remove obsolete infra
This commit is contained in:
parent
cd63ec45b8
commit
c1e09364bb
22 changed files with 0 additions and 1012 deletions
|
|
@ -1,64 +0,0 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.efiSupport = true;
|
||||
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
||||
|
||||
zramSwap = { enable = true; algorithm = "zstd"; };
|
||||
|
||||
networking = {
|
||||
hostName = "cirrus"; # Define your hostname.
|
||||
};
|
||||
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
networks."uplink" = {
|
||||
matchConfig = { Name = "enp1s0"; };
|
||||
networkConfig = {
|
||||
Address = "95.216.166.21/32";
|
||||
DNS = "9.9.9.9";
|
||||
};
|
||||
routes = [
|
||||
{
|
||||
routeConfig = {
|
||||
Gateway = "172.31.1.1";
|
||||
GatewayOnLink = true;
|
||||
Destination = "0.0.0.0/0";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
# Set your time zone.
|
||||
time.timeZone = "Europe/Amsterdam";
|
||||
|
||||
# Select internationalisation properties.
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
# Open ports in the firewall.
|
||||
networking.firewall.enable = true;
|
||||
# networking.firewall.allowedUDPPorts = [ ... ];
|
||||
# Or disable the firewall altogether.
|
||||
|
||||
# Copy the NixOS configuration file and link it from the resulting system
|
||||
# (/run/current-system/configuration.nix). This is useful in case you
|
||||
# accidentally delete configuration.nix.
|
||||
# system.copySystemConfiguration = true;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "22.05"; # Did you read the comment?
|
||||
|
||||
}
|
||||
|
||||
|
|
@ -1,9 +0,0 @@
|
|||
{
|
||||
imports = [
|
||||
./configuration.nix
|
||||
./hardware-configuration.nix
|
||||
./nextcloud-proxy.nix
|
||||
./secrets.nix
|
||||
./wireguard-server.nix
|
||||
];
|
||||
}
|
||||
|
|
@ -1,39 +0,0 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
(modulesPath + "/profiles/qemu-guest.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "ahci" "xhci_pci" "virtio_pci" "sd_mod" "sr_mod" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/627952eb-107a-43c3-8223-bfea9af92837";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/5CA6-CCE4";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault false;
|
||||
networking.interfaces.enp1s0.useDHCP = lib.mkDefault false;
|
||||
|
||||
hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
|
@ -1,46 +0,0 @@
|
|||
{ pkgs, config, ... }: {
|
||||
services.nginx = {
|
||||
# reverse-proxy irc traffic on 7000
|
||||
streamConfig = ''
|
||||
upstream soju {
|
||||
server 127.0.0.1:6667;
|
||||
}
|
||||
|
||||
server {
|
||||
listen 7000 ssl;
|
||||
listen [::]:7000 ssl;
|
||||
|
||||
ssl_certificate /var/lib/acme/mrbouncy.oxapentane.com/fullchain.pem;
|
||||
ssl_certificate_key /var/lib/acme/mrbouncy.oxapentane.com/key.pem;
|
||||
ssl_trusted_certificate /var/lib/acme/mrbouncy.oxapentane.com/chain.pem;
|
||||
|
||||
proxy_pass soju;
|
||||
}
|
||||
'';
|
||||
# just here to get the cert for irc reverse proxy
|
||||
virtualHosts = {
|
||||
"mrbouncy.oxapentane.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
locations = {
|
||||
"/" = {
|
||||
# no content for now, here just for no-boilerplate cert
|
||||
return = "204";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.soju = {
|
||||
hostName = "mrbouncy.oxapentane.com";
|
||||
listen = [ "irc+insecure://127.0.0.1:6667" ];
|
||||
enable = true;
|
||||
enableMessageLogging = true;
|
||||
acceptProxyIP = [ "localhost" ];
|
||||
};
|
||||
|
||||
environment.systemPackages = [ pkgs.soju ]; # expose soju mgmt commands
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 7000 ];
