diff options
| -rw-r--r-- | microvms/lib/default.nix | 85 | ||||
| -rw-r--r-- | microvms/miniflux/default.nix | 60 |
2 files changed, 88 insertions, 57 deletions
diff --git a/microvms/lib/default.nix b/microvms/lib/default.nix new file mode 100644 index 0000000..bdcc07f --- /dev/null +++ b/microvms/lib/default.nix @@ -0,0 +1,85 @@ +{ lib, config, ... }: +{ + options.oxalab.vm.number = + with lib; + mkOption { + type = types.nullOr types.int; + default = null; + }; + + config = + let + vmMac = n: + assert n >= 0 && n <= 4294967295; + let + hex = lib.fixedWidthString 8 "0" (lib.toHexString n); + in + "02:00:" + + "${builtins.substring 0 2 hex}:" + + "${builtins.substring 2 2 hex}:" + + "${builtins.substring 4 2 hex}:" + + "${builtins.substring 6 2 hex}"; + in + { + sops.defaultSopsFile = ../${config.networking.hostName}/secrets.yaml; + sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + microvm = { + hypervisor = "cloud-hypervisor"; + vsock.cid = 3 + config.oxalab.vm.number; + interfaces = + [ + { + type = "tap"; + id = "uvm-${config.networking.hostName}"; + mac = vmMac config.oxalab.vm.number; + } + ]; + shares = [ + { + source = "/nix/store"; + mountPoint = "/nix/.ro-store"; + tag = "store"; + proto = "virtiofs"; + socket = "store.socket"; + } + ] + ++ + map + (dir: { + source = dir; + mountPoint = "/${dir}"; + tag = dir; + proto = "virtiofs"; + socket = "${dir}.socket"; + }) + [ + "etc" + "var" + "home" + ]; + }; + + networking.useNetworkd = true; + networking.firewall.enable = lib.mkForce false; # firewalling done by the host + + systemd.network = { + enable = true; + networks."11-host" = { + matchConfig.MACAddress = vmMac config.oxalab.vm.number; + networkConfig = { + Address = "10.99.99." + lib.toString (10 + config.oxalab.vm.number) + "/24"; + DHCP = "no"; + }; + routes = [ + { + Gateway = "10.99.99.1"; + Destination = "0.0.0.0/0"; + Metric = 1024; + } + ]; + }; + }; + }; + +} diff --git a/microvms/miniflux/default.nix b/microvms/miniflux/default.nix index d2f024f..89235c1 100644 --- a/microvms/miniflux/default.nix +++ b/microvms/miniflux/default.nix @@ -1,13 +1,11 @@ { config, lib, ... }: -let - mac = "02:00:00:00:00:04"; -in { imports = [ + ../lib ./miniflux.nix ]; - sops.defaultSopsFile = ./secrets.yaml; - sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; + + oxalab.vm.number = 4; sops.secrets = { "wg/0xa-proxy" = { @@ -16,62 +14,10 @@ in }; microvm = { - hypervisor = "cloud-hypervisor"; - vsock.cid = 3 + 4; mem = 1 * 1024; vcpu = 2; - interfaces = [ - { - type = "tap"; - id = "uvm-miniflux"; - mac = mac; - } - ]; - shares = [ - { - source = "/nix/store"; - mountPoint = "/nix/.ro-store"; - tag = "store"; - proto = "virtiofs"; - socket = "store.socket"; - } - ] - ++ - map - (dir: { - source = dir; - mountPoint = "/${dir}"; - tag = dir; - proto = "virtiofs"; - socket = "${dir}.socket"; - }) - [ - "etc" - "var" - "home" - ]; }; - networking.useNetworkd = true; - networking.firewall.enable = lib.mkForce false; # firewalling done by the host - - systemd.network = { - enable = true; - networks."11-host" = { - matchConfig.MACAddress = mac; - networkConfig = { - Address = "10.99.99.14/24"; - DHCP = "no"; - }; - routes = [ - { - Gateway = "10.99.99.1"; - Destination = "0.0.0.0/0"; - Metric = 1024; - } - ]; - }; - }; networking.hostName = "miniflux"; system.stateVersion = "24.11"; |