switched to colmena
This commit is contained in:
parent
4117a41093
commit
af460cad2e
GPG key ID:
F6F4C66207FCF995
11 changed files with 155 additions and 41 deletions
|
|
@ -8,11 +8,8 @@ with lib; {
|
|||
manageNetwork = true;
|
||||
manageHostName = true;
|
||||
};
|
||||
nixpkgs.hostPlatform.system = "x86_64-linux";
|
||||
kyouma.machine-type.virtual = true;
|
||||
kyouma.machine-type.headless = true;
|
||||
deployment.tags = [ "pve-lxc" ];
|
||||
networking.useDHCP = false;
|
||||
|
||||
system.autoUpgrade.enable = true;
|
||||
nix.optimise.automatic = true;
|
||||
nix.gc.automatic = true;
|
||||
nix.gc.options = "--delete-older-than 2d";
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,5 @@
|
|||
{ config, pkgs, lib, ... }: with lib; {
|
||||
deployment.tags = [ "web" ];
|
||||
security.dhparams.enable = true;
|
||||
security.dhparams.params.nginx = {};
|
||||
security.acme = {
|
||||
|
|
|
|||
|
|
@ -6,6 +6,7 @@ with lib; {
|
|||
../../modules
|
||||
./networking.nix
|
||||
./openssh.nix
|
||||
./kernel.nix
|
||||
];
|
||||
environment.systemPackages = with pkgs; [
|
||||
kitty.terminfo
|
||||
|
|
@ -28,7 +29,7 @@ with lib; {
|
|||
deployment.targetPort = mkDefault 22;
|
||||
deployment.targetUser = mkDefault null;
|
||||
|
||||
nix.settings.trusted-users = [ "roo" "@wheel" ];
|
||||
nix.settings.trusted-users = [ "root" "@wheel" ];
|
||||
security.dhparams.defaultBitSize = 4096;
|
||||
|
||||
system.activationScripts.motd.text = let
|
||||
|
|
@ -40,17 +41,19 @@ with lib; {
|
|||
|
||||
cat << EOF > $root/motd
|
||||
Welcome to ${cfg.distroName} ${cfg.release} ("${cfg.codeName}") on
|
||||
$(${pkgs.figlet}/bin/figlet ${config.networking.hostName}).${config.networking.domain}
|
||||
$(${pkgs.figlet}/bin/figlet -lt ${config.networking.hostName} | sed -e 's/[[:space:]]*$//').${config.networking.domain}
|
||||
|
||||
Last deployed on $(date -d @$(cat "$deployment_folder/date"))
|
||||
Last deployed on $(date "+%F %T %Z" -d @$(cat "$deployment_folder/date"))
|
||||
EOF
|
||||
'';
|
||||
users.motdFile = "/nix/var/lib/deployment/motd";
|
||||
|
||||
nix.gc.automatic = true;
|
||||
nix.gc.options = "--delete-older-than 7d";
|
||||
nix.optimise.automatic = true;
|
||||
services.journald.extraConfig = "SystemMaxUse=256M";
|
||||
nix.settings.experimental-features = [ "nix-command" "flakes" ];
|
||||
nixpkgs.hostPlatform.system = "x86_64-linux";
|
||||
|
||||
system.stateVersion = "23.11";
|
||||
time.timeZone = mkDefault "CET";
|
||||
|
|
|
|||
55
config/common/kernel.nix
Normal file
55
config/common/kernel.nix
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
{ config, lib, ... }: with lib; {
|
||||
boot.kernel.sysctl = mkIf config.kyouma.machine-type.physical (mkMerge [{
|
||||
"kernel.yama.ptrace_scope" = 1;
|
||||
"kernel.kptr_restric" = 2;
|
||||
"kernel.ftrace_enabled" = 0;
|
||||
"kernel.panic" = -1;
|
||||
|
||||
"net.core.default_qdisc" = "fq";
|
||||
"net.ipv4.tcp_congestion_control" = "bbr";
|
||||
|
||||
"net.ipv4.tcp_ecn" = 1;
|
||||
"net.ipv4.tcp_fastopen" = 3;
|
||||
"net.ipv4.tcp_slow_start_after_idle" = 0;
|
||||
"net.ipv4.tcp_tw_reuse" = 1;
|
||||
"net.ipv4.tcp_mtu_probing" = 1;
|
||||
"net.ipv4.tcp_mtu_probe_floor" = 1220;
|
||||
|
||||
"net.ipv4.tcp_keepalive_time" = 60;
|
||||
"net.ipv4.tcp_keepalive_probes" = 6;
|
||||
"net.ipv4.tcp_keepalive_intvl" = 10;
|
||||
|
||||
"net.core.rmem_default" = 16777216;
|
||||
"net.core.rmem_max" = 56623104;
|
||||
"net.core.wmem_default" = 16777216;
|
||||
"net.core.wmem_max" = 56623104;
|
||||
"net.core.optmem_max" = 65536;
|
||||
"net.ipv4.tcp_rmem" = "4096 1048576 56623104";
|
||||
"net.ipv4.tcp_wmem" = "4096 65536 56623104";
|
||||
"net.ipv4.tcp_notsent_lowat" = 16384;
|
||||
"net.ipv4.udp_rmem_min" = 9216;
|
||||
"net.ipv4.udp_wmem_min" = 9216;
|
||||
|
||||
"net.ipv4.ip_local_port_range" = "16384 65535";
|
||||
|
||||
"net.ipv6.conf.all.mtu" = 1452;
|
||||
"net.ipv6.conf.default.mtu" = 1452;
|
||||
|
||||
"net.core.bpf_jit_enable" = 1;
|
||||
"net.core.bpf_jit_harden" = 1;
|
||||
|
||||
"net.ipv4.conf.all.accept_redirects" = 0;
|
||||
"net.ipv6.conf.all.accept_redirects" = 0;
|
||||
"net.ipv4.conf.default.accept_redirects" = 0;
|
||||
"net.ipv6.conf.default.accept_redirects" = 0;
|
||||
|
||||
"net.ipv4.conf.all.accept_source_route" = 0;
|
||||
|
||||
} (mkIf (!config.kyouma.machine-type.router) {
|
||||
# Enable strict source route filtering
|
||||
# Disable on BGP routers
|
||||
"net.ipv4.conf.all.rp_filter" = 1;
|
||||
"net.ipv4.conf.default.rp_filter" = 1;
|
||||
})
|
||||
]);
|
||||
}
|
||||
|
|
@ -1,3 +1,4 @@
|
|||
{ config, lib, ... }: with lib; {
|
||||
services.openssh.enable = mkDefault true;
|
||||
services.vnstat.enable = mkDefault true;
|
||||
}
|
||||
|
|
|
|||
18
config/hosts/crime/configuration.nix
Normal file
18
config/hosts/crime/configuration.nix
Normal file
|
|
@ -0,0 +1,18 @@
|
|||
{ config, pkgs, ... }: {
|
||||
imports = [
|
||||
../../common
|
||||
../../common-lxc.nix
|
||||
../../common-nginx.nix
|
||||
../../headless.nix
|
||||
];
|
||||
networking = {
|
||||
hostName = "crime";
|
||||
firewall.allowedTCPPorts = [ 80 443 ];
|
||||
firewall.allowedUDPPorts = [ 443 ];
|
||||
};
|
||||
systemd.network.networks."98-eth-default" = {
|
||||
address = [
|
||||
"2a0f:be01:0:100::1337/128"
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
@ -12,6 +12,10 @@ in {
|
|||
imports = [
|
||||
inputs.fernglas.nixosModules.default
|
||||
inputs.kyouma-www.nixosModules.default
|
||||
../../common
|
||||
../../common-lxc.nix
|
||||
../../common-nginx.nix
|
||||
../../headless.nix
|
||||
];
|
||||
networking = {
|
||||
hostName = "web-dus";
|
||||
|
|
@ -23,7 +27,6 @@ in {
|
|||
"2a0f:be01:0:100::1312/128"
|
||||
];
|
||||
};
|
||||
services.vnstat.enable = true;
|
||||
services.vyosBld = {
|
||||
enable = true;
|
||||
output = "/nix/var/www/kyouma.net/vyos";
|
||||
|
|
|
|||
20
flake.lock
20
flake.lock
|
|
@ -61,11 +61,11 @@
|
|||
"nixpkgs": "nixpkgs_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1705415185,
|
||||
"narHash": "sha256-3sAayXCMBqdEdKqAcGd41K2u0HYAWYu3J9rfIKBfLR4=",
|
||||
"lastModified": 1705420537,
|
||||
"narHash": "sha256-/zPsJsNFQF1xFIDY9np9TAK7JaiFLDcEhErNfcoyvIc=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "d2fa7e29cdb68657be67f869383b37ab0dbf168f",
|
||||
"revCount": 28,
|
||||
"rev": "b908e77c7173c6c425cbf085972f5ebbc7b83522",
|
||||
"revCount": 15,
|
||||
"type": "git",
|
||||
"url": "ssh://git@git.bsd.gay/snaki/kyouma-net.git"
|
||||
},
|
||||
|
|
@ -76,11 +76,11 @@
|
|||
},
|
||||
"nixos-hardware": {
|
||||
"locked": {
|
||||
"lastModified": 1704786394,
|
||||
"narHash": "sha256-aJM0ln9fMGWw1+tjyl5JZWZ3ahxAA2gw2ZpZY/hkEMs=",
|
||||
"lastModified": 1705312285,
|
||||
