nixvirt opnsense gandalf
This commit is contained in:
parent
85028eabf2
commit
663c21495b
152
flake.nix
152
flake.nix
|
|
@ -14,6 +14,9 @@
|
|||
# stylix.inputs.nixpkgs.follows = "nixpkgs";
|
||||
# stylix.inputs.home-manager.follows = "home-manager";
|
||||
|
||||
NixVirt.url = "https://flakehub.com/f/AshleyYakeley/NixVirt/*.tar.gz";
|
||||
NixVirt.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
|
||||
ozai.url = "git+https://git.pvv.ntnu.no/Projects/ozai.git";
|
||||
ozai.inputs.nixpkgs.follows = "unstable";
|
||||
|
|
@ -43,6 +46,7 @@
|
|||
, nixpkgs
|
||||
, sops-nix
|
||||
, nixos-hardware
|
||||
, NixVirt
|
||||
, unstable
|
||||
, ... }@inputs:
|
||||
let
|
||||
|
|
@ -113,9 +117,43 @@
|
|||
inherit inputs;
|
||||
};
|
||||
modules = [
|
||||
NixVirt.nixosModules.default
|
||||
./machines/gandalf/configuration.nix
|
||||
({ config, pkgs, ... }: { nixpkgs.overlays = [ overlay-unstable ]; })
|
||||
sops-nix.nixosModules.sops
|
||||
|
||||
({ config, pkgs, ... }: {
|
||||
# Your VM configuration here
|
||||
virtualisation.libvirt.enable = true;
|
||||
virtualisation.libvirt.connections."qemu:///system".domains = [
|
||||
{
|
||||
definition = NixVirt.lib.domain.writeXML (NixVirt.lib.domain.templates.q35 {
|
||||
name = "gandalf-grey";
|
||||
uuid = "a1db010b-4ad3-436a-bd99-f290f5ac8806"; # Replace with a generated UUID
|
||||
memory = { count = 4; unit = "GiB"; };
|
||||
vcpu = { value = 2; }; # Number of CPU cores
|
||||
storage_vol = "/vm-images/OPNsense-24.7-nano-amd64.img"; # Path to your storage image file
|
||||
install_vol = null; # No installation volume since we're using an existing image
|
||||
virtio_net = true;
|
||||
virtio_video = true;
|
||||
virtio_drive = true;
|
||||
devices = [
|
||||
{ hostdev = "/sys/bus/pci/devices/0000:04:00.0"; }
|
||||
{ hostdev = "/sys/bus/pci/devices/0000:05:00.0"; }
|
||||
{ hostdev = "/sys/bus/pci/devices/0000:06:00.0"; }
|
||||
{ hostdev = "/sys/bus/pci/devices/0000:07:00.0"; }
|
||||
{ hostdev = "/sys/bus/pci/devices/0000:08:00.0"; }
|
||||
{ hostdev = "/sys/bus/pci/devices/0000:0b:00.0"; }
|
||||
{ hostdev = "/sys/bus/pci/devices/0000:0b:00.1"; }
|
||||
{ hostdev = "/sys/bus/pci/devices/0000:0c:00.0"; }
|
||||
{ hostdev = "/sys/bus/pci/devices/0000:0c:00.1"; }
|
||||
];
|
||||
});
|
||||
active = true;
|
||||
}
|
||||
];
|
||||
})
|
||||
|
||||
];
|
||||
};
|
||||
|
||||
|
|
@ -146,117 +184,3 @@
|
|||
}
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,15 @@
|
|||
qemu-system-x86_64 \
|
||||
-m 4G \
|
||||
-cpu host \
|
||||
-smp 2 \
|
||||
-enable-kvm \
|
||||
-device vfio-pci,host=04:00.0 \
|
||||
-device vfio-pci,host=05:00.0 \
|
||||
-drive file=/vm-images/OPNsense-24.7-nano-amd64.img,format=raw \
|
||||
-vga virtio \
|
||||
-netdev user,id=net0 -device virtio-net,netdev=net0 \
|
||||
-daemonize \
|
||||
-vnc
|
||||
|
||||
#-nographic \
|
||||
#-net none
|
||||
|
|
@ -8,6 +8,8 @@
|
|||
[ # Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
../../profiles/base.nix
|
||||
../../services/virt.nix
|
||||
# ./nixvirt.nix
|
||||
];
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
|
|
@ -15,13 +17,10 @@
|
|||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
|
||||
|
||||
# Pick only one of the below networking options.
|
||||
#networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
|
||||
networking.networkmanager.enable = true; # Easiest to use and most distros use this by default.
|
||||
|
||||
|
||||
|
||||
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
|
||||
# Per-interface useDHCP will be mandatory in the future, so this generated config
|
||||
# replicates the default behaviour.
|
||||
|
|
@ -50,75 +49,8 @@
|
|||
};
|
||||
|
||||
|
||||
#sequrity managment through kanidm
|
||||
# systemd.services.kanidm = let
|
||||
# certName = config.services.nginx.virtualHosts.${config.services.kanidm.serverSettings.domain}.useACMEHost;
|
||||
# in {
|
||||
# requires = [ "acme-finished-${certName}.target" ];
|
||||
# serviceConfig.LoadCredential = let
|
||||
# certDir = config.security.acme.certs.${certName}.directory;
|
||||
# in [
|
||||
# "fullchain.pem:${certDir}/fullchain.pem"
|
||||
# "key.pem:${certDir}/key.pem"
|
||||
# ];
|
||||
# };
|
||||
#
|
||||
# services.kanidm = {
|
||||
# enableServer = true;
|
||||
# #enablePam = true;
|
||||
# serverSettings = let
|
||||
# credsDir = "/run/credentials/kanidm.service";
|
||||
# #credsDir = "/var/lib/acme/${config.networking.domain}"; #the files are here but not readable
|
||||
# in {
|
||||
# origin = "https://${config.services.kanidm.serverSettings.domain}";
|
||||
# domain = "auth.${config.networking.domain}";
|
||||
# tls_chain = "${credsDir}/fullchain.pem";
|
||||
# tls_key = "${credsDir}/key.pem";
|
||||
# bindaddress = "localhost:8300";
|
||||
# };
|
||||
#
|
||||
# clientSettings = {
|
||||
# # This should be at /etc/kanidm/config or ~/.config/kanidm, and configures the kanidm command line tool
|
||||
# uri = "${config.services.kanidm.serverSettings.bindaddress}";
|
||||
# verify_ca = true;
|
||||
# verify_hostnames = true;
|
||||
# };
|
||||
# };
|
||||
#
|
||||
# #environment = {
|
||||
# # etc."kanidm/config".text = ''
|
||||
# # uri="https://auth.${config.networking.domain}"
|
||||
# # '';
|
||||
# #};
|
||||
|
||||
|
||||
#vpn stuff
|
||||
# #need to run at fresh install to create namespace: headscale namespaces create <namespace_name>
|
||||
# services.headscale = {
|
||||
# enable = true;
|
||||
# user = "headscale";
|
||||
# address = "127.0.0.1";
|
||||
# port = 8080;
|
||||
# settings = {
|
||||
# logtail.enabled = false;
|
||||
# metrics_listen_addr = "127.0.0.1:9090";
|
||||
# server_url = "https://${"vpn."+config.networking.domain}";
|
||||
# dns_config = {
|
||||
# base_domain = "${config.networking.domain}";
|
||||
# magic_dns = true;
|
||||
# nameservers = [
|
||||
# "1.1.1.1"
|
||||
# ];
|
||||
# };
|
||||
#
|
||||
# ##should really implement with fex github and kanidm
|
||||
# #oidc = {
|
||||
# # issuer = "{config.services.kanidm.serverSettings.origin}";
|
||||
# # allowed_domains = Domains;
|
||||
# #};
|
||||
# };
|
||||
# };
|
||||
|
||||
users.users."root".openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHTExYoT3+flrd2wPYiT7sFFDmAUqi2YAz0ldQg7WMop"
|
||||
];
|
||||
|
|
@ -149,6 +81,6 @@
|
|||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "23.05"; # Did you read the comment?
|
||||
system.stateVersion = "24.05"; # Did you read the comment?
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -8,24 +8,31 @@
|
|||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "nvme" "usbhid" "usb_storage" "sd_mod" ];
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
|
||||
boot.initrd.kernelModules = [ "dm-snapshot" ];
|
||||
boot.kernelModules = [ "kvm-intel" ];
|
||||
boot.kernelParams = [ "intel_iommu=on" "iommu=pt" ];
|
||||
boot.kernelModules = [ "kvm-intel" "vfio_pci" "drm" "drm_kms_helper"];
|
||||
boot.extraModulePackages = [ ];
|
||||
boot.extraModprobeConfig = ''
|
||||
options vfio-pci ids=8086:125c,8086:15c4
|
||||
'';
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/a7b19945-9e59-4684-be34-1fd756239c55";
|
||||
{ device = "/dev/disk/by-uuid/a12c97d6-8cbb-4853-8642-ba8760a43584";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{ device = "/dev/disk/by-uuid/B2B1-2206";
|
||||
{ device = "/dev/disk/by-uuid/5526-5FF3";
|
||||
fsType = "vfat";
|
||||
options = [ "fmask=0077" "dmask=0077" ];
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[ { device = "/dev/disk/by-uuid/e2235b7c-f801-4c75-8d9e-15861c4b7e50"; }
|
||||
];
|
||||
fileSystems."/vm-images" =
|
||||
{ device = "/dev/disk/by-uuid/4f4505c3-8942-4767-b7f2-b27087aa9ec1";
|
||||
fsType = "ext4";
|
||||
};
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
|
@ -36,12 +43,12 @@
|
|||
# networking.interfaces.eno2.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.eno3.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.eno4.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp0s21u2.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp5s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp6s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp7s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.enp8s0.useDHCP = lib.mkDefault true;
|
||||
# networking.interfaces.wlp3s0f0.useDHCP = lib.mkDefault true;
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
|
|
|
|||
|
|
@ -0,0 +1,2 @@
|
|||
qemu-img create -f qcow2 /vm-images/opnsense.qcow2 20G
|
||||
|
||||
|
|
@ -0,0 +1,32 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
{
|
||||
|
||||
# Enable libvirt and QEMU
|
||||
virtualisation.libvirtd.enable = true;
|
||||
virtualisation.libvirtd.qemu.package = pkgs.qemu_kvm;
|
||||
|
||||
boot.kernelModules = [ "kvm-intel" "vfio_pci" "drm" "drm_kms_helper"];
|
||||
|
||||
# Add the relevant packages for virtualization, including secure boot and TPM support
|
||||
virtualisation.libvirtd.qemu = {
|
||||
runAsRoot = true;
|
||||
swtpm.enable = true;
|
||||
ovmf = {
|
||||
enable = true;
|
||||
packages = [(pkgs.OVMF.override {
|
||||
secureBoot = true;
|
||||
tpmSupport = true;
|
||||
}).fd];
|
||||
};
|
||||
};
|
||||
|
||||
# Add your user to the libvirt group to allow managing VMs without sudo
|
||||
users.users.gunalx.extraGroups = [ "libvirtd" ];
|
||||
|
||||
# Enable nested virtualization if needed
|
||||
boot.extraModprobeConfig = "options kvm_intel nested=1";
|
||||
|
||||
# (Optional) Enable the virt-manager graphical tool for managing VMs
|
||||
programs.virt-manager.enable = true;
|
||||
|
||||
}
|
||||
Loading…
Reference in New Issue