blob: d09c3c00db6c39be0da1e9562689d2505a8d159a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
{ config, pkgs, lib, ... }:
with lib;
let
ipv4 = {
address = "138.248.67.57";
gateway = "138.248.67.1";
netmask = "255.255.255.0";
prefixLength = 24; # https://www.pawprint.net/designresources/netmask-converter.php
};
ipv6 = {
address = "2001:ce8:77:f::2e27:0";
gateway = "2001:ce8:77:f::1";
prefixLength = 112;
};
networkInterface = "ens3";
hostName = "v-coord1";
hostId = "8b0a9354";
hostAddr = "v-coord1.sefidel.net";
sefidelKeys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILN14b5Fu+StHeMXq4ClyLG4G+/vCAfS7adxceEFria/ openpgp:0x1D5BCD11" ];
maintainerKeys = [ ] ++ sefidelKeys;
in
{
deployment = {
targetHost = hostAddr;
targetPort = 22;
targetUser = "root";
};
imports = [ ./hardware-configuration.nix ];
networking.hostId = hostId;
boot.loader.grub.enable = true;
boot.loader.grub.device = "/dev/vda";
boot.kernelParams = [
# See <https:#www.kernel.org/doc/Documentation/filesystems/nfs/nfsroot.txt> for documentation.
# ip=<client-ip>:<server-ip>:<gw-ip>:<netmask>:<hostname>:<device>:<autoconf>:<dns0-ip>:<dns1-ip>:<ntp0-ip>
# The server ip refers to the NFS server -- not needed in this case.
"ip=${ipv4.address}::${ipv4.gateway}:${ipv4.netmask}:${hostName}-initrd:${networkInterface}:off:8.8.8.8"
];
boot.tmp.cleanOnBoot = true;
zramSwap.enable = true;
networking.hostName = hostName;
networking.useDHCP = false;
networking.interfaces.${networkInterface} = {
ipv4 = { addresses = [{ address = ipv4.address; prefixLength = ipv4.prefixLength; }]; };
ipv6 = { addresses = [{ address = ipv6.address; prefixLength = ipv6.prefixLength; }]; };
};
networking.defaultGateway = ipv4.gateway;
networking.defaultGateway6 = { address = ipv6.gateway; interface = networkInterface; };
networking.nameservers = [ "8.8.8.8" ];
networking.firewall.enable = true;
time.timeZone = "UTC";
sops.secrets.root-password.neededForUsers = true;
# User = networkId;
# nameToId = netName: "nebula-${netName}";
sops.secrets.nebula-sefidel-internal-ca = { owner = "nebula-sefidel-internal"; };
sops.secrets.nebula-sefidel-internal-cert = { owner = "nebula-sefidel-internal"; };
sops.secrets.nebula-sefidel-internal-key = { owner = "nebula-sefidel-internal"; };
users.users.root.hashedPasswordFile = config.sops.secrets.root-password.path;
users.users.root.openssh.authorizedKeys.keys = maintainerKeys;
services.openssh.enable = true;
services.openssh.settings.PermitRootLogin = "prohibit-password";
nix.flakes.enable = true;
modules = {
security.enable = true;
persistence.enable = false;
binary-cache.enable = true;
sops.enable = true;
services.tailscale.enable = true;
services.nebula = {
enable = true;
networks.sefidel-internal = {
ca = config.sops.secrets.nebula-sefidel-internal-ca.path;
cert = config.sops.secrets.nebula-sefidel-internal-cert.path;
key = config.sops.secrets.nebula-sefidel-internal-key.path;
isLighthouse = true;
isRelay = true;
settings = {
lighthouse = {
serve_dns = true;
dns = {
host = "100.64.0.1";
port = 53;
};
};
};
};
};
};
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. It‘s perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "24.05"; # Did you read the comment?
}
|
