From d2013a50d43c2f9d1d134aeb0594ecf4c0d69971 Mon Sep 17 00:00:00 2001 From: xinyangli Date: Tue, 16 Apr 2024 16:48:56 +0800 Subject: [PATCH] dolomite: bandwagon support --- .sops.yaml | 7 +++++ machines/dolomite/bandwagon.nix | 38 ++++++++++++++++++++++++++++ machines/dolomite/default.nix | 14 +++++++--- machines/dolomite/lightsail.nix | 13 ++++++++++ machines/dolomite/secrets/la-00.yaml | 31 +++++++++++++++++++++++ 5 files changed, 99 insertions(+), 4 deletions(-) create mode 100644 machines/dolomite/bandwagon.nix create mode 100644 machines/dolomite/lightsail.nix create mode 100644 machines/dolomite/secrets/la-00.yaml diff --git a/.sops.yaml b/.sops.yaml index dac73f2..4c42092 100644 --- a/.sops.yaml +++ b/.sops.yaml @@ -4,6 +4,7 @@ keys: - &host-raspite age1nugzw24upk8pz5lyz2z89qk8se4gpcsg3ypcs58nykncr56sevrsm8qpvj - &host-sgp-00 age13s6rwd3wjk2x5wkn69tdczhl3l5d7mfmlv90efsv4q67jne43qss9tcakx - &host-tok-00 age1t5nw2jx4dw67jkf72uxcxt72j7lq3xyj35lvl09f8kala90h2g2s2a5yvj + - &host-la-00 age1fw2sqaa5s9c8ml6ncsexkj8ar4288387ju92ytjys4awf9aw6smqqz94dh - &host-massicot age1jle2auermhswqtehww9gqada8car5aczrx43ztzqf9wtcld0sfmqzaecta creation_rules: - path_regex: machines/calcite/secrets.yaml @@ -31,6 +32,11 @@ creation_rules: - age: - *xin - *host-tok-00 + - path_regex: machines/dolomite/secrets/la-00.yaml + key_groups: + - age: + - *xin + - *host-la-00 - path_regex: machines/secrets.yaml key_groups: - age: @@ -39,6 +45,7 @@ creation_rules: - *host-raspite - *host-sgp-00 - *host-tok-00 + - *host-la-00 - *host-massicot - path_regex: home/xin/secrets.yaml key_groups: diff --git a/machines/dolomite/bandwagon.nix b/machines/dolomite/bandwagon.nix new file mode 100644 index 0000000..853f8d8 --- /dev/null +++ b/machines/dolomite/bandwagon.nix @@ -0,0 +1,38 @@ +{ config, lib, pkgs, modulesPath, ... }: +let + cfg = config.isBandwagon; +in +{ + imports = [ (modulesPath + "/profiles/qemu-guest.nix") ]; + + + options = { + isBandwagon = lib.mkEnableOption "Bandwagon instance"; + }; + + config = lib.mkIf cfg.isBandwagon { + boot.initrd.availableKernelModules = [ "ata_piix" "xhci_pci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-label/NIXROOT"; + fsType = "xfs"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-label/NIXBOOT"; + fsType = "vfat"; + }; + + swapDevices = [ ]; + + boot.loader.grub.enable = lib.mkForce true; + boot.loader.grub.version = lib.mkForce 2; + boot.loader.grub.device = lib.mkForce "/dev/sda"; + networking.useDHCP = false; + networking.interfaces.ens18.useDHCP = true; + networking.interfaces.ens19.useDHCP = true; + }; +} diff --git a/machines/dolomite/default.nix b/machines/dolomite/default.nix index 1599db5..15f7e2e 100644 --- a/machines/dolomite/default.nix +++ b/machines/dolomite/default.nix @@ -1,12 +1,19 @@ { inputs, config, pkgs, lib, modulesPath, ... }: +let + awsHosts = [ "sgp-00" "tok-00 "]; + bwgHosts = [ "la-00" ]; +in { imports = [ ../sops.nix - "${modulesPath}/virtualisation/amazon-image.nix" + ./bandwagon.nix + ./lightsail.nix ]; config = { + isBandwagon = builtins.elem config.networking.hostName bwgHosts; + isLightsail = builtins.elem config.networking.hostName awsHosts; sops = { secrets = { wg_private_key = { @@ -19,7 +26,6 @@ }; }; }; - boot.loader.grub.device = lib.mkForce "/dev/nvme0n1"; boot.kernel.sysctl = { "net.core.default_qdisc" = "fq"; "net.ipv4.tcp_congestion_control" = "bbr"; @@ -39,9 +45,9 @@ custom.prometheus = { enable = false; - exporters.enable = true; + exporters.enable = false; grafana = { - enable = true; + enable = false; password_file = config.sops.secrets.grafana_cloud_api.path; }; }; diff --git a/machines/dolomite/lightsail.nix b/machines/dolomite/lightsail.nix new file mode 100644 index 0000000..187c6ff --- /dev/null +++ b/machines/dolomite/lightsail.nix @@ -0,0 +1,13 @@ +{ config, lib, pkgs, modulesPath, ... }: +let + cfg = config.isLightsail; +in +{ + imports = [ "${modulesPath}/virtualisation/amazon-image.nix" ]; + options = { + isLightsail = lib.mkEnableOption "Lightsail instance"; + }; + config = lib.mkIf cfg.isLightsail{ + boot.loader.grub.device = lib.mkForce "/dev/nvme0n1"; + }; +} diff --git a/machines/dolomite/secrets/la-00.yaml b/machines/dolomite/secrets/la-00.yaml new file mode 100644 index 0000000..266dae5 --- /dev/null +++ b/machines/dolomite/secrets/la-00.yaml @@ -0,0 +1,31 @@ +wg_private_key: ENC[AES256_GCM,data:jz/03kP/dj625Jweu0MEw9aGm3Z3M1f43cZqGy2eElCIDhD78n+zZAqOM8c=,iv:fZxuvZLx97YyDoafQXbqVYjqRYzZq90PJiri9vdjwro=,tag:0A9sGnSl3y3gpEuvsdRtGg==,type:str] +wg_ipv6_local_addr: ENC[AES256_GCM,data:W/uR+9kAKdXViAbZ0vEhC2eNwlzqX0x+LpzLrLCmQuVgRbZAtJCqfeE=,iv:pMZumU7fMV5MYX59hO7SEMLlG4m8DdPXeAiNgLxNzZk=,tag:xdGBpOBdWlc8Q9BDMv04sA==,type:str] +sops: + kms: [] + gcp_kms: [] + azure_kv: [] + hc_vault: [] + age: + - recipient: age1uw059wcwfvd9xuj0hpqzqpeg7qemecspjrsatg37wc7rs2pumfdsgken0c + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4WjRVY3BKdVU1WERrVzla + L1NNYWp2SFZEaW84b0h1clFGRHVmRDhnM3o0CkUrZjZKNHp2TGtrTXpyOHNVckJw + VURjOEVaR3VQU1pJY2NaOFBQRjVIdWcKLS0tIFBQRWRnNnk4aWxsQVhhdUdVWWpy + aG9Oa3lOY0JjY2tFU3ZTazcyZW5SM0kKRfTrM65aI5LMOHoGsls3PWChrY5pEz91 + EERpRd552+PxYBKvumI59mtdlD263d5kmlTxIIZXTOJ2fcl1bii2bg== + -----END AGE ENCRYPTED FILE----- + - recipient: age1fw2sqaa5s9c8ml6ncsexkj8ar4288387ju92ytjys4awf9aw6smqqz94dh + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTdzk4ajV5ekNpZXNGTHdD + aVBLZDlSbzE1aG5LT0cvVVVlVDBNOWtackNVCjVnZDhYZmFoT21DZHNYT2pMVDF6 + ZW5UY1ZFRFdtbDdPZHZIWUVuWjhJMk0KLS0tIGR4UUYwcjJtZUFYYlJSS2d6Q3hZ + WVJYSWhOaTEvNUdYTXV6OThPenJaY0UKv3WK6gacUxO6PFklkW+jDMG5FgIUuEvN + RvvI9ZXRD4QwKW1mpVrxbC+fRqlKawyyyyikvHFGJvpts4/88IcgUQ== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2024-04-15T11:37:57Z" + mac: ENC[AES256_GCM,data:iCgvJMijsUjdBT9hMQx4owYkbp2nV1jORB5HGtz5IPHgI9A5FXAAPFtaSGgQSI3twSkYMU94NULjumCyyWt3syH5KK9itHgHwONyVFieyXLiWozqpN2Z0SA5G4SnK3E6X273br9gwNAj33I2MdS/3K8b4EOO2yEzilWmrW7f3rk=,iv:UD7uHrtq4O6+EsWFrjegTXHtQUFcnhKsu4J0e0srDtk=,tag:b0eJEeUJPwi4+rDPeBY7oA==,type:str] + pgp: [] + unencrypted_suffix: _unencrypted + version: 3.8.1