feat(dns01): init

Reviewed-on: DGNum/lab-infra#5
Co-authored-by: Constantin Gierczak--Galle <git.cst1@mailbox.org>
Co-committed-by: Constantin Gierczak--Galle <git.cst1@mailbox.org>

machines/dns01/_configuration.nix

@@ -0,0 +1,39 @@
+{ lib, ... }:
+
+lib.extra.mkConfig {
+  enabledModules = [
+    # List of modules to enable
+  ];
+
+  enabledServices = [
+    # List of services to enable
+    "nsd"
+  ];
+
+  extraConfig = {
+    users.users.root.openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMBW7rTtfZL9wtrpCVgariKdpN60/VeAzXkh9w3MwbO julien@enigma"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrijwPlb7KQkYPLznMPVzPPT69cLzhEsJzZi9tmxzTh cst1@x270"
+    ];
+    systemd.network = {
+      config.routeTables = {
+        he = 100;
+        mwan = 110;
+      };
+      networks = {
+        "10-ens18" = {
+          name = "ens18";
+
+          networkConfig = {
+            Description = "ENS uplink";
+            Address = [ "129.199.146.102/24" ];
+            Gateway = "129.199.146.254";
+            LLDP = true;
+          };
+        };
+      };
+    };
+  };
+
+  root = ./.;
+}

machines/dns01/_hardware-configuration.nix

@@ -0,0 +1,34 @@
+{ lib, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot = {
+    loader.systemd-boot.enable = true;
+    initrd.kernelModules = [ ];
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+    initrd.availableKernelModules = [
+      "ata_piix"
+      "uhci_hcd"
+      "virtio_pci"
+      "virtio_scsi"
+      "sd_mod"
+      "sr_mod"
+    ];
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-partlabel/disk-sda-root";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-partlabel/disk-sda-ESP";
+    fsType = "vfat";
+  };
+
+  networking.useDHCP = lib.mkDefault false;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

machines/dns01/beta.dgnum.eu.nix

@@ -0,0 +1,22 @@
+{ dns, ... }:
+
+with dns.lib.combinators;
+{
+  SOA = {
+    nameServer = "ns1";
+    adminEmail = "webmaster@dgnum.eu";
+    serial = 2019030800;
+  };
+
+  NS = [
+    # TODO: add nameservers with GLUE and everything
+  ];
+
+  #A = [ "203.0.113.1" ];
+  #AAAA = [ "4321:0:1:2:3:4:567:89ab" ];
+
+  subdomains = {
+    photoprism = host "129.199.146.101" null;
+    immich = host "129.199.146.101" null;
+  };
+}

machines/dns01/nsd.nix

@@ -0,0 +1,22 @@
+{ sources, ... }:
+
+let
+  dns = import sources.dns-nix { };
+in
+{
+  services.nsd = {
+    enable = true;
+    zones = {
+      "beta.dgnum.eu" = {
+        # provideXFR = [ ... ];
+        # notify = [ ... ];
+        data = dns.lib.toString "beta.dgnum.eu" (import ./beta.dgnum.eu.nix { inherit dns; });
+      };
+    };
+  };
+  networking = {
+    firewall = {
+      allowedUDPPorts = [ 53 ];
+    };
+  };
+}

machines/dns01/secrets/secrets.nix

@@ -0,0 +1,3 @@
+(import ../../../keys).mkSecrets [ "dns01" ] [
+  # List of secrets for router02
+]

machines/photo01/_configuration.nix

@@ -0,0 +1,55 @@
+# TODO: revamp to use the same framework as the other VMs
+{ pkgs, ... }:
+
+let
+  address = "129.199.146.101";
+in
+{
+  imports = [
+    ./_hardware-configuration.nix
+
+    ./immich.nix
+    ./nginx.nix
+    ./photoprism.nix
+  ];
+  deployment.targetHost = address;
+
+  networking = {
+    firewall.allowedTCPPorts = [
+      22
+      80
+      443
+      8007
+    ];
+    firewall.allowedUDPPorts = [ ];
+    useNetworkd = true;
+  };
+
+  time.timeZone = "Europe/Paris";
+  environment.systemPackages = with pkgs; [ neovim ];
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDMBW7rTtfZL9wtrpCVgariKdpN60/VeAzXkh9w3MwbO julien@enigma"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKrijwPlb7KQkYPLznMPVzPPT69cLzhEsJzZi9tmxzTh cst1@x270"
+  ];
+
+  security.acme.acceptTerms = true;
+
+  systemd.network = {
+    config.routeTables = {
+      he = 100;
+      mwan = 110;
+    };
+    networks = {
+      "10-ens18" = {
+        name = "ens18";
+
+        networkConfig = {
+          Description = "ENS uplink";
+          Address = [ "129.199.146.101/24" ];
+          Gateway = "129.199.146.254";
+          LLDP = true;
+        };
+      };
+    };
+  };
+}

machines/photo01/_hardware-configuration.nix

@@ -0,0 +1,34 @@
+{ lib, modulesPath, ... }:
+
+{
+  imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
+
+  boot = {
+    loader.systemd-boot.enable = true;
+    initrd.kernelModules = [ ];
+    kernelModules = [ ];
+    extraModulePackages = [ ];
+    initrd.availableKernelModules = [
+      "ata_piix"
+      "uhci_hcd"
+      "virtio_pci"
+      "virtio_scsi"
+      "sd_mod"
+      "sr_mod"
+    ];
+  };
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-partlabel/disk-sda-root";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-partlabel/disk-sda-ESP";
+    fsType = "vfat";
+  };
+
+  networking.useDHCP = lib.mkDefault false;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+}