|
||||
}
|
||||
|
|
@ -1,64 +0,0 @@
|
|||
{ config, pkgs, ... }: {
|
||||
security.acme = {
|
||||
defaults.email = "acme@oxapentane.com";
|
||||
acceptTerms = true;
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedProxySettings = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
|
||||
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
|
||||
};
|
||||
|
||||
services.nginx.virtualHosts = {
|
||||
"nc.oxapentane.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 512M;
|
||||
'';
|
||||
locations = {
|
||||
"/" = {
|
||||
proxyPass = "http://10.34.45.100:8080";
|
||||
};
|
||||
"/well-known/carddav" = {
|
||||
return = "301 $scheme://$host/remote.php/dav";
|
||||
};
|
||||
"/well-known/caldav" = {
|
||||
return = "301 $scheme://$host/remote.php/dav";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
"music.oxapentane.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 32M;
|
||||
'';
|
||||
locations = {
|
||||
"/" = {
|
||||
proxyPass = "http://10.34.45.101:4533";
|
||||
};
|
||||
};
|
||||
};
|
||||
"news.oxapentane.com" = {
|
||||
enableACME = true;
|
||||
forceSSL = true;
|
||||
extraConfig = ''
|
||||
client_max_body_size 32M;
|
||||
'';
|
||||
locations = {
|
||||
"/" = {
|
||||
proxyPass = "http://10.34.45.102:8080";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
{ config, ... }:
|
||||
{
|
||||
sops.defaultSopsFile = ../../secrets/cirrus/secrets.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
|
||||
sops.secrets = {
|
||||
"wg/oxalab-seckey" = {
|
||||
owner = config.users.users.systemd-network.name;
|
||||
};
|
||||
"wg/oxaproxy-seckey" = {
|
||||
owner = config.users.users.systemd-network.name;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,123 +0,0 @@
|
|||
{ config, ... }:
|
||||
{
|
||||
networking.firewall = {
|
||||
allowedUDPPorts = [
|
||||
# wireguards
|
||||
51820
|
||||
51821
|
||||
34197
|
||||
];
|
||||
allowedTCPPorts = [
|
||||
# port forward ssh to music
|
||||
2020
|
||||
];
|
||||
# port-forward ssh to the music machine
|
||||
extraCommands = ''
|
||||
iptables -t nat -I PREROUTING -p tcp --dport 2020 -j DNAT --to-destination 10.34.45.101:22
|
||||
iptables -t nat -I PREROUTING -p udp --dport 34197 -j DNAT --to-destination 10.34.45.111:34197
|
||||
iptables ! -o lo -t nat -A POSTROUTING -j MASQUERADE
|
||||
'';
|
||||
extraStopCommands = ''
|
||||
iptables -t nat -D PREROUTING -p tcp --dport 2020 -j DNAT --to-destination 10.34.45.101:22 || true
|
||||
iptables -t nat -D PREROUTING -p udp --dport 34197 -j DNAT --to-destination 10.34.45.111:34197 || true
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
networking.wireguard.enable = true;
|
||||
|
||||
systemd.network = {
|
||||
# oxalab
|
||||
netdevs."oxalab" = {
|
||||
netdevConfig = {
|
||||
Kind = "wireguard";
|
||||
Name = "oxalab";
|
||||
Description = "oxa's enterprise network";
|
||||
};
|
||||
wireguardConfig = {
|
||||
PrivateKeyFile = config.sops.secrets."wg/oxalab-seckey".path;
|
||||
ListenPort = 51820;
|
||||
# own pubkey: 5nCVC21BL+1r70OGwA4Q6Z/gcPLC3+ZF8sTurdn7N0E=
|
||||
};
|
||||
wireguardPeers = [
|
||||
{
|
||||
# microwave
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "0zpfcNrmbsNwwbnDDX4SMl4BVTB0zuhGKixT9TJQoHc=";
|
||||
AllowedIPs = [ "10.66.66.10/32" ];
|
||||
PersistentKeepalive = 25;
|
||||
};
|
||||
}
|
||||
{
|
||||
# Dishwasher
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "AdWUBbyeRkxdP9HUu25PpISoxbgQ8oeCw3BmV93xtAw=";
|
||||
AllowedIPs = [ "10.66.66.100/32" ];
|
||||
PersistentKeepalive = 25;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
networks."oxalab" = {
|
||||
