.drone.yml

@@ -15,5 +15,9 @@ steps:
   commands:
     - "export NIX_PATH=nixpkgs=/var/nixpkgs"
     - "echo Building core-services-01 && nix-build krops.nix -A test-core-services-01 && ./result"
+- name: Build remote-builder-01 configuration
+  commands:
+    - "export NIX_PATH=nixpkgs=/var/nixpkgs"
+    - "echo Building remote-builder-01 && nix-build krops.nix -A test-remote-builder-01 && ./result"
 
 ...

README.md

@@ -5,6 +5,7 @@
 Refer to wiki for details.
 
 - `core-services-01`
+- `remote-builder-01`
 
 ## How to deploy a machine?
 

krops.nix

@@ -1,34 +1,32 @@
 let
-  krops = builtins.fetchGit {
-    url = "https://cgit.krebsco.de/krops/";
-  };
+  krops = builtins.fetchGit { url = "https://cgit.krebsco.de/krops/"; };
   lib = import "${krops}/lib";
-  pkgs = import "${krops}/pkgs" {};
-  source = machine: lib.evalSource [
-    {
+  pkgs = import "${krops}/pkgs" { };
+  source = machine:
+    lib.evalSource [{
       config.file = toString ./machines;
       nixos-config.symlink = "config/${machine}/configuration.nix";
       nixpkgs.git = {
         clean.exclude = [ "/.version-suffix" ];
         ref = "973910f5c31b9ba6c171c33a8bd7199990b14c72"; # nixos-21.05
-        url = https://github.com/NixOS/nixpkgs;
+        url = "https://github.com/NixOS/nixpkgs";
       };
-    }
-  ];
-in
-  {
-    core-services-01 = pkgs.krops.writeDeploy "deploy-core-services-01" {
-      source = source "core-services-01";
-      target = "root@core01.internal.rz.ens.wtf";
-    };
-
-    test-core-services-01 = pkgs.krops.writeTest "test-core-services-01" {
-      source = source "core-services-01";
+    }];
+  mkTestConfig = hostname: {
+    name = "test-${hostname}";
+    value = pkgs.krops.writeTest "test-${hostname}" {
+      source = source hostname;
       target = lib.mkTarget {
         host = "localhost";
         path = "/tmp/src";
       };
       force = true; # force create the sentinel file.
     };
-
-  }
+  };
+  mkTestsConfig = hostnames: builtins.listToAttrs (map mkTestConfig hostnames);
+in {
+  core-services-01 = pkgs.krops.writeDeploy "deploy-core-services-01" {
+    source = source "core-services-01";
+    target = "root@core01.internal.rz.ens.wtf";
+  };
+} // mkTestsConfig [ "core-services-01" "remote-builder-01" ]

machines/remote-builder-01/configuration.nix

@@ -0,0 +1,84 @@
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [
+      ./hardware-configuration.nix
+      ./programs.nix
+      ./system.nix
+      # TODO monitoring
+    ];
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  boot.initrd.supportedFilesystems = [ "zfs" ];
+  boot.supportedFilesystems = [ "zfs" ];
+
+  networking.hostName = "remote-builder-01";
+  networking.hostId = "11894198";
+
+  # Set your time zone.
+  time.timeZone = "Europe/Paris";
+
+  # The global useDHCP flag is deprecated, therefore explicitly set to false here.
+  # Per-interface useDHCP will be mandatory in the future, so this generated config
+  # replicates the default behaviour.
+  networking.useDHCP = false;
+  networking.interfaces.ens18.useDHCP = true;
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "us";
+  };
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    vim
+    wget
+  ];
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  programs.mtr.enable = true;
+  programs.gnupg.agent = {
+    enable = true;
+    enableSSHSupport = true;
+  };
+
+  # List services that you want to enable:
+
+  services.zfs.autoScrub.enable = true;
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  users.users.root.openssh.authorizedKeys.keyFiles = [
+    ./pubkeys/gdd.keys
+    ./pubkeys/raito.keys
+    ./pubkeys/hackens-milieu.keys
+  ];
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  networking.firewall.enable = false;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "21.05"; # Did you read the comment?
+
+}
+

machines/remote-builder-01/hardware-configuration.nix

@@ -0,0 +1,35 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "rpool/root/nixos";
+      fsType = "zfs";
+    };
+
+  fileSystems."/home" =
+    { device = "rpool/home";
+      fsType = "zfs";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/3341-A3B9";
+      fsType = "vfat";
+    };
+
+  swapDevices =
+    [ { device = "/dev/disk/by-uuid/1f624fe3-1fc5-44f4-9529-812558ffba42"; }
+    ];
+
+}

machines/remote-builder-01/programs.nix

@@ -0,0 +1,24 @@
+{ pkgs, ... }:
+let pkgsList = with pkgs; [
+  nix-prefetch-git
+  dnsutils
+
+  unzip
+  zip
+  ripgrep
+
+  niv
+  nixfmt
+  ];
+in
+{
+  imports = [
+    ./vim.nix
+  ];
+  programs = {
+    tmux.enable = true;
+    mosh.enable = true;
+  };
+
+  environment.systemPackages = pkgsList;
+}

machines/remote-builder-01/pubkeys/gdd.keys

@@ -0,0 +1,2 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICE7TN5NQKGojNGIeTFiHjLHTDQGT8i05JFqX/zLW2zc
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIFbkPWWZzOBaRdx4+7xQUgxDwuncSl2fxAeVuYfVUPZ

machines/remote-builder-01/pubkeys/hackens-milieu.keys

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH3+w4+nyJG8lr2mh0S9Zf8j2/6H5smlO87s6KNLlhkF hackens@hackens-milieu

machines/remote-builder-01/pubkeys/raito.keys

@@ -0,0 +1,4 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDcEkYM1r8QVNM/G5CxJInEdoBCWjEHHDdHlzDYNSUIdHHsn04QY+XI67AdMCm8w30GZnLUIj5RiJEWXREUApby0GrfxGGcy8otforygfgtmuUKAUEHdU2MMwrQI7RtTZ8oQ0USRGuqvmegxz3l5caVU7qGvBllJ4NUHXrkZSja2/51vq80RF4MKkDGiz7xUTixI2UcBwQBCA/kQedKV9G28EH+1XfvePqmMivZjl+7VyHsgUVj9eRGA1XWFw59UPZG8a7VkxO/Eb3K9NF297HUAcFMcbY6cPFi9AaBgu3VC4eetDnoN/+xT1owiHi7BReQhGAy/6cdf7C/my5ehZwD
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKIIcqryU28FkV+UpiTnGCOfwKO5jFhkdvU7a7Ew2KoZ
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMLf6B8VV//BhOWihYK8Zy1CJ3sg4w2bP0aBO0VPs4hS
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE0xMwWedkKosax9+7D2OlnMxFL/eV4CvFZLsbLptpXr

machines/remote-builder-01/system.nix

@@ -0,0 +1,28 @@
+{ pkgs, ... }:
+{
+  # # Auto upgrades
+  # system.autoUpgrade = {
+  #   enable = false; # TODO(Ryan): do not enable, it will break deployments.
+  #   allowReboot = false;
+  # };
+
+  # Auto GC and store optimizations
+  nix = {
+    trustedUsers = [ "root" "gab" ];
+    gc = {
+      automatic = true;
+      dates = "weekly";
+      options = "--delete-older-than 90d";
+    };
+    optimise.automatic = true;
+    extraOptions = ''
+      min-free = ${toString (100 * 1024 * 1024)}
+      max-free = ${toString (1024 * 1024 * 1024)}
+    '';
+  };
+
+  services.locate = {
+    enable = true;
+    interval = "04:05";
+  };
+}

machines/remote-builder-01/vim.nix

@@ -0,0 +1,31 @@
+{ pkgs, ... }:
+{
+  environment.variables = { EDITOR = "vim"; };
+
+  environment.systemPackages = with pkgs; [
+    nixfmt
+    git
+    (neovim.override {
+      vimAlias = true;
+      configure = {
+        packages.myPlugins = with pkgs.vimPlugins; {
+          start = [ vim-lastplace vim-nix ];
+          opt = [];
+        };
+        customRC = ''
+          set encoding=utf-8
+          set wildmenu
+
+          set nocompatible
+          set backspace=indent,eol,start
+          set cursorline
+          hi CursorLine term=bold cterm=bold ctermbg=darkgrey
+          set number
+          set relativenumber
+          set tabstop=4
+          set expandtab
+        '';
+      };
+    }
+  )];
+}