machines/photo01/immich.nix

@@ -0,0 +1,16 @@
+{
+  services.immich = {
+    enable = true;
+    # NOTE: default port changes in a later version
+    port = 3001;
+    machine-learning.enable = true;
+    host = "localhost";
+  };
+
+  services.nginx.virtualHosts."immich.cgiga.fr" = {
+    enableACME = true;
+    forceSSL = true;
+    serverAliases = [ ];
+    locations."/".proxyPass = "http://localhost:3001/";
+  };
+}

machines/photo01/nginx.nix

@@ -0,0 +1,10 @@
+{
+  services.nginx = {
+    enable = true;
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedProxySettings = true;
+    clientMaxBodySize = "500m";
+  };
+}

machines/photo01/openssh.nix

@@ -0,0 +1,8 @@
+{
+  services.openssh = {
+    enable = true;
+    settings = {
+      PasswordAuthentication = false;
+    };
+  };
+}

machines/photo01/photoprism.nix

@@ -0,0 +1,54 @@
+{ pkgs, ... }:
+
+{
+  services = {
+    photoprism = {
+      enable = true;
+      port = 2342;
+      settings = {
+        PHOTOPRISM_DEFAULT_LOCALE = "fr";
+        PHOTOPRISM_ADMIN_USERNAME = "admin";
+        PHOHOPRISM_SITE_URL = "https://photoprism.cgiga.fr";
+        PHOTOPRISM_SITE_CAPTION = "PhotoPrism";
+
+        # DB access config
+        PHOTOPRISM_DATABASE_DRIVER = "mysql";
+        PHOTOPRISM_DATABASE_NAME = "photoprism";
+        PHOTOPRISM_DATABASE_SERVER = "/run/mysqld/mysqld.sock";
+        PHOTOPRISM_DATABASE_USER = "photoprism";
+      };
+
+      originalsPath = "/data/photos";
+
+      address = "localhost";
+
+      #importPath = "/photoprism/imports";
+      passwordFile = "/passwords/photoprism";
+    };
+
+    mysql = {
+      enable = true;
+      dataDir = "/data/mysql";
+      package = pkgs.mariadb;
+      ensureDatabases = [ "photoprism" ];
+      ensureUsers = [
+        {
+          name = "photoprism";
+          ensurePermissions = {
+            "photoprism.*" = "ALL PRIVILEGES";
+          };
+        }
+      ];
+    };
+
+    nginx.virtualHosts."photoprism.cgiga.fr" = {
+      enableACME = true;
+      forceSSL = true;
+      serverAliases = [ ];
+      locations."/" = {
+        proxyPass = "http://localhost:2342/";
+        proxyWebsockets = true;
+      };
+    };
+  };
+}

machines/photo01/secrets/secrets.nix

@@ -0,0 +1,3 @@
+(import ../../../keys).mkSecrets [ "photo01" ] [
+  # List of secrets for router02
+]

meta/network.nix

@@ -1,4 +1,11 @@
 {
+  dns01 = {
+    interfaces = { };
+
+    addresses.ipv4 = [ "129.199.146.102" ];
+
+    hostId = "1758233d";
+  };
   krz01 = {
     interfaces = {
       vmbr0 = {
@@ -49,4 +56,11 @@
 
     hostId = "144d0f7a";
   };
+  photo01 = {
+    interfaces = { };
+
+    addresses.ipv4 = [ "129.199.146.101" ];
+
+    hostId = "bcf8ff03";
+  };
 }

meta/nodes.nix

@@ -19,7 +19,15 @@
   - luj01 -> VM de Luj
 */
 {
+  dns01 = {
+    site = "pav01";
 
+    # TODO: 
+    hashedPassword = "$y$j9T$eNZQgDN.J5y7KTG2hXgat1$J1i5tjx5dnSZu.C9B7swXi5zMFIkUnmRrnmyLHFAt8/";
+
+    stateVersion = "24.05";
+    nixpkgs = "24.05";
+  };
   krz01 = {
     site = "pav01";
 
@@ -36,6 +44,15 @@
     stateVersion = "24.05";
     nixpkgs = "24.05";
   };
+  photo01 = {
+    site = "pav01";
+
+    # TODO 
+    hashedPassword = "$y$j9T$aFhOWa05W7VKeKt3Nc.nA1$uBOvG4wf7/yWjwOxO8NLf9ipCsAkS1.5cD2EJpLx57A";
+
+    stateVersion = "24.05";
+    nixpkgs = "unstable";
+  };
   router02 = {
     site = "pav01";
 

npins/sources.json

@@ -30,6 +30,21 @@
       "url": "https://api.github.com/repos/nix-community/disko/tarball/v1.8.0",
       "hash": "06ifryv6rw25cz8zda4isczajdgrvcl3aqr145p8njxx5jya2d77"
     },
+    "dns-nix": {
+      "type": "GitRelease",
+      "repository": {
+        "type": "GitHub",
+        "owner": "nix-community",
+        "repo": "dns.nix"
+      },
+      "pre_releases": false,
+      "version_upper_bound": null,
+      "release_prefix": null,
+      "version": "v1.2.0",
+      "revision": "a3196708a56dee76186a9415c187473b94e6cbae",
+      "url": "https://api.github.com/repos/nix-community/dns.nix/tarball/v1.2.0",
+      "hash": "011b6ahj4qcf7jw009qgbf6k5dvjmgls88khwzgjr9kxlgbypb90"
+    },
     "git-hooks": {
       "type": "Git",
       "repository": {