matchConfig.Name = "oxalab";
|
||||
networkConfig = {
|
||||
Address = "10.66.66.1/24";
|
||||
IPForward = "ipv4";
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
# oxaproxy
|
||||
netdevs."oxaproxy" = {
|
||||
netdevConfig = {
|
||||
Kind = "wireguard";
|
||||
Name = "oxaproxy";
|
||||
Description = "oxa's enterprise reverse-proxy network";
|
||||
};
|
||||
wireguardConfig = {
|
||||
PrivateKeyFile = config.sops.secrets."wg/oxaproxy-seckey".path;
|
||||
#own pubkey 0KMtL2fQOrrCH6c2a2l4FKiM73G86sUuyaNj4FarzVM=
|
||||
ListenPort = 51821;
|
||||
};
|
||||
wireguardPeers = [
|
||||
# nextcloud
|
||||
{
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "KCYoGx7TGei4X79EZo2NONCcmQjPzBUN1Ds6I9lQbz0=";
|
||||
AllowedIPs = [ "10.34.45.100/32" ];
|
||||
PersistentKeepalive = 25;
|
||||
};
|
||||
}
|
||||
# music
|
||||
{
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "vQNkp51S9qLsu97dLPj0/EqFwvVtRFZpMHufgKhxum0=";
|
||||
AllowedIPs = [ "10.34.45.101/32" ];
|
||||
PersistentKeepalive = 25;
|
||||
};
|
||||
}
|
||||
# news
|
||||
{
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "guzNmsPcQw4EGSLU3X0SP+WPKAcoMc+xv9SLWdHV1V0=";
|
||||
AllowedIPs = [ "10.34.45.102/32" ];
|
||||
PersistentKeepalive = 25;
|
||||
};
|
||||
}
|
||||
{
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "6rwSThPEfTyYvMVSnHNcNPRntCHEQFyscF2SodI8A34=";
|
||||
AllowedIPs = [ "10.34.45.111/32" ];
|
||||
PersistentKeepalive = 25;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
networks."oxaproxy" = {
|
||||
matchConfig.Name = "oxaproxy";
|
||||
networkConfig = {
|
||||
Address = "10.34.45.1/24";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,88 +0,0 @@
|
|||
# Edit this configuration file to define what should be installed on
|
||||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
# Include the results of the hardware scan.
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
# Use the systemd-boot EFI boot loader.
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = true;
|
||||
|
||||
networking = {
|
||||
hostName = "dishwasher"; # Define your hostname.
|
||||
useNetworkd = true;
|
||||
firewall.enable = true;
|
||||
};
|
||||
|
||||
time.timeZone = "Europe/Amsterdam";
|
||||
|
||||
# fix wait-online target
|
||||
systemd.services.systemd-networkd-wait-online.serviceConfig.ExecStart = [
|
||||
"" # clear old command
|
||||
"${config.systemd.package}/lib/systemd/systemd-networkd-wait-online --any"
|
||||
];
|
||||
|
||||
systemd.network = {
|
||||
|
||||
enable = true;
|
||||
|
||||
networks."ether" = {
|
||||
matchConfig = {
|
||||
Name = "enp53s0";
|
||||
};
|
||||
networkConfig = {
|
||||
DHCP = "yes";
|
||||
LinkLocalAddressing = "ipv6";
|
||||
IPv6AcceptRA = "yes";
|
||||
};
|
||||
dhcpV6Config = {
|
||||
WithoutRA = "solicit";
|
||||
};
|
||||
ipv6AcceptRAConfig = {
|
||||
DHCPv6Client = "yes";
|
||||
};
|
||||
};
|
||||
networks."aer" = {
|
||||
matchConfig.Name = "wlan0";
|
||||
networkConfig = {
|
||||
DHCP = "yes";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.resolved = {
|
||||
enable = true;
|
||||
fallbackDns = [
|
||||
"8.8.8.8"
|
||||
"2001:4860:4860::8844"
|
||||
];
|
||||
};
|
||||
|
||||
|
||||
i18n = {
|
||||
defaultLocale = "en_US.UTF-8";
|
||||
supportedLocales = [ "all" ];
|
||||
};
|
||||
|
||||
# Copy the NixOS configuration file and link it from the resulting system
|
||||
# (/run/current-system/configuration.nix). This is useful in case you
|
||||
# accidentally delete configuration.nix.
|
||||
# system.copySystemConfiguration = true;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "22.05"; # Did you read the comment?
