From fdb5210f88a751e2aea9d519520897f8574f533e Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Mon, 28 Mar 2022 12:18:52 +0200 Subject: Move configuration.nix to nix/ subfolder --- configuration.nix | 116 -------------------------------------------------- deploy.sh | 2 +- nix/configuration.nix | 116 ++++++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 117 insertions(+), 117 deletions(-) delete mode 100644 configuration.nix create mode 100644 nix/configuration.nix diff --git a/configuration.nix b/configuration.nix deleted file mode 100644 index 7e32a8d..0000000 --- a/configuration.nix +++ /dev/null @@ -1,116 +0,0 @@ -# Edit this configuration file to define what should be installed on -# your system. Help is available in the configuration.nix(5) man page -# and in the NixOS manual (accessible by running ‘nixos-help’). - -{ config, pkgs, ... } @ args: - -# Configuration local for this cluster node (hostname, IP, etc) -{ - imports = - [ # Include the results of the hardware scan. - ./hardware-configuration.nix - # Include generic Deuxfleurs module - ./deuxfleurs.nix - # Configuration for this deployment (a cluster) - ./cluster.nix - # Configuration local for this Deuxfleurs site (set of nodes) - ./site.nix - # Configuration local for this cluster node (hostname, IP, etc) - ./node.nix - ]; - - # The global useDHCP flag is deprecated, therefore explicitly set to false here. - # Per-interface useDHCP will be mandatory in the future, so this generated config - # replicates the default behaviour. - networking.useDHCP = false; - - # Set your time zone. - time.timeZone = "Europe/Paris"; - - # Select internationalisation properties. - # i18n.defaultLocale = "en_US.UTF-8"; - console = { - font = "sun12x22"; - keyMap = "fr"; - }; - - boot.kernel.sysctl = { - "vm.max_map_count" = 262144; - }; - - services.journald.extraConfig = '' -SystemMaxUse=1G - ''; - - # List packages installed in system profile. To search, run: - # $ nix search wget - environment.systemPackages = with pkgs; [ - nmap - bind - inetutils - pciutils - vim - tmux - ncdu - iotop - jnettop - nethogs - wget - htop - smartmontools - links - git - rclone - docker - docker-compose - ]; - - programs.vim.defaultEditor = true; - - # Enable network time - services.ntp.enable = true; - - # Enable the OpenSSH daemon and disable password login. - services.openssh.enable = true; - services.openssh.passwordAuthentication = false; - - # ---- CONFIG FOR DEUXFLEURS CLUSTER ---- - - # Open ports in the firewall. - networking.firewall = { - enable = true; - - # Allow anyone to connect on SSH port - allowedTCPPorts = [ - (builtins.head ({ openssh.ports = [22]; } // config.services).openssh.ports) - ]; - - # Allow specific hosts access to specific things in the cluster - extraCommands = '' - # Allow everything from router (usefull for UPnP/IGD) - iptables -A INPUT -s 192.168.1.254 -j ACCEPT - - # Allow docker containers to access all ports - iptables -A INPUT -s 172.17.0.0/16 -j ACCEPT - - # Allow other nodes on VPN to access all ports - iptables -A INPUT -s 10.42.0.0/16 -j ACCEPT - ''; - - # When stopping firewall, delete all rules that were configured manually above - extraStopCommands = '' - iptables -D INPUT -s 192.168.1.254 -j ACCEPT - iptables -D INPUT -s 172.17.0.0/16 -j ACCEPT - iptables -D INPUT -s 10.42.0.0/16 -j ACCEPT - ''; - }; - - # This value determines the NixOS release from which the default - # settings for stateful data, like file locations and database versions - # on your system were taken. It‘s perfectly fine and recommended to leave - # this value at the release version of the first install of this system. - # Before changing this value read the documentation for this option - # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). - system.stateVersion = "21.05"; # Did you read the comment? -} - diff --git a/deploy.sh b/deploy.sh index 74949b8..d1fb417 100755 --- a/deploy.sh +++ b/deploy.sh @@ -38,7 +38,7 @@ for NIXHOST in $NIXHOSTLIST; do echo "Sending NixOS config files" ssh -F $SSH_CONFIG $SSH_DEST mkdir -p $TMP_PATH $TMP_PATH/pki - cat configuration.nix | ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/configuration.nix > /dev/null + cat nix/configuration.nix | ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/configuration.nix > /dev/null cat nix/deuxfleurs.nix | ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/deuxfleurs.nix > /dev/null cat nix/remote-unlock.nix | ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/remote-unlock.nix > /dev/null cat cluster/$CLUSTER/cluster.nix | ssh -F $SSH_CONFIG $SSH_DEST tee $TMP_PATH/cluster.nix > /dev/null diff --git a/nix/configuration.nix b/nix/configuration.nix new file mode 100644 index 0000000..7e32a8d --- /dev/null +++ b/nix/configuration.nix @@ -0,0 +1,116 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ config, pkgs, ... } @ args: + +# Configuration local for this cluster node (hostname, IP, etc) +{ + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + # Include generic Deuxfleurs module + ./deuxfleurs.nix + # Configuration for this deployment (a cluster) + ./cluster.nix + # Configuration local for this Deuxfleurs site (set of nodes) + ./site.nix + # Configuration local for this cluster node (hostname, IP, etc) + ./node.nix + ]; + + # The global useDHCP flag is deprecated, therefore explicitly set to false here. + # Per-interface useDHCP will be mandatory in the future, so this generated config + # replicates the default behaviour. + networking.useDHCP = false; + + # Set your time zone. + time.timeZone = "Europe/Paris"; + + # Select internationalisation properties. + # i18n.defaultLocale = "en_US.UTF-8"; + console = { + font = "sun12x22"; + keyMap = "fr"; + }; + + boot.kernel.sysctl = { + "vm.max_map_count" = 262144; + }; + + services.journald.extraConfig = '' +SystemMaxUse=1G + ''; + + # List packages installed in system profile. To search, run: + # $ nix search wget + environment.systemPackages = with pkgs; [ + nmap + bind + inetutils + pciutils + vim + tmux + ncdu + iotop + jnettop + nethogs + wget + htop + smartmontools + links + git + rclone + docker + docker-compose + ]; + + programs.vim.defaultEditor = true; + + # Enable network time + services.ntp.enable = true; + + # Enable the OpenSSH daemon and disable password login. + services.openssh.enable = true; + services.openssh.passwordAuthentication = false; + + # ---- CONFIG FOR DEUXFLEURS CLUSTER ---- + + # Open ports in the firewall. + networking.firewall = { + enable = true; + + # Allow anyone to connect on SSH port + allowedTCPPorts = [ + (builtins.head ({ openssh.ports = [22]; } // config.services).openssh.ports) + ]; + + # Allow specific hosts access to specific things in the cluster + extraCommands = '' + # Allow everything from router (usefull for UPnP/IGD) + iptables -A INPUT -s 192.168.1.254 -j ACCEPT + + # Allow docker containers to access all ports + iptables -A INPUT -s 172.17.0.0/16 -j ACCEPT + + # Allow other nodes on VPN to access all ports + iptables -A INPUT -s 10.42.0.0/16 -j ACCEPT + ''; + + # When stopping firewall, delete all rules that were configured manually above + extraStopCommands = '' + iptables -D INPUT -s 192.168.1.254 -j ACCEPT + iptables -D INPUT -s 172.17.0.0/16 -j ACCEPT + iptables -D INPUT -s 10.42.0.0/16 -j ACCEPT + ''; + }; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "21.05"; # Did you read the comment? +} + -- cgit v1.2.3