From a0db30ca26ee0ca8c8efbabd76ba584331b5337c Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Fri, 24 Mar 2023 12:58:44 +0100 Subject: Sanitize DNS configuration - get rid of outside nameserver, unbound does the recursive resolving itself (and it checks DNSSEC) - remove CAP_NET_BIND_SERVICE for Consul as it is no longer binding on port 53 (was already obsolete) - make unbound config independant of LAN IPv4 address --- cluster/staging/site/bespin.nix | 1 - cluster/staging/site/corrin.nix | 1 - cluster/staging/site/jupiter.nix | 1 - cluster/staging/site/neptune.nix | 1 - 4 files changed, 4 deletions(-) (limited to 'cluster/staging') diff --git a/cluster/staging/site/bespin.nix b/cluster/staging/site/bespin.nix index 9401f74..1133603 100644 --- a/cluster/staging/site/bespin.nix +++ b/cluster/staging/site/bespin.nix @@ -6,7 +6,6 @@ deuxfleurs.ipv6_default_gateway = "2a02:a03f:6510:5102::1"; deuxfleurs.lan_ip_prefix_length = 24; deuxfleurs.ipv6_prefix_length = 64; - deuxfleurs.nameservers = [ "192.168.5.254" ]; deuxfleurs.cname_target = "bespin.site.staging.deuxfleurs.org."; networking.firewall.allowedTCPPorts = [ 80 443 ]; diff --git a/cluster/staging/site/corrin.nix b/cluster/staging/site/corrin.nix index ca2ae49..8bf8693 100644 --- a/cluster/staging/site/corrin.nix +++ b/cluster/staging/site/corrin.nix @@ -6,7 +6,6 @@ deuxfleurs.ipv6_default_gateway = "fe80::7ec1:77ff:fe3e:bb90"; deuxfleurs.lan_ip_prefix_length = 24; deuxfleurs.ipv6_prefix_length = 64; - deuxfleurs.nameservers = [ "192.168.1.1" ]; deuxfleurs.cname_target = "corrin.site.staging.deuxfleurs.org."; deuxfleurs.public_ipv4 = "82.120.233.78"; diff --git a/cluster/staging/site/jupiter.nix b/cluster/staging/site/jupiter.nix index 31b9f47..291e582 100644 --- a/cluster/staging/site/jupiter.nix +++ b/cluster/staging/site/jupiter.nix @@ -6,7 +6,6 @@ deuxfleurs.ipv6_default_gateway = "fe80::9038:202a:73a0:e73b"; deuxfleurs.lan_ip_prefix_length = 24; deuxfleurs.ipv6_prefix_length = 64; - deuxfleurs.nameservers = [ "192.168.1.1" ]; deuxfleurs.cname_target = "jupiter.site.staging.deuxfleurs.org."; # no public ipv4 is used for the staging cluster on Jupiter diff --git a/cluster/staging/site/neptune.nix b/cluster/staging/site/neptune.nix index 5399826..b030b46 100644 --- a/cluster/staging/site/neptune.nix +++ b/cluster/staging/site/neptune.nix @@ -6,7 +6,6 @@ deuxfleurs.ipv6_default_gateway = "2001:910:1204:1::1"; deuxfleurs.lan_ip_prefix_length = 24; deuxfleurs.ipv6_prefix_length = 64; - deuxfleurs.nameservers = [ "192.168.1.1" ]; deuxfleurs.cname_target = "neptune.site.staging.deuxfleurs.org."; # no public ipv4 is used for the staging cluster on Neptune, -- cgit v1.2.3 From e2aea648cf2e6c8b11d53d6149f9e9d161da6d3e Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Fri, 24 Mar 2023 14:32:39 +0100 Subject: greatly simplify ipv4 and ipv6 configuration --- cluster/staging/known_hosts | 1 + cluster/staging/node/carcajou.nix | 8 ++++++-- cluster/staging/node/caribou.nix | 2 -- cluster/staging/node/df-pw5.nix | 5 +++-- cluster/staging/node/origan.nix | 3 +-- cluster/staging/node/piranha.nix | 3 +-- cluster/staging/site/bespin.nix | 5 +---- cluster/staging/site/corrin.nix | 5 +---- cluster/staging/site/jupiter.nix | 5 +---- cluster/staging/site/neptune.nix | 4 ---- 10 files changed, 15 insertions(+), 26 deletions(-) (limited to 'cluster/staging') diff --git a/cluster/staging/known_hosts b/cluster/staging/known_hosts index 0cb04f2..d721c27 100644 --- a/cluster/staging/known_hosts +++ b/cluster/staging/known_hosts @@ -9,3 +9,4 @@ piranha.polyno.me,2a01:cb05:8984:3c00:223:24ff:feb0:ea82 ssh-ed25519 AAAAC3NzaC1 2a01:e0a:5e4:1d0:223:24ff:feaf:fdec ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAsZas74RT6lCZwuUOPR23nPdbSdpWORyAmRgjoiMVHK df-pw5.machine.deuxfleurs.fr ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK/dJIxioCkfeehxeGiZR7qquYGoqEH/YrRJ/ukEcaLH 10.14.3.1 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJnpO6zpLWsyyugOoOj+2bUow9TUrcWgURFGGaoyu+co +192.168.1.22 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMf/ioVSSb19Slu+HZLgKt4f1/XsL+K9uMxazSWb/+nQ diff --git a/cluster/staging/node/carcajou.nix b/cluster/staging/node/carcajou.nix index e1bd3a6..5822f49 100644 --- a/cluster/staging/node/carcajou.nix +++ b/cluster/staging/node/carcajou.nix @@ -8,6 +8,12 @@ ./remote-unlock.nix ]; + deuxfleurs.remoteUnlock = { + networkInterface = "eno1"; + staticIP = "192.168.1.22/24"; + defaultGateway = "192.168.1.1"; + }; + # Use the systemd-boot EFI boot loader. boot.loader.systemd-boot.enable = true; boot.loader.timeout = 20; @@ -15,8 +21,6 @@ networking.hostName = "carcajou"; - deuxfleurs.network_interface = "eno1"; - deuxfleurs.lan_ip = "192.168.1.22"; deuxfleurs.ipv6 = "2001:910:1204:1::22"; deuxfleurs.cluster_ip = "10.14.1.2"; diff --git a/cluster/staging/node/caribou.nix b/cluster/staging/node/caribou.nix index 02cb16d..2e8691a 100644 --- a/cluster/staging/node/caribou.nix +++ b/cluster/staging/node/caribou.nix @@ -10,8 +10,6 @@ networking.hostName = "caribou"; - deuxfleurs.network_interface = "eno1"; - deuxfleurs.lan_ip = "192.168.1.23"; deuxfleurs.ipv6 = "2001:910:1204:1::23"; deuxfleurs.cluster_ip = "10.14.1.3"; diff --git a/cluster/staging/node/df-pw5.nix b/cluster/staging/node/df-pw5.nix index 33888d6..356a2ae 100644 --- a/cluster/staging/node/df-pw5.nix +++ b/cluster/staging/node/df-pw5.nix @@ -11,10 +11,11 @@ networking.hostName = "df-pw5"; - deuxfleurs.network_interface = "eno1"; - deuxfleurs.lan_ip = "192.168.5.130"; + deuxfleurs.staticIPv4.address = "192.168.5.130/24"; deuxfleurs.ipv6 = "2a02:a03f:6510:5102:223:24ff:feb0:e8a7"; deuxfleurs.cluster_ip = "10.14.4.1"; deuxfleurs.is_raft_server = false; + + system.stateVersion = "22.11"; } diff --git a/cluster/staging/node/origan.nix b/cluster/staging/node/origan.nix index 50bce58..6db7f87 100644 --- a/cluster/staging/node/origan.nix +++ b/cluster/staging/node/origan.nix @@ -10,8 +10,7 @@ networking.hostName = "origan"; - deuxfleurs.network_interface = "eno1"; - deuxfleurs.lan_ip = "192.168.1.33"; + deuxfleurs.staticIPv4.address = "192.168.1.33/24"; deuxfleurs.ipv6 = "2a01:e0a:5e4:1d0:223:24ff:feaf:fdec"; deuxfleurs.cluster_ip = "10.14.2.33"; diff --git a/cluster/staging/node/piranha.nix b/cluster/staging/node/piranha.nix index 9ac2a07..4873693 100644 --- a/cluster/staging/node/piranha.nix +++ b/cluster/staging/node/piranha.nix @@ -10,8 +10,7 @@ networking.hostName = "piranha"; - deuxfleurs.network_interface = "eno1"; - deuxfleurs.lan_ip = "192.168.1.25"; + deuxfleurs.staticIPv4.address = "192.168.1.25/24"; deuxfleurs.ipv6 = "2a01:cb05:8984:9900:223:24ff:feb0:ea82"; deuxfleurs.cluster_ip = "10.14.3.1"; diff --git a/cluster/staging/site/bespin.nix b/cluster/staging/site/bespin.nix index 1133603..3fcefbb 100644 --- a/cluster/staging/site/bespin.nix +++ b/cluster/staging/site/bespin.nix @@ -2,10 +2,7 @@ { deuxfleurs.site_name = "bespin"; - deuxfleurs.lan_default_gateway = "192.168.5.254"; - deuxfleurs.ipv6_default_gateway = "2a02:a03f:6510:5102::1"; - deuxfleurs.lan_ip_prefix_length = 24; - deuxfleurs.ipv6_prefix_length = 64; + deuxfleurs.staticIPv4.defaultGateway = "192.168.5.254"; deuxfleurs.cname_target = "bespin.site.staging.deuxfleurs.org."; networking.firewall.allowedTCPPorts = [ 80 443 ]; diff --git a/cluster/staging/site/corrin.nix b/cluster/staging/site/corrin.nix index 8bf8693..0ff7b80 100644 --- a/cluster/staging/site/corrin.nix +++ b/cluster/staging/site/corrin.nix @@ -2,10 +2,7 @@ { deuxfleurs.site_name = "corrin"; - deuxfleurs.lan_default_gateway = "192.168.1.1"; - deuxfleurs.ipv6_default_gateway = "fe80::7ec1:77ff:fe3e:bb90"; - deuxfleurs.lan_ip_prefix_length = 24; - deuxfleurs.ipv6_prefix_length = 64; + deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1"; deuxfleurs.cname_target = "corrin.site.staging.deuxfleurs.org."; deuxfleurs.public_ipv4 = "82.120.233.78"; diff --git a/cluster/staging/site/jupiter.nix b/cluster/staging/site/jupiter.nix index 291e582..2269836 100644 --- a/cluster/staging/site/jupiter.nix +++ b/cluster/staging/site/jupiter.nix @@ -2,10 +2,7 @@ { deuxfleurs.site_name = "jupiter"; - deuxfleurs.lan_default_gateway = "192.168.1.1"; - deuxfleurs.ipv6_default_gateway = "fe80::9038:202a:73a0:e73b"; - deuxfleurs.lan_ip_prefix_length = 24; - deuxfleurs.ipv6_prefix_length = 64; + deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1"; deuxfleurs.cname_target = "jupiter.site.staging.deuxfleurs.org."; # no public ipv4 is used for the staging cluster on Jupiter diff --git a/cluster/staging/site/neptune.nix b/cluster/staging/site/neptune.nix index b030b46..36d5957 100644 --- a/cluster/staging/site/neptune.nix +++ b/cluster/staging/site/neptune.nix @@ -2,10 +2,6 @@ { deuxfleurs.site_name = "neptune"; - deuxfleurs.lan_default_gateway = "192.168.1.1"; - deuxfleurs.ipv6_default_gateway = "2001:910:1204:1::1"; - deuxfleurs.lan_ip_prefix_length = 24; - deuxfleurs.ipv6_prefix_length = 64; deuxfleurs.cname_target = "neptune.site.staging.deuxfleurs.org."; # no public ipv4 is used for the staging cluster on Neptune, -- cgit v1.2.3 From 96566ae523934f5a37b8d7c2a9ef928cd5c0d098 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Fri, 24 Mar 2023 15:26:39 +0100 Subject: refactor configuration syntax --- cluster/staging/cluster.nix | 70 ++++++++++++++++++--------------------- cluster/staging/node/carcajou.nix | 7 ++-- cluster/staging/node/caribou.nix | 9 ++--- cluster/staging/node/df-pw5.nix | 8 ++--- cluster/staging/node/origan.nix | 9 ++--- cluster/staging/node/piranha.nix | 9 ++--- cluster/staging/site/bespin.nix | 4 +-- cluster/staging/site/corrin.nix | 6 ++-- cluster/staging/site/jupiter.nix | 7 ++-- cluster/staging/site/neptune.nix | 8 ++--- 10 files changed, 54 insertions(+), 83 deletions(-) (limited to 'cluster/staging') diff --git a/cluster/staging/cluster.nix b/cluster/staging/cluster.nix index cf30d6e..56ca904 100644 --- a/cluster/staging/cluster.nix +++ b/cluster/staging/cluster.nix @@ -1,49 +1,43 @@ { config, pkgs, ... } @ args: { - deuxfleurs.cluster_name = "staging"; + deuxfleurs.clusterName = "staging"; # The IP range to use for the Wireguard overlay of this cluster - deuxfleurs.cluster_prefix = "10.14.0.0"; - deuxfleurs.cluster_prefix_length = 16; + deuxfleurs.clusterPrefix = "10.14.0.0/16"; - deuxfleurs.cluster_nodes = [ - { - hostname = "carcajou"; - site_name = "neptune"; + deuxfleurs.clusterNodes = { + "carcajou" = { + siteName = "neptune"; publicKey = "7Nm7pMmyS7Nts1MB+loyD8u84ODxHPTkDu+uqQR6yDk="; - IP = "10.14.1.2"; + address = "10.14.1.2"; endpoint = "77.207.15.215:33722"; - } - { - hostname = "caribou"; - site_name = "neptune"; + }; + "caribou" = { + siteName = "neptune"; publicKey = "lABn/axzD1jkFulX8c+K3B3CbKXORlIMDDoe8sQVxhs="; - IP = "10.14.1.3"; + address = "10.14.1.3"; endpoint = "77.207.15.215:33723"; - } - { - hostname = "origan"; - site_name = "jupiter"; + }; + "origan" = { + siteName = "jupiter"; publicKey = "smBQYUS60JDkNoqkTT7TgbpqFiM43005fcrT6472llI="; - IP = "10.14.2.33"; + address = "10.14.2.33"; endpoint = "82.64.238.84:33733"; - } - { - hostname = "piranha"; - site_name = "corrin"; + }; + "piranha" = { + siteName = "corrin"; publicKey = "m9rLf+233X1VColmeVrM/xfDGro5W6Gk5N0zqcf32WY="; - IP = "10.14.3.1"; + address = "10.14.3.1"; #endpoint = "82.120.233.78:33721"; - } - { - hostname = "df-pw5"; - site_name = "bespin"; + }; + "df-pw5" = { + siteName = "bespin"; publicKey = "XLOYoMXF+PO4jcgfSVAk+thh4VmWx0wzWnb0xs08G1s="; - IP = "10.14.4.1"; + address = "10.14.4.1"; endpoint = "bitfrost.fiber.shirokumo.net:33734"; - } - ]; + }; + }; services.wgautomesh.logLevel = "debug"; # Bootstrap IPs for Consul cluster, @@ -54,7 +48,7 @@ "10.14.1.3" # caribou ]; - deuxfleurs.admin_accounts = { + deuxfleurs.adminAccounts = { lx = [ # Keys for accessing nodes from outside "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJpaBZdYxHqMxhv2RExAOa7nkKhPBOHupMP3mYaZ73w9 lx@lindy" @@ -142,16 +136,16 @@ enable = true; port = substituter_port; openFirewall = false; - bindAddress = config.deuxfleurs.cluster_ip; + bindAddress = "0.0.0.0"; package = pkgs.haskellPackages.nix-serve-ng; }; nix.settings.substituters = map - ({ IP, ... }: "http://${IP}:${builtins.toString substituter_port}") - (builtins.filter - ({ site_name, IP, ...}: - (IP != config.deuxfleurs.cluster_ip - && site_name == config.deuxfleurs.site_name)) - config.deuxfleurs.cluster_nodes); + ({ address, ... }: "http://${address}:${builtins.toString substituter_port}") + (builtins.attrValues (pkgs.lib.filterAttrs + (hostname: { siteName, ...}: + (hostname != config.deuxfleurs.hostName + && siteName == config.deuxfleurs.siteName)) + config.deuxfleurs.clusterNodes)); }) ]; } diff --git a/cluster/staging/node/carcajou.nix b/cluster/staging/node/carcajou.nix index 5822f49..e6c1653 100644 --- a/cluster/staging/node/carcajou.nix +++ b/cluster/staging/node/carcajou.nix @@ -19,11 +19,8 @@ boot.loader.timeout = 20; boot.loader.efi.canTouchEfiVariables = true; - networking.hostName = "carcajou"; - - deuxfleurs.ipv6 = "2001:910:1204:1::22"; - - deuxfleurs.cluster_ip = "10.14.1.2"; + deuxfleurs.hostName = "carcajou"; + deuxfleurs.ipv6Address = "2001:910:1204:1::22"; system.stateVersion = "21.05"; } diff --git a/cluster/staging/node/caribou.nix b/cluster/staging/node/caribou.nix index 2e8691a..ad5a65d 100644 --- a/cluster/staging/node/caribou.nix +++ b/cluster/staging/node/caribou.nix @@ -8,12 +8,9 @@ boot.loader.timeout = 20; boot.loader.efi.canTouchEfiVariables = true; - networking.hostName = "caribou"; - - deuxfleurs.ipv6 = "2001:910:1204:1::23"; - - deuxfleurs.cluster_ip = "10.14.1.3"; - deuxfleurs.is_raft_server = true; + deuxfleurs.hostName = "caribou"; + deuxfleurs.ipv6Address = "2001:910:1204:1::23"; + deuxfleurs.isRaftServer = true; system.stateVersion = "21.05"; } diff --git a/cluster/staging/node/df-pw5.nix b/cluster/staging/node/df-pw5.nix index 356a2ae..0e5be15 100644 --- a/cluster/staging/node/df-pw5.nix +++ b/cluster/staging/node/df-pw5.nix @@ -9,13 +9,9 @@ boot.loader.efi.efiSysMountPoint = "/boot"; boot.loader.timeout = 20; - networking.hostName = "df-pw5"; - + deuxfleurs.hostName = "df-pw5"; deuxfleurs.staticIPv4.address = "192.168.5.130/24"; - deuxfleurs.ipv6 = "2a02:a03f:6510:5102:223:24ff:feb0:e8a7"; - - deuxfleurs.cluster_ip = "10.14.4.1"; - deuxfleurs.is_raft_server = false; + deuxfleurs.ipv6Address = "2a02:a03f:6510:5102:223:24ff:feb0:e8a7"; system.stateVersion = "22.11"; } diff --git a/cluster/staging/node/origan.nix b/cluster/staging/node/origan.nix index 6db7f87..d900fd6 100644 --- a/cluster/staging/node/origan.nix +++ b/cluster/staging/node/origan.nix @@ -8,13 +8,10 @@ boot.loader.timeout = 20; boot.loader.efi.canTouchEfiVariables = true; - networking.hostName = "origan"; - + deuxfleurs.hostName = "origan"; deuxfleurs.staticIPv4.address = "192.168.1.33/24"; - deuxfleurs.ipv6 = "2a01:e0a:5e4:1d0:223:24ff:feaf:fdec"; - - deuxfleurs.cluster_ip = "10.14.2.33"; - deuxfleurs.is_raft_server = true; + deuxfleurs.ipv6Address = "2a01:e0a:5e4:1d0:223:24ff:feaf:fdec"; + deuxfleurs.isRaftServer = true; system.stateVersion = "22.11"; } diff --git a/cluster/staging/node/piranha.nix b/cluster/staging/node/piranha.nix index 4873693..436965c 100644 --- a/cluster/staging/node/piranha.nix +++ b/cluster/staging/node/piranha.nix @@ -8,13 +8,10 @@ boot.loader.timeout = 20; boot.loader.efi.canTouchEfiVariables = true; - networking.hostName = "piranha"; - + deuxfleurs.hostName = "piranha"; deuxfleurs.staticIPv4.address = "192.168.1.25/24"; - deuxfleurs.ipv6 = "2a01:cb05:8984:9900:223:24ff:feb0:ea82"; - - deuxfleurs.cluster_ip = "10.14.3.1"; - deuxfleurs.is_raft_server = true; + deuxfleurs.ipv6Address = "2a01:cb05:8984:9900:223:24ff:feb0:ea82"; + deuxfleurs.isRaftServer = true; system.stateVersion = "22.11"; } diff --git a/cluster/staging/site/bespin.nix b/cluster/staging/site/bespin.nix index 3fcefbb..22feb59 100644 --- a/cluster/staging/site/bespin.nix +++ b/cluster/staging/site/bespin.nix @@ -1,9 +1,9 @@ { config, pkgs, ... }: { - deuxfleurs.site_name = "bespin"; + deuxfleurs.siteName = "bespin"; deuxfleurs.staticIPv4.defaultGateway = "192.168.5.254"; - deuxfleurs.cname_target = "bespin.site.staging.deuxfleurs.org."; + deuxfleurs.cnameTarget = "bespin.site.staging.deuxfleurs.org."; networking.firewall.allowedTCPPorts = [ 80 443 ]; } diff --git a/cluster/staging/site/corrin.nix b/cluster/staging/site/corrin.nix index 0ff7b80..0083986 100644 --- a/cluster/staging/site/corrin.nix +++ b/cluster/staging/site/corrin.nix @@ -1,10 +1,10 @@ { config, pkgs, ... }: { - deuxfleurs.site_name = "corrin"; + deuxfleurs.siteName = "corrin"; deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1"; - deuxfleurs.cname_target = "corrin.site.staging.deuxfleurs.org."; - deuxfleurs.public_ipv4 = "82.120.233.78"; + deuxfleurs.cnameTarget = "corrin.site.staging.deuxfleurs.org."; + deuxfleurs.publicIPv4 = "82.120.233.78"; networking.firewall.allowedTCPPorts = [ 80 443 ]; } diff --git a/cluster/staging/site/jupiter.nix b/cluster/staging/site/jupiter.nix index 2269836..2d39f5a 100644 --- a/cluster/staging/site/jupiter.nix +++ b/cluster/staging/site/jupiter.nix @@ -1,12 +1,9 @@ { config, pkgs, ... }: { - deuxfleurs.site_name = "jupiter"; + deuxfleurs.siteName = "jupiter"; deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1"; - deuxfleurs.cname_target = "jupiter.site.staging.deuxfleurs.org."; - - # no public ipv4 is used for the staging cluster on Jupiter - # deuxfleurs.public_ipv4 = "???"; + deuxfleurs.cnameTarget = "jupiter.site.staging.deuxfleurs.org."; networking.firewall.allowedTCPPorts = [ 80 443 ]; } diff --git a/cluster/staging/site/neptune.nix b/cluster/staging/site/neptune.nix index 36d5957..f94d62f 100644 --- a/cluster/staging/site/neptune.nix +++ b/cluster/staging/site/neptune.nix @@ -1,12 +1,8 @@ { config, pkgs, ... }: { - deuxfleurs.site_name = "neptune"; - deuxfleurs.cname_target = "neptune.site.staging.deuxfleurs.org."; - - # no public ipv4 is used for the staging cluster on Neptune, - # because the Internet connection is already used for the prod cluster - # deuxfleurs.public_ipv4 = "77.207.15.215"; + deuxfleurs.siteName = "neptune"; + deuxfleurs.cnameTarget = "neptune.site.staging.deuxfleurs.org."; networking.firewall.allowedTCPPorts = [ 80 443 ]; } -- cgit v1.2.3 From cb8d7e92d2aa2950fa403ff8e2ec2a9a31b48b32 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Wed, 5 Apr 2023 10:25:22 +0200 Subject: staging: ipv6-only diplonat for automatic address discovery --- cluster/staging/app/core/deploy/core-system.hcl | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) (limited to 'cluster/staging') diff --git a/cluster/staging/app/core/deploy/core-system.hcl b/cluster/staging/app/core/deploy/core-system.hcl index 05fa0f2..dba6b95 100644 --- a/cluster/staging/app/core/deploy/core-system.hcl +++ b/cluster/staging/app/core/deploy/core-system.hcl @@ -13,7 +13,6 @@ job "core-system" { stagger = "1m" } -/* group "diplonat" { task "diplonat" { driver = "nix2" @@ -21,7 +20,7 @@ job "core-system" { config { packages = [ "#iptables", - "git+https://git.deuxfleurs.fr/Deuxfleurs/diplonat.git?ref=main&rev=f306e8dc8d0e93478353ce39b6064e8c06a8bca6" + "git+https://git.deuxfleurs.fr/Deuxfleurs/diplonat.git?ref=stun&rev=21ab77b8288630c5f39a30b098c6a3888df622a1" ] command = "diplonat" } @@ -53,6 +52,7 @@ job "core-system" { data = < Date: Wed, 5 Apr 2023 13:20:17 +0200 Subject: Allow for IPv6 with RA disabled by manually providing gateway --- cluster/staging/node/carcajou.nix | 2 +- cluster/staging/node/caribou.nix | 2 +- cluster/staging/node/df-pw5.nix | 2 +- cluster/staging/node/origan.nix | 2 +- cluster/staging/node/piranha.nix | 2 +- 5 files changed, 5 insertions(+), 5 deletions(-) (limited to 'cluster/staging') diff --git a/cluster/staging/node/carcajou.nix b/cluster/staging/node/carcajou.nix index e6c1653..d5211f1 100644 --- a/cluster/staging/node/carcajou.nix +++ b/cluster/staging/node/carcajou.nix @@ -20,7 +20,7 @@ boot.loader.efi.canTouchEfiVariables = true; deuxfleurs.hostName = "carcajou"; - deuxfleurs.ipv6Address = "2001:910:1204:1::22"; + deuxfleurs.staticIPv6.address = "2001:910:1204:1::22"; system.stateVersion = "21.05"; } diff --git a/cluster/staging/node/caribou.nix b/cluster/staging/node/caribou.nix index ad5a65d..80293e9 100644 --- a/cluster/staging/node/caribou.nix +++ b/cluster/staging/node/caribou.nix @@ -9,7 +9,7 @@ boot.loader.efi.canTouchEfiVariables = true; deuxfleurs.hostName = "caribou"; - deuxfleurs.ipv6Address = "2001:910:1204:1::23"; + deuxfleurs.staticIPv6.address = "2001:910:1204:1::23"; deuxfleurs.isRaftServer = true; system.stateVersion = "21.05"; diff --git a/cluster/staging/node/df-pw5.nix b/cluster/staging/node/df-pw5.nix index 0e5be15..e1a132c 100644 --- a/cluster/staging/node/df-pw5.nix +++ b/cluster/staging/node/df-pw5.nix @@ -11,7 +11,7 @@ deuxfleurs.hostName = "df-pw5"; deuxfleurs.staticIPv4.address = "192.168.5.130/24"; - deuxfleurs.ipv6Address = "2a02:a03f:6510:5102:223:24ff:feb0:e8a7"; + deuxfleurs.staticIPv6.address = "2a02:a03f:6510:5102:223:24ff:feb0:e8a7"; system.stateVersion = "22.11"; } diff --git a/cluster/staging/node/origan.nix b/cluster/staging/node/origan.nix index d900fd6..6906f4d 100644 --- a/cluster/staging/node/origan.nix +++ b/cluster/staging/node/origan.nix @@ -10,7 +10,7 @@ deuxfleurs.hostName = "origan"; deuxfleurs.staticIPv4.address = "192.168.1.33/24"; - deuxfleurs.ipv6Address = "2a01:e0a:5e4:1d0:223:24ff:feaf:fdec"; + deuxfleurs.staticIPv6.address = "2a01:e0a:5e4:1d0:223:24ff:feaf:fdec"; deuxfleurs.isRaftServer = true; system.stateVersion = "22.11"; diff --git a/cluster/staging/node/piranha.nix b/cluster/staging/node/piranha.nix index 2b9907d..bc1aa03 100644 --- a/cluster/staging/node/piranha.nix +++ b/cluster/staging/node/piranha.nix @@ -10,7 +10,7 @@ deuxfleurs.hostName = "piranha"; deuxfleurs.staticIPv4.address = "192.168.1.25/24"; - deuxfleurs.ipv6Address = "2a01:cb05:9142:7400:223:24ff:feb0:ea82"; + deuxfleurs.staticIPv6.address = "2a01:cb05:9142:7400:223:24ff:feb0:ea82"; deuxfleurs.isRaftServer = true; system.stateVersion = "22.11"; -- cgit v1.2.3 From 16422d280959808aff1670a066788e98049f42b7 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Wed, 5 Apr 2023 14:04:11 +0200 Subject: introduce back static ipv4 prefix lenght but with default value --- cluster/staging/node/df-pw5.nix | 2 +- cluster/staging/node/origan.nix | 2 +- cluster/staging/node/piranha.nix | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) (limited to 'cluster/staging') diff --git a/cluster/staging/node/df-pw5.nix b/cluster/staging/node/df-pw5.nix index e1a132c..2f20f1c 100644 --- a/cluster/staging/node/df-pw5.nix +++ b/cluster/staging/node/df-pw5.nix @@ -10,7 +10,7 @@ boot.loader.timeout = 20; deuxfleurs.hostName = "df-pw5"; - deuxfleurs.staticIPv4.address = "192.168.5.130/24"; + deuxfleurs.staticIPv4.address = "192.168.5.130"; deuxfleurs.staticIPv6.address = "2a02:a03f:6510:5102:223:24ff:feb0:e8a7"; system.stateVersion = "22.11"; diff --git a/cluster/staging/node/origan.nix b/cluster/staging/node/origan.nix index 6906f4d..49ecbbf 100644 --- a/cluster/staging/node/origan.nix +++ b/cluster/staging/node/origan.nix @@ -9,7 +9,7 @@ boot.loader.efi.canTouchEfiVariables = true; deuxfleurs.hostName = "origan"; - deuxfleurs.staticIPv4.address = "192.168.1.33/24"; + deuxfleurs.staticIPv4.address = "192.168.1.33"; deuxfleurs.staticIPv6.address = "2a01:e0a:5e4:1d0:223:24ff:feaf:fdec"; deuxfleurs.isRaftServer = true; diff --git a/cluster/staging/node/piranha.nix b/cluster/staging/node/piranha.nix index bc1aa03..896f169 100644 --- a/cluster/staging/node/piranha.nix +++ b/cluster/staging/node/piranha.nix @@ -9,7 +9,7 @@ boot.loader.efi.canTouchEfiVariables = true; deuxfleurs.hostName = "piranha"; - deuxfleurs.staticIPv4.address = "192.168.1.25/24"; + deuxfleurs.staticIPv4.address = "192.168.1.25"; deuxfleurs.staticIPv6.address = "2a01:cb05:9142:7400:223:24ff:feb0:ea82"; deuxfleurs.isRaftServer = true; -- cgit v1.2.3 From 07f50f297a8fcb3ccee167ca486084bafb2c1120 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Wed, 5 Apr 2023 16:30:28 +0200 Subject: D53 with addresses from DiploNAT autodiscovery; diplonat fw opening for tricot --- cluster/staging/app/core/deploy/core-service.hcl | 2 +- cluster/staging/app/core/deploy/core-system.hcl | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) (limited to 'cluster/staging') diff --git a/cluster/staging/app/core/deploy/core-service.hcl b/cluster/staging/app/core/deploy/core-service.hcl index 6799e01..bf835c7 100644 --- a/cluster/staging/app/core/deploy/core-service.hcl +++ b/cluster/staging/app/core/deploy/core-service.hcl @@ -11,7 +11,7 @@ job "core-service" { config { packages = [ - "git+https://git.deuxfleurs.fr/lx/D53.git?ref=main&rev=86c255dfeabc60b0ef46ff78bc487c61c9548c79" + "git+https://git.deuxfleurs.fr/lx/D53.git?ref=diplonat-autodiscovery&rev=d906a6ebb5d977f44340b157a520477849ced161" ] command = "d53" } diff --git a/cluster/staging/app/core/deploy/core-system.hcl b/cluster/staging/app/core/deploy/core-system.hcl index dba6b95..2ec9b58 100644 --- a/cluster/staging/app/core/deploy/core-system.hcl +++ b/cluster/staging/app/core/deploy/core-system.hcl @@ -140,7 +140,7 @@ EOH tags = [ "d53-aaaa ${meta.site}.site.staging.deuxfleurs.org", "d53-aaaa staging.deuxfleurs.org", - # "(diplonat (tcp_port 80))" + "(diplonat (tcp_port 80))" ] address_mode = "host" } @@ -149,7 +149,7 @@ EOH name = "tricot-https" port = "https_port" tags = [ - # "(diplonat (tcp_port 443))" + "(diplonat (tcp_port 443))" ] address_mode = "host" } -- cgit v1.2.3 From 0372df95b5689d5104131ccc75f05d791c6e6a23 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Wed, 19 Apr 2023 20:36:24 +0200 Subject: staging: fix consul server addresses --- cluster/staging/cluster.nix | 4 ++-- cluster/staging/ssh_config | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) (limited to 'cluster/staging') diff --git a/cluster/staging/cluster.nix b/cluster/staging/cluster.nix index 56ca904..2fec94c 100644 --- a/cluster/staging/cluster.nix +++ b/cluster/staging/cluster.nix @@ -43,9 +43,9 @@ # Bootstrap IPs for Consul cluster, # these are IPs on the Wireguard overlay services.consul.extraConfig.retry_join = [ - "10.14.1.1" # cariacou - "10.14.1.2" # carcajou "10.14.1.3" # caribou + "10.14.2.33" # origan + "10.14.3.1" # piranha ]; deuxfleurs.adminAccounts = { diff --git a/cluster/staging/ssh_config b/cluster/staging/ssh_config index 3043207..08cac54 100644 --- a/cluster/staging/ssh_config +++ b/cluster/staging/ssh_config @@ -10,7 +10,7 @@ Host origan HostName origan.df.trinity.fr.eu.org Host piranha - ProxyJump caribou.machine.deuxfleurs.fr + ProxyJump carcajou.machine.deuxfleurs.fr HostName 10.14.3.1 #HostName piranha.polyno.me -- cgit v1.2.3 From e5f9f3c8495a8f0e6b9c46b56d207b57aad3ec3d Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Wed, 19 Apr 2023 21:05:47 +0200 Subject: increase diplonat ram --- cluster/staging/app/core/deploy/core-system.hcl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'cluster/staging') diff --git a/cluster/staging/app/core/deploy/core-system.hcl b/cluster/staging/app/core/deploy/core-system.hcl index 2ec9b58..1d3eb84 100644 --- a/cluster/staging/app/core/deploy/core-system.hcl +++ b/cluster/staging/app/core/deploy/core-system.hcl @@ -65,7 +65,7 @@ EOH } resources { - memory = 40 + memory = 100 } } } -- cgit v1.2.3 From b4e82e37e4e1718dfffa70cd0c6222c1b34fc997 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Thu, 20 Apr 2023 15:13:13 +0200 Subject: diplonat with fixed iptables thing --- cluster/staging/app/core/deploy/core-service.hcl | 62 --------- cluster/staging/app/core/deploy/core-system.hcl | 164 ----------------------- cluster/staging/app/core/deploy/d53.hcl | 62 +++++++++ cluster/staging/app/core/deploy/diplonat.hcl | 75 +++++++++++ cluster/staging/app/core/deploy/tricot.hcl | 108 +++++++++++++++ 5 files changed, 245 insertions(+), 226 deletions(-) delete mode 100644 cluster/staging/app/core/deploy/core-service.hcl delete mode 100644 cluster/staging/app/core/deploy/core-system.hcl create mode 100644 cluster/staging/app/core/deploy/d53.hcl create mode 100644 cluster/staging/app/core/deploy/diplonat.hcl create mode 100644 cluster/staging/app/core/deploy/tricot.hcl (limited to 'cluster/staging') diff --git a/cluster/staging/app/core/deploy/core-service.hcl b/cluster/staging/app/core/deploy/core-service.hcl deleted file mode 100644 index bf835c7..0000000 --- a/cluster/staging/app/core/deploy/core-service.hcl +++ /dev/null @@ -1,62 +0,0 @@ -job "core-service" { - datacenters = ["neptune", "jupiter", "corrin", "bespin"] - type = "service" - priority = 90 - - group "D53" { - count = 1 - - task "d53" { - driver = "nix2" - - config { - packages = [ - "git+https://git.deuxfleurs.fr/lx/D53.git?ref=diplonat-autodiscovery&rev=d906a6ebb5d977f44340b157a520477849ced161" - ] - command = "d53" - } - - resources { - cpu = 100 - memory = 100 - } - - restart { - interval = "3m" - attempts = 10 - delay = "15s" - mode = "delay" - } - - template { - data = "{{ key \"secrets/consul/consul-ca.crt\" }}" - destination = "etc/tricot/consul-ca.crt" - } - - template { - data = "{{ key \"secrets/consul/consul-client.crt\" }}" - destination = "etc/tricot/consul-client.crt" - } - - template { - data = "{{ key \"secrets/consul/consul-client.key\" }}" - destination = "etc/tricot/consul-client.key" - } - - template { - data = < Date: Fri, 21 Apr 2023 11:29:15 +0200 Subject: Fix unbound; remove Nixos firewall (use only diplonat) --- cluster/staging/site/bespin.nix | 2 -- cluster/staging/site/corrin.nix | 2 -- cluster/staging/site/jupiter.nix | 2 -- cluster/staging/site/neptune.nix | 2 -- 4 files changed, 8 deletions(-) (limited to 'cluster/staging') diff --git a/cluster/staging/site/bespin.nix b/cluster/staging/site/bespin.nix index 22feb59..2dbfbad 100644 --- a/cluster/staging/site/bespin.nix +++ b/cluster/staging/site/bespin.nix @@ -4,6 +4,4 @@ deuxfleurs.siteName = "bespin"; deuxfleurs.staticIPv4.defaultGateway = "192.168.5.254"; deuxfleurs.cnameTarget = "bespin.site.staging.deuxfleurs.org."; - - networking.firewall.allowedTCPPorts = [ 80 443 ]; } diff --git a/cluster/staging/site/corrin.nix b/cluster/staging/site/corrin.nix index 6eb5239..027f6b3 100644 --- a/cluster/staging/site/corrin.nix +++ b/cluster/staging/site/corrin.nix @@ -5,6 +5,4 @@ deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1"; deuxfleurs.cnameTarget = "corrin.site.staging.deuxfleurs.org."; deuxfleurs.publicIPv4 = "2.13.96.213"; - - networking.firewall.allowedTCPPorts = [ 80 443 ]; } diff --git a/cluster/staging/site/jupiter.nix b/cluster/staging/site/jupiter.nix index 2d39f5a..28ba297 100644 --- a/cluster/staging/site/jupiter.nix +++ b/cluster/staging/site/jupiter.nix @@ -4,6 +4,4 @@ deuxfleurs.siteName = "jupiter"; deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1"; deuxfleurs.cnameTarget = "jupiter.site.staging.deuxfleurs.org."; - - networking.firewall.allowedTCPPorts = [ 80 443 ]; } diff --git a/cluster/staging/site/neptune.nix b/cluster/staging/site/neptune.nix index f94d62f..86148f4 100644 --- a/cluster/staging/site/neptune.nix +++ b/cluster/staging/site/neptune.nix @@ -3,6 +3,4 @@ { deuxfleurs.siteName = "neptune"; deuxfleurs.cnameTarget = "neptune.site.staging.deuxfleurs.org."; - - networking.firewall.allowedTCPPorts = [ 80 443 ]; } -- cgit v1.2.3 From 607add3161f9a465fc061cfd3a5434aa4dbd4796 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Fri, 21 Apr 2023 14:36:10 +0200 Subject: make specifying an ipv6 fully optionnal --- cluster/staging/app/core/deploy/d53.hcl | 4 ++-- cluster/staging/app/garage/config/garage.toml | 6 ++++-- cluster/staging/app/garage/deploy/garage.hcl | 1 + 3 files changed, 7 insertions(+), 4 deletions(-) (limited to 'cluster/staging') diff --git a/cluster/staging/app/core/deploy/d53.hcl b/cluster/staging/app/core/deploy/d53.hcl index 5d57eb3..fb1c1bf 100644 --- a/cluster/staging/app/core/deploy/d53.hcl +++ b/cluster/staging/app/core/deploy/d53.hcl @@ -11,7 +11,7 @@ job "core:d53" { config { packages = [ - "git+https://git.deuxfleurs.fr/lx/D53.git?ref=diplonat-autodiscovery&rev=d906a6ebb5d977f44340b157a520477849ced161" + "git+https://git.deuxfleurs.fr/lx/D53.git?ref=diplonat-autodiscovery&rev=49d94dae1d753c1f3349be7ea9bc7e7978c0af15" ] command = "d53" } @@ -52,7 +52,7 @@ D53_CONSUL_CLIENT_KEY=/etc/tricot/consul-client.key D53_PROVIDERS=deuxfleurs.org:gandi D53_GANDI_API_KEY={{ key "secrets/d53/gandi_api_key" }} D53_ALLOWED_DOMAINS=staging.deuxfleurs.org -RUST_LOG=d53=info +RUST_LOG=d53=debug EOH destination = "secrets/env" env = true diff --git a/cluster/staging/app/garage/config/garage.toml b/cluster/staging/app/garage/config/garage.toml index f14a602..26e0361 100644 --- a/cluster/staging/app/garage/config/garage.toml +++ b/cluster/staging/app/garage/config/garage.toml @@ -6,8 +6,10 @@ db_engine = "lmdb" replication_mode = "3" -rpc_bind_addr = "[{{ env "meta.public_ipv6" }}]:3991" -rpc_public_addr = "[{{ env "meta.public_ipv6" }}]:3991" +{{ with $a := env "attr.unique.hostname" | printf "diplonat/autodiscovery/ipv6/%s" | key | parseJSON }} +rpc_bind_addr = "[{{ $a.address }}]:3991" +rpc_public_addr = "[{{ $a.address }}]:3991" +{{ end }} rpc_secret = "{{ key "secrets/garage-staging/rpc_secret" | trimSpace }}" bootstrap_peers = [] diff --git a/cluster/staging/app/garage/deploy/garage.hcl b/cluster/staging/app/garage/deploy/garage.hcl index 6e37d82..1fc969b 100644 --- a/cluster/staging/app/garage/deploy/garage.hcl +++ b/cluster/staging/app/garage/deploy/garage.hcl @@ -25,6 +25,7 @@ job "garage-staging" { config { packages = [ "#bash", # so that we can enter a shell inside container + "#coreutils", "git+https://git.deuxfleurs.fr/Deuxfleurs/garage.git?ref=main&rev=0d0906b066eb76111f3b427dce1c50eac083366c", ] command = "garage" -- cgit v1.2.3 From 6c07a429781d4a26a546e3f3049b41e0b968b033 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Thu, 4 May 2023 13:39:33 +0200 Subject: different wgautomesh gossip ports for prod and staging --- cluster/staging/cluster.nix | 2 ++ 1 file changed, 2 insertions(+) (limited to 'cluster/staging') diff --git a/cluster/staging/cluster.nix b/cluster/staging/cluster.nix index 2fec94c..362724b 100644 --- a/cluster/staging/cluster.nix +++ b/cluster/staging/cluster.nix @@ -38,6 +38,8 @@ endpoint = "bitfrost.fiber.shirokumo.net:33734"; }; }; + + deuxfleurs.wgautomeshPort = 1667; services.wgautomesh.logLevel = "debug"; # Bootstrap IPs for Consul cluster, -- cgit v1.2.3