gensokyo-zone/infrastructure
1
0
Fork 0
mirror of https://github.com/gensokyo-zone/infrastructure.git synced 2026-02-09 20:39:18 -08:00
Code Issues Projects Releases Packages Wiki Activity Actions

project-wide: Starting to move to tf-nix

Browse source
This commit is contained in:
kat witch 2021-03-29 01:08:19 +01:00
parent c9973eb986
commit 4ad12c96fa
No known key found for this signature in database
GPG key ID: 1B477797DCA5EC72
10 changed files with 103 additions and 60 deletions
Download patch file Download diff file Expand all files Collapse all files

2
default.nix
View file

@ -12,7 +12,7 @@ rec {
inherit (pkgs) lib;
deploy = import ./lib/deploy.nix {
inherit pkgs;
inherit pkgs sources;
inherit (hosts) hosts groups;
};
}

31
hosts/athame/nixos/default.nix
View file

@ -6,27 +6,24 @@
# profiles
profiles.kat
# host-specific services
./postgres.nix
./virtualhosts.nix
./fail2ban.nix
#./postgres.nix
#./virtualhosts.nix
#./fail2ban.nix
# services
../../../services/nginx.nix
../../../services/mail.nix
../../../services/asterisk.nix
../../../services/gitea
../../../services/syncplay.nix
../../../services/bitwarden.nix
../../../services/taskserver.nix
../../../services/murmur.nix
../../../services/znc.nix
../../../services/matrix.nix
#../../../services/nginx.nix
#../../../services/mail.nix
#../../../services/asterisk.nix
#../../../services/gitea
#../../../services/syncplay.nix
#../../../services/bitwarden.nix
#../../../services/taskserver.nix
#../../../services/murmur.nix
#../../../services/znc.nix
#../../../services/matrix.nix
];
deploy.ssh.host = "athame.kittywit.ch";
boot.loader.grub.enable = true;
boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/sda";
networking = {
hostName = "athame";
@ -37,7 +34,7 @@
};
networking.firewall.allowedTCPPorts =
[ 80 443 5160 5060 8999 64738 1935 53589 5001 ];
[ 22 80 443 5160 5060 8999 64738 1935 53589 5001 ];
networking.firewall.allowedUDPPorts = [ 5160 5060 64738 ];
networking.firewall.allowedTCPPortRanges = [{
from = 10000;

19
hosts/athame/nixos/hw.nix
View file

@ -1,21 +1,10 @@
{ config, lib, pkgs, ... }:
{
{ ... }: {
imports = [ <nixpkgs/nixos/modules/profiles/qemu-guest.nix> ];
boot.initrd.availableKernelModules =
[ "ahci" "xhci_pci" "virtio_pci" "sd_mod" "sr_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ ];
boot.extraModulePackages = [ ];
[ "ata_piix" "uhci_hcd" "virtio_pci" "sd_mod" "sr_mod" ];
boot.loader.grub.device = "/dev/sda";
fileSystems."/" = {
device = "/dev/disk/by-uuid/126049c0-34bd-4d96-a8db-276c5d172abe";
device = "/dev/sda1";
fsType = "ext4";
};
swapDevices =
[{ device = "/dev/disk/by-uuid/1f19daed-1c51-4b14-bfe8-bd7ea075ed96"; }];
nix.maxJobs = lib.mkDefault 3;
}

96
lib/deploy.nix
View file

@ -1,22 +1,80 @@
{ pkgs, hosts, groups }:
{ pkgs, hosts, sources, groups }:
with pkgs.lib;
(mapAttrs (name: hosts: ''
#!${pkgs.runtimeShell}
export PATH=
nix build --no-link ${
concatMapStringsSep " " (host:
builtins.unsafeDiscardStringContext
host.config.system.build.toplevel.drvPath) hosts
}
${concatMapStrings (host: ''
echo "deploying ${host.config.networking.hostName}..."
${host.config.system.build.deployScript}
PID_LIST+=" $!"
'') hosts}
# FIXME: remove jobs from PIDLIST once they finish
trap "kill $PID_LIST" SIGINT
wait $PID_LIST
'') groups)
// (mapAttrs (name: host: host.config.system.build.deployScript) hosts)
let
pkgsModule = { ... }: { config._module.args = { pkgs = mkDefault pkgs; }; };
tfEval = config:
(evalModules {
modules = [ pkgsModule (sources.tf-nix + "/modules") ] ++ toList config;
specialArgs = { };
}).config;
tf = tfEval ({ config, ... }: {
deps = { enable = true; };
state = { file = toString ../private/files/tf/terraform.tfstate; };
runners.lazy = {
file = ../.;
args = [ "--show-trace" ];
attrPrefix = "deploy.tf.runners.run.";
};
terraform = {
dataDir = toString ../private/files/tf/tfdata;
logPath = toString ../private/files/tf/terraform.log;
};
variables.hcloud_token = {
type = "string";
value.shellCommand = "bitw get infra/hcloud_token";
};
providers.hcloud = { inputs.token = config.variables.hcloud_token.ref; };
resources = with config.resources; {
hcloud_ssh_key = {
provider = "hcloud";
type = "ssh_key";
inputs = {
name = "yubikey";
public_key =
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCocjQqiDIvzq+Qu3jkf7FXw5piwtvZ1Mihw9cVjdVcsra3U2c9WYtYrA3rS50N3p00oUqQm9z1KUrvHzdE+03ZCrvaGdrtYVsaeoCuuvw7qxTQRbItTAEsfRcZLQ5c1v/57HNYNEsjVrt8VukMPRXWgl+lmzh37dd9w45cCY1QPi+JXQQ/4i9Vc3aWSe4X6PHOEMSBHxepnxm5VNHm4PObGcVbjBf0OkunMeztd1YYA9sEPyEK3b8IHxDl34e5t6NDLCIDz0N/UgzCxSxoz+YJ0feQuZtud/YLkuQcMxW2dSGvnJ0nYy7SA5DkW1oqcy6CGDndHl5StOlJ1IF9aGh0gGkx5SRrV7HOGvapR60RphKrR5zQbFFka99kvSQgOZqSB3CGDEQGHv8dXKXIFlzX78jjWDOBT67vA/M9BK9FS2iNnBF5x6shJ9SU5IK4ySxq8qvN7Us8emkN3pyO8yqgsSOzzJT1JmWUAx0tZWG/BwKcFBHfceAPQl6pwxx28TM3BTBRYdzPJLTkAy48y6iXW6UYdfAPlShy79IYjQtEThTuIiEzdzgYdros0x3PDniuAP0KOKMgbikr0gRa6zahPjf0qqBnHeLB6nHAfaVzI0aNbhOg2bdOueE1FX0x48sjKqjOpjlIfq4WeZp9REr2YHEsoLFOBfgId5P3BPtpBQ== cardno:000612078454";
};
};
athame = {
provider = "hcloud";
type = "server";
inputs = {
name = "athame-testing";
image = "ubuntu-20.04";
server_type = "cpx21";
location = "nbg1";
backups = false;
ssh_keys = [ (hcloud_ssh_key.refAttr "id") ];
};
connection = { host = config.lib.tf.terraformSelf "ipv4_address"; };
provisioners = [
{
remote-exec.command =
"curl https://raw.githubusercontent.com/elitak/nixos-infect/master/nixos-infect | NO_REBOOT=true PROVIDER=hetznercloud NIX_CHANNEL=nixos-20.09 bash 2>&1 | tee /tmp/infect.log";
}
{
remote-exec.command = "reboot";
onFailure = "continue";
}
];
};
};
deploy.systems.athame = with config.resources; {
nixosConfig = hosts.athame.config;
connection = athame.connection.set;
triggers.copy.athame = athame.refAttr "id";
triggers.secrets.athame = athame.refAttr "id";
};
});
in { inherit tf; }

2
lib/hosts.nix
View file

@ -10,7 +10,7 @@ rec {
hostConfig = hostName:
{ config, ... }: {
_module.args = { inherit hosts groups; };
imports = [ ../nixos.nix ../modules/nixos ../modules/nixos/deploy ];
imports = [ ../nixos.nix ../modules/nixos ];
networking = { inherit hostName; };
nixpkgs.pkgs = import pkgsPath {
inherit (config.nixpkgs) config;

1
modules/nixos/default.nix
View file

@ -2,7 +2,6 @@
{
imports = [
./deploy
(sources.tf-nix + "/modules/nixos/secrets.nix")
(sources.tf-nix + "/modules/nixos/secrets-users.nix")
];

6
nix/sources.json
View file

@ -124,10 +124,10 @@
"homepage": null,
"owner": "arcnmx",
"repo": "tf-nix",
"rev": "32dae16c0aaba3412905bd80968888a767071808",
"sha256": "1c0vg42j096jp65b6indynh2y77xfv8nrfrnbv4llxfjsmd6w3lq",
"rev": "f8388c58aa7759dede5163a011fb1a08e7c27fc8",
"sha256": "0n0cp2hz00naz78dxi3b7ayrjv4l0001sc1k08w01aw2p400wpyc",
"type": "tarball",
"url": "https://github.com/arcnmx/tf-nix/archive/32dae16c0aaba3412905bd80968888a767071808.tar.gz",
"url": "https://github.com/arcnmx/tf-nix/archive/f8388c58aa7759dede5163a011fb1a08e7c27fc8.tar.gz",
"url_template": "https://github.com/<owner>/<repo>/archive/<rev>.tar.gz"
}
}

2
profiles/common/nixos/ssh.nix
View file

@ -3,7 +3,7 @@
{
services.openssh = {
enable = true;
ports = lib.mkDefault [ 62954 ];
#ports = lib.mkDefault [ 62954 ];
passwordAuthentication = false;
challengeResponseAuthentication = false;
permitRootLogin = lib.mkDefault "prohibit-password";

2
profiles/kat/nixos.nix
View file

@ -3,7 +3,7 @@
{
home-manager.users.kat = { imports = [ ./home.nix ]; };
deploy.profile.kat = true;
deploy.profile.kat = true;
users.users.kat = {
uid = 1000;

2
profiles/laptop/home.nix
View file

@ -1,5 +1,5 @@
{ lib, ... }:
{
{
deploy.profile.laptop = true;
}