diff --git a/flake.lock b/flake.lock
new file mode 100644
index 00000000..64a1044d
--- /dev/null
+++ b/flake.lock
@@ -0,0 +1,105 @@
+{
+ "nodes": {
+ "hydra": {
+ "info": {
+ "lastModified": 1587883324,
+ "narHash": "sha256-WQxv9rrG2HX8j2UfXjifeBkMjgea3uIAEB3Swv+IIus="
+ },
+ "inputs": {
+ "nix": "nix",
+ "nixpkgs": "nixpkgs_2"
+ },
+ "locked": {
+ "owner": "ehmry",
+ "repo": "hydra",
+ "rev": "e93c36aab1bf96cf392ab0e40157b0620638b599",
+ "type": "github"
+ },
+ "original": {
+ "owner": "ehmry",
+ "ref": "sotest",
+ "repo": "hydra",
+ "type": "github"
+ }
+ },
+ "nix": {
+ "info": {
+ "lastModified": 1586440843,
+ "narHash": "sha256-7YxrpRPmAOoCSl6KtepKCXcae5MUm1Pl+lwDunBFGoo="
+ },
+ "inputs": {
+ "nixpkgs": "nixpkgs"
+ },
+ "locked": {
+ "owner": "NixOS",
+ "repo": "nix",
+ "rev": "3aaceeb7e2d3fb8a07a1aa5a21df1dca6bbaa0ef",
+ "type": "github"
+ },
+ "original": {
+ "id": "nix",
+ "type": "indirect"
+ }
+ },
+ "nixpkgs": {
+ "info": {
+ "lastModified": 1585405475,
+ "narHash": "sha256-bESW0n4KgPmZ0luxvwJ+UyATrC6iIltVCsGdLiphVeE="
+ },
+ "locked": {
+ "owner": "NixOS",
+ "repo": "nixpkgs",
+ "rev": "b88ff468e9850410070d4e0ccd68c7011f15b2be",
+ "type": "github"
+ },
+ "original": {
+ "id": "nixpkgs",
+ "ref": "nixos-20.03-small",
+ "type": "indirect"
+ }
+ },
+ "nixpkgs_2": {
+ "info": {
+ "lastModified": 1586219474,
+ "narHash": "sha256-fvfrMnEA2lDnXvH/eInGV5i0sO/EGLVHa4pOek8VG78="
+ },
+ "locked": {
+ "owner": "NixOS",
+ "repo": "nixpkgs",
+ "rev": "29eddfc36d720dcc4822581175217543b387b1e8",
+ "type": "github"
+ },
+ "original": {
+ "id": "nixpkgs",
+ "ref": "nixos-20.03",
+ "type": "indirect"
+ }
+ },
+ "nixpkgs_3": {
+ "info": {
+ "lastModified": 1586724123,
+ "narHash": "sha256-VQ7zZy2xpz6dULpjar4jxNaQ0N/2q68l+EYO2nXaXDo="
+ },
+ "locked": {
+ "owner": "nixos",
+ "repo": "nixpkgs-channels",
+ "rev": "708cb6b307b04ad862cc50de792e57e7a4a8bb5a",
+ "type": "github"
+ },
+ "original": {
+ "owner": "nixos",
+ "ref": "nixos-20.03",
+ "repo": "nixpkgs-channels",
+ "type": "github"
+ }
+ },
+ "root": {
+ "inputs": {
+ "hydra": "hydra",
+ "nixpkgs": "nixpkgs_3"
+ }
+ }
+ },
+ "root": "root",
+ "version": 5
+}
diff --git a/flake.nix b/flake.nix
new file mode 100644
index 00000000..d0c283f0
--- /dev/null
+++ b/flake.nix
@@ -0,0 +1,33 @@
+{
+ description = "C3D2 NixOS configurations";
+
+ edition = 201909;
+
+ inputs.nixpkgs.url = "github:nixos/nixpkgs-channels/nixos-20.03";
+ inputs.hydra.url = "github:ehmry/hydra/sotest";
+
+ outputs = { self, nixpkgs, hydra }: {
+
+ nixosConfigurations = {
+
+ server7 = nixpkgs.lib.nixosSystem {
+ modules = [ ./hosts/server7 hydra.nixosModules.hydra ];
+ system = "x86_64-linux";
+ };
+
+ hydra = nixpkgs.lib.nixosSystem {
+ modules = [ ./hosts/hydra/configuration.nix ];
+ system = "x86_64-linux";
+ };
+
+ pulsebert = nixpkgs.lib.nixosSystem {
+ modules = [ ./hosts/pulsebert/configuration.nix ];
+ system = "x86_64-linux";
+ };
+
+ };
+
+ nixosModules.c3d2 = import ./lib;
+
+ };
+}
diff --git a/host-registry.nix b/host-registry.nix
index 387091e9..a12b7a23 100644
--- a/host-registry.nix
+++ b/host-registry.nix
@@ -13,6 +13,7 @@ rec {
hydra.publicKey =
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDhurL/sxsXRglKdLfiWIcK+iqpyhGrGt/MoBODsgvig";
+ hydra7 = { };
mpd-index = { };
nfs = { };
ncdc.publicKey =
diff --git a/hosts/containers/dn42/configuration.nix b/hosts/containers/dn42/configuration.nix
index edf0fa57..01a49504 100644
--- a/hosts/containers/dn42/configuration.nix
+++ b/hosts/containers/dn42/configuration.nix
@@ -70,6 +70,30 @@ in {
servers = builtins.mapAttrs (name: conf: mkServer name conf) openvpnNeighbors;
};
+ networking.wireguard = {
+ enable = true;
+ interfaces =
+ let
+ wireguardNeighbors = lib.filterAttrs (_: conf: conf ? wireguard) neighbors;
+ in
+ builtins.mapAttrs (name: conf: {
+ inherit (conf.wireguard) listenPort privateKey;
+ ips = [ "${address4}/32" "${address6}/64" ];
+ allowedIPsAsRoutes = false;
+ postSetup = ''
+ ${pkgs.iproute}/bin/ip addr del ${address4}/32 dev ${name}
+ ${pkgs.iproute}/bin/ip addr add ${address4} dev ${name} peer ${conf.address4}/32
+ '';
+ peers = [ ({
+ inherit (conf.wireguard) publicKey;
+ allowedIPs = [ "0.0.0.0/0" "::0/0" ];
+ persistentKeepalive = 30;
+ } // (lib.optionalAttrs (conf.wireguard ? endpoint) {
+ inherit (conf.wireguard) endpoint;
+ })) ];
+ }) wireguardNeighbors;
+ };
+
services.bird2 = {
enable = true;
config =
diff --git a/hosts/containers/dnscache/configuration.nix b/hosts/containers/dnscache/configuration.nix
index 19d135ad..81530821 100644
--- a/hosts/containers/dnscache/configuration.nix
+++ b/hosts/containers/dnscache/configuration.nix
@@ -19,7 +19,8 @@
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
networking.useNetworkd = true;
networking.useDHCP = false;
- networking.interfaces.eth0.useDHCP = true;
+ networking.interfaces.eth0.ipv4.addresses = [ { address = "172.20.73.8"; prefixLength = 26; } ];
+ networking.defaultGateway = "172.20.73.1";
services.resolved.enable = false;
# Set your time zone.
@@ -39,7 +40,7 @@
# Create a few files early before packing tarball for Proxmox
# architecture/OS detection.
- system.extraSystemBuilderCmds =
+ system.extraSystemBuilderCmds =
''
mkdir -m 0755 -p $out/bin
ln -s ${pkgs.bash}/bin/bash $out/bin/sh
@@ -85,22 +86,25 @@
"1.1.1.1@853" #cloudflare-dns.com
"2606:4700:4700::1111@853" #cloudflare-dns.com
"1.0.0.1@853" #cloudflare-dns.com
- "2606:4700:4700::1001@853" #cloudflare-dns.com
+ "2606:4700:4700::1001@853\n forward-ssl-upstream: yes" #cloudflare-dns.com
];
extraConfig = ''
server:
- ssl-upstream: yes
domain-insecure: "dn42"
domain-insecure: "20.172.in-addr.arpa"
domain-insecure: "21.172.in-addr.arpa"
domain-insecure: "22.172.in-addr.arpa"
domain-insecure: "23.172.in-addr.arpa"
domain-insecure: "d.f.ip6.arpa"
+ domain-insecure: "ffdd"
+ domain-insecure: "200.10.in-addr.arpa"
local-zone: "20.172.in-addr.arpa." nodefault
local-zone: "21.172.in-addr.arpa." nodefault
local-zone: "22.172.in-addr.arpa." nodefault
local-zone: "23.172.in-addr.arpa." nodefault
local-zone: "d.f.ip6.arpa." nodefault
+ local-zone: "ffdd." nodefault
+ local-zone: "200.10.in-addr.arpa." nodefault
remote-control:
control-enable: yes
@@ -109,36 +113,71 @@
control-key-file: /var/lib/unbound/unbound_control.key
control-cert-file: /var/lib/unbound/unbound_control.pem
+ forward-zone:
+ name: "99.22.172.in-addr.arpa"
+ forward-host: "ns.c3d2.de"
- forward-zone:
+ forward-zone:
+ name: "zentralwerk.dn42"
+ forward-host: "dns.serv.zentralwerk.org"
+
+ forward-zone:
+ name: "72.20.172.in-addr.arpa"
+ forward-host: "dns.serv.zentralwerk.org"
+
+ forward-zone:
+ name: "73.20.172.in-addr.arpa"
+ forward-host: "dns.serv.zentralwerk.org"
+
+ forward-zone:
+ name: "74.20.172.in-addr.arpa"
+ forward-host: "dns.serv.zentralwerk.org"
+
+ forward-zone:
+ name: "75.20.172.in-addr.arpa"
+ forward-host: "dns.serv.zentralwerk.org"
+
+ forward-zone:
+ name: "76.20.172.in-addr.arpa"
+ forward-host: "dns.serv.zentralwerk.org"
+
+ forward-zone:
+ name: "77.20.172.in-addr.arpa"
+ forward-host: "dns.serv.zentralwerk.org"
+
+ forward-zone:
name: "dn42"
- forward-addr: fd42:d42:d42:53::1
forward-addr: 172.23.0.53
- forward-zone:
+ forward-zone:
name: "20.172.in-addr.arpa"
- forward-addr: fd42:d42:d42:53::1
forward-addr: 172.23.0.53
- forward-zone:
+ forward-zone:
name: "21.172.in-addr.arpa"
- forward-addr: fd42:d42:d42:53::1
forward-addr: 172.23.0.53
- forward-zone:
+ forward-zone:
name: "22.172.in-addr.arpa"
- forward-addr: fd42:d42:d42:53::1
forward-addr: 172.23.0.53
- forward-zone:
+ forward-zone:
name: "23.172.in-addr.arpa"
- forward-addr: fd42:d42:d42:53::1
forward-addr: 172.23.0.53
forward-zone:
name: "d.f.ip6.arpa"
- forward-addr: fd42:d42:d42:53::1
forward-addr: 172.23.0.53
+
+ forward-zone:
+ name: "ffdd"
+ forward-addr: 10.200.0.4
+ forward-addr: 10.200.0.16
+
+ forward-zone:
+ name: "200.10.in-addr.arpa"
+ forward-addr: 10.200.0.4
+ forward-addr: 10.200.0.16
'';
};
@@ -150,7 +189,7 @@
memory = "";
interface = "";
load = "";
- exec =
+ exec =
let
unboundScript = builtins.toFile "unbound.rb" ''
loop do
diff --git a/hosts/containers/freifunk/assets/index.html b/hosts/containers/freifunk/assets/index.html
new file mode 100644
index 00000000..d767ce34
--- /dev/null
+++ b/hosts/containers/freifunk/assets/index.html
@@ -0,0 +1,18 @@
+
+
+
+
+ http://c3d2.ffdd
+
+
+ Chaos Computer Club Dresden
+ Router zu Freifunk Dresden
+
+
+
+
diff --git a/hosts/containers/freifunk/configuration.nix b/hosts/containers/freifunk/configuration.nix
deleted file mode 100644
index 0ba81c2c..00000000
--- a/hosts/containers/freifunk/configuration.nix
+++ /dev/null
@@ -1,60 +0,0 @@
-{ config, pkgs, lib, ... }:
-
-let
- meshInterface = "bmx";
-in {
- imports = [
-
-
-
-
- ];
-
- c3d2 = {
- isInHq = false;
- enableHail = false;
- };
-
- networking.hostName = "freifunk";
- networking.useNetworkd = true;
- networking.nameservers = [ "172.20.73.8" "9.9.9.9" ];
-
- # Required for krops
- services.openssh.enable = true;
- environment.systemPackages = with pkgs; [ git tcpdump ];
-
- systemd.network.networks = {
- "10-bmx" = {
- enable = true;
- matchConfig = { Name = meshInterface; };
- networkConfig = {
- Address = "10.200.0.15/16";
- };
- };
- "20-core" = {
- enable = true;
- matchConfig = { Name = "core"; };
- networkConfig = {
- Address = "172.20.72.40/26";
- Gateway = "172.20.72.7";
- };
- };
- };
- systemd.services.bmxd =
- let
- bmxd = import (toString ) { inherit pkgs; };
- in {
- after = [ "systemd-networkd.service" ];
- wantedBy = [ "network.target" ];
- serviceConfig = {
- ExecStart = "${bmxd}/sbin/bmxd --no_fork 1 --throw-rules 0 --prio-rules 0 dev=${meshInterface} /linklayer 0";
- Restart = "always";
- };
- };
-
- # This value determines the NixOS release with which your system is to be
- # compatible, in order to avoid breaking some software such as database
- # servers. You should change this only after NixOS release notes say you
- # should.
- system.stateVersion = "20.03"; # Did you read the comment?
-}
diff --git a/hosts/containers/freifunk/sysinfo-json.nix b/hosts/containers/freifunk/sysinfo-json.nix
new file mode 100644
index 00000000..3aafe3c2
--- /dev/null
+++ b/hosts/containers/freifunk/sysinfo-json.nix
@@ -0,0 +1,70 @@
+{ pkgs ? import {},
+ ffdd-server ? builtins.fetchGit "https://github.com/Freifunk-Dresden/ffdd-server.git",
+ bmxd,
+ ddmeshNode,
+ ... }:
+
+with pkgs;
+let
+ nvram = {
+ ddmesh_node = toString ddmeshNode;
+ city = "Dresden";
+ autoupdate = "0";
+ contact_name = "C3D2";
+ contact_location = "Zentralwerk";
+ contact_email = "astro@spaceboyz.net";
+ contact_note = "http://www.c3d2.ffdd/";
+ gps_latitude = "51.0810624";
+ gps_longitude = "13.7285866";
+ gps_altitude = "100";
+ };
+in
+stdenv.mkDerivation {
+ name = "sysinfo-json";
+ src = "${ffdd-server}/salt/freifunk/base/ddmesh/";
+ buildPhase = ''
+ cat > bmxddump.sh < \$DB_PATH/gateways
+ ${bmxd}/sbin/bmxd -c --links > \$DB_PATH/links
+ ${bmxd}/sbin/bmxd -c --originators > \$DB_PATH/originators
+ ${bmxd}/sbin/bmxd -c --status > \$DB_PATH/status
+ #${bmxd}/sbin/bmxd -c --networks > \$DB_PATH/networks
+ ${bmxd}/sbin/bmxd -ci > \$DB_PATH/info
+ EOF
+
+ cat > lsb_release <
];
diff --git a/hosts/containers/scrape/configuration.nix b/hosts/containers/scrape/configuration.nix
index f3d1a900..bd174df0 100644
--- a/hosts/containers/scrape/configuration.nix
+++ b/hosts/containers/scrape/configuration.nix
@@ -45,10 +45,6 @@
script = "xerox";
host = "roxi.hq.c3d2.de";
};
- scrape-luftdaten = makeService {
- script = "luftdaten";
- host = "";
- };
scrape-fhem = makeService {
script = "fhem";
host = "fhem.hq.c3d2.de";
@@ -59,6 +55,30 @@
host = "matemat.hq.c3d2.de";
inherit (matematLogin) user password;
};
+ scrape-node1139 = makeService {
+ script = "freifunk_node";
+ host = "10.200.4.120";
+ };
+ scrape-node1487 = makeService {
+ script = "freifunk_node";
+ host = "10.200.5.213";
+ };
+ scrape-node1884 = makeService {
+ script = "freifunk_node";
+ host = "10.200.7.100";
+ };
+ scrape-node1891 = makeService {
+ script = "freifunk_node";
+ host = "10.200.7.107";
+ };
+ scrape-node1768 = makeService {
+ script = "freifunk_node";
+ host = "10.200.6.239";
+ };
+ scrape-node1176 = makeService {
+ script = "freifunk_node";
+ host = "10.200.7.80";
+ };
};
systemd.timers.scrape-xeri = {
partOf = [ "scrape-xeri.service" ];
@@ -70,11 +90,6 @@
wantedBy = [ "timers.target" ];
timerConfig.OnCalendar = "minutely";
};
- systemd.timers.scrape-luftdaten = {
- partOf = [ "scrape-luftdaten.service" ];
- wantedBy = [ "timers.target" ];
- timerConfig.OnCalendar = "minutely";
- };
systemd.timers.scrape-fhem = {
partOf = [ "scrape-fhem.service" ];
wantedBy = [ "timers.target" ];
@@ -85,6 +100,36 @@
wantedBy = [ "timers.target" ];
timerConfig.OnCalendar = "minutely";
};
+ systemd.timers.scrape-node1139 = {
+ partOf = [ "scrape-node1139.service" ];
+ wantedBy = [ "timers.target" ];
+ timerConfig.OnCalendar = "minutely";
+ };
+ systemd.timers.scrape-node1487 = {
+ partOf = [ "scrape-node1487.service" ];
+ wantedBy = [ "timers.target" ];
+ timerConfig.OnCalendar = "minutely";
+ };
+ systemd.timers.scrape-node1884 = {
+ partOf = [ "scrape-node1884.service" ];
+ wantedBy = [ "timers.target" ];
+ timerConfig.OnCalendar = "minutely";
+ };
+ systemd.timers.scrape-node1891 = {
+ partOf = [ "scrape-node1894.service" ];
+ wantedBy = [ "timers.target" ];
+ timerConfig.OnCalendar = "minutely";
+ };
+ systemd.timers.scrape-node1768 = {
+ partOf = [ "scrape-node1768.service" ];
+ wantedBy = [ "timers.target" ];
+ timerConfig.OnCalendar = "minutely";
+ };
+ systemd.timers.scrape-node1176 = {
+ partOf = [ "scrape-node1176.service" ];
+ wantedBy = [ "timers.target" ];
+ timerConfig.OnCalendar = "minutely";
+ };
# This value determines the NixOS release with which your system is to be
# compatible, in order to avoid breaking some software such as database
diff --git a/hosts/hydra/configuration.nix b/hosts/hydra/configuration.nix
index 457851c6..b4b7a87d 100644
--- a/hosts/hydra/configuration.nix
+++ b/hosts/hydra/configuration.nix
@@ -2,12 +2,9 @@
{
imports = [
-
./hydra.nix
./cache.nix
../../lib
- ../../lib/hq.nix
- ../../lib/yggdrasil.nix
];
c3d2 = {
@@ -18,26 +15,17 @@
isInHq = true;
mapHqHosts = true;
hq.interface = "eth0";
+ hq.yggdrasil.enableGateway = true;
};
networking.interfaces.eth0.preferTempAddress = false;
- systemd.services.yggdrasil.preStart = ''
- mkdir -p /dev/net
- mknod /dev/net/tun c 10 200 || true
- chmod 0666 /dev/net/tun
- '';
- services.yggdrasil = {
- configFile = "/var/lib/yggdrasil/keys";
- config.Peers = [
- "tcp://[2a03:3b40:fe:ab::1]:46370" # Praha
- "tcp://ygg.thingylabs.io:443" # Nürnberg
- "tcp://176.223.130.120:22632" # Wrocław
- "tcp://[2a05:9403::8b]:7743" # Praha
- ];
- };
nixpkgs.config.allowUnfree = true;
+ security.acme = {
+ email = "mail@c3d2.de";
+ acceptTerms = true;
+ };
security.pam.enableSSHAgentAuth = true;
services.openssh = {
diff --git a/hosts/hydra/hydra.nix b/hosts/hydra/hydra.nix
index 5a187b71..f00d958f 100644
--- a/hosts/hydra/hydra.nix
+++ b/hosts/hydra/hydra.nix
@@ -15,8 +15,11 @@
allowed-uris = http:// https://
'';
buildMachines = [{
- hostName = "localhost";
+ hostName = "server7.hq";
+ sshUser = "hydra";
+ sshKey = "/var/lib/hydra/queue-runner/id_rsa";
system = "x86_64-linux";
+ speedFactor = 2;
supportedFeatures = [ "kvm" "nixos-test" "big-parallel" "benchmark" ];
maxJobs = 8;
}];
@@ -27,6 +30,7 @@
hydraURL = "https://hydra.hq.c3d2.de";
logo = ./c3d2.svg;
notificationSender = "hydra@spam.works";
+ package = pkgs.hydra-unstable;
useSubstitutes = false;
};
diff --git a/hosts/pulsebert/configuration.nix b/hosts/pulsebert/configuration.nix
index 497ca89c..ff33c871 100644
--- a/hosts/pulsebert/configuration.nix
+++ b/hosts/pulsebert/configuration.nix
@@ -13,7 +13,6 @@ in {
../../lib
../../lib/admins.nix
../../lib/hq.nix
- ../../lib/yggdrasil.nix
./mpdConsole.nix
];
@@ -27,6 +26,7 @@ in {
hq = {
interface = "eno1";
enableMpdProxy = true;
+ yggdrasi.enableGateway = true;
};
enableHail = true;
};
diff --git a/hosts/server7/borgbackup.nix b/hosts/server7/borgbackup.nix
new file mode 100644
index 00000000..0801a910
--- /dev/null
+++ b/hosts/server7/borgbackup.nix
@@ -0,0 +1,10 @@
+{ config, ... }:
+
+{
+ services.borgbackup.repos.emery = {
+ allowSubRepos = true;
+ authorizedKeys = config.users.users.emery.openssh.authorizedKeys.keys;
+ path = "/srv/ceph/c3d2/backups/emery";
+ quota = "200G";
+ };
+}
diff --git a/hosts/server7/containers/adc/default.nix b/hosts/server7/containers/adc/default.nix
index b0e3a04c..365f3b37 100644
--- a/hosts/server7/containers/adc/default.nix
+++ b/hosts/server7/containers/adc/default.nix
@@ -2,7 +2,16 @@ name:
(import ../outer-defaults.nix name) // {
config = { config, pkgs, lib, ... }: {
- imports = [ ../inner-defaults.nix ../../../../lib/yggdrasil-hq.nix ];
+ imports = [ ../inner-defaults.nix ];
+
+ c3d2.hq.yggdrasil.enableGateway = true;
+
+ networking.firewall.allowedTCPPorts = [ config.services.uhub.port ];
+
+ networking.interfaces.eth0.ipv6.addresses = [{
+ address = "310:5217:69c0:9afc:0:576d:1184:c3d2";
+ prefixLength = 64;
+ }]; # Old address used by some clients
services.uhub = {
enable = true;
@@ -18,8 +27,6 @@ name:
};
};
- networking.firewall.allowedTCPPorts = [ config.services.uhub.port ];
- hq.yggdrasil.enable = true;
};
}
diff --git a/hosts/server7/containers/default.nix b/hosts/server7/containers/default.nix
index f7b77205..e26eb748 100644
--- a/hosts/server7/containers/default.nix
+++ b/hosts/server7/containers/default.nix
@@ -1,8 +1,6 @@
{ lib, ... }:
let
- yggaddr = import ../yggaddr.nix;
-
containerFunc = name:
# Generate a container expression from the directory at `name`.
{
diff --git a/hosts/server7/containers/hydra7/default.nix b/hosts/server7/containers/hydra7/default.nix
new file mode 100644
index 00000000..5ad2522b
--- /dev/null
+++ b/hosts/server7/containers/hydra7/default.nix
@@ -0,0 +1,35 @@
+name:
+
+(import ../outer-defaults.nix name) // {
+
+ ephemeral = true;
+
+ config = { config, pkgs, lib, ... }: {
+ imports = [ ../inner-defaults.nix ];
+ c3d2.hq.yggdrasil.enableGateway = true;
+ networking.firewall.enable = false;
+ networking.interfaces.eth0.useDHCP = true;
+ security.acme = {
+ acceptTerms = true;
+ email = "mail@c3d2.de";
+ };
+ services.nginx = {
+ enable = true;
+ recommendedGzipSettings = true;
+ recommendedProxySettings = true;
+ virtualHosts = {
+ "hydra7.hq.c3d2.de" = {
+ forceSSL = true;
+ enableACME = true;
+ locations."/".proxyPass = "http://172.22.99.245:3000";
+ };
+ "hydra7.y.c3d2.de" = {
+ default = true;
+ addSSL = false;
+ locations."/".proxyPass = "http://172.22.99.245:3000";
+ };
+ };
+ };
+ };
+
+}
diff --git a/hosts/server7/containers/ncdc/default.nix b/hosts/server7/containers/ncdc/default.nix
index d169ece4..4fdd3bdf 100644
--- a/hosts/server7/containers/ncdc/default.nix
+++ b/hosts/server7/containers/ncdc/default.nix
@@ -10,11 +10,12 @@ name:
config = { config, pkgs, lib, ... }:
let ncdcPort = 1512;
in {
- imports = [ ../inner-defaults.nix ../../../../lib/yggdrasil-hq.nix ];
+ imports = [ ../inner-defaults.nix ];
c3d2 = {
users.k-ot = true;
hq.statistics.enable = true;
+ hq.yggdrasil.enableGateway = true;
};
services.openssh.enable = true;
@@ -23,7 +24,6 @@ name:
environment.systemPackages = with pkgs; [ tmux ncdc ];
networking.firewall.enable = false;
- hq.yggdrasil.enable = true;
};
}
diff --git a/hosts/server7/containers/outer-defaults.nix b/hosts/server7/containers/outer-defaults.nix
index c5a4a9a5..680bec38 100644
--- a/hosts/server7/containers/outer-defaults.nix
+++ b/hosts/server7/containers/outer-defaults.nix
@@ -7,12 +7,4 @@ in {
autoStart = true;
privateNetwork = true;
hostBridge = "br0";
-
- localAddress6 = with builtins; let
- hash = hashString "sha256" name;
- hextet0 = substring 0 4 hash;
- hextet1 = substring 4 4 hash;
- in "${yggaddr.prefix}:${hextet0}:${hextet1}:c3d2/64";
- # Generate a deterministic IPv6 address for the container.
- # This address is accessible within HQ and Yggdrasil but not from ARPANET.
}
diff --git a/hosts/server7/containers/storage/default.nix b/hosts/server7/containers/storage/default.nix
index 67a0a52b..93319fe5 100644
--- a/hosts/server7/containers/storage/default.nix
+++ b/hosts/server7/containers/storage/default.nix
@@ -13,6 +13,7 @@ name:
c3d2 = {
users.k-ot = true;
hq.statistics.enable = true;
+ hq.yggdrasil.enableGateway = true;
};
services.openssh = {
@@ -20,6 +21,8 @@ name:
allowSFTP = true;
};
+ environment.systemPackages = with pkgs; [ git borgbackup ];
+
services.nginx = {
enable = true;
package = pkgs.nginx.override {
@@ -45,7 +48,7 @@ name:
fancyindex on;
# autoindex on;
dav_access all:r;
- '';
+ '';
};
};
};
diff --git a/hosts/server7/configuration.nix b/hosts/server7/default.nix
similarity index 67%
rename from hosts/server7/configuration.nix
rename to hosts/server7/default.nix
index dc4de885..11fc3461 100644
--- a/hosts/server7/configuration.nix
+++ b/hosts/server7/default.nix
@@ -3,16 +3,21 @@
let yggaddr = import ./yggaddr.nix;
in {
imports = [
-
+ #
../../lib
../../lib/default-gateway.nix
- ../../lib/yggdrasil.nix
+ ./borgbackup.nix
./containers
./hardware-configuration.nix
./hydra.nix
./nix-serve.nix
];
+ security.acme = {
+ email = " mail@c3d2.de";
+ acceptTerms = true;
+ };
+
c3d2 = {
users = {
emery = true;
@@ -40,20 +45,13 @@ in {
];
};
- services.nginx = {
- enable = true;
- recommendedGzipSettings = true;
- recommendedProxySettings = true;
- recommendedTlsSettings = true;
- statusPage = true;
- };
-
# Route IPv6
boot.kernel.sysctl."net.ipv6.conf.all.forwarding" = 1;
# Obtain global IPv6 despite being a router myself
boot.kernel.sysctl."net.ipv6.conf.eth0.accept_ra" = 2;
services.yggdrasil = {
+ enable = true;
configFile = "/var/lib/yggdrasil/keys";
config.Peers = [
"tcp://[2a03:3b40:fe:ab::1]:46370" # Praha
@@ -74,28 +72,43 @@ in {
nix = {
package = pkgs.nixFlakes;
- extraOptions = "experimental-features = nix-command flakes ca-references";
gc.automatic = true;
optimise.automatic = true;
+ extraOptions = ''
+ experimental-features = nix-command flakes ca-references
+ post-build-hook = ${
+ pkgs.writeScript "post-build-sign-paths" ''
+ #!${pkgs.runtimeShell}
+ nix sign-paths --key-file /var/lib/nix-serve.key $OUT_PATHS
+ ''
+ }
+ '';
};
+ nixpkgs.overlays = [
+ (self: super: {
+ nix = super.nix // { meta.platforms = lib.platforms.linux; };
+ })
+ ];
virtualisation.docker.enable = true;
networking = {
firewall.enable = false;
+ firewall.trustedInterfaces = [ "br0" ];
hostName = "server7";
+ hostId = "454fe12c";
useDHCP = false;
bridges.br0.interfaces = [ "enp2s0f0" ];
interfaces = {
br0 = {
useDHCP = true;
- preferTempAddress = false;
+ tempAddress = "disabled";
ipv4.addresses = [{
address = "172.22.99.245";
prefixLength = 24;
}];
ipv6.addresses = [{
- address = yggaddr.prefix + ":1";
+ address = yggaddr.prefix64 + "::1";
prefixLength = 64;
}];
};
@@ -107,19 +120,21 @@ in {
boot.kernel.sysctl."net.bridge.bridge-nf-call-iptables" = 0;
boot.kernel.sysctl."net.bridge.bridge-nf-call-ip6tables" = 0;
- environment.systemPackages = with pkgs; [ tmux htop vim gitMinimal nixfmt ];
+ environment.systemPackages = with pkgs; [
+ tmux
+ htop
+ vim
+ gitMinimal
+ nixfmt
+ zfsStable
+ ];
services.collectd.extraConfig = ''
- LoadPlugin sensors
LoadPlugin memory
- LoadPlugin irq
- LoadPlugin thermal
LoadPlugin processes
LoadPlugin disk
- LoadPlugin hddtemp
LoadPlugin df
LoadPlugin cpu
- LoadPlugin cpufreq
LoadPlugin entropy
LoadPlugin load
LoadPlugin swap
@@ -139,4 +154,9 @@ in {
time.timeZone = "Europe/Berlin";
system.stateVersion = "19.09"; # Did you read the comment?
+
+ users.extraUsers.hydra.openssh.authorizedKeys.keys = [
+ # allow the old hydra to build here
+ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC7HuDlyTlPC4rCjwhklY8kiYIxdgPhiu6wxs29ksnpKZmJa2R7qoD02N3ACm9cTb1GVkIWukAXI3KvU9h08+WLQJqUH0cHVBj3V1sDYmkN2QecE59gz3e1gfN3zPtwmQEUe6xvHWK3X3qdH45pGPUtxk1eDTZl45037C0NClWF7RXI4m6UXng4bL9wnPvoVqCI+ySsNWaTkHDLE/D9s/VrqGxJ1w2KiJb1F73g9/x/zjL8Ixb16wkPmLE0e50MQAQa7EMFTyPZoEskFnEviLYXM9pDexABAjJfbfZ39lLyMgVYGwnzEDbjDlm68dE6wQWUY1OV6wbt8uYreB2IRrlb root@hydra"
+ ];
}
diff --git a/hosts/server7/hardware-configuration.nix b/hosts/server7/hardware-configuration.nix
index b5bf6419..e198467f 100644
--- a/hosts/server7/hardware-configuration.nix
+++ b/hosts/server7/hardware-configuration.nix
@@ -4,27 +4,173 @@
{ config, lib, pkgs, ... }:
{
- imports =
- [
- ];
+ # imports = [ ];
- boot.initrd.availableKernelModules = [ "ehci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" ];
+ boot.initrd.availableKernelModules =
+ [ "ehci_pci" "ahci" "nvme" "usbhid" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
+ boot.supportedFilesystems = [ "zfs" ];
- fileSystems."/" =
- { device = "/dev/disk/by-uuid/f14628ce-0f13-4544-9197-0ddda291f48f";
- fsType = "ext4";
- };
+ fileSystems."/" = {
+ device = "/dev/disk/by-uuid/f14628ce-0f13-4544-9197-0ddda291f48f";
+ fsType = "ext4";
+ };
- fileSystems."/boot" =
- { device = "/dev/disk/by-uuid/9812-00B2";
- fsType = "vfat";
- };
+ fileSystems."/boot" = {
+ device = "/dev/disk/by-uuid/9812-00B2";
+ fsType = "vfat";
+ };
+
+ fileSystems."/zones/9c31e6c7-97ee-e757-b5e8-d4f07a25bdc3/cores" = {
+ device = "nvme0n1/cores/9c31e6c7-97ee-e757-b5e8-d4f07a25bdc3";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1" = {
+ device = "nvme0n1";
+ fsType = "zfs";
+ };
+
+ fileSystems."/zones/9f467f1e-000b-e771-e117-b32261e48220/cores" = {
+ device = "nvme0n1/cores/9f467f1e-000b-e771-e117-b32261e48220";
+ fsType = "zfs";
+ };
+
+ fileSystems."/zones/archive" = {
+ device = "nvme0n1/archive";
+ fsType = "zfs";
+ };
+
+ fileSystems."/zones/9a9880d3-82db-c500-fcaa-d4e5a5cc617d/cores" = {
+ device = "nvme0n1/cores/9a9880d3-82db-c500-fcaa-d4e5a5cc617d";
+ fsType = "zfs";
+ };
+
+ fileSystems."/zones/eec98403-5f4f-cadf-f4ff-aa9a99b4cdb5/cores" = {
+ device = "nvme0n1/cores/eec98403-5f4f-cadf-f4ff-aa9a99b4cdb5";
+ fsType = "zfs";
+ };
+
+ fileSystems."/zones/global/cores" = {
+ device = "nvme0n1/cores/global";
+ fsType = "zfs";
+ };
+
+ fileSystems."/zones/b090f14b-0a60-4451-e82a-c5291e5951de/cores" = {
+ device = "nvme0n1/cores/b090f14b-0a60-4451-e82a-c5291e5951de";
+ fsType = "zfs";
+ };
+
+ fileSystems."/zones/3516ab22-69b0-e327-95ec-f9be8852ee44/cores" = {
+ device = "nvme0n1/cores/3516ab22-69b0-e327-95ec-f9be8852ee44";
+ fsType = "zfs";
+ };
+
+ fileSystems."/zones/e71d4460-8eef-6623-a875-dd5ec20b650f/cores" = {
+ device = "nvme0n1/cores/e71d4460-8eef-6623-a875-dd5ec20b650f";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/c3d2.de" = {
+ device = "nvme0n1/c3d2.de";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/b090f14b-0a60-4451-e82a-c5291e5951de" = {
+ device = "nvme0n1/b090f14b-0a60-4451-e82a-c5291e5951de";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/55bcd862-bb70-11e9-9991-7b9a40d4e95f" = {
+ device = "nvme0n1/55bcd862-bb70-11e9-9991-7b9a40d4e95f";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/9a9880d3-82db-c500-fcaa-d4e5a5cc617d" = {
+ device = "nvme0n1/9a9880d3-82db-c500-fcaa-d4e5a5cc617d";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/9c31e6c7-97ee-e757-b5e8-d4f07a25bdc3" = {
+ device = "nvme0n1/9c31e6c7-97ee-e757-b5e8-d4f07a25bdc3";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/c3d2.de/admin" = {
+ device = "nvme0n1/c3d2.de/admin";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/c3d2.de/templates" = {
+ device = "nvme0n1/c3d2.de/templates";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/d5a8bfc2-6d01-6d5e-ad3f-edf032eedd89" = {
+ device = "nvme0n1/d5a8bfc2-6d01-6d5e-ad3f-edf032eedd89";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/a9786e8b-fce2-7567-6467-2a95086a51d4" = {
+ device = "nvme0n1/a9786e8b-fce2-7567-6467-2a95086a51d4";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/3e65fa50-2f41-8792-df46-8c826bddab75" = {
+ device = "nvme0n1/3e65fa50-2f41-8792-df46-8c826bddab75";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/9f467f1e-000b-e771-e117-b32261e48220" = {
+ device = "nvme0n1/9f467f1e-000b-e771-e117-b32261e48220";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/eec98403-5f4f-cadf-f4ff-aa9a99b4cdb5" = {
+ device = "nvme0n1/eec98403-5f4f-cadf-f4ff-aa9a99b4cdb5";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/b28b36ed-1824-3a6c-cdbb-258c7dd63317" = {
+ device = "nvme0n1/b28b36ed-1824-3a6c-cdbb-258c7dd63317";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/9651893f-4b85-293a-2d72-60ea3b541bc3" = {
+ device = "nvme0n1/9651893f-4b85-293a-2d72-60ea3b541bc3";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/0cc567e5-5e4c-1868-eca3-4426508cbfb9" = {
+ device = "nvme0n1/0cc567e5-5e4c-1868-eca3-4426508cbfb9";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/7644820f-5ce5-f9f1-94b7-4537ee598f43" = {
+ device = "nvme0n1/7644820f-5ce5-f9f1-94b7-4537ee598f43";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/63d6e664-3f1f-11e8-aef6-a3120cf8dd9d" = {
+ device = "nvme0n1/63d6e664-3f1f-11e8-aef6-a3120cf8dd9d";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/e71d4460-8eef-6623-a875-dd5ec20b650f" = {
+ device = "nvme0n1/e71d4460-8eef-6623-a875-dd5ec20b650f";
+ fsType = "zfs";
+ };
+
+ fileSystems."/nvme0n1/c3d2.de/iso" = {
+ device = "nvme0n1/c3d2.de/iso";
+ fsType = "zfs";
+ };
swapDevices = [ ];
- nix.maxJobs = lib.mkDefault 20;
- powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
+ nix.maxJobs = lib.mkDefault 10;
+ nix.buildCores = lib.mkDefault 40;
+ powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
}
diff --git a/hosts/server7/hydra.nix b/hosts/server7/hydra.nix
index 5d57ed3d..52692b0e 100644
--- a/hosts/server7/hydra.nix
+++ b/hosts/server7/hydra.nix
@@ -1,173 +1,28 @@
-let
- hydraFlakes = pkgs:
- with pkgs;
- let
- perlDeps = buildEnv {
- name = "hydra-perl-deps";
- paths = with perlPackages; [
- ModulePluggable
- CatalystActionREST
- CatalystAuthenticationStoreDBIxClass
- CatalystDevel
- CatalystDispatchTypeRegex
- CatalystPluginAccessLog
- CatalystPluginAuthorizationRoles
- CatalystPluginCaptcha
- CatalystPluginSessionStateCookie
- CatalystPluginSessionStoreFastMmap
- CatalystPluginStackTrace
- CatalystPluginUnicodeEncoding
- CatalystTraitForRequestProxyBase
- CatalystViewDownload
- CatalystViewJSON
- CatalystViewTT
- CatalystXScriptServerStarman
- CatalystXRoleApplicator
- CryptRandPasswd
- DBDPg
- DBDSQLite
- DataDump
- DateTime
- DigestSHA1
- EmailMIME
- EmailSender
- FileSlurp
- IOCompress
- IPCRun
- JSON
- JSONAny
- JSONXS
- LWP
- LWPProtocolHttps
- NetAmazonS3
- NetPrometheus
- NetStatsd
- PadWalker
- Readonly
- SQLSplitStatement
- SetScalar
- Starman
- SysHostnameLong
- TermSizeAny
- TestMore
- TextDiff
- TextTable
- XMLSimple
- pkgs.nixFlakes
- pkgs.nixFlakes.perl-bindings
- git
- boehmgc
- ];
- };
+{ config, lib, pkgs, ... }:
- in stdenv.mkDerivation {
-
- name = "hydra-flake";
-
- src = pkgs.fetchFromGitHub {
- owner = "NixOS";
- repo = "hydra";
- rev = "47797576838974c8209536b67bb45e953a50900f";
- sha256 = "1vqib99d7wgnl3c6ccx0xx2q88qmdkpydkb6gd0pik9wg2nn3jng";
- };
-
- buildInputs = [
- makeWrapper
- autoconf
- automake
- libtool
- unzip
- nukeReferences
- pkgconfig
- sqlite
- libpqxx
- gitAndTools.topGit
- mercurial
- darcs
- subversion
- bazaar
- openssl
- bzip2
- libxslt
- guile # optional, for Guile + Guix support
- perlDeps
- perl
- pkgs.nixFlakes
- postgresql95 # for running the tests
- boost
- (nlohmann_json.override { multipleHeaders = true; })
- ];
-
- hydraPath = lib.makeBinPath ([
- sqlite
- subversion
- openssh
- pkgs.nixFlakes
- coreutils
- findutils
- pixz
- gzip
- bzip2
- lzma
- gnutar
- unzip
- git
- gitAndTools.topGit
- mercurial
- darcs
- gnused
- bazaar
- ] ++ lib.optionals stdenv.isLinux [ rpm dpkg cdrkit ]);
-
- configureFlags = [ "--with-docbook-xsl=${docbook_xsl}/xml/xsl/docbook" ];
-
- shellHook = ''
- PATH=$(pwd)/src/hydra-evaluator:$(pwd)/src/script:$(pwd)/src/hydra-eval-jobs:$(pwd)/src/hydra-queue-runner:$PATH
- PERL5LIB=$(pwd)/src/lib:$PERL5LIB
- '';
-
- preConfigure = "autoreconf -vfi";
-
- NIX_LDFLAGS = [ "-lpthread" ];
-
- enableParallelBuilding = true;
-
- preCheck = ''
- patchShebangs .
- export LOGNAME=''${LOGNAME:-foo}
- '';
-
- postInstall = ''
- mkdir -p $out/nix-support
-
- for i in $out/bin/*; do
- read -n 4 chars < $i
- if [[ $chars =~ ELF ]]; then continue; fi
- wrapProgram $i \
- --prefix PERL5LIB ':' $out/libexec/hydra/lib:$PERL5LIB \
- --prefix PATH ':' $out/bin:$hydraPath \
- --set HYDRA_RELEASE 0.1 \
- --set HYDRA_HOME $out/libexec/hydra \
- --set NIX_RELEASE ${pkgs.nixFlakes.name or "unknown"}
- done
- '';
-
- dontStrip = true;
-
- meta.description = "Build of Hydra on ${system}";
- passthru.perlDeps = perlDeps;
- };
-in { config, pkgs, ... }: {
-
- services.hydra = {
+{
+ services.hydra-dev = {
enable = true;
+ debugServer = true;
+ extraEnv.HYDRA_DEBUG = "1";
hydraURL = "https://server7.hq.c3d2.de";
logo = ./hydra.svg;
notificationSender = "hydra@spam.works";
- package = hydraFlakes pkgs;
- listenHost = "127.0.0.1";
+ # package = pkgs.hydra-unstable;
+ listenHost = "172.22.99.245";
+ # listenHost = "*";
+ useSubstitutes = true;
+ minimumDiskFree = 2;
+ minimumDiskFreeEvaluator = 2;
+ extraConfig = ''
+
+ authfile = /var/lib/hydra/sotest.auth
+
+ '';
};
+ nix.trustedUsers = [ "hydra" ];
+
nix.buildMachines = [{
hostName = "localhost";
system = "x86_64-linux";
@@ -175,18 +30,20 @@ in { config, pkgs, ... }: {
maxJobs = 8;
}];
+ nix.binaryCachePublicKeys =
+ [ "nix-serve.hq.c3d2.de-2:elqZouiiQP4XNfmEekwXH/YRPL1pXlN5JgVSzT1Ctoc=" ];
+ nix.binaryCaches = [ "http://nix-serve.hq.c3d2.de" ];
+
services.nginx = {
enable = true;
virtualHosts = {
"server7.hq.c3d2.de" = {
- default = true;
addSSL = true;
enableACME = true;
- locations."/".proxyPass =
- "http://127.0.0.1:${toString config.services.hydra.port}";
+ globalRedirect = "hydra7.hq.c3d2.de";
};
};
};
- networking.firewall.allowedTCPPorts = [ 80 443 ];
+
}
diff --git a/hosts/server7/nix-serve.nix b/hosts/server7/nix-serve.nix
index a3456808..58c6d80a 100644
--- a/hosts/server7/nix-serve.nix
+++ b/hosts/server7/nix-serve.nix
@@ -15,7 +15,9 @@
addSSL = true;
enableACME = true;
locations."/".proxyPass =
- "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
+ "http://${config.services.nix-serve.bindAddress}:${
+ toString config.services.nix-serve.port
+ }";
};
};
};
diff --git a/hosts/server7/yggaddr.nix b/hosts/server7/yggaddr.nix
index f5086928..22be5469 100644
--- a/hosts/server7/yggaddr.nix
+++ b/hosts/server7/yggaddr.nix
@@ -1,4 +1,4 @@
{
address = "210:5217:69c0:9afc:1b95:b9f:8718:c3d2";
- prefix = "310:5217:69c0:9afc:";
+ prefix64 = "310:5217:69c0:9afc";
}
diff --git a/krops.nix b/krops.nix
index f9ad4e28..6e31df4d 100644
--- a/krops.nix
+++ b/krops.nix
@@ -16,6 +16,7 @@ let
url = "https://github.com/NixOS/nixpkgs.git";
};
nixos-config.file = toString (./hosts + "/${path}/configuration.nix");
+ this-host.file = toString (./hosts + "/${path}");
lib.file = toString ./lib;
secrets.file = toString ./secrets;
"host-registry.nix".file = toString ./host-registry.nix;
diff --git a/lib/default.nix b/lib/default.nix
index 3843e6b0..505a6ab1 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -8,6 +8,8 @@ let
hqPrefix64 = "fd23:42:c3d2:523";
# TODO: Is this stable? Is there a better place to specifiy this?
+ server7Ygg = import ../hosts/server7/yggaddr.nix;
+
# Generate a deterministic IPv6 address for a 64 bit prefix
# and seed string. Prefix must not contain trailing ':'.
toIpv6Address = prefix64: seed:
@@ -21,14 +23,9 @@ let
# for the HQ networking using a seed string.
toHqPrivateAddress = toIpv6Address hqPrefix64;
- /* # Generate a deterministic public IPv6 addresses
- # for the HQ networking using a seed string.
- toHqPublicAddress = toIpv6Address publicPrefix64;
+ toServer7Address = toIpv6Address server7Ygg.prefix64;
- # Generate a deterministic public IPv6 addresses
- # for the HQ networking using a seed string.
- toserver7YggdrasilAddress = toIpv6Address server7YggrasilPrefix64;
- */
+ # toHqPublicAddress = toIpv6Address publicPrefix64;
cfg = config.c3d2;
@@ -106,6 +103,8 @@ in {
description = "Whether to proxy the local MPD database";
};
+ yggdrasil.enableGateway = mkEnableOption
+ "Whether to join the host to the Yggdrasil network via a gateway";
};
};
@@ -118,7 +117,8 @@ in {
# Configuration specific to this machine
assertions = [
- { assertion = cfg.isInHq -> (config.users.users.root.password == null);
+ {
+ assertion = cfg.isInHq -> (config.users.users.root.password == null);
message = "Root passwords not allowed in HQ";
}
{
@@ -166,10 +166,16 @@ in {
host.ip6
else
toHqPrivateAddress hostName;
- in [{
- name = ip6;
- value = [ "${hostName}.hq" hostName ];
- }] ++ lib.optional (hasAttr "ip4" host) {
+ in [
+ {
+ name = ip6;
+ value = [ "${hostName}.hq" hostName ];
+ }
+ {
+ name = toServer7Address hostName;
+ value = [ "${hostName}.y.c3d2.de" "${hostName}.y" ];
+ }
+ ] ++ lib.optional (hasAttr "ip4" host) {
name = host.ip4;
value = [ "${hostName}.hq" hostName ];
};
@@ -196,7 +202,16 @@ in {
ipv6.addresses = [{
address = toHqPrivateAddress config.networking.hostName;
prefixLength = 64;
- }];
+ }] ++ lib.optional (cfg.hq.yggdrasil.enableGateway) {
+ address = toServer7Address config.networking.hostName;
+ prefixLength = 64;
+ };
+ ipv6.routes = lib.optional (cfg.hq.yggdrasil.enableGateway) {
+ address = "200::";
+ options.pref = "low";
+ prefixLength = 7;
+ via = server7Ygg.prefix64 + "::1";
+ };
};
});
@@ -231,17 +246,31 @@ in {
services.collectd = lib.mkIf cfg.hq.statistics.enable {
enable = true;
- autoLoadPlugin = true;
extraConfig = ''
- HostName "${config.networking.hostName}"
FQDNLookup false
Interval 10
-
- LoadPlugin network
-
- Server "grafana.hq" "25826"
-
'';
+ buildMinimalPackage = true;
+ plugins = {
+ logfile = ''
+ LogLevel info
+ File STDOUT
+ '';
+ network = ''
+ Server "grafana.hq.c3d2.de" "25826"
+ '';
+ memory = "";
+ processes = "";
+ disk = "";
+ df = "";
+ cpu = "";
+ entropy = "";
+ load = "";
+ swap = "";
+ cgroups = "";
+ vmem = "";
+ interface = "";
+ };
};
services.hail = lib.mkIf cfg.enableHail {
diff --git a/lib/hq.nix b/lib/hq.nix
deleted file mode 100644
index 4ecc258c..00000000
--- a/lib/hq.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{ config, lib, ... }:
-
-{
- # Please import only things that are configurable and OFF BY DEFAULT!
- imports = [ ./yggdrasil-hq.nix ];
-
-}
diff --git a/lib/lxc-container.nix b/lib/lxc-container.nix
index 9f0e1577..cad10c70 100644
--- a/lib/lxc-container.nix
+++ b/lib/lxc-container.nix
@@ -4,7 +4,6 @@
imports =
[
- ./hq.nix
];
networking.networkmanager.dns = "unbound";
diff --git a/lib/lxc/default.nix b/lib/lxc/default.nix
index 37cf50bd..185058e6 100644
--- a/lib/lxc/default.nix
+++ b/lib/lxc/default.nix
@@ -3,8 +3,11 @@
with lib;
let
- nixcloud-webservices = builtins.fetchGit {
- url = "https://github.com/nixcloud/nixcloud-webservices.git";
+ nixcloud-webservices = pkgs.fetchFromGitHub {
+ owner = "nixcloud";
+ repo = "nixcloud-webservices";
+ rev = "3a0767f0536fac811065eb87e6342f27eac085aa";
+ sha256 = "vC0vBu+0HchrevuWsmE7giouKnSt/q4F0TffwhuNJv8=";
};
nixcloud = (
import "${nixcloud-webservices}/pkgs" { inherit pkgs; }
diff --git a/lib/users/emery.nix b/lib/users/emery.nix
index 27834ed1..49a061ba 100644
--- a/lib/users/emery.nix
+++ b/lib/users/emery.nix
@@ -4,6 +4,7 @@ let
keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICgL2kRs+cXAcUzOO2Tp+mtMBVuHqMuslQy3LN+HLSP4 emery@nixos"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMVmyXQNE5IhcFdAWNfd4Cgg+rc+z/uClSQdPcaAVbYf emery@nixos"
+ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQC55d1lIbI00AyDnlfig3znWKPToGUcM8TKj5s8EHQm5SkUn0DeG1+h5/wciyu7NonIxykgtx2nfnLAewgNjKDk1Q7bqNTxvIkb5dtpuEvGWuuLmm5VCQUszPSNmQAMocFAc+A0ALDTdR0pS+DFuKPx4DncYLQxDFwdV+1vw0PYCXNHfS6umJW/bsQ2jLc2+H3bnXqhcoQX6EVvlQS3QNpWOY3qhK9Yy58NJywmcSSzamc4Fyd1Jz/R67/4hYDfB65f7bs6l0BjFj+yciiVYyZuILPb6CZicXcNTjnW6YFGHDQt3owsr/pQuuPxUWiP8rfrrrwnyi1SFeYrmCKSQ6WOZMA5mHZ6091LbspwrlGiGBXKPoZhHHUW/dDmojy1XAIK/XFg/5+DiG+2Rc61l1AnRaP4IRiFViV9VlPBYBG5TFmAfxCz6iiwuDQY1cSX4+duqL7sIkZTPMkQP0Bf3ek1hTK1U8nbSOP6sILt7e5ApRCoAu9S+fFtbpI+l1GCy90= root@bigpad"
];
in {
diff --git a/lib/yggdrasil-hq.nix b/lib/yggdrasil-hq.nix
deleted file mode 100644
index 21d026b3..00000000
--- a/lib/yggdrasil-hq.nix
+++ /dev/null
@@ -1,40 +0,0 @@
-{ config, lib, ... }:
-with lib;
-
-let
- cfg = config.hq.yggdrasil;
- hostNameHash = builtins.hashString "sha256" config.networking.hostName;
- hextets = map (i: substring (4 * i) 4 hostNameHash) [ 0 1 2 3 ];
- hostAddr = concatStringsSep ":" hextets;
-in {
- options = with types; {
- hq.yggdrasil = {
- enable =
- mkEnableOption "Configure Yggdrasil access via the Yggdrasil router";
-
- interface = mkOption {
- type = nullOr str;
- default = "eth0";
- description = "Network interface to the C3D2 HQ ethernet";
- };
- };
- };
-
- config = mkIf cfg.enable {
- networking.interfaces = {
- "${cfg.interface}" = {
- "ipv6" = {
- addresses = [{
- address = "310:5217:69c0:9afc:${hostAddr}";
- prefixLength = 64;
- }];
- routes = [{
- address = "200::";
- prefixLength = 7;
- via = "310:5217:69c0:9afc::1";
- }];
- };
- };
- };
- };
-}
diff --git a/lib/yggdrasil-service.nix b/lib/yggdrasil-service.nix
deleted file mode 100644
index 33d1f093..00000000
--- a/lib/yggdrasil-service.nix
+++ /dev/null
@@ -1,185 +0,0 @@
-{ config, lib, pkgs, ... }:
-with lib;
-let
- cfg = config.services.yggdrasil;
- configProvided = (cfg.config != { });
- configAsFile = (if configProvided then
- toString (pkgs.writeTextFile {
- name = "yggdrasil-conf";
- text = builtins.toJSON cfg.config;
- })
- else
- null);
- configFileProvided = (cfg.configFile != null);
- generateConfig = (if configProvided && configFileProvided then
- "${pkgs.jq}/bin/jq -s add ${configAsFile} ${cfg.configFile}"
- else if configProvided then
- "cat ${configAsFile}"
- else if configFileProvided then
- "cat ${cfg.configFile}"
- else
- "${cfg.package}/bin/yggdrasil -genconf");
-
-in {
- options = with types; {
- services.yggdrasil = {
- enable = mkEnableOption "the yggdrasil system service";
-
- configFile = mkOption {
- type = nullOr str;
- default = null;
- example = "/run/keys/yggdrasil.conf";
- description = ''
- A file which contains JSON configuration for yggdrasil.
-
- You do not have to supply a complete configuration, as
- yggdrasil will use default values for anything which is
- omitted. If the encryption and signing keys are omitted,
- yggdrasil will generate new ones each time the service is
- started, resulting in a random IPv6 address on the yggdrasil
- network each time.
-
- If both this option and are
- supplied, they will be combined, with values from
- taking precedence.
-
- You can use the command nix-shell -p yggdrasil --run
- "yggdrasil -genconf -json"
to generate a default
- JSON configuration.
- '';
- };
-
- config = mkOption {
- type = attrs;
- default = { };
- example = {
- Peers = [
- "tcp://aa.bb.cc.dd:eeeee"
- "tcp://[aaaa:bbbb:cccc:dddd::eeee]:fffff"
- ];
- Listen = [ "tcp://0.0.0.0:xxxxx" ];
- };
- description = ''
- Configuration for yggdrasil, as a Nix attribute set.
-
- Warning: this is stored in the WORLD-READABLE Nix store!
- Therefore, it is not appropriate for private keys. If you
- do not specify the keys, yggdrasil will generate a new set
- each time the service is started, creating a random IPv6
- address on the yggdrasil network each time.
-
- If you wish to specify the keys, use
- . If both
- and are
- supplied, they will be combined, with values from
- taking precedence.
-
- You can use the command nix-shell -p yggdrasil --run
- "yggdrasil -genconf"
to generate default
- configuration values with documentation.
- '';
- };
-
- openMulticastPort = mkOption {
- type = bool;
- default = false;
- description = ''
- Whether to open the UDP port used for multicast peer
- discovery. The NixOS firewall blocks link-local
- communication, so in order to make local peering work you
- will also need to set LinkLocalTCPPort
in your
- yggdrasil configuration ( or
- ) to a port number other than 0,
- and then add that port to
- .
- '';
- };
-
- denyDhcpcdInterfaces = mkOption {
- type = listOf str;
- default = [ ];
- example = [ "tap*" ];
- description = ''
- Disable the DHCP client for any interface whose name matches
- any of the shell glob patterns in this list. Use this
- option to prevent the DHCP client from broadcasting requests
- on the yggdrasil network. It is only necessary to do so
- when yggdrasil is running in TAP mode, because TUN
- interfaces do not support broadcasting.
- '';
- };
-
- package = mkOption {
- type = package;
- default = pkgs.yggdrasil;
- defaultText = "pkgs.yggdrasil";
- description = "Yggdrasil package to use.";
- };
- };
- };
-
- config = mkIf cfg.enable {
- assertions = [{
- assertion = config.networking.enableIPv6;
- message = "networking.enableIPv6 must be true for yggdrasil to work";
- }];
-
- systemd.services.yggdrasil = {
- description = "Yggdrasil Network Service";
- path = [ cfg.package ]
- ++ optional (configProvided && configFileProvided) pkgs.jq;
- bindsTo = [ "network-online.target" ];
- after = [ "network-online.target" ];
- wantedBy = [ "multi-user.target" ];
-
- preStart = ''
- ${generateConfig} | yggdrasil -normaliseconf -useconf > /run/yggdrasil/yggdrasil.conf
- '';
-
- serviceConfig = {
- ExecStart =
- "${cfg.package}/bin/yggdrasil -useconffile /run/yggdrasil/yggdrasil.conf";
- ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
- Restart = "always";
-
- RuntimeDirectory = "yggdrasil";
- RuntimeDirectoryMode = "0700";
- BindReadOnlyPaths = mkIf configFileProvided [ "${cfg.configFile}" ];
-
- # TODO: as of yggdrasil 0.3.8 and systemd 243, yggdrasil fails
- # to set up the network adapter when DynamicUser is set. See
- # github.com/yggdrasil-network/yggdrasil-go/issues/557. The
- # following options are implied by DynamicUser according to
- # the systemd.exec documentation, and can be removed if the
- # upstream issue is fixed and DynamicUser is set to true:
- PrivateTmp = true;
- RemoveIPC = true;
- NoNewPrivileges = true;
- ProtectSystem = "strict";
- RestrictSUIDSGID = true;
- # End of list of options implied by DynamicUser.
-
- AmbientCapabilities = "CAP_NET_ADMIN";
- CapabilityBoundingSet = "CAP_NET_ADMIN";
- MemoryDenyWriteExecute = true;
- ProtectControlGroups = true;
- ProtectHome = "tmpfs";
- ProtectKernelModules = true;
- ProtectKernelTunables = true;
- RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK";
- RestrictNamespaces = true;
- RestrictRealtime = true;
- SystemCallArchitectures = "native";
- SystemCallFilter =
- "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @resources";
- };
- };
-
- networking.dhcpcd.denyInterfaces = cfg.denyDhcpcdInterfaces;
- networking.firewall.allowedUDPPorts = mkIf cfg.openMulticastPort [ 9001 ];
-
- # Make yggdrasilctl available on the command line.
- environment.systemPackages = [ cfg.package ];
- };
- meta.maintainers = with lib.maintainers; [ gazally ];
-}
diff --git a/lib/yggdrasil.nix b/lib/yggdrasil.nix
deleted file mode 100644
index f497dc6e..00000000
--- a/lib/yggdrasil.nix
+++ /dev/null
@@ -1,13 +0,0 @@
-{ config, ... }: {
- imports = [ ./yggdrasil-service.nix ];
-
- services.yggdrasil = {
- enable = true;
- package = (import { }).yggdrasil;
- openMulticastPort = true;
- config.NodeInfo = {
- name = config.networking.hostName + ".c3d2";
- location = "Dresden";
- };
- };
-}
diff --git a/secrets b/secrets
index 35a994c6..eb06c122 160000
--- a/secrets
+++ b/secrets
@@ -1 +1 @@
-Subproject commit 35a994c6ea2f2720e8ec045ea1369163ea69a35f
+Subproject commit eb06c122762133b7831475615b1a3b039eaa389e