back round 0 view raw

nixify knot1 #6

open

opened by

anirudh.fi 1 week ago targeting master from push-oqkkllmzurup

Signed-off-by: Anirudh Oppiliappan anirudh@tangled.org

options

unified split

Changed files

+170

flake.nix

hosts

knot1

configuration.nix

disk-config.nix

services

knot.nix

nginx.nix

+11

flake.nix

···

       90
       90
        
                 ];

     

       91
       91
        
                 target = "spindle.alpha.tangled.sh";

     

       92
       92
        
               };

     

       93
       93
       +
       

     

       94
       94
       +
               knot1 = {

     

       95
       95
       +
                 modules = [

     

       96
       96
       +
                   tangled.nixosModules.knot

     

       97
       97
       +
                   ./hosts/knot1/services/knot.nix

     

       98
       98
       +
                   ./hosts/knot1/services/nginx.nix

     

       99
       99
       +
                 ];

     

       100
       100
       +
                 target = "knot1.alpha.tangled.sh";

     

       101
       101
       +
               };

     

       93
       102
        
             };

     

       94
       103
        
           in

     

       95
       104
        
           {

     
···

       99
       108
        
               pds = mkHost "pds" hosts.pds.modules;

     

       100
       109
        
               nixery = mkHost "nixery" hosts.nixery.modules;

     

       101
       110
        
               spindle = mkHost "spindle" hosts.spindle.modules;

     

       111
       111
       +
               knot1 = mkHost "knot1" hosts.knot1.modules;

     

       102
       112
        
             };

     

       103
       113
        
       

     

       104
       114
        
             # colmena uses this

     
···

       121
       131
        
               pds = mkColmenaHost "pds" hosts.pds.target hosts.pds.modules;

     

       122
       132
        
               nixery = mkColmenaHost "nixery" hosts.nixery.target hosts.nixery.modules;

     

       123
       133
        
               spindle = mkColmenaHost "spindle" hosts.spindle.target hosts.spindle.modules;

     

       134
       134
       +
               knot1 = mkColmenaHost "knot1" hosts.knot1.target hosts.knot1.modules;

     

       124
       135
        
             };

     

       125
       136
        
           };

     

       126
       137
        
       }

+57

hosts/knot1/configuration.nix

···

       1
       1
       +
       { modulesPath

     

       2
       2
       +
       , lib

     

       3
       3
       +
       , pkgs

     

       4
       4
       +
       , ...

     

       5
       5
       +
       } @ args:

     

       6
       6
       +
       {

     

       7
       7
       +
         imports = [

     

       8
       8
       +
           (modulesPath + "/installer/scan/not-detected.nix")

     

       9
       9
       +
           (modulesPath + "/profiles/qemu-guest.nix")

     

       10
       10
       +
           ./disk-config.nix

     

       11
       11
       +
         ];

     

       12
       12
       +
         boot.loader.grub = {

     

       13
       13
       +
           # no need to set devices, disko will add all devices that have a EF02 partition to the list already

     

       14
       14
       +
           # devices = [ ];

     

       15
       15
       +
           efiSupport = true;

     

       16
       16
       +
           efiInstallAsRemovable = true;

     

       17
       17
       +
         };

     

       18
       18
       +
       

     

       19
       19
       +
         networking.hostName = "knot1-ams";

     

       20
       20
       +
         services = {

     

       21
       21
       +
           openssh.enable = true;

     

       22
       22
       +
         };

     

       23
       23
       +
       

     

       24
       24
       +
       

     

       25
       25
       +
         nix = {

     

       26
       26
       +
           extraOptions = ''

     

       27
       27
       +
             experimental-features = nix-command flakes ca-derivations

     

       28
       28
       +
             warn-dirty = false

     

       29
       29
       +
             keep-outputs = false

     

       30
       30
       +
           '';

     

       31
       31
       +
         };

     

       32
       32
       +
       

     

       33
       33
       +
         environment.systemPackages = map lib.lowPrio [

     

       34
       34
       +
           pkgs.curl

     

       35
       35
       +
           pkgs.gitMinimal

     

       36
       36
       +
         ];

     

       37
       37
       +
       

     

       38
       38
       +
         users.users.tangler = {

     

       39
       39
       +
           extraGroups = [ "networkmanager" "wheel" "docker" ];

     

       40
       40
       +
           openssh.authorizedKeys.keys = args.commonArgs.sshKeys;

     

       41
       41
       +
           isNormalUser = true;

     

       42
       42
       +
         };

     

       43
       43
       +
       

     

       44
       44
       +
         security.sudo.extraRules = [

     

       45
       45
       +
           {

     

       46
       46
       +
             users = [ "tangler" ];

     

       47
       47
       +
             commands = [

     

       48
       48
       +
               {

     

       49
       49
       +
                 command = "ALL";

     

       50
       50
       +
                 options = [ "NOPASSWD" ];

     

       51
       51
       +
               }

     

       52
       52
       +
             ];

     

       53
       53
       +
           }

     

       54
       54
       +
         ];

     

       55
       55
       +
       

     

       56
       56
       +
         system.stateVersion = "25.05";

     

       57
       57
       +
       }

+56

hosts/knot1/disk-config.nix

···

       1
       1
       +
       # Example to create a bios compatible gpt partition

     

       2
       2
       +
       { lib, ... }:

     

       3
       3
       +
       {

     

       4
       4
       +
         disko.devices = {

     

       5
       5
       +
           disk.disk1 = {

     

       6
       6
       +
             device = lib.mkDefault "/dev/vda";

     

       7
       7
       +
             type = "disk";

     

       8
       8
       +
             content = {

     

       9
       9
       +
               type = "gpt";

     

       10
       10
       +
               partitions = {

     

       11
       11
       +
                 boot = {

     

       12
       12
       +
                   name = "boot";

     

       13
       13
       +
                   size = "1M";

     

       14
       14
       +
                   type = "EF02";

     

       15
       15
       +
                 };

     

       16
       16
       +
                 esp = {

     

       17
       17
       +
                   name = "ESP";

     

       18
       18
       +
                   size = "500M";

     

       19
       19
       +
                   type = "EF00";

     

       20
       20
       +
                   content = {

     

       21
       21
       +
                     type = "filesystem";

     

       22
       22
       +
                     format = "vfat";

     

       23
       23
       +
                     mountpoint = "/boot";

     

       24
       24
       +
                   };

     

       25
       25
       +
                 };

     

       26
       26
       +
                 root = {

     

       27
       27
       +
                   name = "root";

     

       28
       28
       +
                   size = "100%";

     

       29
       29
       +
                   content = {

     

       30
       30
       +
                     type = "lvm_pv";

     

       31
       31
       +
                     vg = "pool";

     

       32
       32
       +
                   };

     

       33
       33
       +
                 };

     

       34
       34
       +
               };

     

       35
       35
       +
             };

     

       36
       36
       +
           };

     

       37
       37
       +
           lvm_vg = {

     

       38
       38
       +
             pool = {

     

       39
       39
       +
               type = "lvm_vg";

     

       40
       40
       +
               lvs = {

     

       41
       41
       +
                 root = {

     

       42
       42
       +
                   size = "100%FREE";

     

       43
       43
       +
                   content = {

     

       44
       44
       +
                     type = "filesystem";

     

       45
       45
       +
                     format = "ext4";

     

       46
       46
       +
                     mountpoint = "/";

     

       47
       47
       +
                     mountOptions = [

     

       48
       48
       +
                       "defaults"

     

       49
       49
       +
                     ];

     

       50
       50
       +
                   };

     

       51
       51
       +
                 };

     

       52
       52
       +
               };

     

       53
       53
       +
             };

     

       54
       54
       +
           };

     

       55
       55
       +
         };

     

       56
       56
       +
       }

+11

hosts/knot1/services/knot.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         services.tangled.knot = {

     

       3
       3
       +
           enable = true;

     

       4
       4
       +
           stateDir = "/home/git";

     

       5
       5
       +
           server = {

     

       6
       6
       +
             listenAddr = "127.0.0.1:5555";

     

       7
       7
       +
             owner = "did:plc:hwevmowznbiukdf6uk5dwrrq";

     

       8
       8
       +
             hostname = "knot1.alpha.tangled.sh";

     

       9
       9
       +
           };

     

       10
       10
       +
         };

     

       11
       11
       +
       }

+35

hosts/knot1/services/nginx.nix

···

       1
       1
       +
       {

     

       2
       2
       +
         services.nginx = {

     

       3
       3
       +
           enable = true;

     

       4
       4
       +
           virtualHosts = {

     

       5
       5
       +
             "knot1.alpha.tangled.sh" = {

     

       6
       6
       +
               forceSSL = true;

     

       7
       7
       +
               enableACME = true;

     

       8
       8
       +
               locations."/" = {

     

       9
       9
       +
                 proxyPass = "http://127.0.0.1:5555";

     

       10
       10
       +
       

     

       11
       11
       +
                 extraConfig = ''

     

       12
       12
       +
                   proxy_set_header X-Forwarded-For $remote_addr;

     

       13
       13
       +
                   proxy_set_header Host $host;

     

       14
       14
       +
                   proxy_set_header X-Real-IP $remote_addr;

     

       15
       15
       +
                   proxy_set_header X-Forwarded-Proto $scheme;

     

       16
       16
       +
                 '';

     

       17
       17
       +
               };

     

       18
       18
       +
               locations."/events" = {

     

       19
       19
       +
                 proxyPass = "http://127.0.0.1:5555";

     

       20
       20
       +
                 extraConfig = ''

     

       21
       21
       +
                   proxy_set_header X-Forwarded-For $remote_addr;

     

       22
       22
       +
                   proxy_set_header Host $host;

     

       23
       23
       +
                   proxy_set_header Upgrade $http_upgrade;

     

       24
       24
       +
                   proxy_set_header Connection "upgrade";

     

       25
       25
       +
                 '';

     

       26
       26
       +
               };

     

       27
       27
       +
             };

     

       28
       28
       +
           };

     

       29
       29
       +
         };

     

       30
       30
       +
         security.acme = {

     

       31
       31
       +
           acceptTerms = true;

     

       32
       32
       +
           defaults.email = "team@tangled.org";

     

       33
       33
       +
         };

     

       34
       34
       +
         networking.firewall.allowedTCPPorts = [ 80 443 ];

     

       35
       35
       +
       }