From af460cad2e9bf6957dede60673490a4db9170999 Mon Sep 17 00:00:00 2001 From: emily Date: Wed, 17 Jan 2024 14:34:33 +0100 Subject: [PATCH] switched to colmena --- config/common-lxc.nix | 9 ++--- config/common-nginx.nix | 1 + config/common/default.nix | 9 +++-- config/common/kernel.nix | 55 ++++++++++++++++++++++++++ config/headless.nix | 1 + config/hosts/crime/configuration.nix | 18 +++++++++ config/hosts/web-dus/configuration.nix | 5 ++- flake.lock | 20 +++++----- flake.nix | 33 ++++++---------- modules/default.nix | 1 + modules/machine-type/default.nix | 44 +++++++++++++++++++++ 11 files changed, 155 insertions(+), 41 deletions(-) create mode 100644 config/common/kernel.nix create mode 100644 config/hosts/crime/configuration.nix create mode 100644 modules/machine-type/default.nix diff --git a/config/common-lxc.nix b/config/common-lxc.nix index 2824373..76df404 100644 --- a/config/common-lxc.nix +++ b/config/common-lxc.nix @@ -8,11 +8,8 @@ with lib; { manageNetwork = true; manageHostName = true; }; - nixpkgs.hostPlatform.system = "x86_64-linux"; + kyouma.machine-type.virtual = true; + kyouma.machine-type.headless = true; + deployment.tags = [ "pve-lxc" ]; networking.useDHCP = false; - - system.autoUpgrade.enable = true; - nix.optimise.automatic = true; - nix.gc.automatic = true; - nix.gc.options = "--delete-older-than 2d"; } diff --git a/config/common-nginx.nix b/config/common-nginx.nix index b9ba1ba..92780be 100644 --- a/config/common-nginx.nix +++ b/config/common-nginx.nix @@ -1,4 +1,5 @@ { config, pkgs, lib, ... }: with lib; { + deployment.tags = [ "web" ]; security.dhparams.enable = true; security.dhparams.params.nginx = {}; security.acme = { diff --git a/config/common/default.nix b/config/common/default.nix index 5b6b400..a9f1a45 100644 --- a/config/common/default.nix +++ b/config/common/default.nix @@ -6,6 +6,7 @@ with lib; { ../../modules ./networking.nix ./openssh.nix + ./kernel.nix ]; environment.systemPackages = with pkgs; [ kitty.terminfo @@ -28,7 +29,7 @@ with lib; { deployment.targetPort = mkDefault 22; deployment.targetUser = mkDefault null; - nix.settings.trusted-users = [ "roo" "@wheel" ]; + nix.settings.trusted-users = [ "root" "@wheel" ]; security.dhparams.defaultBitSize = 4096; system.activationScripts.motd.text = let @@ -40,17 +41,19 @@ with lib; { cat << EOF > $root/motd Welcome to ${cfg.distroName} ${cfg.release} ("${cfg.codeName}") on - $(${pkgs.figlet}/bin/figlet ${config.networking.hostName}).${config.networking.domain} + $(${pkgs.figlet}/bin/figlet -lt ${config.networking.hostName} | sed -e 's/[[:space:]]*$//').${config.networking.domain} - Last deployed on $(date -d @$(cat "$deployment_folder/date")) + Last deployed on $(date "+%F %T %Z" -d @$(cat "$deployment_folder/date")) EOF ''; users.motdFile = "/nix/var/lib/deployment/motd"; nix.gc.automatic = true; nix.gc.options = "--delete-older-than 7d"; + nix.optimise.automatic = true; services.journald.extraConfig = "SystemMaxUse=256M"; nix.settings.experimental-features = [ "nix-command" "flakes" ]; + nixpkgs.hostPlatform.system = "x86_64-linux"; system.stateVersion = "23.11"; time.timeZone = mkDefault "CET"; diff --git a/config/common/kernel.nix b/config/common/kernel.nix new file mode 100644 index 0000000..fd22995 --- /dev/null +++ b/config/common/kernel.nix @@ -0,0 +1,55 @@ +{ config, lib, ... }: with lib; { + boot.kernel.sysctl = mkIf config.kyouma.machine-type.physical (mkMerge [{ + "kernel.yama.ptrace_scope" = 1; + "kernel.kptr_restric" = 2; + "kernel.ftrace_enabled" = 0; + "kernel.panic" = -1; + + "net.core.default_qdisc" = "fq"; + "net.ipv4.tcp_congestion_control" = "bbr"; + + "net.ipv4.tcp_ecn" = 1; + "net.ipv4.tcp_fastopen" = 3; + "net.ipv4.tcp_slow_start_after_idle" = 0; + "net.ipv4.tcp_tw_reuse" = 1; + "net.ipv4.tcp_mtu_probing" = 1; + "net.ipv4.tcp_mtu_probe_floor" = 1220; + + "net.ipv4.tcp_keepalive_time" = 60; + "net.ipv4.tcp_keepalive_probes" = 6; + "net.ipv4.tcp_keepalive_intvl" = 10; + + "net.core.rmem_default" = 16777216; + "net.core.rmem_max" = 56623104; + "net.core.wmem_default" = 16777216; + "net.core.wmem_max" = 56623104; + "net.core.optmem_max" = 65536; + "net.ipv4.tcp_rmem" = "4096 1048576 56623104"; + "net.ipv4.tcp_wmem" = "4096 65536 56623104"; + "net.ipv4.tcp_notsent_lowat" = 16384; + "net.ipv4.udp_rmem_min" = 9216; + "net.ipv4.udp_wmem_min" = 9216; + + "net.ipv4.ip_local_port_range" = "16384 65535"; + + "net.ipv6.conf.all.mtu" = 1452; + "net.ipv6.conf.default.mtu" = 1452; + + "net.core.bpf_jit_enable" = 1; + "net.core.bpf_jit_harden" = 1; + + "net.ipv4.conf.all.accept_redirects" = 0; + "net.ipv6.conf.all.accept_redirects" = 0; + "net.ipv4.conf.default.accept_redirects" = 0; + "net.ipv6.conf.default.accept_redirects" = 0; + + "net.ipv4.conf.all.accept_source_route" = 0; + + } (mkIf (!config.kyouma.machine-type.router) { + # Enable strict source route filtering + # Disable on BGP routers + "net.ipv4.conf.all.rp_filter" = 1; + "net.ipv4.conf.default.rp_filter" = 1; + }) + ]); +} diff --git a/config/headless.nix b/config/headless.nix index ac0ae52..2dfb592 100644 --- a/config/headless.nix +++ b/config/headless.nix @@ -1,3 +1,4 @@ { config, lib, ... }: with lib; { services.openssh.enable = mkDefault true; + services.vnstat.enable = mkDefault true; } diff --git a/config/hosts/crime/configuration.nix b/config/hosts/crime/configuration.nix new file mode 100644 index 0000000..90a55df --- /dev/null +++ b/config/hosts/crime/configuration.nix @@ -0,0 +1,18 @@ +{ config, pkgs, ... }: { + imports = [ + ../../common + ../../common-lxc.nix + ../../common-nginx.nix + ../../headless.nix + ]; + networking = { + hostName = "crime"; + firewall.allowedTCPPorts = [ 80 443 ]; + firewall.allowedUDPPorts = [ 443 ]; + }; + systemd.network.networks."98-eth-default" = { + address = [ + "2a0f:be01:0:100::1337/128" + ]; + }; +} diff --git a/config/hosts/web-dus/configuration.nix b/config/hosts/web-dus/configuration.nix index a976db8..bd36ef3 100644 --- a/config/hosts/web-dus/configuration.nix +++ b/config/hosts/web-dus/configuration.nix @@ -12,6 +12,10 @@ in { imports = [ inputs.fernglas.nixosModules.default inputs.kyouma-www.nixosModules.default + ../../common + ../../common-lxc.nix + ../../common-nginx.nix + ../../headless.nix ]; networking = { hostName = "web-dus"; @@ -23,7 +27,6 @@ in { "2a0f:be01:0:100::1312/128" ]; }; - services.vnstat.enable = true; services.vyosBld = { enable = true; output = "/nix/var/www/kyouma.net/vyos"; diff --git a/flake.lock b/flake.lock index 34b4dda..6613dd9 100644 --- a/flake.lock +++ b/flake.lock @@ -61,11 +61,11 @@ "nixpkgs": "nixpkgs_2" }, "locked": { - "lastModified": 1705415185, - "narHash": "sha256-3sAayXCMBqdEdKqAcGd41K2u0HYAWYu3J9rfIKBfLR4=", + "lastModified": 1705420537, + "narHash": "sha256-/zPsJsNFQF1xFIDY9np9TAK7JaiFLDcEhErNfcoyvIc=", "ref": "refs/heads/main", - "rev": "d2fa7e29cdb68657be67f869383b37ab0dbf168f", - "revCount": 28, + "rev": "b908e77c7173c6c425cbf085972f5ebbc7b83522", + "revCount": 15, "type": "git", "url": "ssh://git@git.bsd.gay/snaki/kyouma-net.git" }, @@ -76,11 +76,11 @@ }, "nixos-hardware": { "locked": { - "lastModified": 1704786394, - "narHash": "sha256-aJM0ln9fMGWw1+tjyl5JZWZ3ahxAA2gw2ZpZY/hkEMs=", + "lastModified": 1705312285, + "narHash": "sha256-rd+dY+v61Y8w3u9bukO/hB55Xl4wXv4/yC8rCGVnK5U=", "owner": "nixos", "repo": "nixos-hardware", - "rev": "b34a6075e9e298c4124e35c3ccaf2210c1f3a43b", + "rev": "bee2202bec57e521e3bd8acd526884b9767d7fa0", "type": "github" }, "original": { @@ -123,11 +123,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1704722960, - "narHash": "sha256-mKGJ3sPsT6//s+Knglai5YflJUF2DGj7Ai6Ynopz0kI=", + "lastModified": 1705316053, + "narHash": "sha256-J2Ey5mPFT8gdfL2XC0JTZvKaBw/b2pnyudEXFvl+dQM=", "owner": "nixos", "repo": "nixpkgs", - "rev": "317484b1ead87b9c1b8ac5261a8d2dd748a0492d", + "rev": "c3e128f3c0ecc1fb04aef9f72b3dcc2f6cecf370", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index ff0ea03..a5e09ae 100644 --- a/flake.nix +++ b/flake.nix @@ -11,31 +11,17 @@ colmena = { meta = { allowApplyAll = false; - nixpkgs = self.legacyPackages.x86_64-linux; + nixpkgs = nixpkgs.legacyPackages.x86_64-linux; specialArgs = { inherit inputs; }; }; + web-dus = { + imports = [ ./config/hosts/web-dus/configuration.nix ]; + }; + crime = { + imports = [ ./config/hosts/crime/configuration.nix ]; + }; }; nixosConfigurations = { - web02 = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - ./config/common - ./config/common-lxc.nix - ./config/common-nginx.nix - ./config/hosts/web-dus/configuration.nix - ]; - }; - crime = nixpkgs.lib.nixosSystem { - system = "x86_64-linux"; - specialArgs = { inherit inputs; }; - modules = [ - .config/common - .config/common-lxc.nix - .config/common-nginx.nix - .config/hosts/crime/configuration.nix - ]; - }; # ryuuko = nixpkgs.lib.nixosSystem { # system = "x86_64-linux"; # specialArgs = attrs; @@ -46,5 +32,10 @@ # ]; # }; }; + devShells.x86_64-linux.default = let + pkgs = nixpkgs.legacyPackages.x86_64-linux; + in pkgs.mkShell { + packages = [ pkgs.colmena ]; + }; }; } diff --git a/modules/default.nix b/modules/default.nix index dfe2cd6..2771d99 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -1,5 +1,6 @@ { ... }: { imports = [ ./vhost + ./machine-type ]; } diff --git a/modules/machine-type/default.nix b/modules/machine-type/default.nix new file mode 100644 index 0000000..d7e448f --- /dev/null +++ b/modules/machine-type/default.nix @@ -0,0 +1,44 @@ +{ config, lib, ...}: with lib; { + options.kyouma.machine-type = { + physical = mkOption { + type = types.bool; + default = false; + description = mdDoc "Mark machine as physical."; + }; + + virtual = mkOption { + type = types.bool; + default = false; + description = mdDoc "Mark machine as virtual."; + }; + + router = mkOption { + type = types.bool; + default = false; + description = mdDoc "Mark machine as router."; + }; + + headless = mkOption { + type = types.bool; + default = false; + description = mdDoc "Mark machine as headless."; + }; + + graphical = mkOption { + type = types.bool; + default = false; + description = mdDoc "Mark machine as graphical."; + }; + + portable = mkOption { + type = types.bool; + default = false; + description = mdDoc "Mark machine as portable."; + }; + }; + config = let + cfg = config.kyouma.machine-type; + in { + deployment.tags = mkIf cfg.router [ "router" ]; + }; +}