diff --git a/systems/minecraft/default.nix b/systems/minecraft/default.nix new file mode 100644 index 00000000..d55be39f --- /dev/null +++ b/systems/minecraft/default.nix @@ -0,0 +1,23 @@ +_: { + imports = [ + ./proxmox.nix + ]; + arch = "x86_64"; + type = "NixOS"; + ci.allowFailure = true; + access.online.enable = false; + modules = [ + ./nixos.nix + ]; + network.networks = { + tail = { + address4 = "100.70.124.79"; + address6 = "fd7a:115c:a1e0::b001:7c4f"; + }; + }; + exports = { + services = { + tailscale.enable = true; + }; + }; +} diff --git a/systems/minecraft/lxc.json b/systems/minecraft/lxc.json new file mode 100644 index 00000000..3cee5afa --- /dev/null +++ b/systems/minecraft/lxc.json @@ -0,0 +1,8 @@ +{ + "lxc": { + "lxc.mount.entry": [ + "/mnt/kyuuto-minecraft mnt/kyuuto-minecraft none bind,optional,create=dir", + "/dev/net/tun dev/net/tun none bind,optional,create=file" + ] + } +} diff --git a/systems/minecraft/nixos.nix b/systems/minecraft/nixos.nix new file mode 100644 index 00000000..b094070b --- /dev/null +++ b/systems/minecraft/nixos.nix @@ -0,0 +1,17 @@ +{meta, ...}: { + imports = let + inherit (meta) nixos; + in [ + nixos.sops + nixos.reisen-ct + nixos.tailscale + nixos.syncthing-kat + ]; + + sops = { + defaultSopsFile = ./secrets.yaml; + secrets.tailscale-key.key = "tailscale-key"; + }; + + system.stateVersion = "23.11"; +} diff --git a/systems/minecraft/proxmox.nix b/systems/minecraft/proxmox.nix new file mode 100644 index 00000000..ef28f1bc --- /dev/null +++ b/systems/minecraft/proxmox.nix @@ -0,0 +1,18 @@ +_: { + proxmox = { + vm.id = 106; + container = { + enable = true; + lxc.configJsonFile = ./lxc.json; + }; + network.interfaces = { + net0 = { + mdns.enable = true; + macAddress = "BC:24:11:C4:66:AB"; + address4 = "dhcp"; + address6 = "auto"; + }; + net1.internal.enable = true; + }; + }; +} diff --git a/systems/minecraft/secrets.yaml b/systems/minecraft/secrets.yaml new file mode 100644 index 00000000..c2247ec5 --- /dev/null +++ b/systems/minecraft/secrets.yaml @@ -0,0 +1,57 @@ +tailscale-key: ENC[AES256_GCM,data:fJ+Eikbocenx5EbQR8CN4wclrxbf+Y/0tI4GSPrrt38QPt3Lw8DhY4s=,iv:LDK8zO7tWzU7+YYfC83GnOawNwXkikYJKN97sV+S6zc=,tag:7AFJPd8pRD0R2rvy5aAdeg==,type:str] +sops: + shamir_threshold: 1 + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1xg6zm9t25wjakljm54m38pjdr9q53jysdcl82r5xwkrn0cgyuvvsuh63eh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwSjUwb3F6NnA5cENqcFRJ + dzdTRFptZ2hsMFR0MXMzT2I3aVpXN3N2emhJCi9SQWJQc0JZOW1FeUx5NU5DdGlF + Yjh6VnJjaE96QzU0dGlweVNnUk9oaU0KLS0tIFFYR05qbThxb2tZamhlTmxZRXdm + NEVHRk0zTFU4aW1wbmVEUGZXVWNsbXMKgnZY9saX6DmVdX4hgutyg78T9mqKqG8C + 4Qahrc9V3e6rC09GuCeGuAN/F51Sq6T6wbO+ESfONrhWNi4gIKKWtQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-02-23T00:08:06Z" + mac: ENC[AES256_GCM,data:KRSoHWTux2BTJ7KH16xyJkyZnynPYIO+C6rM3WhbdphIx5WtfpSO6pX8juTDmYCob3n3jJdFEfy28M2UjSRJhC/CLcdvUx5vV7J8WVldXox8YN5uyQG5cyW2TkO1qwTov1mj4f2FWQsTgKSyXgn/yyzbA9tcfQ4qBHrUj8XiPHc=,iv:bw7UVnVOT6PN6I8iySrCxh1UIqbRQl5RMgnG5WqIPWA=,tag:NV2NTnsYwIjWJdQoTmhECg==,type:str] + pgp: + - created_at: "2024-09-02T04:47:29Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA82M54yws73UAQ//Wwh/MOunzqURoJXQaeNh2DubgZhV9rNdrvC9eW5otANa + sqv4JgJHOYwJXGrP/959Y040M3v4L43nFSKGmiONscfWsP+hyv2izYY01ynyb5Dm + f99Dx6irEFe1a1cK9wRdAsNW8xmHtrkP1ufFaqRcTMDyu4eMtPtuNJEcbhJ95jDU + 54cXM3JGo3Qvv+eTsbAQqM5svBsQ0tDRx9uICrtsYRfLa2lX3nn7RTXj8TewmFgF + qJJ1qsItjVKTUs24ogcgtYbWqRacSzCIyDx2LT0ta6hC28nmPjoDJdXhlDoFqP3n + a9zsPV04leGt69T2JhT4U3SZNC10UoiLc0Zz1wEVvgGX0zYse4gxB7xiLfC+/FMm + FEkWxK/7OxJv9iORpPtYagmOfgg+RXnRTnnJs1IbknMCr8+YWyksy8HQ7yF05d1E + YEnar6mb+fJp4iUtyE9hm3YBBK9biCdgFjrQR5sf0OkYZJ7/77sBkOyMAU5H6+5z + XS+IsojnwmqN4dnnSkrZ3FwLSa2JHDAbzA0+m6QyJI0w7SO/7AzOtM8YWCjl9nUL + O4QMEyRRsKOt4xO3APvfXnGaRn/V00L8gg7RfVF6UWl/U1Qhk/3VtgP6coHvbMcQ + Xjke95g8x5X3kmdRQJBMCbLGbjA2iqRR/LGTZKuBsSD7KUdSCPOY/45DM7E4h4fS + XgFsMaX+GYPeygQjnn6ttfQHSfiY6eIIXP11DwzKHdUj3NrfQ9mvuvLfkKsKvtst + rKulWzjoXtum9/I/E4DK4FGfhrPW9BrAcGZOgMNBZCie9fc5clm9g0IqOcdG1dc= + =/Pdm + -----END PGP MESSAGE----- + fp: CD8CE78CB0B3BDD4 + - created_at: "2024-09-02T04:47:29Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQEMA2W9MER3HLb7AQgAhjfU3ktIoiVnbSUIwL3NbCSi2iODFtW3h59iwAMegX8O + ahGgEZTI8AELqfNG0n6T1pn5JypwtQKIjkdl4LeoG3xcfn+G34000uWfOZgCjwwe + K5pUERNtox3LI1baPXi3o66iKHM4D3ukcwl1OWZj0nWiTmSX4fls1OM0t74vvztI + Ow8d/Yl7YWoXV+wI1lNi/ARJZQEJcn+wBfXnULkZAfydjtFaODS63jHnYGEzbWIm + jjJ3zlFd0DPuVb1Qc4z7SAIwcDWPEWlWN693MiH2PxSdhlOcBlq2EKE/iRbwZ1QM + eDsAjTHuNSEGC9H0H+nHOiUwM1JZlBcMj5bcyVbJctJeAVyMiEPdvZRXL6poHUYU + lT1yllbP+Y8CsGfSixi7Zw8i3oidQKGiJUT3sxWHPlQCR1GQmPKWooThUG4yvvzo + veLPUlbaWKBMffOSKJun2JFMCCscxGedB1YsVkmemQ== + =i9QW + -----END PGP MESSAGE----- + fp: 65BD3044771CB6FB + unencrypted_suffix: _unencrypted + version: 3.8.1 diff --git a/tf/proxmox_vms.tf b/tf/proxmox_vms.tf index a9be8c6a..807b43b6 100644 --- a/tf/proxmox_vms.tf +++ b/tf/proxmox_vms.tf @@ -4,6 +4,8 @@ variable "proxmox_container_template" { } locals { + proxmox_minecraft_vm_id = 109 + proxmox_minecraft_config = jsondecode(file("${path.root}/../systems/minecraft/lxc.json")) proxmox_utsuho_vm_id = 108 proxmox_utsuho_config = jsondecode(file("${path.root}/../systems/utsuho/lxc.json")) proxmox_keycloak_vm_id = 107 @@ -752,3 +754,84 @@ module "keycloak_config" { container = proxmox_virtual_environment_container.keycloak config = local.proxmox_keycloak_config.lxc } + +resource "proxmox_virtual_environment_container" "minecraft" { + node_name = "reisen" + vm_id = local.proxmox_minecraft_vm_id + tags = ["tf"] + description = <