104 lines
2.5 KiB
Nix
104 lines
2.5 KiB
Nix
{ zentralwerk, config, lib, pkgs, ... }:
|
|
let
|
|
netConfig = zentralwerk.lib.config.site.net.serv;
|
|
|
|
nfsExports = [
|
|
"var/lib/nfsroot/dacbert"
|
|
"var/lib/nfsroot/riscbert"
|
|
"var/lib/dump-dvb/whoopsie"
|
|
];
|
|
in {
|
|
microvm = {
|
|
hypervisor = "qemu";
|
|
mem = 2048;
|
|
|
|
shares = [ {
|
|
source = "/nix/store";
|
|
mountPoint = "/nix/.ro-store";
|
|
tag = "store";
|
|
proto = "virtiofs";
|
|
socket = "store.socket";
|
|
} ] ++ map (dir: {
|
|
source = "/var/lib/microvms/${config.networking.hostName}/${dir}";
|
|
mountPoint = "/${dir}";
|
|
tag = builtins.baseNameOf dir;
|
|
proto = "virtiofs";
|
|
socket = "${builtins.baseNameOf dir}.socket";
|
|
}) [ "etc" "home" "var" ];
|
|
|
|
volumes = map (export: {
|
|
mountPoint = "/${export}";
|
|
image = "/dev/zvol/server10/vm/nfsroot/${builtins.baseNameOf export}";
|
|
autoCreate = false;
|
|
}) nfsExports;
|
|
|
|
interfaces = [ {
|
|
type = "tap";
|
|
id = "nfsroot";
|
|
mac = "00:de:fa:c8:28:9c";
|
|
} ];
|
|
};
|
|
|
|
fileSystems = builtins.foldl' (fileSystems: export: fileSystems // {
|
|
"/${export}".options = [ "relatime" "discard" ];
|
|
}) {} nfsExports;
|
|
|
|
networking = {
|
|
hostName = "nfsroot";
|
|
|
|
useDHCP = false;
|
|
interfaces.eth0 = {
|
|
useDHCP = false;
|
|
ipv4.addresses = [ {
|
|
address = netConfig.hosts4.${config.networking.hostName};
|
|
prefixLength = netConfig.subnet4Len;
|
|
} ];
|
|
};
|
|
defaultGateway = netConfig.hosts4.serv-gw;
|
|
nameservers = [
|
|
netConfig.hosts4.dnscache "9.9.9.9"
|
|
];
|
|
|
|
firewall.enable = false;
|
|
};
|
|
|
|
system.stateVersion = "22.05";
|
|
|
|
|
|
services.nfs.server = {
|
|
enable = true;
|
|
exports =
|
|
let
|
|
allowed = [
|
|
"172.22.99.0/24"
|
|
"172.20.72.0/21"
|
|
"30c:c3d2:b946:76d0::/64"
|
|
"2a00:8180:2c00:200::/56"
|
|
"fd23:42:c3d2:500::/56"
|
|
];
|
|
opts = o: fsid:
|
|
lib.concatStringsSep "," [
|
|
o "async"
|
|
"no_subtree_check" "no_root_squash"
|
|
"fsid=${toString fsid}"
|
|
];
|
|
in ''
|
|
/var/lib/nfsroot/dacbert ${
|
|
lib.concatMapStringsSep " " (subnet:
|
|
"${subnet}(${opts "rw" 0})"
|
|
) allowed
|
|
}
|
|
/var/lib/nfsroot/riscbert ${
|
|
lib.concatMapStringsSep " " (subnet:
|
|
"${subnet}(${opts "rw" 1})"
|
|
) allowed
|
|
}
|
|
/var/lib/dump-dvb/whoopsie ${
|
|
lib.concatMapStringsSep " " (subnet:
|
|
"${subnet}(${opts "rw" 2})"
|
|
) allowed
|
|
}
|
|
'';
|
|
};
|
|
}
|