hosts/schule: add host

flake.nix

@@ -108,6 +108,13 @@
           ./hosts/porter/configuration.nix
         ];
       };
+      schule = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          ./configuration/common
+          ./hosts/schule/configuration.nix
+        ];
+      };
       storage-2 = nixpkgs.lib.nixosSystem {
         system = "x86_64-linux";
         modules = [
@@ -136,8 +143,8 @@
     } // builtins.mapAttrs (name: host: {
       nixpkgs.system = host.config.nixpkgs.system;
       imports = host._module.args.modules;
+      deployment.allowLocalDeployment = builtins.any (n: n == name) [ "schule" "osmium" ];
     }) self.nixosConfigurations;
-
     packages.x86_64-linux = {
       inherit (pkgs)
         anycast_healthchecker

hosts/schule/configuration.nix

@@ -0,0 +1,127 @@
+{ config, pkgs, lib, ... }:
+
+{
+  imports =
+    [
+      ./hardware-configuration.nix
+    ];
+
+  boot.kernelParams = [ "console=ttyS0,115200n8" ];
+
+  boot.loader.grub.enable = true;
+  boot.loader.grub.version = 2;
+  boot.loader.grub.device = "/dev/vda";
+
+  boot.loader.grub.extraConfig = ''
+    serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
+    terminal_input serial
+    terminal_output serial
+  '';
+
+  networking.hostName = "schule";
+
+  networking.useDHCP = false;
+  networking.interfaces.ens18.useDHCP = false;
+  networking.interfaces.ens18.ipv4.addresses = [ { address = "192.168.10.37"; prefixLength = 24; } ];
+  networking.interfaces.ens19.ipv6.addresses = [ { address = "2001:638:904:ffcb::d"; prefixLength = 64; } ];
+  networking.defaultGateway6 = { address = "2001:638:904:ffcb::1"; interface = "ens19"; };
+  networking.defaultGateway = { address = "192.168.10.1"; interface = "ens18"; };
+  networking.nameservers = [ "141.24.40.3" "141.24.40.4" ];
+
+  users.users.lord.isNormalUser = true;
+
+  users.users.js.isNormalUser = true;
+
+  services.openssh.passwordAuthentication = lib.mkForce true;
+  services.openssh.challengeResponseAuthentication = lib.mkForce true;
+
+  services.ttyd = {
+    enable = true;
+    port = 8436;
+    enableIPv6 = true;
+    interface = "::1";
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 8436 ];
+
+  services.nginx = {
+    enable = true;
+
+    virtualHosts = {
+      "term.schule.clerie.de" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          basicAuthFile = "/var/src/secrets/nginx/htpasswd";
+          proxyPass = "http://[::1]:8436";
+          proxyWebsockets = true;
+        };
+      };
+
+      "term.v6.schule.clerie.de" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          basicAuthFile = "/var/src/secrets/nginx/htpasswd";
+          proxyPass = "http://[::1]:8436";
+          proxyWebsockets = true;
+        };
+      };
+
+      "ports.schule.clerie.de" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          return = ''200 "Some piece of infrastructure\n"'';
+          extraConfig = ''
+            types { } default_type "text/plain; charset=utf-8";
+          '';
+        };
+      };
+
+      "\"~^(?<requestedport>[0-9]{4,5})\.ports\.schule\.clerie\.de$\"" = {
+        forceSSL = true;
+        sslCertificate = "${config.security.acme.certs."ports.schule.clerie.de".directory}/fullchain.pem";
+        sslCertificateKey = "${config.security.acme.certs."ports.schule.clerie.de".directory}/key.pem";
+        locations."/" = {
+          basicAuthFile = "/var/src/secrets/nginx/htpasswd";
+          proxyPass = "http://127.0.0.1:$requestedport";
+          proxyWebsockets = true;
+        };
+      };
+
+      "ports.v6.schule.clerie.de" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          return = ''200 "Some piece of infrastructure\n"'';
+          extraConfig = ''
+            types { } default_type "text/plain; charset=utf-8";
+          '';
+        };
+      };
+
+      "\"~^(?<requestedport>[0-9]{4,5})\.ports\.v6\.schule\.clerie\.de$\"" = {
+        forceSSL = true;
+        sslCertificate = "${config.security.acme.certs."ports.v6.schule.clerie.de".directory}/fullchain.pem";
+        sslCertificateKey = "${config.security.acme.certs."ports.v6.schule.clerie.de".directory}/key.pem";
+        locations."/" = {
+          basicAuthFile = "/var/src/secrets/nginx/htpasswd";
+          proxyPass = "http://127.0.0.1:$requestedport";
+          proxyWebsockets = true;
+        };
+      };
+    };
+  };
+
+  services.mysql = {
+    enable = true;
+    package = pkgs.mariadb;
+  };
+
+  services.mongodb = {
+    enable = true;
+  };
+
+  system.stateVersion = "22.11";
+}

hosts/schule/hardware-configuration.nix

@@ -0,0 +1,32 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/f24fdef6-1ace-46a4-80cf-652edb285be6";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}