mirror of
https://github.com/Swarsel/.dotfiles.git
synced 2025-12-06 09:07:21 +01:00
feat[server]: network management
This commit is contained in:
Leon Schwarzäugl
parent
d56d65aac5
commit
626d990b4a
GPG key ID:
26A54C31F2A4FD84
17 changed files with 415 additions and 356 deletions
83
hosts/nixos/aarch64-linux/stoicclub/default.nix
Normal file
83
hosts/nixos/aarch64-linux/stoicclub/default.nix
Normal file
|
|
@ -0,0 +1,83 @@
|
|||
{ lib, config, minimal, globals, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./disk-config.nix
|
||||
];
|
||||
|
||||
topology.self = {
|
||||
icon = "devices.cloud-server";
|
||||
};
|
||||
swarselmodules.server.nginx = false;
|
||||
|
||||
networking = {
|
||||
useDHCP = lib.mkForce false;
|
||||
useNetworkd = true;
|
||||
dhcpcd.enable = false;
|
||||
renameInterfacesByMac = lib.mapAttrs (_: v: v.mac) (
|
||||
config.repo.secrets.local.networking.networks or { }
|
||||
);
|
||||
};
|
||||
boot.initrd.systemd.network = {
|
||||
enable = true;
|
||||
networks."10-${config.swarselsystems.server.localNetwork}" = config.systemd.network.networks."10-${config.swarselsystems.server.localNetwork}";
|
||||
};
|
||||
|
||||
systemd = {
|
||||
network = {
|
||||
enable = true;
|
||||
wait-online.enable = false;
|
||||
networks =
|
||||
let
|
||||
netConfig = config.repo.secrets.local.networking;
|
||||
in
|
||||
{
|
||||
"10-${config.swarselsystems.server.localNetwork}" = {
|
||||
address = [
|
||||
"${globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.cidrv4}"
|
||||
"${globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.cidrv6}"
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Gateway = netConfig.defaultGateway6;
|
||||
GatewayOnLink = true;
|
||||
}
|
||||
{
|
||||
Gateway = netConfig.defaultGateway4;
|
||||
GatewayOnLink = true;
|
||||
}
|
||||
];
|
||||
networkConfig = {
|
||||
IPv6PrivacyExtensions = true;
|
||||
IPv6AcceptRA = false;
|
||||
};
|
||||
matchConfig.MACAddress = netConfig.networks.${config.swarselsystems.server.localNetwork}.mac;
|
||||
linkConfig.RequiredForOnline = "routable";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
swarselsystems = {
|
||||
flakePath = "/root/.dotfiles";
|
||||
info = "VM.Standard.A1.Flex, 4 vCPUs, 24GB RAM";
|
||||
isImpermanence = true;
|
||||
isSecureBoot = false;
|
||||
isCrypted = true;
|
||||
isSwap = false;
|
||||
rootDisk = "/dev/disk/by-id/scsi-360e1a5236f034316a10a97cc703ce9e3";
|
||||
isBtrfs = true;
|
||||
isNixos = true;
|
||||
isLinux = true;
|
||||
