From 2e9da82d941197c51653355281afeca0f25ec970 Mon Sep 17 00:00:00 2001 From: clerie Date: Fri, 9 Dec 2022 23:24:09 +0100 Subject: [PATCH] hosts/schule: add host --- flake.nix | 9 +- hosts/schule/configuration.nix | 127 ++++++++++++++++++++++++ hosts/schule/hardware-configuration.nix | 32 ++++++ 3 files changed, 167 insertions(+), 1 deletion(-) create mode 100644 hosts/schule/configuration.nix create mode 100644 hosts/schule/hardware-configuration.nix diff --git a/flake.nix b/flake.nix index 8988593..d1605b0 100644 --- a/flake.nix +++ b/flake.nix @@ -108,6 +108,13 @@ ./hosts/porter/configuration.nix ]; }; + schule = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + modules = [ + ./configuration/common + ./hosts/schule/configuration.nix + ]; + }; storage-2 = nixpkgs.lib.nixosSystem { system = "x86_64-linux"; modules = [ @@ -136,8 +143,8 @@ } // builtins.mapAttrs (name: host: { nixpkgs.system = host.config.nixpkgs.system; imports = host._module.args.modules; + deployment.allowLocalDeployment = builtins.any (n: n == name) [ "schule" "osmium" ]; }) self.nixosConfigurations; - packages.x86_64-linux = { inherit (pkgs) anycast_healthchecker diff --git a/hosts/schule/configuration.nix b/hosts/schule/configuration.nix new file mode 100644 index 0000000..3b7bee3 --- /dev/null +++ b/hosts/schule/configuration.nix @@ -0,0 +1,127 @@ +{ config, pkgs, lib, ... }: + +{ + imports = + [ + ./hardware-configuration.nix + ]; + + boot.kernelParams = [ "console=ttyS0,115200n8" ]; + + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + boot.loader.grub.device = "/dev/vda"; + + boot.loader.grub.extraConfig = '' + serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1 + terminal_input serial + terminal_output serial + ''; + + networking.hostName = "schule"; + + networking.useDHCP = false; + networking.interfaces.ens18.useDHCP = false; + networking.interfaces.ens18.ipv4.addresses = [ { address = "192.168.10.37"; prefixLength = 24; } ]; + networking.interfaces.ens19.ipv6.addresses = [ { address = "2001:638:904:ffcb::d"; prefixLength = 64; } ]; + networking.defaultGateway6 = { address = "2001:638:904:ffcb::1"; interface = "ens19"; }; + networking.defaultGateway = { address = "192.168.10.1"; interface = "ens18"; }; + networking.nameservers = [ "141.24.40.3" "141.24.40.4" ]; + + users.users.lord.isNormalUser = true; + + users.users.js.isNormalUser = true; + + services.openssh.passwordAuthentication = lib.mkForce true; + services.openssh.challengeResponseAuthentication = lib.mkForce true; + + services.ttyd = { + enable = true; + port = 8436; + enableIPv6 = true; + interface = "::1"; + }; + + networking.firewall.allowedTCPPorts = [ 80 443 8436 ]; + + services.nginx = { + enable = true; + + virtualHosts = { + "term.schule.clerie.de" = { + enableACME = true; + forceSSL = true; + locations."/" = { + basicAuthFile = "/var/src/secrets/nginx/htpasswd"; + proxyPass = "http://[::1]:8436"; + proxyWebsockets = true; + }; + }; + + "term.v6.schule.clerie.de" = { + enableACME = true; + forceSSL = true; + locations."/" = { + basicAuthFile = "/var/src/secrets/nginx/htpasswd"; + proxyPass = "http://[::1]:8436"; + proxyWebsockets = true; + }; + }; + + "ports.schule.clerie.de" = { + enableACME = true; + forceSSL = true; + locations."/" = { + return = ''200 "Some piece of infrastructure\n"''; + extraConfig = '' + types { } default_type "text/plain; charset=utf-8"; + ''; + }; + }; + + "\"~^(?[0-9]{4,5})\.ports\.schule\.clerie\.de$\"" = { + forceSSL = true; + sslCertificate = "${config.security.acme.certs."ports.schule.clerie.de".directory}/fullchain.pem"; + sslCertificateKey = "${config.security.acme.certs."ports.schule.clerie.de".directory}/key.pem"; + locations."/" = { + basicAuthFile = "/var/src/secrets/nginx/htpasswd"; + proxyPass = "http://127.0.0.1:$requestedport"; + proxyWebsockets = true; + }; + }; + + "ports.v6.schule.clerie.de" = { + enableACME = true; + forceSSL = true; + locations."/" = { + return = ''200 "Some piece of infrastructure\n"''; + extraConfig = '' + types { } default_type "text/plain; charset=utf-8"; + ''; + }; + }; + + "\"~^(?[0-9]{4,5})\.ports\.v6\.schule\.clerie\.de$\"" = { + forceSSL = true; + sslCertificate = "${config.security.acme.certs."ports.v6.schule.clerie.de".directory}/fullchain.pem"; + sslCertificateKey = "${config.security.acme.certs."ports.v6.schule.clerie.de".directory}/key.pem"; + locations."/" = { + basicAuthFile = "/var/src/secrets/nginx/htpasswd"; + proxyPass = "http://127.0.0.1:$requestedport"; + proxyWebsockets = true; + }; + }; + }; + }; + + services.mysql = { + enable = true; + package = pkgs.mariadb; + }; + + services.mongodb = { + enable = true; + }; + + system.stateVersion = "22.11"; +} diff --git a/hosts/schule/hardware-configuration.nix b/hosts/schule/hardware-configuration.nix new file mode 100644 index 0000000..78ce7ce --- /dev/null +++ b/hosts/schule/hardware-configuration.nix @@ -0,0 +1,32 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/f24fdef6-1ace-46a4-80cf-652edb285be6"; + fsType = "ext4"; + }; + + swapDevices = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.ens18.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +}