From 38e3202c9edee94d7c0c91f3a7d0f9cacd8bfdde Mon Sep 17 00:00:00 2001 From: Daniel Olsen Date: Sun, 26 Mar 2023 14:42:45 +0200 Subject: [PATCH] Move more of jokum slightly less stupid this time --- hosts/bicep/hardware-configuration.nix | 29 ++++++++--------- hosts/bicep/services/jokum.nix | 45 ++++++++++++++++++++++++-- hosts/bicep/services/postgres.nix | 14 +++++--- hosts/jokum/configuration.nix | 16 +++++---- 4 files changed, 75 insertions(+), 29 deletions(-) diff --git a/hosts/bicep/hardware-configuration.nix b/hosts/bicep/hardware-configuration.nix index 200875a..e379330 100644 --- a/hosts/bicep/hardware-configuration.nix +++ b/hosts/bicep/hardware-configuration.nix @@ -1,35 +1,34 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. { config, lib, pkgs, modulesPath, ... }: -# FIXME: please don't use me, I'm from bekkalokk - { - imports = [ ]; + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; - boot.initrd.availableKernelModules = [ "ata_piix" "mptspi" "uhci_hcd" "ehci_pci" "sd_mod" "sr_mod" ]; + boot.initrd.availableKernelModules = [ "uhci_hcd" "ehci_pci" "hpsa" "ohci_pci" "usbhid" "sd_mod" ]; boot.initrd.kernelModules = [ ]; - boot.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; boot.extraModulePackages = [ ]; fileSystems."/" = - { device = "/dev/disk/by-uuid/cdcafe3a-01d8-4bdf-9a3d-78705b581090"; + { device = "/dev/disk/by-uuid/31a67903-dc00-448a-a24a-36e820318fe5"; fsType = "ext4"; }; - fileSystems."/boot" = - { device = "/dev/disk/by-uuid/1CB4-280D"; - fsType = "vfat"; - }; - - swapDevices = - [ { device = "/dev/disk/by-uuid/3eaace48-91ec-4d46-be86-fd26877d8b86"; } - ]; + swapDevices = [ ]; # Enables DHCP on each ethernet and wireless interface. In case of scripted networking # (the default) this is the recommended approach. When using systemd-networkd it's # still possible to use this option, but it's recommended to use it in conjunction # with explicit per-interface declarations with `networking.interfaces..useDHCP`. networking.useDHCP = lib.mkDefault true; - # networking.interfaces.ens33.useDHCP = lib.mkDefault true; + # networking.interfaces.enp6s0f0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp6s0f1.useDHCP = lib.mkDefault true; + # networking.interfaces.enp6s0f2.useDHCP = lib.mkDefault true; + # networking.interfaces.enp6s0f3.useDHCP = lib.mkDefault true; nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; diff --git a/hosts/bicep/services/jokum.nix b/hosts/bicep/services/jokum.nix index 0219be3..802a5cf 100644 --- a/hosts/bicep/services/jokum.nix +++ b/hosts/bicep/services/jokum.nix @@ -3,8 +3,49 @@ { # lfmao containers.jokum = { - interfaces = [ "ens10f1" ]; + autoStart = true; # wtf - path = inputs.self.nixosConfigurations.jokum.config.system.build.toplevel; + #path = inputs.self.nixosConfigurations.jokum.config.system.build.toplevel; + interfaces = [ "enp6s0f1" ]; + bindMounts = { + "/data" = { hostPath = "/data/jokum"; isReadOnly = false; }; + }; + config = {config, pkgs, ...}: let + inherit values inputs; + in { + imports = [ + inputs.sops-nix.nixosModules.sops + inputs.matrix-next.nixosModules.synapse + + ../../jokum/services/matrix + ../../jokum/services/nginx + ]; + + _module.args = { + inherit values inputs; + }; + + sops.defaultSopsFile = ../../../secrets/jokum/jokum.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + sops.age.keyFile = "/var/lib/sops-nix/key.txt"; + sops.age.generateKey = true; + + services.openssh = { + enable = true; + permitRootLogin = "yes"; + }; + + systemd.network.enable = true; + + networking.useHostResolvConf = false; + + systemd.network.networks."30-enp6s0f1" = values.defaultNetworkConfig // { + matchConfig.Name = "enp6s0f1"; + address = with values.hosts.jokum; [ (ipv4 + "/25") (ipv6 + "/64") ] + ++ (with values.services.turn; [ (ipv4 + "/25") (ipv6 + "/64") ]); + }; + + system.stateVersion = "21.05"; + }; }; } diff --git a/hosts/bicep/services/postgres.nix b/hosts/bicep/services/postgres.nix index ad4d7d3..75ba852 100644 --- a/hosts/bicep/services/postgres.nix +++ b/hosts/bicep/services/postgres.nix @@ -2,13 +2,14 @@ { services.postgresql = { enable = true; + package = pkgs.postgresql_15; enableTCPIP = true; - authentication = pkgs.lib.mkOverride 10 '' - local all all trust - host all all 127.0.0.0/8 trust - host all all ::1/128 trust - host all all 241.129.241.128/25 + dataDir = "/data/postgresql"; + + authentication = '' + host all all 129.241.210.128/25 md5 + host all all 2001:700:300:1900::/64 md5 ''; # Hilsen https://pgconfigurator.cybertec-postgresql.com/ @@ -68,4 +69,7 @@ wal_recycle = true; }; }; + + networking.firewall.allowedTCPPorts = [ 5432 ]; + networking.firewall.allowedUDPPorts = [ 5432 ]; } diff --git a/hosts/jokum/configuration.nix b/hosts/jokum/configuration.nix index 5b75a15..d744b52 100644 --- a/hosts/jokum/configuration.nix +++ b/hosts/jokum/configuration.nix @@ -2,19 +2,21 @@ { imports = [ ../../base.nix - ../../misc/metrics-exporters.nix +# ../../misc/metrics-exporters.nix ../../misc/rust-motd.nix - ./services/matrix - ./services/nginx +# ./services/matrix +# ./services/nginx ]; - sops.defaultSopsFile = ../../secrets/jokum/jokum.yaml; - sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; - sops.age.keyFile = "/var/lib/sops-nix/key.txt"; - sops.age.generateKey = true; +# sops.defaultSopsFile = ../../secrets/jokum/jokum.yaml; +# sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; +# sops.age.keyFile = "/var/lib/sops-nix/key.txt"; +# sops.age.generateKey = true; + boot.kernel.enable = false; boot.isContainer = true; + boot.loader.initScript.enable = true; networking.useHostResolvConf = false; networking.hostName = "jokum"; # Define your hostname.