isCloud = true;
|
||||
proxyHost = "stoicclub";
|
||||
server = {
|
||||
inherit (config.repo.secrets.local.networking) localNetwork;
|
||||
};
|
||||
};
|
||||
} // lib.optionalAttrs (!minimal) {
|
||||
swarselprofiles = {
|
||||
server = true;
|
||||
};
|
||||
|
||||
}
|
||||
|
|
@ -0,0 +1,15 @@
|
|||
{ lib, modulesPath, ... }:
|
||||
{
|
||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||
|
||||
boot = {
|
||||
initrd = {
|
||||
availableKernelModules = [ "xhci_pci" "virtio_pci" "virtio_scsi" "usbhid" ];
|
||||
kernelModules = [ ];
|
||||
};
|
||||
kernelModules = [ ];
|
||||
extraModulePackages = [ ];
|
||||
};
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkForce "aarch64-linux";
|
||||
}
|
||||
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
"data": "ENC[AES256_GCM,data:pikVONWg81bulGRM+enUyBGxFw4C51177O3WrhRzvCiWpulc9RHVH12AfVh4uAkoOANrPyLZuEUGdu8hvFgcTWBzJXPSPZ2sMfAjx593RhSsW+VM58IS0Oa+N9XxwpYnKiUBHrvAxgJD3vhVgCIrL+1LSylZG/RF4Wj6fw4dkttlCqioRkyNPufBtpMEN+MTw9IFsAKaCV5LTFnetIzm6wUPepExaPOpdFhf61JYyzsHkKZslA4FKs1cWgK5ggJkfQS1aA3KCh8pU8vU6uXRgl4ixyUzn/l1HnGZRhFxjcc0x4RqrJYFW9Qyj7oehHU6AxuzD2bf0vuVxZn7nQy8MrDfsvYL5yU34MSdokwrvg3IBXvPogbmjWoBLl6+0WSlV5s6o8GbTkhFi0kWv5H9AKcywY54ltyzoxAQ/9hsZa9IIGCNMFjVfcrKPQKAfrdLbYQxdioq62lHX0LbXKWU9WPRhiG9eRsETudIPan8VRMvHx/6qS6bXSaEjYkKsVSmUOhcVYp7bp58wl9JKu4qYUOLyE2T00IdmbUWrQ+MP14lj6XKNyLN6//8qFyTyhDBLPBJ5DxOMt6qn1qe/lqD4R8Iqvvj63IFq3/psdDXHu+WNmq2/LQH3Y8GTxIoEQ+uPK/I7Tqdh2DXQgKYK162ybczcqsQwGwQWe+DWtno8fauypNrFp6Wgd7c62pxY+8nJzTU9gYSyAIHWEHmRW1LV231X+7kB+JwB2AxfDFXRChuNtJkOK9pdwo4SSS/tGDS5RLmsO4VpE2mPmhxA78IuU88c0LF/e4fC8N5hteecXjMMsSswbC1VUO/3B0JfN8nI0/BnE5Hhau8McSZ1Z06/GsxC+6ArX+zIXthcLIr95nAnLDgJUOKOU7XvLQ9Y22u4lmYWedSTg+vjdljjUG3aBNyp5ZI2xXQmOOgL21aE9aQgBN27GQGqgzECrNEbK0osBefjw14sxv/aZlWU9hHlVROLVbpyWl3edN9ZEMYSJDCpMPwFkEOshlkZ78IfQw7fWRKoBW3W9uHyRPEFeldy8KQ2Lux8A5KwokgFFrp4JI92gjUSubfFsCZp/NHrV5k5UltfMz50QdaKw==,iv:5tRqYZwfz4AeC/HSetPfDaysniUoAgklLl7mEiWBqiM=,tag:7TnVeBMtP8Q81eqeRu02gg==,type:str]",
|
||||
"data": "ENC[AES256_GCM,data:RvrGk0fGCxkhhxPaJ0zg/Jl24mv3PyMFz5mkX05zaytgQ9l2yUs2rsAe/GW7CjarVQYi+5Mkc+BDWFUPMjsmu7mTXLXckcjv3YPukO2cvUEHr/Cywj8RZXFxzJaZwc0wpN0vZIXcDDhdZWjrb/WuBykPuYekIu2DaNJ6Ioe0OO4wcoyI3dSyj/1dwWHDqvDgn8v8I8FFm87gGoBn4Po2DZ308C2ge+B4vKcL5S1Lwruz1ocJRh03SDR5cyuDvGioyuSiyDSC1+Sz9mwsRSoTkO94Iv7MJDYmUxDBc2cDPyUP2py9L/BAx42tBpGkHxNctjrTQz9gTaRknpx6sfBmxyNCrg6uv6tBlXujXvyIPA4z6mD9dS6LOP1QKmYOjOrg+l3WYorFZYE5wb93G+bfqwPnd8CcnUQsJ17GzWQ0RMEQ+UDJCASvuuU7osSzJJlBi0vMXmF/sXPgjweuO0xiRuT/KiwKchmWUuygWCFW3PvjY3QkVvLe7mTXxHRZTxw2XsMyFvaMgn+fyCKQ0RUic+j5itXcJS93v5PHX62XgNtziQ4RF7Qnxj+gpNWcBWjEDtgS8v+v+imQVTUu5Mvkqv1XhK+e3iPeiHkvqP3S0UJzvxlwgeRoGziKOiOWpqQynig/sRwQNhcN7L8k4woDbFBf6OgAT8yVMB+WwTT2EFk0L12Is8W0vw4nlWChH8D+QyMvP5Wz0Q3clwlVjfHKWm8s4pIntknoKvGDvbzqTkJCQjPs1gTIbnbckvsrWvm9xu9d85vCL/AP4HFWHE+ZS3nYJYMsxegog3qUka1gHBkfbpwh9bbPvVAD4DPzTs7gDQ7ZSQlzA5hAHEsbOJF8vz+fYqhp6raJ8fXN6Yq2iQcEjbzTFhb+ukzcEln8l+6QWviMI+yr730tx4f2OEGEH0ydvFUUEGx/BBcVuKx4EN+SVPC4TkZUaaHtfE+Fz1WxY+Woh5Bl93J9KhVtK8tficRNW0lGRpbbUGixPrLozl3rNS1OHhbAzA0QJ0ZtzKTa848rFS667YEO/85ZBna/kAH7RGLHWXF3taRHCDqUo2aXbQcGSkhNpPi7XOcOgaujvvHNlg==,iv:M+6rUkhstAIiLRK8Tzd6wnXFu3cKupBImGo1yI4AciM=,tag:FMHnrshyG1Fk2QERIzu98g==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
|
|
@ -7,8 +7,8 @@
|
|||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJZzY0QVQ4ZUxxZkdhQ2Zn\nOHpmTnRaR0R3cXh2Z2JFM1RDVDB2QnE3M3prCm43NjQyOS93UTZKaUlUUmhVcTdG\nUWp1YU1kVmZPc0tBN2FMY2FFVkI1a0UKLS0tIFovZi9FQlhMaXpvcnRYN2FiSm16\nTzJESjNyZ1NzajJRNDR6ZTd2TitoQTgKe2hC6OpYIzgqzhmeJuHWe0yXNE+/Ek26\nGt7s1B6OKnrj+S3es84ePOjAbLHr/ez282b/h0y55ws4R7jMemUIrQ==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2025-11-25T15:37:26Z",
|
||||
"mac": "ENC[AES256_GCM,data:nZoyO4iZKAgecFiQ0tBdTEogMIDhe+Tg28L73DLVGCDTaG4QTR4ulvh77R3+Guun6eV5CsH86hTgENgDvybEVJV9bZmJWVbVQ0a+QYsZKIVDcH+o1ZK5EiOoaUb+Tfze1CGey2aw8zBgz3hl7ZeVjb5XNsKOhQz00Oc8xQ7z2CQ=,iv:x7oSgep++DVe2JQ1PPORcqfgBpCRbjO+MNPpDVSlzeI=,tag:JlibH3nTCf64bqxpnCxJAg==,type:str]",
|
||||
"lastmodified": "2025-11-28T00:08:44Z",
|
||||
"mac": "ENC[AES256_GCM,data:16eXbpMM+scd4NxLrANCiAZuWrtoFMgbjCgo4/TbihhiXGPkO6YP6ERS5F4+Wu282ABRyJoS+ia8EaX2Ug9r5mRtdiNmfbMFibNMXK3hXTqtlquTqCQ0vdYVa5b6XT1dX52MZQ53f9MRSY4V/sPmcpJZaXWbZOIYaqbqxg/iKV4=,iv:1n8OWQuRZzHd2A/uMI7bVkUVyVoe2/GSv3CKlJkFmNE=,tag:Rl0n/9pnJGlKif8TER3cFw==,type:str]",
|
||||
"pgp": [
|
||||
{
|
||||
"created_at": "2025-11-20T01:03:05Z",
|
||||
|
|
@ -1,4 +1,4 @@
|
|||
{ lib, config, minimal, ... }:
|
||||
{ lib, config, minimal, globals, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
|
|
@ -35,19 +35,24 @@
|
|||
{
|
||||
"10-wan" = {
|
||||
address = [
|
||||
"${netConfig.wanAddress4}/32"
|
||||
"${netConfig.wanAddress6}/64"
|
||||
"${globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.cidrv4}"
|
||||
"${globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.cidrv6}"
|
||||
];
|
||||
gateway = [ "fe80::1" ];
|
||||
routes = [
|
||||
{ Destination = netConfig.defaultGateway4; }
|
||||
{
|
||||
Gateway = netConfig.defaultGateway6;
|
||||
GatewayOnLink = true;
|
||||
}
|
||||
{
|
||||
Gateway = netConfig.defaultGateway4;
|
||||
GatewayOnLink = true;
|
||||
}
|
||||
];
|
||||
networkConfig = {
|
||||
IPv6PrivacyExtensions = true;
|
||||
IPv6AcceptRA = false;
|
||||
};
|
||||
matchConfig.MACAddress = netConfig.networks.${config.swarselsystems.server.localNetwork}.mac;
|
||||
networkConfig.IPv6PrivacyExtensions = "yes";
|
||||
linkConfig.RequiredForOnline = "routable";
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,5 +1,5 @@
|
|||
{
|
||||
"data": "ENC[AES256_GCM,data:vLTAWtyZJVHtXifwicSRYRYj1PjoEiumhE3bcsMuhj5P0PjyT9f2wzse7GDtusUFXDNWQXNWMNwk1V0auQmWayJa0zvpfRGtnGJrwdl/dImK+UN7ddJ6x6tNU6kjNZ05UplaUsJAJ9tm4eg050muY7KLBuEw1E4Ki9clDDxhxULXv4bdv5QpXaYSiK33ZORnD2EWcYvqUJayU/d8zSRTHV456ePHDIJPfXo22XQSLY7//q1v44ZMKDptOwlktxVQr9/asvE4eLDjdDTA5DXHTfsAGBDZCHqPI33CxZbHENM9UOHw7S0qYpKW2f232Huwv4J7llmsOIT8Axppz6fC8neBKOFPH+n4bZQTaZUL/xSLCQrF/T8k8k84lKJ3eBJdfyTpU8oInu8VAe/w+s2lC+n/zAjGoSGIF412xQ5VS0fsG1Wi/veRDr50KybYUuYQNjwtIXle3fUibUaMGFwd4Y9uSlxrWwWQxJhFpoZhoPPfeNMrT+7BSpVax27HvM7p9+VKkLfWtHiwuSZNSI3HKRmrsxHJVUxuJdXO87TCbabQAvPWoqR6qKMwixN/gvN1JNZ6Ml59HPSe6SKBAh5SI95kzXaBMZ9d7Yy7bUy/xkbbFHNYLwXR62H89XyK3yW6CMr+M7JLSC0WErAVHkUEuIEkWILBIiTeqU3Q,iv:KoTbJUnhbZp7jX/jPmX8gBobDJDoLPAvhBU9j9RYr/g=,tag:qhd6OAHNkbn0xN7wJhF1Fw==,type:str]",
|
||||
"data": "ENC[AES256_GCM,data:nIgv3b+6o5Ce9X9xZtBK62f6dgsAGLPqq7aVFCw2qjD9UiHCrAY9vTn5NSW2O2pbLAfx6h7falS3/0yU+AkJ2H3zhxBy7ZxQ0m9dLoQGrYY/E9Z45xZmdFRxtzexCaxr2DxbP8haJKomQ22cHk07HGsrEZ/CFGkyjRxUr3Y4rewgZPBXahVtM75mWbNpVGApc8cs/W4JbjuXw3qlCQcACz8sZVPHKCjbEypypo6nTmU7NO7worrAJ2QgU75oGJ9g96wp9paFMEDofVp2Y25IVYReGg8T1Qi/kTcZzfzGfSpEwnQBB/ZCW6gNYhMK3shfB8DxKy6+romVXm1K+/0yUmwsCM8xC5zJX0GsO8Uu63YFrW/Y2E6aYZfBHdIgfy4lYOFKC2o0ixirw9EO8HyfsDt47QYB970vLPjYZfKNAZBgltbV3KPsOHxmgiZbTbAl0cb9zRc+jV2voH9T5VhFiUWdfaLBY1HUAVAjU7h62uZoCsi1HWyAroEROKS96npTD+3/vHehYuEGBf1IxYnLwHnKeqsr/Bqoukf3OecOH2EkMTTFQ7E0k9s0keRypoHmeYIh2a3dRcaXXbNEgiAMfabhgUh1NNcYKSZhcIekN8WN8azXjbVIrfEakJ8S+PUf5fJdspN/3Ppm06fDLv7yLHnLc8Eae2COOR8vYKIo3Onu4doxNjisfpHujLXYaCGhWpINEGWF7fkeC1B7,iv:v9MxvhcHg+P00UnOWujSgVlMNcOnDm/gK8kNcN54E2E=,tag:XnPMzsDeGJMt9yv6GnFzqg==,type:str]",
|
||||
"sops": {
|
||||
"age": [
|
||||
{
|
||||
|
|
@ -7,8 +7,8 @@
|
|||
"enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJR1ZPZFUxRTh0QjB6UDJ4\nOFd2c2lFejhHck5UdUxVbmFFbVRYNEJaSzJZCkNxbndVVThObDkxUmx2WW9ESzhh\na2o0LzFCbWdJVlRIV00rTVUwTktoek0KLS0tIC9qalVvZmpGQXZsV3RIYWRPbmRY\nam80NkRkT2l0ak8wV3pTSW9kSC9nZ3cKCH8eEMmku6WMliEDdAiW2Lk1jAGH9SoP\nWQ5Y6e90jEnp8XbGE7KYiG+jy5fHSc6Y5/YyMmi/b9bF9AhmRT6rdw==\n-----END AGE ENCRYPTED FILE-----\n"
|
||||
}
|
||||
],
|
||||
"lastmodified": "2025-11-25T15:44:12Z",
|
||||
"mac": "ENC[AES256_GCM,data:EqEvcd75Si3I0Tgxm0ffeVRKrKNqaFNI+NqZcB02mKPYPWTR6fX4VT2oVhLIxvn+5MQY2BBR/VzSxblcX6K149REpk/22aGuHfk45giq8q1xBnZeNzEQDuhoY8XZd8dzqxk1pHmQFS+jL/zl42a2Qib/jVmlnPof0bcwa/HlZDU=,iv:5V2zSQOCG/XkRF7zgFe1oDuzrP3dx6pWZpsvdVT8hz8=,tag:DYHQIFEedflw43aCTT/ACA==,type:str]",
|
||||
"lastmodified": "2025-11-28T10:50:22Z",
|
||||
"mac": "ENC[AES256_GCM,data:lwkkp8YSzX8NM7E65kmPpF/q9Vn+FnCTeePLswDH6AVgndo/7QOy0GtJeXmiwt2YsA4AhRqxexWl2R8tjEysP35pyfQJ4vEkVi+V2tEnoLgftriNJzpoeVuRNXLxTPhPezOZgAcTDDL4yyqJXpcFj0PE1DPHKxazT28BoilaBYE=,iv:3dcAqkw/y6rAPL8wb5iewz37S4xszYFGHxvQiQ98sLk=,tag:SEmbptei6GrTXXyb7zwrIg==,type:str]",
|
||||
"pgp": [
|
||||
{
|
||||
"created_at": "2025-11-23T15:25:41Z",
|
||||
|
|
|
|||
|
|
@ -1,46 +0,0 @@
|
|||
{ lib, config, minimal, ... }:
|
||||
{
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./disk-config.nix
|
||||
];
|
||||
node.lockFromBootstrapping = false;
|
||||
sops = {
|
||||
age.sshKeyPaths = lib.mkDefault [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
};
|
||||
|
||||
topology.self = {
|
||||
icon = "devices.cloud-server";
|
||||
};
|
||||
|
||||
networking = {
|
||||
domain = "subnet03112148.vcn03112148.oraclevcn.com";
|
||||
firewall = {
|
||||
allowedTCPPorts = [ 53 ];
|
||||
};
|
||||
};
|
||||
|
||||
system.stateVersion = "23.11";
|
||||
|
||||
swarselsystems = {
|
||||
flakePath = "/root/.dotfiles";
|
||||
info = "VM.Standard.E2.1.Micro";
|
||||
isImpermanence = true;
|
||||
isSecureBoot = false;
|
||||
isCrypted = false;
|
||||
isSwap = true;
|
||||
swapSize = "8G";
|
||||
rootDisk = "/dev/sda";
|
||||
isBtrfs = true;
|
||||
isNixos = true;
|
||||
isLinux = true;
|
||||
server = {
|
||||
inherit (config.repo.secrets.local.networking) localNetwork;
|
||||
};
|
||||
};
|
||||
} // lib.optionalAttrs (!minimal) {
|
||||
swarselprofiles = {
|
||||
server = true;
|
||||
};
|
||||
|
||||
}
|
||||
|
|
@ -1,26 +0,0 @@
|
|||
{ lib, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot = {
|
||||
initrd = {
|
||||
availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" ];
|
||||
kernelModules = [ "dm-snapshot" ];
|
||||
};
|
||||
kernelModules = [ "kvm-amd" ];
|
||||
extraModulePackages = [ ];
|
||||
};
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.ens3.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue