mirror of
https://github.com/Swarsel/.dotfiles.git
synced 2025-12-06 09:07:21 +01:00
feat[client,server]: add remote builds, confLib
This commit is contained in:
Leon Schwarzäugl
parent
626d990b4a
commit
f2674bee48
GPG key ID:
26A54C31F2A4FD84
133 changed files with 4297 additions and 3249 deletions
|
|
@ -1,4 +1,4 @@
|
|||
{ lib, config, pkgs, globals, inputs, nixosConfig ? config, ... }:
|
||||
{ lib, config, pkgs, globals, inputs, confLib, ... }:
|
||||
let
|
||||
moduleName = "anki";
|
||||
inherit (config.swarselsystems) isPublic isNixos;
|
||||
|
|
@ -23,11 +23,11 @@ in
|
|||
syncMedia = true;
|
||||
autoSyncMediaMinutes = 5;
|
||||
url = "https://${globals.services.ankisync.domain}";
|
||||
usernameFile = nixosConfig.sops.secrets.anki-user.path;
|
||||
usernameFile = confLib.getConfig.sops.secrets.anki-user.path;
|
||||
# this is not the password but the syncKey
|
||||
# get it by logging in or out, saving preferences and then
|
||||
# show details on the "settings wont be saved" dialog
|
||||
keyFile = nixosConfig.sops.secrets.anki-pw.path;
|
||||
keyFile = confLib.getConfig.sops.secrets.anki-pw.path;
|
||||
};
|
||||
addons =
|
||||
let
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ lib, config, ... }:
|
||||
{ lib, config, globals, ... }:
|
||||
let
|
||||
moduleName = "element-desktop";
|
||||
in
|
||||
|
|
@ -10,7 +10,7 @@ in
|
|||
settings = {
|
||||
default_server_config = {
|
||||
"m.homeserver" = {
|
||||
base_url = "https://swatrix.swarsel.win/";
|
||||
base_url = "https://${globals.services.matrix.domain}/";
|
||||
};
|
||||
};
|
||||
UIFeature = {
|
||||
|
|
|
|||
|
|
@ -1,8 +1,8 @@
|
|||
{ lib, config, nixosConfig ? config, ... }:
|
||||
{ lib, config, confLib, globals, ... }:
|
||||
let
|
||||
inherit (nixosConfig.repo.secrets.common.mail) address1 address2 address3 address4 allMailAddresses;
|
||||
inherit (nixosConfig.repo.secrets.common.calendar) source1 source1-name source2 source2-name source3 source3-name;
|
||||
inherit (nixosConfig.repo.secrets.common) fullName openrouterApi;
|
||||
inherit (confLib.getConfig.repo.secrets.common.mail) address1 address2 address3 address4 allMailAddresses;
|
||||
inherit (confLib.getConfig.repo.secrets.common.calendar) source1 source1-name source2 source2-name source3 source3-name;
|
||||
inherit (confLib.getConfig.repo.secrets.common) fullName openrouterApi instaDomain sportDomain;
|
||||
inherit (config.swarselsystems) isPublic homeDir;
|
||||
|
||||
DISPLAY = ":0";
|
||||
|
|
@ -18,6 +18,12 @@ in
|
|||
DOCUMENT_DIR_PRIV = lib.mkForce "${homeDir}/Documents/Private";
|
||||
FLAKE = "${config.home.homeDirectory}/.dotfiles";
|
||||
} // lib.optionalAttrs (!isPublic) {
|
||||
SWARSEL_DOMAIN = globals.domains.main;
|
||||
SWARSEL_RSS_DOMAIN = globals.services.freshrss.domain;
|
||||
SWARSEL_MUSIC_DOMAIN = globals.services.navidrome.domain;
|
||||
SWARSEL_FILES_DOMAIN = globals.services.nextcloud.domain;
|
||||
SWARSEL_INSTA_DOMAIN = instaDomain;
|
||||
SWARSEL_SPORT_DOMAIN = sportDomain;
|
||||
SWARSEL_MAIL1 = address1;
|
||||
SWARSEL_MAIL2 = address2;
|
||||
SWARSEL_MAIL3 = address3;
|
||||
|
|
@ -30,7 +36,7 @@ in
|
|||
SWARSEL_CAL3NAME = source3-name;
|
||||
SWARSEL_FULLNAME = fullName;
|
||||
SWARSEL_MAIL_ALL = lib.mkDefault allMailAddresses;
|
||||
GITHUB_NOTIFICATION_TOKEN_PATH = nixosConfig.sops.secrets.github-notifications-token.path;
|
||||
GITHUB_NOTIFICATION_TOKEN_PATH = confLib.getConfig.sops.secrets.github-notifications-token.path;
|
||||
OPENROUTER_API_KEY = openrouterApi;
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ lib, config, nixosConfig ? config, ... }:
|
||||
{ lib, config, confLib, ... }:
|
||||
let
|
||||
inherit (nixosConfig.repo.secrets.common.location) latitude longitude;
|
||||
inherit (confLib.getConfig.repo.secrets.common.location) latitude longitude;
|
||||
in
|
||||
{
|
||||
options.swarselmodules.gammastep = lib.mkEnableOption "gammastep settings";
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{ lib, config, globals, minimal, nixosConfig ? config, ... }:
|
||||
{ lib, config, globals, minimal, confLib, ... }:
|
||||
let
|
||||
inherit (nixosConfig.repo.secrets.common.mail) address1;
|
||||
inherit (nixosConfig.repo.secrets.common) fullName;
|
||||
inherit (confLib.getConfig.repo.secrets.common.mail) address1;
|
||||
inherit (confLib.getConfig.repo.secrets.common) fullName;
|
||||
|
||||
gitUser = globals.user.name;
|
||||
in
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{ lib, config, nixosConfig ? config, ... }:
|
||||
{ lib, config, confLib, ... }:
|
||||
let
|
||||
moduleName = "hexchat";
|
||||
inherit (nixosConfig.repo.secrets.common.irc) irc_nick1;
|
||||
inherit (confLib.getConfig.repo.secrets.common.irc) irc_nick1;
|
||||
in
|
||||
{
|
||||
options.swarselmodules.${moduleName} = lib.mkEnableOption "enable ${moduleName} and settings";
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{ lib, config, inputs, globals, nixosConfig ? config, ... }:
|
||||
{ lib, config, inputs, globals, confLib, ... }:
|
||||
let
|
||||
inherit (nixosConfig.repo.secrets.common.mail) address1 address2 address2-name address3 address3-name address4;
|
||||
inherit (nixosConfig.repo.secrets.common) fullName;
|
||||
inherit (confLib.getConfig.repo.secrets.common.mail) address1 address2 address2-name address3 address3-name address4;
|
||||
inherit (confLib.getConfig.repo.secrets.common) fullName;
|
||||
inherit (config.swarselsystems) xdgDir;
|
||||
in
|
||||
{
|
||||
|
|
@ -140,7 +140,7 @@ in
|
|||
address = address4;
|
||||
userName = address4;
|
||||
realName = fullName;
|
||||
passwordCommand = "cat ${nixosConfig.sops.secrets.address4-token.path}";
|
||||
passwordCommand = "cat ${confLib.getConfig.sops.secrets.address4-token.path}";
|
||||
mu.enable = true;
|
||||
msmtp = {
|
||||
enable = true;
|
||||
|
|
@ -169,7 +169,7 @@ in
|
|||
address = address1;
|
||||
userName = address1;
|
||||
realName = fullName;
|
||||
passwordCommand = "cat ${nixosConfig.sops.secrets.address1-token.path}";
|
||||
passwordCommand = "cat ${confLib.getConfig.sops.secrets.address1-token.path}";
|
||||
gpg = {
|
||||
key = "0x76FD3810215AE097";
|
||||
signByDefault = true;
|
||||
|
|
@ -183,7 +183,7 @@ in
|
|||
address = address2;
|
||||
userName = address2;
|
||||
realName = address2-name;
|
||||
passwordCommand = "cat ${nixosConfig.sops.secrets.address2-token.path}";
|
||||
passwordCommand = "cat ${confLib.getConfig.sops.secrets.address2-token.path}";
|
||||
}
|
||||
defaultSettings;
|
||||
|
||||
|
|
@ -193,7 +193,7 @@ in
|
|||
address = address3;
|
||||
userName = address3;
|
||||
realName = address3-name;
|
||||
passwordCommand = "cat ${nixosConfig.sops.secrets.address3-token.path}";
|
||||
passwordCommand = "cat ${confLib.getConfig.sops.secrets.address3-token.path}";
|
||||
}
|
||||
defaultSettings;
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{ lib, config, pkgs, nixosConfig ? config, ... }:
|
||||
{ lib, config, pkgs, confLib, ... }:
|
||||
let
|
||||
moduleName = "obsidian";
|
||||
inherit (nixosConfig.repo.secrets.common.obsidian) userIgnoreFilters;
|
||||
inherit (confLib.getConfig.repo.secrets.common.obsidian) userIgnoreFilters;
|
||||
name = "Main";
|
||||
in
|
||||
{
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ lib, config, ... }:
|
||||
{ lib, config, globals, ... }:
|
||||
let
|
||||
moduleName = "opkssh";
|
||||
in
|
||||
|
|
@ -13,7 +13,7 @@ in
|
|||
providers = [
|
||||
{
|
||||
alias = "kanidm";
|
||||
issuer = "https://sso.swarsel.win/oauth2/openid/opkssh";
|
||||
issuer = "https://${globals.services.kanidm.domain}/oauth2/openid/opkssh";
|
||||
client_id = "opkssh";
|
||||
scopes = "openid email profile";
|
||||
redirect_uris = [
|
||||
|
|
|
|||
|
|
@ -40,7 +40,11 @@ in
|
|||
trusted-public-keys = [
|
||||
atticPublicKey
|
||||
];
|
||||
trusted-users = [ "@wheel" "${mainUser}" ];
|
||||
trusted-users = [
|
||||
"@wheel"
|
||||
"${mainUser}"
|
||||
(lib.mkIf config.swarselmodules.server.ssh-builder "builder")
|
||||
];
|
||||
connect-timeout = 5;
|
||||
bash-prompt-prefix = "[33m$SHLVL:\\w [0m";
|
||||
bash-prompt = "$(if [[ $? -gt 0 ]]; then printf \"[31m\"; else printf \"[32m\"; fi)λ [0m";
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{ lib, config, nixosConfig ? config, ... }:
|
||||
{ inputs, lib, config, confLib, ... }:
|
||||
{
|
||||
options.swarselmodules.ssh = lib.mkEnableOption "ssh settings";
|
||||
config = lib.mkIf config.swarselmodules.ssh {
|
||||
config = lib.mkIf config.swarselmodules.ssh ({
|
||||
programs.ssh = {
|
||||
enable = true;
|
||||
enableDefaultConfig = false;
|
||||
|
|
@ -18,11 +18,15 @@
|
|||
serverAliveCountMax = 3;
|
||||
hashKnownHosts = false;
|
||||
userKnownHostsFile = "~/.ssh/known_hosts";
|
||||
controlMaster = "no";
|
||||
controlMaster = "auto";
|
||||
controlPath = "~/.ssh/master-%r@%n:%p";
|
||||
controlPersist = "no";
|
||||
controlPersist = "5m";
|
||||
};
|
||||
} // nixosConfig.repo.secrets.common.ssh.hosts;
|
||||
} // confLib.getConfig.repo.secrets.common.ssh.hosts;
|
||||
};
|
||||
};
|
||||
} // lib.optionalAttrs (inputs ? sops) {
|
||||
sops.secrets = lib.mkIf (!config.swarselsystems.isPublic && !config.swarselsystems.isNixos) {
|
||||
builder-key = { path = "${config.home.homeDirectory}/.ssh/builder"; mode = "0600"; };
|
||||
};
|
||||
});
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, lib, vars, nixosConfig ? config, ... }:
|
||||
{ config, lib, vars, confLib, ... }:
|
||||
let
|
||||
eachOutput = _: monitor: {
|
||||
inherit (monitor) name;
|
||||
|
|
@ -381,7 +381,7 @@ in
|
|||
export XDG_CURRENT_DESKTOP=sway;
|
||||
export XDG_SESSION_DESKTOP=sway;
|
||||
export _JAVA_AWT_WM_NONREPARENTING=1;
|
||||
export GITHUB_NOTIFICATION_TOKEN_PATH=${nixosConfig.sops.secrets.github-notifications-token.path};
|
||||
export GITHUB_NOTIFICATION_TOKEN_PATH=${confLib.getConfig.sops.secrets.github-notifications-token.path};
|
||||
'' + vars.waylandExports;
|
||||
# extraConfigEarly = "
|
||||
# exec systemctl --user import-environment DISPLAY WAYLAND_DISPLAY SWAYSOCK
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ lib, config, inputs, nixosConfig ? config, ... }:
|
||||
{ lib, config, inputs, confLib, ... }:
|
||||
let
|
||||
inherit (config.swarselsystems) homeDir;
|
||||
in
|
||||
|
|
@ -9,8 +9,8 @@ in
|
|||
|
||||
pam.yubico.authorizedYubiKeys = lib.mkIf (config.swarselsystems.isNixos && !config.swarselsystems.isPublic) {
|
||||
ids = [
|
||||
nixosConfig.repo.secrets.common.yubikeys.dev1
|
||||
nixosConfig.repo.secrets.common.yubikeys.dev2
|
||||
confLib.getConfig.repo.secrets.common.yubikeys.dev1
|
||||
confLib.getConfig.secrets.common.yubikeys.dev2
|
||||
];
|
||||
};
|
||||
} // lib.optionalAttrs (inputs ? sops) {
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, pkgs, lib, minimal, inputs, globals, nixosConfig ? config, ... }:
|
||||
{ config, pkgs, lib, minimal, inputs, globals, confLib, ... }:
|
||||
let
|
||||
inherit (config.swarselsystems) flakePath isNixos;
|
||||
crocDomain = globals.services.croc.domain;
|
||||
|
|
@ -127,8 +127,8 @@ in
|
|||
'';
|
||||
sessionVariables = lib.mkIf (!config.swarselsystems.isPublic) {
|
||||
CROC_RELAY = crocDomain;
|
||||
CROC_PASS = "$(cat ${nixosConfig.sops.secrets.croc-password.path or ""})";
|
||||
GITHUB_TOKEN = "$(cat ${nixosConfig.sops.secrets.github-nixpkgs-review-token.path or ""})";
|
||||
CROC_PASS = "$(cat ${confLib.getConfig.sops.secrets.croc-password.path or ""})";
|
||||
GITHUB_TOKEN = "$(cat ${confLib.getConfig.sops.secrets.github-nixpkgs-review-token.path or ""})";
|
||||
QT_QPA_PLATFORM_PLUGIN_PATH = "${pkgs.libsForQt5.qt5.qtbase.bin}/lib/qt-${pkgs.libsForQt5.qt5.qtbase.version}/plugins";
|
||||
# QTWEBENGINE_CHROMIUM_FLAGS = "--no-sandbox";
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
{ lib, config, ... }:
|
||||
_:
|
||||
{
|
||||
options.swarselmodules.optional.framework = lib.mkEnableOption "optional framework machine settings";
|
||||
config = lib.mkIf config.swarselmodules.optional.framework {
|
||||
config = {
|
||||
swarselsystems = {
|
||||
inputs = {
|
||||
"12972:18:Framework_Laptop_16_Keyboard_Module_-_ANSI_Keyboard" = {
|
||||
|
|
|
|||
|
|
@ -1,10 +1,9 @@
|
|||
{ lib, config, pkgs, nixosConfig ? config, ... }:
|
||||
{ config, pkgs, confLib, ... }:
|
||||
let
|
||||
inherit (config.swarselsystems) isNixos;
|
||||
in
|
||||
{
|
||||
options.swarselmodules.optional.gaming = lib.mkEnableOption "optional gaming settings";
|
||||
config = lib.mkIf config.swarselmodules.optional.gaming {
|
||||
config = {
|
||||
# specialisation = {
|
||||
# gaming.configuration = {
|
||||
home.packages = with pkgs; [
|
||||
|
|
@ -44,7 +43,7 @@ in
|
|||
gamescope
|
||||
umu-launcher
|
||||
];
|
||||
steamPackage = if isNixos then nixosConfig.programs.steam.package else pkgs.steam;
|
||||
steamPackage = if isNixos then confLib.getConfig.programs.steam.package else pkgs.steam;
|
||||
winePackages = with pkgs; [
|
||||
wineWow64Packages.waylandFull
|
||||
];
|
||||
|
|
|
|||
|
|
@ -1,5 +1,8 @@
|
|||
{ config, pkgs, lib, vars, ... }:
|
||||
{ inputs, config, pkgs, lib, vars, ... }:
|
||||
{
|
||||
imports = [
|
||||
inputs.niri-flake.homeModules.niri
|
||||
];
|
||||
options.swarselmodules.niri = lib.mkEnableOption "niri settings";
|
||||
config = lib.mkIf config.swarselmodules.niri
|
||||
{
|
||||
|
|
@ -1,24 +1,22 @@
|
|||
{ config, lib, nixosConfig ? config, ... }:
|
||||
{ confLib, ... }:
|
||||
{
|
||||
options.swarselmodules.optional.uni = lib.mkEnableOption "optional uni settings";
|
||||
config = lib.mkIf config.swarselmodules.optional.uni
|
||||
{
|
||||
services.pizauth = {
|
||||
enable = true;
|
||||
accounts = {
|
||||
uni = {
|
||||
authUri = "https://login.microsoftonline.com/common/oauth2/v2.0/authorize";
|
||||
tokenUri = "https://login.microsoftonline.com/common/oauth2/v2.0/token";
|
||||
clientId = "08162f7c-0fd2-4200-a84a-f25a4db0b584";
|
||||
clientSecret = "TxRBilcHdC6WGBee]fs?QR:SJ8nI[g82";
|
||||
scopes = [
|
||||
"https://outlook.office365.com/IMAP.AccessAsUser.All"
|
||||
"https://outlook.office365.com/SMTP.Send"
|
||||
"offline_access"
|
||||
];
|
||||
loginHint = "${nixosConfig.repo.secrets.local.uni.mailAddress}";
|
||||
};
|
||||
config = {
|
||||
services.pizauth = {
|
||||
enable = true;
|
||||
accounts = {
|
||||
uni = {
|
||||
authUri = "https://login.microsoftonline.com/common/oauth2/v2.0/authorize";
|
||||
tokenUri = "https://login.microsoftonline.com/common/oauth2/v2.0/token";
|
||||
clientId = "08162f7c-0fd2-4200-a84a-f25a4db0b584";
|
||||
clientSecret = "TxRBilcHdC6WGBee]fs?QR:SJ8nI[g82";
|
||||
scopes = [
|
||||
"https://outlook.office365.com/IMAP.AccessAsUser.All"
|
||||
"https://outlook.office365.com/SMTP.Send"
|
||||
"offline_access"
|
||||
];
|
||||
loginHint = "${confLib.getConfig.repo.secrets.local.uni.mailAddress}";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
File diff suppressed because it is too large
Load diff
85
modules/nixos/client/remotebuild.nix
Normal file
85
modules/nixos/client/remotebuild.nix
Normal file
|
|
@ -0,0 +1,85 @@
|
|||
{ lib, config, globals, ... }:
|
||||
let
|
||||
inherit (config.swarselsystems) homeDir mainUser isClient;
|
||||
in
|
||||
{
|
||||
options.swarselmodules.remotebuild = lib.mkEnableOption "enable remote builds on this machine";
|
||||
config = lib.mkIf config.swarselmodules.remotebuild {
|
||||
|
||||
sops.secrets = {
|
||||
builder-key = lib.mkIf isClient { owner = mainUser; path = "${homeDir}/.ssh/builder"; mode = "0600"; };
|
||||
nixbuild-net-key = { owner = mainUser; path = "${homeDir}/.ssh/nixbuild-net"; mode = "0600"; };
|
||||
};
|
||||
|
||||
nix = {
|
||||
settings.builders-use-substitutes = true;
|
||||
distributedBuilds = true;
|
||||
buildMachines = [
|
||||
(lib.mkIf isClient {
|
||||
hostName = config.repo.secrets.common.builder1-ip;
|
||||
system = "aarch64-linux";
|
||||
maxJobs = 20;
|
||||
speedFactor = 10;
|
||||
})
|
||||
(lib.mkIf isClient {
|
||||
hostName = globals.hosts.belchsfactory.wanAddress4;
|
||||
system = "aarch64-linux";
|
||||
maxJobs = 4;
|
||||
speedFactor = 2;
|
||||
protocol = "ssh-ng";
|
||||
})
|
||||
{
|
||||
hostName = "eu.nixbuild.net";
|
||||
system = "x86_64-linux";
|
||||
maxJobs = 100;
|
||||
speedFactor = 2;
|
||||
supportedFeatures = [ "big-parallel" ];
|
||||
}
|
||||
];
|
||||
};
|
||||
programs.ssh = {
|
||||
knownHosts = {
|
||||
nixbuild = {
|
||||
hostNames = [ "eu.nixbuild.net" ];
|
||||
publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPIQCZc54poJ8vqawd8TraNryQeJnvH1eLpIDgbiqymM";
|
||||
};
|
||||
builder1 = lib.mkIf isClient {
|
||||
hostNames = [ config.repo.secrets.common.builder1-ip ];
|
||||
publicKey = config.repo.secrets.common.builder1-pubHostKey;
|
||||
};
|
||||
jump = lib.mkIf isClient {
|
||||
hostNames = [ globals.hosts.liliputsteps.wanAddress4 ];
|
||||
publicKey = config.repo.secrets.common.jump-pubHostKey;
|
||||
};
|
||||
builder2 = lib.mkIf isClient {
|
||||
hostNames = [ globals.hosts.belchsfactory.wanAddress4 ];
|
||||
publicKey = config.repo.secrets.common.builder2-pubHostKey;
|
||||
};
|
||||
};
|
||||
extraConfig = ''
|
||||
Host eu.nixbuild.net
|
||||
ConnectTimeout 1
|
||||
PubkeyAcceptedKeyTypes ssh-ed25519
|
||||
ServerAliveInterval 60
|
||||
IPQoS throughput
|
||||
IdentityFile ${config.sops.secrets.nixbuild-net-key.path}
|
||||
'' + lib.optionalString isClient ''
|
||||
Host ${config.repo.secrets.common.builder1-ip}
|
||||
ConnectTimeout 1
|
||||
User ${mainUser}
|
||||
IdentityFile ${config.sops.secrets.builder-key.path}
|
||||
|
||||
Host ${globals.hosts.belchsfactory.wanAddress4}
|
||||
ConnectTimeout 5
|
||||
ProxyJump ${globals.hosts.liliputsteps.wanAddress4}
|
||||
User builder
|
||||
IdentityFile ${config.sops.secrets.builder-key.path}
|
||||
|
||||
Host ${globals.hosts.liliputsteps.wanAddress4}
|
||||
ConnectTimeout 1
|
||||
User jump
|
||||
IdentityFile ${config.sops.secrets.builder-key.path}
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -13,7 +13,7 @@ in
|
|||
comment = "Sway compositor managed by UWSM";
|
||||
binPath = "/run/current-system/sw/bin/sway";
|
||||
};
|
||||
niri = {
|
||||
niri = lib.mkIf (config.swarselmodules ? niri) {
|
||||
prettyName = "Niri";
|
||||
comment = "Niri compositor managed by UWSM";
|
||||
binPath = "/run/current-system/sw/bin/niri-session";
|
||||
|
|
|
|||
|
|
@ -197,6 +197,10 @@ in
|
|||
main = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
externalDns = mkOption {
|
||||
type = types.listOf types.str;
|
||||
description = "List of external dns nameservers";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -25,7 +25,7 @@ in
|
|||
}) // (lib.optionalAttrs modules.emacs {
|
||||
emacs-radicale-pw = { owner = mainUser; };
|
||||
github-forge-token = { owner = mainUser; };
|
||||
}) // (lib.optionalAttrs modules.optional.work {
|
||||
}) // (lib.optionalAttrs (modules ? optional-work) {
|
||||
harica-root-ca = { sopsFile = certsSopsFile; path = "${homeDir}/.aws/certs/harica-root.pem"; owner = mainUser; };
|
||||
}) // (lib.optionalAttrs modules.anki {
|
||||
anki-user = { owner = mainUser; };
|
||||
|
|
|
|||
|
|
@ -34,6 +34,11 @@ let
|
|||
"nginx"
|
||||
"virtualHosts"
|
||||
]
|
||||
[
|
||||
"swarselsystems"
|
||||
"server"
|
||||
"dns"
|
||||
]
|
||||
];
|
||||
|
||||
attrsForEachOption =
|
||||
|
|
|
|||
|
|
@ -59,8 +59,8 @@ in
|
|||
config = lib.mkIf config.swarselmodules.general
|
||||
(lib.recursiveUpdate
|
||||
{
|
||||
sops.secrets.github-api-token = lib.mkIf (!minimal) {
|
||||
owner = mainUser;
|
||||
sops.secrets = lib.mkIf (!minimal) {
|
||||
github-api-token = { owner = mainUser; };
|
||||
};
|
||||
|
||||
nix =
|
||||
|
|
@ -83,7 +83,11 @@ in
|
|||
trusted-public-keys = [
|
||||
atticPublicKey
|
||||
];
|
||||
trusted-users = [ "@wheel" "${config.swarselsystems.mainUser}" ];
|
||||
trusted-users = [
|
||||
"@wheel"
|
||||
"${config.swarselsystems.mainUser}"
|
||||
(lib.mkIf config.swarselmodules.server.ssh-builder "builder")
|
||||
];
|
||||
};
|
||||
# extraOptions = ''
|
||||
# plugin-files = ${pkgs.dev.nix-plugins}/lib/nix/plugins
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
{ lib, config, ... }:
|
||||
_:
|
||||
{
|
||||
options.swarselmodules.optional.amdcpu = lib.mkEnableOption "optional amd cpu settings";
|
||||
config = lib.mkIf config.swarselmodules.optional.amdcpu {
|
||||
config = {
|
||||
hardware = {
|
||||
cpu.amd.updateMicrocode = true;
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,7 +1,6 @@
|
|||
{ lib, config, ... }:
|
||||
_:
|
||||
{
|
||||
options.swarselmodules.optional.amdgpu = lib.mkEnableOption "optional amd gpu settings";
|
||||
config = lib.mkIf config.swarselmodules.optional.amdgpu {
|
||||
config = {
|
||||
hardware = {
|
||||
amdgpu = {
|
||||
opencl.enable = true;
|
||||
|
|
|
|||
|
|
@ -1,7 +1,13 @@
|
|||
{ lib, config, ... }:
|
||||
{ self, config, ... }:
|
||||
{
|
||||
options.swarselmodules.optional.framework = lib.mkEnableOption "optional framework machine settings";
|
||||
config = lib.mkIf config.swarselmodules.optional.framework {
|
||||
config = {
|
||||
|
||||
home-manager.users."${config.swarselsystems.mainUser}" = {
|
||||
imports = [
|
||||
"${self}/modules/home/optional/framework.nix"
|
||||
];
|
||||
};
|
||||
|
||||
services = {
|
||||
fwupd = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -1,7 +1,13 @@
|
|||
{ pkgs, lib, config, ... }:
|
||||
{ self, pkgs, config, ... }:
|
||||
{
|
||||
options.swarselmodules.optional.gaming = lib.mkEnableOption "optional gaming settings";
|
||||
config = lib.mkIf config.swarselmodules.optional.gaming {
|
||||
config = {
|
||||
|
||||
home-manager.users."${config.swarselsystems.mainUser}" = {
|
||||
imports = [
|
||||
"${self}/modules/home/optional/gaming.nix"
|
||||
];
|
||||
};
|
||||
|
||||
programs.steam = {
|
||||
enable = true;
|
||||
package = pkgs.steam;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,5 @@
|
|||
{ lib, config, ... }:
|
||||
{
|
||||
options.swarselmodules.optional.hibernation = lib.mkEnableOption "optional amd gpu settings";
|
||||
options.swarselsystems = {
|
||||
hibernation = {
|
||||
offset = lib.mkOption {
|
||||
|
|
@ -13,7 +12,7 @@
|
|||
};
|
||||
};
|
||||
};
|
||||
config = lib.mkIf config.swarselmodules.optional.hibernation {
|
||||
config = {
|
||||
boot = {
|
||||
kernelParams = [
|
||||
"resume_offset=${builtins.toString config.swarselsystems.hibernation.offset}"
|
||||
|
|
|
|||
|
|
@ -1,11 +1,9 @@
|
|||
{ lib, config, ... }:
|
||||
_:
|
||||
{
|
||||
options.swarselmodules.optional.microvmGuest = lib.mkEnableOption "optional microvmGuest settings";
|
||||
# imports = [
|
||||
# inputs.microvm.nixosModules.microvm
|
||||
# "${self}/profiles/nixos"
|
||||
# "${self}/modules/nixos"
|
||||
# ];
|
||||
config = lib.mkIf config.swarselmodules.optional.microvmGuest
|
||||
|
||||
config =
|
||||
{ };
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,10 +1,7 @@
|
|||
{ lib, config, ... }:
|
||||
{ config, lib, ... }:
|
||||
{
|
||||
options = {
|
||||
swarselmodules.optional.microvmHost = lib.mkEnableOption "optional microvmHost settings";
|
||||
};
|
||||
# imports = [
|
||||
# inputs.microvm.nixosModules.host
|
||||
# inputs.microvm.nixosModules.host
|
||||
# ];
|
||||
|
||||
config = lib.mkIf (config.guests != { }) {
|
||||
|
|
|
|||
|
|
@ -1,8 +1,11 @@
|
|||
{ lib, config, pkgs, ... }:
|
||||
{ inputs, lib, config, pkgs, ... }:
|
||||
let
|
||||
moduleName = "niri";
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
inputs.niri-flake.nixosModules.niri
|
||||
];
|
||||
options.swarselmodules.${moduleName} = lib.mkEnableOption "${moduleName} settings";
|
||||
config = lib.mkIf config.swarselmodules.${moduleName}
|
||||
{
|
||||
|
|
@ -1,7 +1,6 @@
|
|||
{ lib, config, pkgs, ... }:
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
options.swarselmodules.optional.nswitch-rcm = lib.mkEnableOption "optional nswitch-rcm settings";
|
||||
config = lib.mkIf config.swarselmodules.optional.nswitch-rcm {
|
||||
config = {
|
||||
services.nswitch-rcm = {
|
||||
enable = true;
|
||||
package = pkgs.fetchurl {
|
||||
|
|
|
|||
50
modules/nixos/optional/systemd-networkd-server.nix
Normal file
50
modules/nixos/optional/systemd-networkd-server.nix
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
{ lib, config, globals, ... }:
|
||||
{
|
||||
networking = {
|
||||
useDHCP = lib.mkForce false;
|
||||
useNetworkd = true;
|
||||
dhcpcd.enable = false;
|
||||
renameInterfacesByMac = lib.mapAttrs (_: v: v.mac) (
|
||||
config.repo.secrets.local.networking.networks or { }
|
||||
);
|
||||
};
|
||||
boot.initrd.systemd.network = {
|
||||
enable = true;
|
||||
networks."10-${config.swarselsystems.server.localNetwork}" = config.systemd.network.networks."10-${config.swarselsystems.server.localNetwork}";
|
||||
};
|
||||
|
||||
systemd = {
|
||||
network = {
|
||||
enable = true;
|
||||
wait-online.enable = false;
|
||||
networks =
|
||||
let
|
||||
netConfig = config.repo.secrets.local.networking;
|
||||
in
|
||||
{
|
||||
"10-${config.swarselsystems.server.localNetwork}" = {
|
||||
address = [
|
||||
"${globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.cidrv4}"
|
||||
"${globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.cidrv6}"
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Gateway = netConfig.defaultGateway6;
|
||||
GatewayOnLink = true;
|
||||
}
|
||||
{
|
||||
Gateway = netConfig.defaultGateway4;
|
||||
GatewayOnLink = true;
|
||||
}
|
||||
];
|
||||
networkConfig = {
|
||||
IPv6PrivacyExtensions = true;
|
||||
IPv6AcceptRA = false;
|
||||
};
|
||||
matchConfig.MACAddress = netConfig.networks.${config.swarselsystems.server.localNetwork}.mac;
|
||||
linkConfig.RequiredForOnline = "routable";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
11
modules/nixos/optional/uni.nix
Normal file
11
modules/nixos/optional/uni.nix
Normal file
|
|
@ -0,0 +1,11 @@
|
|||
{ self, config, ... }:
|
||||
{
|
||||
config = {
|
||||
|
||||
home-manager.users."${config.swarselsystems.mainUser}" = {
|
||||
imports = [
|
||||
"${self}/modules/home/optional/work.nix"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,7 +1,6 @@
|
|||
{ lib, config, pkgs, ... }:
|
||||
{
|
||||
options.swarselmodules.optional.virtualbox = lib.mkEnableOption "optional VBox settings";
|
||||
config = lib.mkIf config.swarselmodules.optional.virtualbox {
|
||||
config = {
|
||||
# specialisation = {
|
||||
# VBox.configuration = {
|
||||
virtualisation.virtualbox = {
|
||||
|
|
|
|||
|
|
@ -1,8 +1,7 @@
|
|||
{ lib, config, ... }:
|
||||
_:
|
||||
{
|
||||
|
||||
options.swarselmodules.optional.vmware = lib.mkEnableOption "optional vmware settings";
|
||||
config = lib.mkIf config.swarselmodules.optional.vmware {
|
||||
config = {
|
||||
virtualisation.vmware.host.enable = true;
|
||||
virtualisation.vmware.guest.enable = true;
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ self, lib, pkgs, config, configName, ... }:
|
||||
{ self, lib, pkgs, config, ... }:
|
||||
let
|
||||
inherit (config.swarselsystems) mainUser homeDir;
|
||||
iwd = config.networking.networkmanager.wifi.backend == "iwd";
|
||||
|
|
@ -6,18 +6,24 @@ let
|
|||
sopsFile = self + /secrets/work/secrets.yaml;
|
||||
in
|
||||
{
|
||||
options.swarselmodules.optional.work = lib.mkEnableOption "optional work settings";
|
||||
options.swarselsystems = {
|
||||
hostName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = configName;
|
||||
default = config.node.name;
|
||||
};
|
||||
fqdn = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
};
|
||||
};
|
||||
config = lib.mkIf config.swarselmodules.optional.work {
|
||||
config = {
|
||||
|
||||
home-manager.users."${config.swarselsystems.mainUser}" = {
|
||||
imports = [
|
||||
"${self}/modules/home/optional/work.nix"
|
||||
];
|
||||
};
|
||||
|
||||
sops =
|
||||
let
|
||||
secretNames = [
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ in
|
|||
};
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
67
modules/nixos/server/bastion.nix
Normal file
67
modules/nixos/server/bastion.nix
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
{ self, lib, config, ... }:
|
||||
{
|
||||
options.swarselmodules.server.bastion = lib.mkEnableOption "enable bastion on server";
|
||||
config = lib.mkIf config.swarselmodules.server.bastion {
|
||||
|
||||
users = {
|
||||
groups = {
|
||||
jump = { };
|
||||
};
|
||||
users = {
|
||||
"jump" = {
|
||||
isNormalUser = true;
|
||||
useDefaultShell = true;
|
||||
group = lib.mkForce "jump";
|
||||
createHome = lib.mkForce true;
|
||||
openssh.authorizedKeys.keyFiles = [
|
||||
(self + /secrets/keys/ssh/yubikey.pub)
|
||||
(self + /secrets/keys/ssh/magicant.pub)
|
||||
(self + /secrets/keys/ssh/builder.pub)
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
startWhenNeeded = lib.mkForce false;
|
||||
authorizedKeysInHomedir = false;
|
||||
extraConfig = ''
|
||||
Match User jump
|
||||
PermitTTY no
|
||||
X11Forwarding no
|
||||
PermitTunnel no
|
||||
GatewayPorts no
|
||||
AllowAgentForwarding no
|
||||
'';
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
KbdInteractiveAuthentication = false;
|
||||
PermitRootLogin = lib.mkDefault "no";
|
||||
AllowUsers = [
|
||||
"jump"
|
||||
];
|
||||
};
|
||||
hostKeys = lib.mkIf (!config.swarselmodules.server.ssh) [
|
||||
{
|
||||
path = "/etc/ssh/ssh_host_ed25519_key";
|
||||
type = "ed25519";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
home-manager.users.jump.config = {
|
||||
home.stateVersion = lib.mkDefault "23.05";
|
||||
programs.ssh = {
|
||||
enable = true;
|
||||
enableDefaultConfig = false;
|
||||
matchBlocks = {
|
||||
"*" = {
|
||||
forwardAgent = false;
|
||||
};
|
||||
} // config.repo.secrets.local.ssh.hosts;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -17,7 +17,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
{ self, pkgs, lib, config, globals, minimal, ... }:
|
||||
let
|
||||
localIp = globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.ipv4;
|
||||
subnetMask = globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".subnetMask4;
|
||||
localIp = globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.ipv4;
|
||||
subnetMask = globals.networks.${config.swarselsystems.server.netConfigName}.subnetMask4;
|
||||
gatewayIp = globals.hosts.${config.node.name}.defaultGateway4;
|
||||
|
||||
hostKeyPathBase = "/etc/secrets/initrd/ssh_host_ed25519_key";
|
||||
|
|
@ -36,7 +36,7 @@ in
|
|||
files = [ hostKeyPathBase ];
|
||||
};
|
||||
|
||||
boot = lib.mkIf (!config.swarselsystems.isLaptop) {
|
||||
boot = lib.mkIf (!config.swarselsystems.isClient) {
|
||||
kernelParams = lib.mkIf (!config.swarselsystems.isCloud) [
|
||||
"ip=${localIp}::${gatewayIp}:${subnetMask}:${config.networking.hostName}::none"
|
||||
];
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -54,11 +54,11 @@ in
|
|||
assertions = [
|
||||
{
|
||||
assertion = config.swarselsystems.server.${serviceName}.buckets != [ ];
|
||||
message = "If Garage is enabled, at least one bucket must be specified in atro.garage.buckets";
|
||||
message = "If Garage is enabled, at least one bucket must be specified in swarselsystems.server.${serviceName}.buckets";
|
||||
}
|
||||
{
|
||||
assertion = builtins.length (lib.attrsToList config.swarselsystems.server.${serviceName}.keys) > 0;
|
||||
message = "If Garage is enabled, at least one key must be specified in atro.garage.keys";
|
||||
message = "If Garage is enabled, at least one key must be specified in swarselsystems.server.${serviceName}.keys";
|
||||
}
|
||||
{
|
||||
assertion =
|
||||
|
|
@ -71,7 +71,7 @@ in
|
|||
}
|
||||
];
|
||||
|
||||
swarselsystems.server.dns.${baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${baseDomain}.subdomainRecords = {
|
||||
"${subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
"${subDomain}admin" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
"${subDomain}web" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
|
|
@ -121,7 +121,7 @@ in
|
|||
|
||||
rpc_bind_addr = "[::]:${builtins.toString garageRpcPort}";
|
||||
# we are not joining our nodes, just use the private ipv4
|
||||
rpc_public_addr = "${globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.ipv4}:${builtins.toString garageRpcPort}";
|
||||
rpc_public_addr = "${globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.ipv4}:${builtins.toString garageRpcPort}";
|
||||
|
||||
rpc_secret_file = config.sops.secrets.garage-rpc-secret.path;
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -31,7 +31,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ in
|
|||
calibre
|
||||
];
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ in
|
|||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
sops.secrets = {
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ in
|
|||
};
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,28 +1,40 @@
|
|||
{ lib, config, ... }:
|
||||
let
|
||||
inherit (config.swarselsystems.server) localNetwork;
|
||||
netConfig = config.repo.secrets.local.networking;
|
||||
netName = "${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}";
|
||||
in
|
||||
{
|
||||
options.swarselmodules.server.network = lib.mkEnableOption "enable server network config";
|
||||
options.swarselsystems.server.localNetwork = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "home";
|
||||
options = {
|
||||
swarselmodules.server.network = lib.mkEnableOption "enable server network config";
|
||||
swarselsystems.server = {
|
||||
localNetwork = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
};
|
||||
netConfigName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = netName;
|
||||
readOnly = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
config = lib.mkIf config.swarselmodules.server.network {
|
||||
|
||||
globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${localNetwork}".hosts.${config.node.name} = {
|
||||
inherit (config.repo.secrets.local.networking.networks.${localNetwork}) id;
|
||||
mac = config.repo.secrets.local.networking.networks.${localNetwork}.mac or null;
|
||||
swarselsystems.server.localNetwork = netConfig.localNetwork or "";
|
||||
|
||||
globals.networks.${netName}.hosts.${config.node.name} = {
|
||||
inherit (netConfig.networks.${netConfig.localNetwork}) id;
|
||||
mac = netConfig.networks.${netConfig.localNetwork}.mac or null;
|
||||
};
|
||||
|
||||
globals.hosts.${config.node.name} = {
|
||||
inherit (config.repo.secrets.local.networking) defaultGateway4;
|
||||
wanAddress4 = config.repo.secrets.local.networking.wanAddress4 or null;
|
||||
wanAddress6 = config.repo.secrets.local.networking.wanAddress6 or null;
|
||||
wanAddress4 = netConfig.wanAddress4 or null;
|
||||
wanAddress6 = netConfig.wanAddress6 or null;
|
||||
};
|
||||
|
||||
networking = {
|
||||
inherit (config.repo.secrets.local.networking) hostId;
|
||||
inherit (netConfig) hostId;
|
||||
hostName = config.node.name;
|
||||
nftables.enable = lib.mkDefault false;
|
||||
enableIPv6 = lib.mkDefault true;
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,6 @@
|
|||
{ pkgs, lib, config, ... }:
|
||||
let
|
||||
inherit (config.repo.secrets.common) dnsProvider;
|
||||
inherit (config.repo.secrets.common) dnsProvider dnsBase;
|
||||
inherit (config.repo.secrets.common.mail) address3;
|
||||
|
||||
serviceUser = "nginx";
|
||||
|
|
@ -63,9 +63,12 @@ in
|
|||
];
|
||||
|
||||
sops = {
|
||||
secrets.acme-dns-token = { inherit (config.swarselsystems) sopsFile; };
|
||||
secrets = {
|
||||
acme-dns-token = { inherit (config.swarselsystems) sopsFile; };
|
||||
};
|
||||
templates."certs.secret".content = ''
|
||||
CF_DNS_API_TOKEN=${config.sops.placeholder.acme-dns-token}
|
||||
ACME_DNS_API_BASE=${dnsBase}
|
||||
ACME_DNS_STORAGE_PATH=${config.sops.placeholder.acme-dns-token}
|
||||
'';
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,10 +1,7 @@
|
|||
{ inputs, lib, config, globals, dns, confLib, ... }:
|
||||
{ lib, config, globals, dns, confLib, ... }:
|
||||
let
|
||||
inherit (confLib.gen { name = "nsd"; port = 53; }) serviceName;
|
||||
# servicePort = 53;
|
||||
# serviceDomain = config.repo.secrets.common.services.domains."${serviceName}";
|
||||
# serviceAddress = globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.ipv4;
|
||||
|
||||
inherit (confLib.gen { name = "nsd"; port = 53; }) serviceName servicePort proxyAddress4 proxyAddress6;
|
||||
inherit (config.swarselsystems) sopsFile;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
|
|
@ -14,7 +11,7 @@ in
|
|||
lib.types.submodule {
|
||||
options = {
|
||||
subdomainRecords = lib.mkOption {
|
||||
type = lib.types.attrsOf inputs.dns.subzone;
|
||||
type = lib.types.attrsOf dns.lib.types.subzone;
|
||||
default = { };
|
||||
};
|
||||
};
|
||||
|
|
@ -23,14 +20,69 @@ in
|
|||
};
|
||||
};
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
sops.secrets = {
|
||||
tsig-key = { inherit sopsFile; };
|
||||
};
|
||||
|
||||
# services.resolved.enable = false;
|
||||
networking = {
|
||||
# nameservers = [ "1.1.1.1" "8.8.8.8" ];
|
||||
firewall = {
|
||||
allowedUDPPorts = [ servicePort ];
|
||||
allowedTCPPorts = [ servicePort ];
|
||||
};
|
||||
};
|
||||
|
||||
services.nsd = {
|
||||
enable = true;
|
||||
zones = {
|
||||
"${globals.domains.main}" = {
|
||||
# provideXFR = [ ... ];
|
||||
# notify = [ ... ];
|
||||
data = dns.lib.toString "${globals.domains.main}" (import ./site1.nix { inherit config globals dns; });
|
||||
keys = {
|
||||
"${globals.domains.main}.${proxyAddress4}" = {
|
||||
algorithm = "hmac-sha256";
|
||||
keyFile = config.sops.secrets.tsig-key.path;
|
||||
};
|
||||
"${globals.domains.main}.${proxyAddress6}" = {
|
||||
algorithm = "hmac-sha256";
|
||||
keyFile = config.sops.secrets.tsig-key.path;
|
||||
};
|
||||
"${globals.domains.main}" = {
|
||||
algorithm = "hmac-sha256";
|
||||
keyFile = config.sops.secrets.tsig-key.path;
|
||||
};
|
||||
};
|
||||
interfaces = [
|
||||
"10.1.2.157"
|
||||
"2603:c020:801f:a0cc::9d"
|
||||
];
|
||||
zones = {
|
||||
"${globals.domains.main}" =
|
||||
let
|
||||
keyName4 = "${globals.domains.main}.${proxyAddress4}";
|
||||
keyName6 = "${globals.domains.main}.${proxyAddress6}";
|
||||
keyName = "${globals.domains.main}";
|
||||
transferList = [
|
||||
"213.239.242.238 ${keyName4}"
|
||||
"2a01:4f8:0:a101::a:1 ${keyName6}"
|
||||
"213.133.100.103 ${keyName4}"
|
||||
"2a01:4f8:0:1::5ddc:2 ${keyName6}"
|
||||
"193.47.99.3 ${keyName4}"
|
||||
"2001:67c:192c::add:a3 ${keyName6}"
|
||||
];
|
||||
|
||||
in
|
||||
{
|
||||
outgoingInterface = "2603:c020:801f:a0cc::9d";
|
||||
notify = transferList ++ [
|
||||
"216.218.130.2 ${keyName}"
|
||||
];
|
||||
provideXFR = transferList ++ [
|
||||
"216.218.133.2 ${keyName}"
|
||||
"2001:470:600::2 ${keyName}"
|
||||
];
|
||||
|
||||
# dnssec = true;
|
||||
data = dns.lib.toString "${globals.domains.main}" (import ./site1.nix { inherit config globals dns proxyAddress4 proxyAddress6; });
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,40 +1,35 @@
|
|||
{ config, globals, dns, ... }:
|
||||
{ config, globals, dns, proxyAddress4, proxyAddress6, ... }:
|
||||
with dns.lib.combinators; {
|
||||
SOA = {
|
||||
nameServer = "soa";
|
||||
adminEmail = "admin@${globals.domains.main}";
|
||||
serial = 2025112101;
|
||||
adminEmail = "admin@${globals.domains.main}"; # this option is not parsed as domain (we cannot just write "admin")
|
||||
serial = 2025120201; # update this on changes for secondary dns
|
||||
};
|
||||
|
||||
useOrigin = false;
|
||||
|
||||
NS = [
|
||||
"soa.${globals.domains.name}."
|
||||
"ns1.he.net"
|
||||
"ns2.he.net"
|
||||
"ns3.he.net"
|
||||
"ns4.he.net"
|
||||
"ns5.he.net"
|
||||
"oxygen.ns.hetzner.com"
|
||||
"pola.ns.cloudflare.com"
|
||||
];
|
||||
"soa"
|
||||
"srv"
|
||||
] ++ globals.domains.externalDns;
|
||||
|
||||
A = [ "75.2.60.5" ];
|
||||
|
||||
A = [ config.repo.secrets.local.dns.homepage-ip ];
|
||||
|
||||
SRV = [
|
||||
{
|
||||
service = "_matrix";
|
||||
proto = "_tcp";
|
||||
port = 443;
|
||||
target = "${globals.services.matrix.baseDomain}.${globals.domains.main}";
|
||||
target = "${globals.services.matrix.subDomain}";
|
||||
priority = 10;
|
||||
wweight = 5;
|
||||
weight = 5;
|
||||
}
|
||||
{
|
||||
service = "_submissions";
|
||||
proto = "_tcp";
|
||||
port = 465;
|
||||
target = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
|
||||
target = "${globals.services.mailserver.subDomain}";
|
||||
priority = 5;
|
||||
weight = 0;
|
||||
ttl = 3600;
|
||||
|
|
@ -43,7 +38,7 @@ with dns.lib.combinators; {
|
|||
service = "_submission";
|
||||
proto = "_tcp";
|
||||
port = 587;
|
||||
target = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
|
||||
target = "${globals.services.mailserver.subDomain}";
|
||||
priority = 5;
|
||||
weight = 0;
|
||||
ttl = 3600;
|
||||
|
|
@ -52,7 +47,7 @@ with dns.lib.combinators; {
|
|||
service = "_imap";
|
||||
proto = "_tcp";
|
||||
port = 143;
|
||||
target = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
|
||||
target = "${globals.services.mailserver.subDomain}";
|
||||
priority = 5;
|
||||
weight = 0;
|
||||
ttl = 3600;
|
||||
|
|
@ -61,7 +56,7 @@ with dns.lib.combinators; {
|
|||
service = "_imaps";
|
||||
proto = "_tcp";
|
||||
port = 993;
|
||||
target = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
|
||||
target = "${globals.services.mailserver.subDomain}";
|
||||
priority = 5;
|
||||
weight = 0;
|
||||
ttl = 3600;
|
||||
|
|
@ -71,13 +66,7 @@ with dns.lib.combinators; {
|
|||
MX = [
|
||||
{
|
||||
preference = 10;
|
||||
exchange = "${globals.services.mailserver.baseDomain}.${globals.domains.main}";
|
||||
}
|
||||
];
|
||||
|
||||
CNAME = [
|
||||
{
|
||||
cname = "www.${glovals.domains.main}";
|
||||
exchange = "${globals.services.mailserver.subDomain}";
|
||||
}
|
||||
];
|
||||
|
||||
|
|
@ -90,28 +79,22 @@ with dns.lib.combinators; {
|
|||
}
|
||||
];
|
||||
|
||||
DMARC = [
|
||||
{
|
||||
p = "none";
|
||||
ttl = 10800;
|
||||
}
|
||||
];
|
||||
|
||||
TXT = [
|
||||
(with spf; strict [ "a:${globals.services.mailserver.baseDomain}.${globals.domains.main}" ])
|
||||
(with spf; strict [ "a:${globals.services.mailserver.subDomain}.${globals.domains.main}" ])
|
||||
"google-site-verification=${config.repo.secrets.local.dns.google-site-verification}"
|
||||
];
|
||||
|
||||
DMARC = [
|
||||
{
|
||||
selector = "mail";
|
||||
k = "rsa";
|
||||
p = "none";
|
||||
ttl = 10800;
|
||||
}
|
||||
];
|
||||
|
||||
subdomains = config.swarselsystems.server.dns.${globals.domain.main}.subdomainRecords // {
|
||||
"minecraft" = host "130.61.119.12" null;
|
||||
subdomains = config.swarselsystems.server.dns.${globals.domains.main}.subdomainRecords // {
|
||||
"www".CNAME = [ "${globals.domains.main}." ];
|
||||
"_acme-challenge".CNAME = [ "${config.repo.secrets.local.dns.acme-challenge-domain}." ];
|
||||
"soa" = host proxyAddress4 proxyAddress6;
|
||||
"srv" = host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -119,7 +119,7 @@ in
|
|||
};
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ in
|
|||
};
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ in
|
|||
};
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ in
|
|||
options.swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
35
modules/nixos/server/ssh-builder.nix
Normal file
35
modules/nixos/server/ssh-builder.nix
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
{ self, pkgs, lib, config, ... }:
|
||||
let
|
||||
ssh-restrict = "restrict,pty,command=\"${wrapper-dispatch-ssh-nix}/bin/wrapper-dispatch-ssh-nix\" ";
|
||||
|
||||
wrapper-dispatch-ssh-nix = pkgs.writeShellScriptBin "wrapper-dispatch-ssh-nix" ''
|
||||
case $SSH_ORIGINAL_COMMAND in
|
||||
"nix-daemon --stdio")
|
||||
exec env NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt ${config.nix.package}/bin/nix-daemon --stdio
|
||||
;;
|
||||
"nix-store --serve --write")
|
||||
exec env NIX_SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt ${config.nix.package}/bin/nix-store --serve --write
|
||||
;;
|
||||
*)
|
||||
echo "Access only allowed for using the nix remote builder" 1>&2
|
||||
exit
|
||||
esac
|
||||
'';
|
||||
in
|
||||
{
|
||||
options.swarselmodules.server.ssh-builder = lib.mkEnableOption "enable ssh-builder config on server";
|
||||
config = lib.mkIf config.swarselmodules.server.ssh-builder {
|
||||
users = {
|
||||
groups.builder = { };
|
||||
users.builder = {
|
||||
useDefaultShell = true;
|
||||
isSystemUser = true;
|
||||
group = "builder";
|
||||
openssh.authorizedKeys.keys = [
|
||||
''${ssh-restrict} ${builtins.readFile "${self}/secrets/keys/ssh/builder.pub"}''
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
}
|
||||
|
|
@ -9,6 +9,10 @@
|
|||
PasswordAuthentication = false;
|
||||
KbdInteractiveAuthentication = false;
|
||||
PermitRootLogin = "yes";
|
||||
AllowUsers = [
|
||||
"root"
|
||||
config.swarselsystems.mainUser
|
||||
];
|
||||
};
|
||||
hostKeys = [
|
||||
{
|
||||
|
|
@ -20,10 +24,12 @@
|
|||
users.users."${config.swarselsystems.mainUser}".openssh.authorizedKeys.keyFiles = [
|
||||
(self + /secrets/keys/ssh/yubikey.pub)
|
||||
(self + /secrets/keys/ssh/magicant.pub)
|
||||
# (lib.mkIf config.swarselsystems.isBastionTarget (self + /secrets/keys/ssh/jump.pub))
|
||||
];
|
||||
users.users.root.openssh.authorizedKeys.keyFiles = [
|
||||
(self + /secrets/keys/ssh/yubikey.pub)
|
||||
(self + /secrets/keys/ssh/magicant.pub)
|
||||
# (lib.mkIf config.swarselsystems.isBastionTarget (self + /secrets/keys/ssh/jump.pub))
|
||||
];
|
||||
security.sudo.extraConfig = ''
|
||||
Defaults env_keep+=SSH_AUTH_SOCK
|
||||
|
|
|
|||
|
|
@ -42,7 +42,7 @@ in
|
|||
};
|
||||
config = lib.mkIf config.swarselmodules.server.${serviceName} {
|
||||
|
||||
swarselsystems.server.dns.${globals.services.${specificServiceName}.baseDomain}.subdomainRecords = {
|
||||
nodes.stoicclub.swarselsystems.server.dns.${globals.services.${specificServiceName}.baseDomain}.subdomainRecords = {
|
||||
"${globals.services.${specificServiceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,14 +1,14 @@
|
|||
{ config, lib, globals, ... }:
|
||||
{ config, lib, globals, nixosConfig ? null, ... }:
|
||||
{
|
||||
_module.args = {
|
||||
confLib = rec {
|
||||
|
||||
addressDefault = if config.swarselsystems.proxyHost != config.node.name then globals.networks."${if config.swarselsystems.isCloud then config.node.name else "home"}-${config.swarselsystems.server.localNetwork}".hosts.${config.node.name}.ipv4 else "localhost";
|
||||
addressDefault = if config.swarselsystems.proxyHost != config.node.name then globals.networks.${config.swarselsystems.server.netConfigName}.hosts.${config.node.name}.ipv4 else "localhost";
|
||||
|
||||
domainDefault = service: config.repo.secrets.common.services.domains.${service};
|
||||
proxyDefault = config.swarselsystems.proxyHost;
|
||||
|
||||
getConfig = config;
|
||||
getConfig = if nixosConfig == null then config else nixosConfig;
|
||||
|
||||
gen = { name, user ? name, group ? name, dir ? null, port ? null, domain ? (domainDefault name), address ? addressDefault, proxy ? proxyDefault }: rec {
|
||||
servicePort = port;
|
||||
|
|
|
|||
|
|
@ -3,12 +3,24 @@
|
|||
options.swarselsystems = {
|
||||
proxyHost = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
default = config.node.name;
|
||||
};
|
||||
isBastionTarget = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
};
|
||||
isCloud = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
};
|
||||
isServer = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = config.swarselsystems.isCloud;
|
||||
};
|
||||
isClient = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = config.swarselsystems.isLaptop;
|
||||
};
|
||||
withHomeManager = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue