aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--cluster/prod/cluster.nix58
-rw-r--r--cluster/prod/node/celeri.nix33
l---------cluster/prod/node/celeri.site.nix1
-rw-r--r--cluster/prod/node/concombre.nix33
l---------cluster/prod/node/concombre.site.nix1
-rw-r--r--cluster/prod/node/courgette.nix33
l---------cluster/prod/node/courgette.site.nix1
-rw-r--r--cluster/prod/site/neptune.nix10
-rw-r--r--cluster/prod/ssh_config10
-rw-r--r--cluster/staging/cluster.nix8
-rw-r--r--cluster/staging/node/carcajou.nix2
-rw-r--r--cluster/staging/node/cariacou.nix2
-rw-r--r--cluster/staging/node/caribou.nix2
-rw-r--r--cluster/staging/node/spoutnik.nix2
-rw-r--r--cluster/staging/ssh_config6
-rwxr-xr-xgenpki.sh6
-rw-r--r--nix/deuxfleurs.nix2
-rw-r--r--ssh_known_hosts6
18 files changed, 201 insertions, 15 deletions
diff --git a/cluster/prod/cluster.nix b/cluster/prod/cluster.nix
new file mode 100644
index 0000000..ab70c77
--- /dev/null
+++ b/cluster/prod/cluster.nix
@@ -0,0 +1,58 @@
+{ config, pkgs, ... } @ args:
+
+{
+ deuxfleurs.cluster_name = "prod";
+ deuxfleurs.cluster_nodes = [
+ {
+ hostname = "concombre";
+ publicKey = "VvXT0fPDfWsHxumZqVShpS33dJQAdpJ1E79ZbCBJP34=";
+ IP = "10.42.1.31";
+ endpoint = "82.66.112.151:33731";
+ }
+ {
+ hostname = "courgette";
+ publicKey = "goTkBJGmzrGDOAjUcdH9G0JekipqSMoaYQdB6IHnzi0=";
+ IP = "10.42.1.32";
+ endpoint = "82.66.112.151:33732";
+ }
+ {
+ hostname = "celeri";
+ publicKey = "oZDAb8LoLW87ktUHyFFec0VaIar97bqq47mGbdVqJ0U=";
+ IP = "10.42.1.33";
+ endpoint = "82.66.112.151:33733";
+ }
+ ];
+ deuxfleurs.admin_nodes = [
+ {
+ hostname = "hammerhead";
+ publicKey = "b5hF+GSTgg3oM6wnjL7jRbfyf1jtsWdVptPPbAh3Qic=";
+ IP = "10.42.0.1";
+ endpoint = "5.135.179.11:51349";
+ }
+ {
+ hostname = "robinson";
+ publicKey = "ETaZFil3mFXlJ0LaJZyWqJVLV2IZUF5PB/8M7WbQSTg=";
+ IP = "10.42.0.42";
+ endpoint = "77.141.67.109:33742";
+ }
+ {
+ hostname = "shiki";
+ publicKey = "QUiUNMk70TEQ75Ut7Uqikr5uGVSXmx8EGNkGM6tANlg=";
+ IP = "10.42.0.206";
+ endpoint = "37.187.118.206:51820";
+ }
+ {
+ hostname = "lindy";
+ publicKey = "wen9GnZy2iLT6RyHfn7ydS/wvdvow1XPmhZxIkrDbks=";
+ IP = "10.42.0.66";
+ endpoint = "82.66.112.151:33766";
+ }
+ ];
+ deuxfleurs.admin_accounts = {
+ lx = [
+ # Keys for accessing nodes from outside
+ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJpaBZdYxHqMxhv2RExAOa7nkKhPBOHupMP3mYaZ73w9 lx@lindy"
+ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDIDdVbA9fEdqSr5UJ77NnoIqDTVp8ca5kHExhZYI4ecBExFJfonJllXMBN9KdC4ukxtY8Ug47PcMOfMaTBZQc+e+KpvDWpkBt15Xpem3RCxmMBES79sLL7LgtAdBXc5mNaCX8EOEVixWKdarjvxRyf6py6the51G5muaiMpoj5fae4ZpRGjhGTPefzc7y7zRWBUUZ8pYHW774BIaK6XT9gn3hyHV+Occjl/UODXvodktk55YtnuPi8adXTYEsHrVVz8AkFhx+cr0U/U8vtQnsTrZG+JmgQLqpXVs0RDw5bE1RefEbMuYNKxutYKUe3L+ZJtDe0M0MqOFI8a4F5TxP5 katchup@konata"
+ ];
+ };
+}
diff --git a/cluster/prod/node/celeri.nix b/cluster/prod/node/celeri.nix
new file mode 100644
index 0000000..09de302
--- /dev/null
+++ b/cluster/prod/node/celeri.nix
@@ -0,0 +1,33 @@
+# Configuration file local to this node
+
+{ config, pkgs, ... }:
+
+{
+ # Use the systemd-boot EFI boot loader.
