Config for prod cluster

18 files changed, 201 insertions, 15 deletions

diff --git a/cluster/prod/cluster.nix b/cluster/prod/cluster.nix
new file mode 100644
index 0000000..ab70c77
--- /dev/null
+++ b/cluster/prod/cluster.nix
@@ -0,0 +1,58 @@
+{ config, pkgs, ... } @ args:
+
+{
+  deuxfleurs.cluster_name = "prod";
+  deuxfleurs.cluster_nodes = [
+    {
+      hostname = "concombre";
+      publicKey = "VvXT0fPDfWsHxumZqVShpS33dJQAdpJ1E79ZbCBJP34=";
+      IP = "10.42.1.31";
+      endpoint = "82.66.112.151:33731";
+    }
+    {
+      hostname = "courgette";
+      publicKey = "goTkBJGmzrGDOAjUcdH9G0JekipqSMoaYQdB6IHnzi0=";
+      IP = "10.42.1.32";
+      endpoint = "82.66.112.151:33732";
+    }
+    {
+      hostname = "celeri";
+      publicKey = "oZDAb8LoLW87ktUHyFFec0VaIar97bqq47mGbdVqJ0U=";
+      IP = "10.42.1.33";
+      endpoint = "82.66.112.151:33733";
+    }
+  ];
+  deuxfleurs.admin_nodes = [
+    {
+      hostname = "hammerhead";
+      publicKey = "b5hF+GSTgg3oM6wnjL7jRbfyf1jtsWdVptPPbAh3Qic=";
+      IP = "10.42.0.1";
+      endpoint = "5.135.179.11:51349";
+    }
+    {
+      hostname = "robinson";
+      publicKey = "ETaZFil3mFXlJ0LaJZyWqJVLV2IZUF5PB/8M7WbQSTg=";
+      IP = "10.42.0.42";
+      endpoint = "77.141.67.109:33742";
+    }
+    {
+      hostname = "shiki";
+      publicKey = "QUiUNMk70TEQ75Ut7Uqikr5uGVSXmx8EGNkGM6tANlg=";
+      IP = "10.42.0.206";
+      endpoint = "37.187.118.206:51820";
+    }
+    {
+      hostname = "lindy";
+      publicKey = "wen9GnZy2iLT6RyHfn7ydS/wvdvow1XPmhZxIkrDbks=";
+      IP = "10.42.0.66";
+      endpoint = "82.66.112.151:33766";
+    }
+  ];
+  deuxfleurs.admin_accounts = {
+    lx = [
+      # Keys for accessing nodes from outside
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJpaBZdYxHqMxhv2RExAOa7nkKhPBOHupMP3mYaZ73w9 lx@lindy"
+      "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDIDdVbA9fEdqSr5UJ77NnoIqDTVp8ca5kHExhZYI4ecBExFJfonJllXMBN9KdC4ukxtY8Ug47PcMOfMaTBZQc+e+KpvDWpkBt15Xpem3RCxmMBES79sLL7LgtAdBXc5mNaCX8EOEVixWKdarjvxRyf6py6the51G5muaiMpoj5fae4ZpRGjhGTPefzc7y7zRWBUUZ8pYHW774BIaK6XT9gn3hyHV+Occjl/UODXvodktk55YtnuPi8adXTYEsHrVVz8AkFhx+cr0U/U8vtQnsTrZG+JmgQLqpXVs0RDw5bE1RefEbMuYNKxutYKUe3L+ZJtDe0M0MqOFI8a4F5TxP5 katchup@konata"
+    ];
+  };
+}
diff --git a/cluster/prod/node/celeri.nix b/cluster/prod/node/celeri.nix
new file mode 100644
index 0000000..09de302
--- /dev/null
+++ b/cluster/prod/node/celeri.nix
@@ -0,0 +1,33 @@
+# Configuration file local to this node
+
+{ config, pkgs, ... }:
+
+{
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.timeout = 20;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "celeri";
+
+  networking.interfaces.eno1.useDHCP = false;
+  networking.interfaces.eno1.ipv4.addresses = [
+    {
+      address = "192.168.1.33";
+      prefixLength = 24;
+    }
+  ];
+  networking.interfaces.eno1.ipv6.addresses = [
+    {
+      address = "2a01:e0a:c:a720::33";
+      prefixLength = 64;
+    }
+  ];
+
+  deuxfleurs.vpn_ip = "10.42.1.33";
+  deuxfleurs.vpn_listen_port = 33733;
+  deuxfleurs.is_raft_server = true;
+
+  # Enable netdata monitoring
+  services.netdata.enable = true;
+}
diff --git a/cluster/prod/node/celeri.site.nix b/cluster/prod/node/celeri.site.nix
new file mode 120000
index 0000000..04ee36c
--- /dev/null
+++ b/cluster/prod/node/celeri.site.nix
@@ -0,0 +1 @@
+../site/neptune.nix
\ No newline at end of file
diff --git a/cluster/prod/node/concombre.nix b/cluster/prod/node/concombre.nix
new file mode 100644
index 0000000..f06e387
--- /dev/null
+++ b/cluster/prod/node/concombre.nix
@@ -0,0 +1,33 @@
+# Configuration file local to this node
+
+{ config, pkgs, ... }:
+
+{
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.timeout = 20;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "concombre";
+
+  networking.interfaces.eno1.useDHCP = false;
+  networking.interfaces.eno1.ipv4.addresses = [
+    {
+      address = "192.168.1.31";
+      prefixLength = 24;
+    }
+  ];
+  networking.interfaces.eno1.ipv6.addresses = [
+    {
+      address = "2a01:e0a:c:a720::31";
+      prefixLength = 64;
+    }
+  ];
+
+  deuxfleurs.vpn_ip = "10.42.1.31";
+  deuxfleurs.vpn_listen_port = 33731;
+  deuxfleurs.is_raft_server = true;
+
+  # Enable netdata monitoring
+  services.netdata.enable = true;
+}
diff --git a/cluster/prod/node/concombre.site.nix b/cluster/prod/node/concombre.site.nix
new file mode 120000
index 0000000..04ee36c
--- /dev/null
+++ b/cluster/prod/node/concombre.site.nix
@@ -0,0 +1 @@
+../site/neptune.nix
\ No newline at end of file
diff --git a/cluster/prod/node/courgette.nix b/cluster/prod/node/courgette.nix
new file mode 100644
index 0000000..e540de1
--- /dev/null
+++ b/cluster/prod/node/courgette.nix
@@ -0,0 +1,33 @@
+# Configuration file local to this node
+
+{ config, pkgs, ... }:
+
+{
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.timeout = 20;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "courgette";
+
+  networking.interfaces.eno1.useDHCP = false;
+  networking.interfaces.eno1.ipv4.addresses = [
+    {
+      address = "192.168.1.32";
+      prefixLength = 24;
+    }
+  ];
+  networking.interfaces.eno1.ipv6.addresses = [
+    {
+      address = "2a01:e0a:c:a720::32";
+      prefixLength = 64;
+    }
+  ];
+
+  deuxfleurs.vpn_ip = "10.42.1.32";
+  deuxfleurs.vpn_listen_port = 33732;
+  deuxfleurs.is_raft_server = true;
+
+  # Enable netdata monitoring
+  services.netdata.enable = true;
+}
diff --git a/cluster/prod/node/courgette.site.nix b/cluster/prod/node/courgette.site.nix
new file mode 120000
index 0000000..04ee36c
--- /dev/null
+++ b/cluster/prod/node/courgette.site.nix
@@ -0,0 +1 @@
+../site/neptune.nix
\ No newline at end of file
diff --git a/cluster/prod/site/neptune.nix b/cluster/prod/site/neptune.nix
new file mode 100644
index 0000000..6987f31
--- /dev/null
+++ b/cluster/prod/site/neptune.nix
@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+
+{
+  networking.defaultGateway = {
+    address = "192.168.1.254";
+    interface = "eno1";
+  };
+
+  deuxfleurs.site_name = "neptune";
+}
diff --git a/cluster/prod/ssh_config b/cluster/prod/ssh_config
new file mode 100644
index 0000000..266d77f
--- /dev/null
+++ b/cluster/prod/ssh_config
@@ -0,0 +1,10 @@
+UserKnownHostsFile ./ssh_known_hosts
+
+Host concombre
+	HostName 10.42.1.31
+
+Host courgette
+	HostName 10.42.1.32
+
+Host celeri
+	HostName 10.42.1.33
diff --git a/cluster/staging/cluster.nix b/cluster/staging/cluster.nix
index 1292c8b..2b6cb6c 100644
--- a/cluster/staging/cluster.nix
+++ b/cluster/staging/cluster.nix
@@ -6,25 +6,25 @@
     {
       hostname = "spoutnik";
       publicKey = "fO8qZOZmnug84cA8nvfjl5MUqyWljP0BAz/4tHRZyEg=";
-      IP = "10.42.0.2";
+      IP = "10.42.2.2";
       endpoint = "77.141.67.109:42136";
     }
     { 
       hostname = "cariacou";
       publicKey = "qxrtfn2zRVnN52Y5NYumyU3/FcRMnh3kJ2C37JfrczA=";
-      IP = "10.42.0.21";
+      IP = "10.42.2.21";
       endpoint = "82.66.112.151:33721";
     }
     { 
       hostname = "carcajou";
       publicKey = "7Nm7pMmyS7Nts1MB+loyD8u84ODxHPTkDu+uqQR6yDk=";
-      IP = "10.42.0.22";
+      IP = "10.42.2.22";
       endpoint = "82.66.112.151:33722";
     }
     { 
       hostname = "caribou";
       publicKey = "g6ZED/wPn5MPfytJKwPI19808CXtEad0IJUkEAAzwyY=";
-      IP = "10.42.0.23";
+      IP = "10.42.2.23";
       endpoint = "82.66.112.151:33723";
     }
   ];
diff --git a/cluster/staging/node/carcajou.nix b/cluster/staging/node/carcajou.nix
index 9ef88ad..82cd8f9 100644
--- a/cluster/staging/node/carcajou.nix
+++ b/cluster/staging/node/carcajou.nix
@@ -24,7 +24,7 @@
     }
   ];
 
-  deuxfleurs.vpn_ip = "10.42.0.22";
+  deuxfleurs.vpn_ip = "10.42.2.22";
   deuxfleurs.vpn_listen_port = 33722;
   deuxfleurs.is_raft_server = true;
 
diff --git a/cluster/staging/node/cariacou.nix b/cluster/staging/node/cariacou.nix
index 7e999d3..d9dbc93 100644
--- a/cluster/staging/node/cariacou.nix
+++ b/cluster/staging/node/cariacou.nix
@@ -24,7 +24,7 @@
     }
   ];
 
-  deuxfleurs.vpn_ip = "10.42.0.21";
+  deuxfleurs.vpn_ip = "10.42.2.21";
   deuxfleurs.vpn_listen_port = 33721;
   deuxfleurs.is_raft_server = true;
 
diff --git a/cluster/staging/node/caribou.nix b/cluster/staging/node/caribou.nix
index 474f3d3..3be3cdc 100644
--- a/cluster/staging/node/caribou.nix
+++ b/cluster/staging/node/caribou.nix
@@ -24,7 +24,7 @@
     }
   ];
 
-  deuxfleurs.vpn_ip = "10.42.0.23";
+  deuxfleurs.vpn_ip = "10.42.2.23";
   deuxfleurs.vpn_listen_port = 33723;
   deuxfleurs.is_raft_server = true;
 
diff --git a/cluster/staging/node/spoutnik.nix b/cluster/staging/node/spoutnik.nix
index 1554de9..80ed5d7 100644
--- a/cluster/staging/node/spoutnik.nix
+++ b/cluster/staging/node/spoutnik.nix
@@ -21,7 +21,7 @@
   ];
 
   networking.wireguard.interfaces.wg0 = {
-    ips = [ "10.42.0.2/16" ];
+    ips = [ "10.42.2.2/16" ];
     listenPort = 42136;
   };
 
diff --git a/cluster/staging/ssh_config b/cluster/staging/ssh_config
index 74590ac..8fae8ab 100644
--- a/cluster/staging/ssh_config
+++ b/cluster/staging/ssh_config
@@ -1,13 +1,13 @@
 UserKnownHostsFile ./ssh_known_hosts
 
 Host caribou
-	HostName 10.42.0.23
+	HostName 10.42.2.23
 
 Host carcajou
-	HostName 10.42.0.22
+	HostName 10.42.2.22
 
 Host cariacou
-	HostName 10.42.0.21
+	HostName 10.42.2.21
 
 Host spoutnik
 	HostName 10.42.0.2
diff --git a/genpki.sh b/genpki.sh
index 0dd541e..d41d3b8 100755
--- a/genpki.sh
+++ b/genpki.sh
@@ -63,8 +63,8 @@ extendedKeyUsage = serverAuth, clientAuth
 subjectAltName = @alt_names
 
 [alt_names]
-DNS.1 = server.staging.$APP
-DNS.2 = client.staging.$APP
+DNS.1 = server.$CLUSTER.$APP
+DNS.2 = client.$CLUSTER.$APP
 DNS.3 = localhost
 DNS.4 = 127.0.0.1
 EOF
@@ -104,7 +104,7 @@ extendedKeyUsage = clientAuth
 subjectAltName = @alt_names
 
 [alt_names]
-DNS.1 = client.staging.$APP
+DNS.1 = client.$CLUSTER.$APP
 EOF
 	) \
 			-CA $APP-ca.crt -CAkey $APP-ca.key -CAcreateserial \
diff --git a/nix/deuxfleurs.nix b/nix/deuxfleurs.nix
index 9b8013c..54af8ff 100644
--- a/nix/deuxfleurs.nix
+++ b/nix/deuxfleurs.nix
@@ -79,7 +79,7 @@ in
     networking.wireguard.interfaces.wg0 = {
       ips = [ "${cfg.vpn_ip}/16" ];
       listenPort = cfg.vpn_listen_port;
-      privateKeyFile = "/root/wireguard-keys/private";
+      privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private";
       peers = map ({ publicKey, endpoint, IP, ... }: {
         publicKey = publicKey;
         allowedIPs = [ "${IP}/32" ];
diff --git a/ssh_known_hosts b/ssh_known_hosts
index 3959743..468ea66 100644
--- a/ssh_known_hosts
+++ b/ssh_known_hosts
@@ -2,3 +2,9 @@
 10.42.0.21 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILYIRbHPU1w1xWRpm2+u3QsXOKfMjv1EXrpYbHT+epds
 10.42.0.23 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICNRilSqrgqdZlLdhN2eOY5ZMbzqpeqAdIf6QuChhXU+
 10.42.0.2 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIORTjNdFaDbhto8kuMPB3hYkfnzdnceZVIELApUe5PPL
+10.42.1.33 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOuY1CvhxBP9BtKkTlmOUu6Hhy8OQTB3R8OCFXbHA/RA
+10.42.1.31 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL3N0QOFNGkCpVLuOHFdpnBaxIFH925KpdIHV/3F9+BR
+10.42.1.32 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPCXJeo6yeQeTN7D7OZwLd8zbyU1jWywlhQ29yyk7x+G
+192.168.1.22 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHXyY9yZdq/VYpg3K1plBzFvim41tWlu+Dmov3BNSm39
+192.168.1.21 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILYIRbHPU1w1xWRpm2+u3QsXOKfMjv1EXrpYbHT+epds
+192.168.1.23 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICNRilSqrgqdZlLdhN2eOY5ZMbzqpeqAdIf6QuChhXU+