"narHash": "sha256-rd+dY+v61Y8w3u9bukO/hB55Xl4wXv4/yC8rCGVnK5U=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "b34a6075e9e298c4124e35c3ccaf2210c1f3a43b",
|
||||
"rev": "bee2202bec57e521e3bd8acd526884b9767d7fa0",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -123,11 +123,11 @@
|
|||
},
|
||||
"nixpkgs_3": {
|
||||
"locked": {
|
||||
"lastModified": 1704722960,
|
||||
"narHash": "sha256-mKGJ3sPsT6//s+Knglai5YflJUF2DGj7Ai6Ynopz0kI=",
|
||||
"lastModified": 1705316053,
|
||||
"narHash": "sha256-J2Ey5mPFT8gdfL2XC0JTZvKaBw/b2pnyudEXFvl+dQM=",
|
||||
"owner": "nixos",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "317484b1ead87b9c1b8ac5261a8d2dd748a0492d",
|
||||
"rev": "c3e128f3c0ecc1fb04aef9f72b3dcc2f6cecf370",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
|||
33
flake.nix
33
flake.nix
|
|
@ -11,31 +11,17 @@
|
|||
colmena = {
|
||||
meta = {
|
||||
allowApplyAll = false;
|
||||
nixpkgs = self.legacyPackages.x86_64-linux;
|
||||
nixpkgs = nixpkgs.legacyPackages.x86_64-linux;
|
||||
specialArgs = { inherit inputs; };
|
||||
};
|
||||
web-dus = {
|
||||
imports = [ ./config/hosts/web-dus/configuration.nix ];
|
||||
};
|
||||
crime = {
|
||||
imports = [ ./config/hosts/crime/configuration.nix ];
|
||||
};
|
||||
};
|
||||
nixosConfigurations = {
|
||||
web02 = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs = { inherit inputs; };
|
||||
modules = [
|
||||
./config/common
|
||||
./config/common-lxc.nix
|
||||
./config/common-nginx.nix
|
||||
./config/hosts/web-dus/configuration.nix
|
||||
];
|
||||
};
|
||||
crime = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
specialArgs = { inherit inputs; };
|
||||
modules = [
|
||||
.config/common
|
||||
.config/common-lxc.nix
|
||||
.config/common-nginx.nix
|
||||
.config/hosts/crime/configuration.nix
|
||||
];
|
||||
};
|
||||
# ryuuko = nixpkgs.lib.nixosSystem {
|
||||
# system = "x86_64-linux";
|
||||
# specialArgs = attrs;
|
||||
|
|
@ -46,5 +32,10 @@
|
|||
# ];
|
||||
# };
|
||||
};
|
||||
devShells.x86_64-linux.default = let
|
||||
pkgs = nixpkgs.legacyPackages.x86_64-linux;
|
||||
in pkgs.mkShell {
|
||||
packages = [ pkgs.colmena ];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
{ ... }: {
|
||||
imports = [
|
||||
./vhost
|
||||
./machine-type
|
||||
];
|
||||
}
|
||||
|
|
|
|||
44
modules/machine-type/default.nix
Normal file
44
modules/machine-type/default.nix
Normal file
|
|
@ -0,0 +1,44 @@
|
|||
{ config, lib, ...}: with lib; {
|
||||
options.kyouma.machine-type = {
|
||||
physical = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = mdDoc "Mark machine as physical.";
|
||||
};
|
||||
|
||||
virtual = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = mdDoc "Mark machine as virtual.";
|
||||
};
|
||||
|
||||
router = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = mdDoc "Mark machine as router.";
|
||||
};
|
||||
|
||||
headless = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = mdDoc "Mark machine as headless.";
|
||||
};
|
||||
|
||||
graphical = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = mdDoc "Mark machine as graphical.";
|
||||
};
|
||||
|
||||
portable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description = mdDoc "Mark machine as portable.";
|
||||
};
|
||||
};
|
||||
config = let
|
||||
cfg = config.kyouma.machine-type;
|
||||
in {
|
||||
deployment.tags = mkIf cfg.router [ "router" ];
|
||||
};
|
||||
}
|
||||
Loading…
Reference in a new issue