|
||||
|
||||
}
|
||||
|
||||
|
|
@ -1,10 +0,0 @@
|
|||
{
|
||||
imports = [
|
||||
./configuration.nix
|
||||
./hardware-configuration.nix
|
||||
./secrets.nix
|
||||
./oxalab.nix
|
||||
./mcvm-network.nix
|
||||
./microvms.nix
|
||||
];
|
||||
}
|
||||
|
|
@ -1,112 +0,0 @@
|
|||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "xhci_pci" "thunderbolt" "nvme" "usb_storage" "sd_mod" "rtsx_pci_sdmmc" "r8169" ];
|
||||
boot.initrd.kernelModules = [ "r8169" ];
|
||||
boot.kernelModules = [ "kvm-intel" "r8169" ];
|
||||
boot.extraModulePackages = [ ];
|
||||
|
||||
fileSystems."/" =
|
||||
{
|
||||
device = "rpool/nixos";
|
||||
fsType = "zfs";
|
||||
options = [ "zfsutil" ];
|
||||
};
|
||||
|
||||
fileSystems."/nix" =
|
||||
{
|
||||
device = "rpool/nixos/nix";
|
||||
fsType = "zfs";
|
||||
options = [ "zfsutil" ];
|
||||
};
|
||||
|
||||
fileSystems."/home" =
|
||||
{
|
||||
device = "rpool/userdata/home";
|
||||
fsType = "zfs";
|
||||
options = [ "zfsutil" ];
|
||||
};
|
||||
|
||||
fileSystems."/var/lib" =
|
||||
{
|
||||
device = "rpool/userdata/var-lib";
|
||||
fsType = "zfs";
|
||||
options = [ "zfsutil" ];
|
||||
};
|
||||
|
||||
fileSystems."/boot" =
|
||||
{
|
||||
device = "/dev/disk/by-uuid/A8AA-1CC4";
|
||||
fsType = "vfat";
|
||||
options = [ "X-mount.mkdir" ];
|
||||
};
|
||||
|
||||
swapDevices =
|
||||
[{
|
||||
device = "/dev/disk/by-partuuid/f9712640-96a5-46e1-b07d-53b0cba19057";
|
||||
randomEncryption = true;
|
||||
}];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault true;
|
||||
networking.interfaces.enp53s0.useDHCP = lib.mkDefault true;
|
||||
networking.interfaces.wlan0.useDHCP = lib.mkDefault true;
|
||||
|
||||
# hostId for zfs
|
||||
networking.hostId = "7da4f1e6";
|
||||
|
||||
# extra zfs settings
|
||||
boot = {
|
||||
loader = {
|
||||
efi.canTouchEfiVariables = true;
|
||||
systemd-boot.enable = true;
|
||||
};
|
||||
supportedFilesystems = [ "zfs" ];
|
||||
kernelPackages = pkgs.zfs.latestCompatibleLinuxPackages;
|
||||
kernelParams = [ "nohibernate" ];
|
||||
zfs.devNodes = "/dev/";
|
||||
plymouth.enable = false;
|
||||
tmp.useTmpfs = true;
|
||||
};
|
||||
|
||||
# remote unlock
|
||||
boot.initrd.network = {
|
||||
enable = true;
|
||||
ssh = {
|
||||
enable = true;
|
||||
port = 2222;
|
||||
hostKeys = [ "/etc/initrd-ssh/key" ];
|
||||
authorizedKeys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDP6xE2ey0C8XXfvniiiHiqXsCC277jKI9RXEA+s2LQLUI5zl7v350i3Oa8H3NCcPj39lfMreqE6ncxcOhqYyzahPrrMkOqgbPAoRvq8H3ophLK+56O3xdHoKwLBwRD1yoGACjqG4UTiTrmnN2ateENgYcnTEY1e4vDw1qMj1drUXCsZ/6mkBBmHJiFfCaR4yCMt1r4gGi/dAC7ifnBP3oSyV/lJEwPxYYkGlbOBIvX/7Ar98pJS6xYPB3jHs9gwyNNON63d0fNYrwBojXPPCnGGaRZNOkBTzex3zZYp12ThINQ2xl8tRp9D8qpZ7vrLjhTD6AXkOBRzmDj+NsCeEaeTuWajqUM93iKncYUI+JxR1t7q8gA2pBMFzLesMXnx7R+5Kw7QDtSJM7a4GMIfsocPwf64BH6rzxEz68rXFE3P+J77PPM9CuaYw90JXHo3z220zYw2nMQ/1qjATVZw/hiVrLmQMVfmFJIufnGjTBs2sy3IoNyzvYm/oDeNNg1cdSV9gyyRKZhK08fxjXN5GSf9vZkfZa9tHtqaZ99HI40GQBHUVx1K2/NQJY8TVTSA+v16SFnJK8BIbmp/WFCuvDcMkgLIbqiYtDASe7P2mKIib86uOENT+P820egeLiTQ06kFw/gfUa8t69d5qEcjiQZ+lxCeYIs/E9KrEXHvRUWew== cardno:16 811 34" ];
|
||||
};
|
||||
};
|
||||
|
||||
services.zfs = {
|
||||
trim.enable = true;
|
||||
autoScrub = {
|
||||
enable = true;
|
||||
pools = [ "rpool" ];
|
||||
};
|
||||
autoSnapshot.enable = true;
|
||||
};
|
||||
|
||||
# update the microcode
|
||||
hardware.cpu.intel.updateMicrocode = true;
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
hardware.enableAllFirmware = true;
|
||||
|
||||
services.logind.lidSwitch = "ignore";
|
||||
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
|
||||
}
|
||||
|
|
@ -1,55 +0,0 @@
|
|||
{ ... }:
|
||||
{
|
||||
systemd.network = {
|
||||
netdevs."microvm-bridge".netdevConfig = {
|
||||
Kind = "bridge";
|
||||
Name = "microvm-bridge";
|
||||
};
|
||||
|
||||
networks."0-microvm-bridge" = {
|
||||
matchConfig.Name = "microvm-bridge";
|
||||
networkConfig = {
|
||||
DHCPServer = false;
|
||||
IPv6SendRA = true;
|
||||
};
|
||||
addresses = [
|
||||
{
|
||||
addressConfig.Address = "10.99.99.1/24";
|
||||
}
|
||||
{
|
||||
addressConfig.Address = "fd12:3456:789a::1/64";
|
||||
}
|
||||
];
|
||||
ipv6Prefixes = [{
|
||||
ipv6PrefixConfig.Prefix = "fd12:3456:789a::/64";
|
||||
}];
|
||||
# networkConfig = {
|
||||
# Address = "10.99.99.1/24";
|
||||
# IPForward = "ipv4";
|
||||
# };
|
||||
# routes = [{
|
||||
# routeConfig = {
|
||||
# GatewayOnLink = true;
|
||||
# };}];
|
||||
# IPForward = "ipv4";
|
||||
# DHCPServer = true;
|
||||
# IPv6SendRA = true;
|
||||
# addresses = [{
|
||||
# addressConfig.Address = "10.99.99.1/24";
|
||||
# }];
|
||||
};
|
||||
|
||||
networks."1-microvm-bridge" = {
|
||||
matchConfig.Name = "vm-*";
|
||||
networkConfig.Bridge = "microvm-bridge";
|
||||
};
|
||||
};
|
||||
|
||||
networking.nat = {
|
||||
enable = true;
|
||||
enableIPv6 = true;
|
||||
externalInterface = "enp53s0";
|
||||
internalInterfaces = [ "microvm-bridge" ];
|
||||
};
|
||||
|
||||
}
|
||||
|
|
@ -1,16 +0,0 @@
|
|||
{ inputs, ... }: {
|
||||
microvm.vms = {
|
||||
nextcloud = {
|
||||
flake = inputs.self;
|
||||
updateFlake = "github:oxapentane/nix-config/master";
|
||||
};
|
||||
music = {
|
||||
flake = inputs.self;
|
||||
updateFlake = "github:oxapentane/nix-config/master";
|
||||
};
|
||||
news = {
|
||||
flake = inputs.self;
|
||||
updateFlake = "github:oxapentane/nix-config/master";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,33 +0,0 @@
|
|||
{ config, ... }:
|
||||
{
|
||||
networking.wireguard.enable = true;
|
||||
systemd.network = {
|
||||
netdevs."oxalab" = {
|
||||
netdevConfig = {
|
||||
Kind = "wireguard";
|
||||
Name = "oxalab";
|
||||
Description = "oxa's enterprise network";
|
||||
};
|
||||
wireguardConfig = {
|
||||
PrivateKeyFile = config.sops.secrets."wg/oxalab-seckey".path;
|
||||
};
|
||||
wireguardPeers = [
|
||||
{
|
||||
# cirrus
|
||||
wireguardPeerConfig = {
|
||||
PublicKey = "5nCVC21BL+1r70OGwA4Q6Z/gcPLC3+ZF8sTurdn7N0E=";
|
||||
AllowedIPs = [ "10.66.66.0/24" ];
|
||||
Endpoint = [ "95.216.166.21:51820" ];
|
||||
PersistentKeepalive = 25;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
networks."oxalab" = {
|
||||
matchConfig.Name = "oxalab";
|
||||
networkConfig = {
|
||||
Address = "10.66.66.100/24";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,11 +0,0 @@
|
|||
{ config, ... }:
|
||||
{
|
||||
sops.defaultSopsFile = ../../secrets/dishwasher/secrets.yaml;
|
||||
sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
|
||||
sops.secrets = {
|
||||
"wg/oxalab-seckey" = {
|
||||
owner = config.users.users.systemd-network.name;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,55 +0,0 @@
|
|||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
# Use the GRUB 2 boot loader.
|
||||
boot.loader.grub.enable = true;
|
||||
boot.loader.grub.efiSupport = true;
|
||||
boot.loader.grub.device = "/dev/sda"; # or "nodev" for efi only
|
||||
|
||||
zramSwap = { enable = true; algorithm = "zstd"; };
|
||||
|
||||
networking = {
|
||||
hostName = "noctilucent"; # Define your hostname.
|
||||
};
|
||||
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
networks."uplink" = {
|
||||
matchConfig = { Name = "enp1s0"; };
|
||||
networkConfig = {
|
||||
Address = "91.107.193.99/32";
|
||||
DNS = "9.9.9.9";
|
||||
};
|
||||
routes = [
|
||||
{
|
||||
routeConfig = {
|
||||
Gateway = "172.31.1.1";
|
||||
GatewayOnLink = true;
|
||||
Destination = "0.0.0.0/0";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
time.timeZone = "Europe/Amsterdam";
|
||||
|
||||
i18n.defaultLocale = "en_US.UTF-8";
|
||||
|
||||
networking.firewall.enable = true;
|
||||
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
# on your system were taken. It‘s perfectly fine and recommended to leave
|
||||
# this value at the release version of the first install of this system.
|
||||
# Before changing this value read the documentation for this option
|
||||
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
||||
system.stateVersion = "23.05"; # Did you read the comment?
|
||||
|
||||
}
|
||||
|
||||
|
|
@ -1,25 +0,0 @@
|
|||
{ modulesPath, lib, ... }:
|
||||
{
|
||||
imports = [ (modulesPath + "/profiles/qemu-guest.nix") ];
|
||||
boot.loader.grub.device = "/dev/sda";
|
||||
boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
|
||||
boot.initrd.kernelModules = [ "nvme" ];
|
||||
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/e9356185-9812-4873-8822-13c8aef59948";
|
||||
fsType = "ext4";
|
||||
};
|
||||
fileSystems."/boot" = {
|
||||
device = "dev/disk/by-uuid/6F78-D438";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
# still possible to use this option, but it's recommended to use it in conjunction
|
||||
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
|
||||
networking.useDHCP = lib.mkDefault false;
|
||||
networking.interfaces.enp1s0.useDHCP = lib.mkDefault false;
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue