From 025888c4501e668b5ea4cde02b0d536e960dab2f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Wed, 19 Jul 2023 11:29:29 +0200 Subject: [PATCH 1/4] add deploy.sh script --- targets/web01/deploy.sh | 14 ++++++++++++++ 1 file changed, 14 insertions(+) create mode 100755 targets/web01/deploy.sh diff --git a/targets/web01/deploy.sh b/targets/web01/deploy.sh new file mode 100755 index 0000000..3f47464 --- /dev/null +++ b/targets/web01/deploy.sh @@ -0,0 +1,14 @@ +#!/usr/bin/env nix-shell +#!nix-shell -i bash -p nix jq bash rsync + +set -euo pipefail + +path=$(nix flake metadata --json '.#' | jq -r .path) +ip=65.109.103.5 +rsync --checksum -vaF --delete -e ssh "${path}/" "root@${ip}:/etc/nixos" + +ssh "root@$ip" nixos-rebuild switch \ + --fast \ + --option keep-going true \ + --option accept-flake-config true \ + --flake '/etc/nixos#web01' From 689ea867dcdfb3ac5b0db6623feb22c65bc4bbb7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Wed, 19 Jul 2023 14:40:08 +0200 Subject: [PATCH 2/4] add borgbackup --- modules/web01/borgbackup.nix | 64 ++++++++++++++++++++++++++++++++++++ modules/web01/default.nix | 1 + targets/web01/secrets.yaml | 6 ++-- 3 files changed, 69 insertions(+), 2 deletions(-) create mode 100644 modules/web01/borgbackup.nix diff --git a/modules/web01/borgbackup.nix b/modules/web01/borgbackup.nix new file mode 100644 index 0000000..d298076 --- /dev/null +++ b/modules/web01/borgbackup.nix @@ -0,0 +1,64 @@ +{ config, ... }: { + # 100GB storagebox is under the nix-community hetzner account + + # $ nix run nixpkgs#xkcdpass -- -d '-' -n 3 -C capitalize "$@" + sops.secrets.hetzner-borgbackup-ssh = { }; + # $ ssh-keygen -t ed25519 -N "" -f /tmp/ssh_host_ed25519_key + sops.secrets.hetzner-borgbackup-passphrase = { }; + + systemd.services.borgbackup-job-nixpkgs-update.serviceConfig.ReadWritePaths = [ + "/var/log/telegraf" + ]; + + services.borgbackup.jobs.clan-lol = { + paths = [ + "/home" + "/var" + "/root" + ]; + exclude = [ + "*.pyc" + "/home/*/.direnv" + "/home/*/.cache" + "/home/*/.cargo" + "/home/*/.npm" + "/home/*/.m2" + "/home/*/.gradle" + "/home/*/.opam" + "/home/*/.clangd" + "/var/lib/containerd" + # already included in database backup + "/var/lib/postgresql" + # not so important + "/var/lib/docker/" + "/var/log/journal" + "/var/cache" + "/var/tmp" + "/var/log" + ]; + repo = "u359378@u359378.your-storagebox.de:/./borgbackup"; + encryption = { + mode = "repokey"; + passCommand = "cat ${config.sops.secrets.hetzner-borgbackup-passphrase.path}"; + }; + compression = "auto,zstd"; + startAt = "daily"; + environment.BORG_RSH = "ssh -oPort=23 -i ${config.sops.secrets.hetzner-borgbackup-ssh.path}"; + preHook = '' + set -x + ''; + + postHook = '' + cat > /var/log/telegraf/borgbackup-clan-lol < Date: Wed, 19 Jul 2023 14:43:30 +0200 Subject: [PATCH 3/4] scripts: hardcode target --- targets/web01/decrypt.sh | 7 +------ targets/web01/deploy.sh | 2 +- 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/targets/web01/decrypt.sh b/targets/web01/decrypt.sh index 10d805c..727a0ae 100755 --- a/targets/web01/decrypt.sh +++ b/targets/web01/decrypt.sh @@ -3,12 +3,7 @@ set -euox pipefail -if [ $# -ne 1 ]; then - echo "Usage: $0 " - exit 1 -fi - -HOST=$1 +HOST=clan.lol temp=$(mktemp -d) trap 'rm -rf $temp' EXIT sops --extract '["cryptsetup_key"]' -d secrets.yaml > "$temp/secret.key" diff --git a/targets/web01/deploy.sh b/targets/web01/deploy.sh index 3f47464..4181cfc 100755 --- a/targets/web01/deploy.sh +++ b/targets/web01/deploy.sh @@ -4,7 +4,7 @@ set -euo pipefail path=$(nix flake metadata --json '.#' | jq -r .path) -ip=65.109.103.5 +ip=clan.lol rsync --checksum -vaF --delete -e ssh "${path}/" "root@${ip}:/etc/nixos" ssh "root@$ip" nixos-rebuild switch \ From f5d1b35345b4fc0805bc5112415b2e1923e17276 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= Date: Wed, 19 Jul 2023 14:45:39 +0200 Subject: [PATCH 4/4] hetzner-ex101: limit maximum frequency hetzner-ex101: limit to 4.5Ghz --- modules/hetzner-ex101.nix | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/modules/hetzner-ex101.nix b/modules/hetzner-ex101.nix index cdbf850..1021dee 100644 --- a/modules/hetzner-ex101.nix +++ b/modules/hetzner-ex101.nix @@ -1,8 +1,32 @@ -{ +{ pkgs, ... }: { # Enable raid support specifically, this will disable srvos's # systemd-initrd as well, which currently is not compatible with mdraid. boot.initrd.services.swraid.enable = true; systemd.services.mdmonitor.enable = false; boot.loader.systemd-boot.enable = true; boot.loader.efi.canTouchEfiVariables = true; + + # We are not limited by zfs, so we can use the latest kernel + boot.kernelPackages = pkgs.linuxPackages_latest; + + # looks like the Intel i9-13900 draws too much power and crashes the system + systemd.services.limit-cpu-freq = { + description = "Limit CPU frequency to 4.2GHz"; + wantedBy = [ "multi-user.target" ]; + after = [ "systemd-modules-load.service" ]; + # Some cores do have a scaling max freq less than 5GHz, so we need to + # check for that or else all cores will run at 800MHz + script = '' + #!/bin/sh + for f in /sys/devices/system/cpu/cpu*/cpufreq/scaling_max_freq; do + old_val="$(<"$f")" + if [[ "$old_val" -gt 4200000 ]]; then + echo 4200000 > "$f" + fi + done + ''; + serviceConfig = { + Type = "oneshot"; + }; + }; }