": "Git",
@@ -71,9 +86,9 @@
         "url": "https://git.lix.systems/lix-project/nixos-module.git"
       },
       "branch": "main",
-      "revision": "aa2846680fa9a2032939d720487942567fd9eb63",
+      "revision": "fd186f535a4ac7ae35d98c1dd5d79f0a81b7976d",
       "url": null,
-      "hash": "0gb174800sgh6y6sir23nxsx85xrk478hbwqbzyd46ac34clz9wz"
+      "hash": "0jxpqaz12lqibg03iv36sa0shfvamn2yhg937llv3kl4csijd34f"
     },
     "lon": {
       "type": "Git",
@@ -106,9 +121,9 @@
         "url": "https://git.hubrecht.ovh/hubrecht/nix-modules.git"
       },
       "branch": "main",
-      "revision": "75e8d70a051dd19d126b5248b62f61d6f8ce4361",
+      "revision": "2fd7c7810b2a901020ddd2d0cc82810b83a313fc",
       "url": null,
-      "hash": "0yx5by3v2cshiidyh27n75lcqy9d1kk5zz5mchmfv63s9p0cjzqn"
+      "hash": "0rag870ll745r5isnk6hlxv0b0sbgriba5k6nihahcwsal2f4830"
     },
     "nix-patches": {
       "type": "GitRelease",
@@ -131,9 +146,9 @@
         "url": "https://git.hubrecht.ovh/hubrecht/nix-pkgs"
       },
       "branch": "main",
-      "revision": "3ab3e49269d9e2536c8c5f78d4da673d7a3f5286",
+      "revision": "0e80d4dcdd54a75556c0784de55dc139ad4fe797",
       "url": null,
-      "hash": "0b4k0gchxcdlmvs88403hdbidsxswigzxswcba7a3fxz9d884c4y"
+      "hash": "1hlb0cczxq0jrzw4lhmkibnb8skcar0rmny594aqgyikknwzx2qf"
     },
     "nixos-23.11": {
       "type": "Channel",
@@ -144,8 +159,8 @@
     "nixos-24.05": {
       "type": "Channel",
       "name": "nixos-24.05",
-      "url": "https://releases.nixos.org/nixos/24.05/nixos-24.05.6668.e8c38b73aeb2/nixexprs.tar.xz",
-      "hash": "0lhh36z3fvd3b64dz7an08y3c3shb67aj17ny9z28bs21i3dc5yh"
+      "url": "https://releases.nixos.org/nixos/24.05/nixos-24.05.5518.ecbc1ca8ffd6/nixexprs.tar.xz",
+      "hash": "1yr2v17d8jg9567rvadv62bpr6i47fp73by2454yjxh1m9ric2cm"
     },
     "nixos-generators": {
       "type": "Git",
@@ -155,21 +170,21 @@
         "repo": "nixos-generators"
       },
       "branch": "master",
-      "revision": "15a87ccb45e06d24a9fd5f99a49782efe11b23f0",
-      "url": "https://github.com/nix-community/nixos-generators/archive/15a87ccb45e06d24a9fd5f99a49782efe11b23f0.tar.gz",
-      "hash": "0mwllbwinr6cira94347vhzq3jn3zgp28xg6w1ga0ncls7s476q4"
+      "revision": "9ae128172f823956e54947fe471bc6dfa670ecb4",
+      "url": "https://github.com/nix-community/nixos-generators/archive/9ae128172f823956e54947fe471bc6dfa670ecb4.tar.gz",
+      "hash": "1zn3lykymimzh21q4fixw6ql42n8j82dqwm5axifhcnl8dsdgrvr"
     },
     "nixos-unstable": {
       "type": "Channel",
       "name": "nixos-unstable",
-      "url": "https://releases.nixos.org/nixos/unstable/nixos-25.05beta708622.5e4fbfb6b3de/nixexprs.tar.xz",
-      "hash": "18zd6qnn1zmz3pgq2q484lmdk486ncxyp8r5g9c71r9dc8jr5dnc"
+      "url": "https://releases.nixos.org/nixos/unstable/nixos-24.11pre688563.bc947f541ae5/nixexprs.tar.xz",
+      "hash": "1jsaxwi128fiach3dj8rdj5agqivsr4sidb8lmdnl7g07fl9x0kj"
     },
     "nixpkgs": {
       "type": "Channel",
       "name": "nixpkgs-unstable",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-25.05pre709559.5083ec887760/nixexprs.tar.xz",
-      "hash": "1z912j1lmrg8zp2hpmmi69dls9zlpvqfvdkvh5xc3x6iqkqwn0cd"
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-24.11pre689466.7d49afd36b55/nixexprs.tar.xz",
+      "hash": "0r4zb6j8in4dk7gxciapfm49dqbdd0c7ajjzj9iy2xrrj5aj32qp"
     },
     "proxmox-nixos": {
       "type": "Git",
@@ -179,10 +194,10 @@
         "repo": "proxmox-nixos"
       },
       "branch": "main",
-      "revision": "803e86e10e02f92769e08e4802b7b1cb1423d1d6",
-      "url": "https://github.com/SaumonNet/proxmox-nixos/archive/803e86e10e02f92769e08e4802b7b1cb1423d1d6.tar.gz",
-      "hash": "1jfbx248892qqm0wsknjjckfgha9d8f0ydmgk28z33cqahq8wsg7"
+      "revision": "950e4cccac0f942076e8558f7f9f4d496cabfb18",
+      "url": "https://github.com/SaumonNet/proxmox-nixos/archive/950e4cccac0f942076e8558f7f9f4d496cabfb18.tar.gz",
+      "hash": "0bhqw42ydc0jfkfqw64xsg518a1pbxnvpqw92nna7lm8mzpxm6d4"
     }
   },
   "version": 3
-}
+}