+ boot.loader.systemd-boot.enable = true;
+ boot.loader.timeout = 20;
+ boot.loader.efi.canTouchEfiVariables = true;
+
+ networking.hostName = "celeri";
+
+ networking.interfaces.eno1.useDHCP = false;
+ networking.interfaces.eno1.ipv4.addresses = [
+ {
+ address = "192.168.1.33";
+ prefixLength = 24;
+ }
+ ];
+ networking.interfaces.eno1.ipv6.addresses = [
+ {
+ address = "2a01:e0a:c:a720::33";
+ prefixLength = 64;
+ }
+ ];
+
+ deuxfleurs.vpn_ip = "10.42.1.33";
+ deuxfleurs.vpn_listen_port = 33733;
+ deuxfleurs.is_raft_server = true;
+
+ # Enable netdata monitoring
+ services.netdata.enable = true;
+}
diff --git a/cluster/prod/node/celeri.site.nix b/cluster/prod/node/celeri.site.nix
new file mode 120000
index 0000000..04ee36c
--- /dev/null
+++ b/cluster/prod/node/celeri.site.nix
@@ -0,0 +1 @@
+../site/neptune.nix \ No newline at end of file
diff --git a/cluster/prod/node/concombre.nix b/cluster/prod/node/concombre.nix
new file mode 100644
index 0000000..f06e387
--- /dev/null
+++ b/cluster/prod/node/concombre.nix
@@ -0,0 +1,33 @@
+# Configuration file local to this node
+
+{ config, pkgs, ... }:
+
+{
+ # Use the systemd-boot EFI boot loader.
+ boot.loader.systemd-boot.enable = true;
+ boot.loader.timeout = 20;
+ boot.loader.efi.canTouchEfiVariables = true;
+
+ networking.hostName = "concombre";
+
+ networking.interfaces.eno1.useDHCP = false;
+ networking.interfaces.eno1.ipv4.addresses = [
+ {
+ address = "192.168.1.31";
+ prefixLength = 24;
+ }
+ ];
+ networking.interfaces.eno1.ipv6.addresses = [
+ {
+ address = "2a01:e0a:c:a720::31";
+ prefixLength = 64;
+ }
+ ];
+
+ deuxfleurs.vpn_ip = "10.42.1.31";
+ deuxfleurs.vpn_listen_port = 33731;
+ deuxfleurs.is_raft_server = true;
+
+ # Enable netdata monitoring
+ services.netdata.enable = true;
+}
diff --git a/cluster/prod/node/concombre.site.nix b/cluster/prod/node/concombre.site.nix
new file mode 120000
index 0000000..04ee36c
--- /dev/null
+++ b/cluster/prod/node/concombre.site.nix
@@ -0,0 +1 @@
+../site/neptune.nix \ No newline at end of file
diff --git a/cluster/prod/node/courgette.nix b/cluster/prod/node/courgette.nix
new file mode 100644
index 0000000..e540de1
--- /dev/null
+++ b/cluster/prod/node/courgette.nix
@@ -0,0 +1,33 @@
+# Configuration file local to this node
+
+{ config, pkgs, ... }:
+
+{
+ # Use the systemd-boot EFI boot loader.
+ boot.loader.systemd-boot.enable = true;
+ boot.loader.timeout = 20;
+ boot.loader.efi.canTouchEfiVariables = true;
+
+ networking.hostName = "courgette";
+
+ networking.interfaces.eno1.useDHCP = false;
+ networking.interfaces.eno1.ipv4.addresses = [
+ {
+ address = "192.168.1.32";
+ prefixLength = 24;
+ }
+ ];
+ networking.interfaces.eno1.ipv6.addresses = [
+ {
+ address = "2a01:e0a:c:a720::32";
+ prefixLength = 64;
+ }
+ ];
+
+ deuxfleurs.vpn_ip = "10.42.1.32";
+ deuxfleurs.vpn_listen_port = 33732;
+ deuxfleurs.is_raft_server = true;
+
+ # Enable netdata monitoring
+ services.netdata.enable = true;
+}
diff --git a/cluster/prod/node/courgette.site.nix b/cluster/prod/node/courgette.site.nix
new file mode 120000
index 0000000..04ee36c
--- /dev/null
+++ b/cluster/prod/node/courgette.site.nix
@@ -0,0 +1 @@
+../site/neptune.nix \ No newline at end of file
diff --git a/cluster/prod/site/neptune.nix b/cluster/prod/site/neptune.nix
new file mode 100644
index 0000000..6987f31
--- /dev/null
+++ b/cluster/prod/site/neptune.nix
@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+
+{
+ networking.defaultGateway = {
+ address = "192.168.1.254";
+ interface = "eno1";
+ };
+
+ deuxfleurs.site_name = "neptune";
+}
diff --git a/cluster/prod/ssh_config b/cluster/prod/ssh_config
new file mode 100644
index 0000000..266d77f
--- /dev/null
+++ b/cluster/prod/ssh_config
@@ -0,0 +1,10 @@
+UserKnownHostsFile ./ssh_known_hosts
+
+Host concombre
+ HostName 10.42.1.31
+
+Host courgette
+ HostName 10.42.1.32
+
+Host celeri
+ HostName 10.42.1.33
diff --git a/cluster/staging/cluster.nix b/cluster/staging/cluster.nix
index 1292c8b..2b6cb6c 100644
--- a/cluster/staging/cluster.nix
+++ b/cluster/staging/cluster.nix
@@ -6,25 +6,25 @@
{
hostname = "spoutnik";
publicKey = "fO8qZOZmnug84cA8nvfjl5MUqyWljP0BAz/4tHRZyEg=";
- IP = "10.42.0.2";
+ IP = "10.42.2.2";
endpoint = "77.141.67.109:42136";
}
{
hostname = "cariacou";
publicKey = "qxrtfn2zRVnN52Y5NYumyU3/FcRMnh3kJ2C37JfrczA=";
- IP = "10.42.0.21";
+ IP = "10.42.2.21";
endpoint = "82.66.112.151:33721";
}
{
hostname = "carcajou";
publicKey = "7Nm7pMmyS7Nts1MB+loyD8u84ODxHPTkDu+uqQR6yDk=";
- IP = "10.42.0.22";
+ IP = "10.42.2.22";
endpoint = "82.66.112.151:33722";
}
{
hostname = "caribou";
publicKey = "g6ZED/wPn5MPfytJKwPI19808CXtEad0IJUkEAAzwyY=";
- IP = "10.42.0.23";
+ IP = "10.42.2.23";
endpoint = "82.66.112.151:33723";
}
];
diff --git a/cluster/staging/node/carcajou.nix b/cluster/staging/node/carcajou.nix
index 9ef88ad..82cd8f9 100644
--- a/cluster/staging/node/carcajou.nix
+++ b/cluster/staging/node/carcajou.nix
@@ -24,7 +24,7 @@
}
];
- deuxfleurs.vpn_ip = "10.42.0.22";
+ deuxfleurs.vpn_ip = "10.42.2.22";
deuxfleurs.vpn_listen_port = 33722;
deuxfleurs.is_raft_server = true;
diff --git a/cluster/staging/node/cariacou.nix b/cluster/staging/node/cariacou.nix
index 7e999d3..d9dbc93 100644
--- a/cluster/staging/node/cariacou.nix
+++ b/cluster/staging/node/cariacou.nix
@@ -24,7 +24,7 @@
}
];
- deuxfleurs.vpn_ip = "10.42.0.21";
+ deuxfleurs.vpn_ip = "10.42.2.21";
deuxfleurs.vpn_listen_port = 33721;
deuxfleurs.is_raft_server = true;
diff --git a/cluster/staging/node/caribou.nix b/cluster/staging/node/caribou.nix
index 474f3d3..3be3cdc 100644
--- a/cluster/staging/node/caribou.nix
+++ b/cluster/staging/node/caribou.nix
@@ -24,7 +24,7 @@
}
];
- deuxfleurs.vpn_ip = "10.42.0.23";
+ deuxfleurs.vpn_ip = "10.42.2.23";
deuxfleurs.vpn_listen_port = 33723;
deuxfleurs.is_raft_server = true;
diff --git a/cluster/staging/node/spoutnik.nix b/cluster/staging/node/spoutnik.nix
index 1554de9..80ed5d7 100644
--- a/cluster/staging/node/spoutnik.nix
+++ b/cluster/staging/node/spoutnik.nix
@@ -21,7 +21,7 @@
];
networking.wireguard.interfaces.wg0 = {
- ips = [ "10.42.0.2/16" ];
+ ips = [ "10.42.2.2/16" ];
listenPort = 42136;
};
diff --git a/cluster/staging/ssh_config b/cluster/staging/ssh_config
index 74590ac..8fae8ab 100644
--- a/cluster/staging/ssh_config
+++ b/cluster/staging/ssh_config
@@ -1,13 +1,13 @@
UserKnownHostsFile ./ssh_known_hosts
Host caribou
- HostName 10.42.0.23
+ HostName 10.42.2.23
Host carcajou
- HostName 10.42.0.22
+ HostName 10.42.2.22
Host cariacou
- HostName 10.42.0.21
+ HostName 10.42.2.21
Host spoutnik
HostName 10.42.0.2
diff --git a/genpki.sh b/genpki.sh
index 0dd541e..d41d3b8 100755
--- a/genpki.sh
+++ b/genpki.sh
@@ -63,8 +63,8 @@ extendedKeyUsage = serverAuth, clientAuth
subjectAltName = @alt_names
[alt_names]
-DNS.1 = server.staging.$APP
-DNS.2 = client.staging.$APP
+DNS.1 = server.$CLUSTER.$APP
+DNS.2 = client.$CLUSTER.$APP
DNS.3 = localhost
DNS.4 = 127.0.0.1
EOF
@@ -104,7 +104,7 @@ extendedKeyUsage = clientAuth
subjectAltName = @alt_names
[alt_names]
-DNS.1 = client.staging.$APP
+DNS.1 = client.$CLUSTER.$APP
EOF
) \
-CA $APP-ca.crt -CAkey $APP-ca.key -CAcreateserial \
diff --git a/nix/deuxfleurs.nix b/nix/deuxfleurs.nix
index 9b8013c..54af8ff 100644
--- a/nix/deuxfleurs.nix
+++ b/nix/deuxfleurs.nix
@@ -79,7 +79,7 @@ in
networking.wireguard.interfaces.wg0 = {
ips = [ "${cfg.vpn_ip}/16" ];
listenPort = cfg.vpn_listen_port;
- privateKeyFile = "/root/wireguard-keys/private";
+ privateKeyFile = "/var/lib/deuxfleurs/wireguard-keys/private";
peers = map ({ publicKey, endpoint, IP, ... }: {
publicKey = publicKey;
allowedIPs = [ "${IP}/32" ];
diff --git a/ssh_known_hosts b/ssh_known_hosts
index 3959743..468ea66 100644
--- a/ssh_known_hosts
+++ b/ssh_known_hosts
@@ -2,3 +2,9 @@
10.42.0.21 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILYIRbHPU1w1xWRpm2+u3QsXOKfMjv1EXrpYbHT+epds
10.42.0.23 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICNRilSqrgqdZlLdhN2eOY5ZMbzqpeqAdIf6QuChhXU+
10.42.0.2 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIORTjNdFaDbhto8kuMPB3hYkfnzdnceZVIELApUe5PPL
+10.42.1.33 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOuY1CvhxBP9BtKkTlmOUu6Hhy8OQTB3R8OCFXbHA/RA
+10.42.1.31 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL3N0QOFNGkCpVLuOHFdpnBaxIFH925KpdIHV/3F9+BR
+10.42.1.32 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPCXJeo6yeQeTN7D7OZwLd8zbyU1jWywlhQ29yyk7x+G
+192.168.1.22 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHXyY9yZdq/VYpg3K1plBzFvim41tWlu+Dmov3BNSm39
+192.168.1.21 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILYIRbHPU1w1xWRpm2+u3QsXOKfMjv1EXrpYbHT+epds
+192.168.1.23 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICNRilSqrgqdZlLdhN2eOY5ZMbzqpeqAdIf6QuChhXU+
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-16 16:35:59 +0000