Qubasa
94939cd213
buildbot/nix-build gitea:clan/clan-infra#checks.aarch64-linux.vars Build done.
buildbot/nix-build gitea:clan/clan-infra#checks.aarch64-linux.treefmt Build done.
buildbot/nix-build gitea:clan/clan-infra#checks.aarch64-linux.secrets Build done.
buildbot/nix-build gitea:clan/clan-infra#checks.aarch64-linux.nixos-build01 Build done.
buildbot/nix-eval Build done.
buildbot/nix-build Build done.
305 lines
9.4 KiB
Nix
305 lines
9.4 KiB
Nix
{ self, inputs, ... }:
|
|
{
|
|
imports = [
|
|
inputs.terranix.flakeModule
|
|
];
|
|
|
|
clan = {
|
|
meta.name = "infra";
|
|
meta.domain = "clan";
|
|
|
|
# Make flake available in modules
|
|
specialArgs = { inherit self; };
|
|
inherit self;
|
|
inventory.machines = {
|
|
web01.deploy.targetHost = "root@web01.clan.lol";
|
|
web02.deploy.targetHost = "root@web02.clan.lol";
|
|
jitsi01.deploy.targetHost = "root@jitsi01.clan.lol";
|
|
build01.deploy.targetHost = "root@build01.clan.lol";
|
|
build-x86-01.deploy.targetHost = "root@build-x86-01.clan.lol";
|
|
|
|
# no public IP, via jump host
|
|
build02.machineClass = "darwin";
|
|
build02.deploy.targetHost = "root@build02?ProxyJump=tunnel@web01.clan.lol";
|
|
|
|
build04.machineClass = "darwin";
|
|
build04.deploy.targetHost = "root@build04.clan.lol";
|
|
|
|
storinator01.deploy.targetHost = "root@storinator01.wireguard-infra?ProxyJump=tunnel@web01.clan.lol";
|
|
storinator01.deploy.buildHost = "root@web01.clan.lol";
|
|
};
|
|
inventory.instances = {
|
|
emergency-access = {
|
|
module = {
|
|
name = "emergency-access";
|
|
input = "clan-core";
|
|
};
|
|
|
|
roles.default.tags."all" = { };
|
|
};
|
|
users-root = {
|
|
module = {
|
|
name = "users";
|
|
input = "clan-core";
|
|
};
|
|
roles.default.tags."all" = { };
|
|
roles.default.settings = {
|
|
user = "root";
|
|
prompt = false;
|
|
groups = [ ];
|
|
};
|
|
};
|
|
zerotier-claninfra = {
|
|
module = {
|
|
name = "zerotier";
|
|
input = "clan-core";
|
|
};
|
|
roles.controller.machines.web01 = { };
|
|
roles.controller.extraModules = [ ../modules/zerotier.nix ];
|
|
roles.moon.machines.jitsi01.settings = {
|
|
# jitsi.clan.lol
|
|
stableEndpoints = [
|
|
"207.148.120.82"
|
|
"2401:c080:1400:5439:5400:5ff:fe43:3de5"
|
|
];
|
|
};
|
|
roles.moon.machines.web01.settings = {
|
|
# clan.lol
|
|
stableEndpoints = [
|
|
"23.88.17.207"
|
|
"2a01:4f8:2220:1565::1"
|
|
];
|
|
};
|
|
roles.peer.tags.nixos = { };
|
|
};
|
|
sshd-clan = {
|
|
module = {
|
|
name = "sshd";
|
|
input = "clan-core";
|
|
};
|
|
roles.server.tags.all = { };
|
|
roles.server.settings = {
|
|
# disable ssh certificates as enabling SSH CA by default will lock out all GPG users as GPG does not handle this at all
|
|
# @magic_rb complained about this
|
|
certificate.enable = false;
|
|
certificate.searchDomains = [
|
|
"clan.lol"
|
|
"wireguard-infra"
|
|
];
|
|
};
|
|
roles.server.machines.web01.settings = {
|
|
hostKeys.rsa.enable = true;
|
|
};
|
|
roles.client.tags.all = { };
|
|
# searchDomains automatically inherited from all servers in the instance
|
|
};
|
|
matrix-synapse = {
|
|
module = {
|
|
name = "matrix-synapse";
|
|
input = "clan-core";
|
|
};
|
|
roles.default.machines.web01 = { };
|
|
roles.default.settings = {
|
|
app_domain = "matrix.clan.lol";
|
|
server_tld = "clan.lol";
|
|
acmeEmail = "admins@clan.lol";
|
|
|
|
users = {
|
|
admin = {
|
|
admin = true;
|
|
};
|
|
monitoring = { };
|
|
clan-bot = { };
|
|
w = { };
|
|
toastal = { };
|
|
calendar = { };
|
|
};
|
|
};
|
|
};
|
|
matrix-synapse-personal-computer = {
|
|
module = {
|
|
name = "matrix-synapse";
|
|
input = "clan-core";
|
|
};
|
|
roles.default.machines.web02 = { };
|
|
roles.default.settings = {
|
|
app_domain = "matrix.personal.computer";
|
|
server_tld = "personal.computer";
|
|
acmeEmail = "admins@clan.lol";
|
|
|
|
users = {
|
|
admin = {
|
|
admin = true;
|
|
};
|
|
w = { };
|
|
};
|
|
};
|
|
};
|
|
wireguard-infra = {
|
|
module = {
|
|
name = "wireguard";
|
|
input = "clan-core";
|
|
};
|
|
roles.controller.machines = {
|
|
web01.settings.endpoint = "clan.lol";
|
|
build01.settings.endpoint = "build01.clan.lol";
|
|
build-x86-01.settings.endpoint = "build-x86-01.clan.lol";
|
|
build04.settings.endpoint = "build04.clan.lol";
|
|
jitsi01.settings.endpoint = "jitsi.clan.lol";
|
|
web02.settings.endpoint = "thecomputer.co";
|
|
};
|
|
roles.peer.machines = {
|
|
storinator01.settings.controller = "web01";
|
|
build02.settings.controller = "web01";
|
|
};
|
|
};
|
|
};
|
|
|
|
secrets.age.plugins = [
|
|
"age-plugin-1p"
|
|
"age-plugin-yubikey"
|
|
];
|
|
};
|
|
|
|
perSystem =
|
|
{
|
|
inputs',
|
|
pkgs,
|
|
...
|
|
}:
|
|
{
|
|
terranix =
|
|
let
|
|
package = pkgs.opentofu.withPlugins (p: [
|
|
p.hashicorp_external
|
|
p.hashicorp_local
|
|
p.hashicorp_null
|
|
p.hashicorp_tls
|
|
p.hetznercloud_hcloud
|
|
p.vultr_vultr
|
|
]);
|
|
cachePackage = pkgs.opentofu.withPlugins (p: [
|
|
p.hashicorp_external
|
|
p.fastly_fastly
|
|
inputs'.nixpkgs-terraform-providers-bin.legacyPackages.providers.Backblaze.b2
|
|
]);
|
|
in
|
|
{
|
|
# `nix run .#dns` will fail
|
|
# This is used as a module from the `terraform` terranix config
|
|
terranixConfigurations.dns = {
|
|
workdir = "terraform";
|
|
modules = [
|
|
self.modules.terranix.base
|
|
self.modules.terranix.dns
|
|
];
|
|
terraformWrapper.package = package;
|
|
terraformWrapper.extraRuntimeInputs = [ inputs'.clan-core.packages.default ];
|
|
terraformWrapper.prefixText = ''
|
|
TF_VAR_passphrase=$(clan secrets get tf-passphrase)
|
|
export TF_VAR_passphrase
|
|
'';
|
|
};
|
|
|
|
terranixConfigurations.terraform = {
|
|
workdir = "terraform";
|
|
modules = [
|
|
self.modules.terranix.base
|
|
self.modules.terranix.with-dns
|
|
self.modules.terranix.vultr
|
|
self.modules.terranix.build01
|
|
self.modules.terranix.build02
|
|
self.modules.terranix.build04
|
|
self.modules.terranix.build-x86-01
|
|
self.modules.terranix.jitsi01
|
|
self.modules.terranix.storinator01
|
|
self.modules.terranix.web01
|
|
self.modules.terranix.web02
|
|
];
|
|
terraformWrapper.package = package;
|
|
terraformWrapper.extraRuntimeInputs = [ inputs'.clan-core.packages.default ];
|
|
terraformWrapper.prefixText = ''
|
|
TF_VAR_passphrase=$(clan secrets get tf-passphrase)
|
|
export TF_VAR_passphrase
|
|
TF_ENCRYPTION=$(cat <<'EOF'
|
|
key_provider "pbkdf2" "state_encryption_password" {
|
|
passphrase = var.passphrase
|
|
}
|
|
method "aes_gcm" "encryption_method" {
|
|
keys = key_provider.pbkdf2.state_encryption_password
|
|
}
|
|
state {
|
|
enforced = true
|
|
method = method.aes_gcm.encryption_method
|
|
}
|
|
EOF
|
|
)
|
|
|
|
# shellcheck disable=SC2090
|
|
export TF_ENCRYPTION
|
|
'';
|
|
};
|
|
|
|
# Separate Fastly cache configuration
|
|
terranixConfigurations.cache = {
|
|
workdir = "terraform-cache";
|
|
modules = [
|
|
self.modules.terranix.cache
|
|
];
|
|
terraformWrapper.package = cachePackage;
|
|
terraformWrapper.extraRuntimeInputs = [ inputs'.clan-core.packages.default ];
|
|
terraformWrapper.prefixText = ''
|
|
TF_VAR_passphrase=$(clan secrets get tf-passphrase)
|
|
export TF_VAR_passphrase
|
|
TF_ENCRYPTION=$(cat <<'EOF'
|
|
key_provider "pbkdf2" "state_encryption_password" {
|
|
passphrase = var.passphrase
|
|
}
|
|
method "aes_gcm" "encryption_method" {
|
|
keys = key_provider.pbkdf2.state_encryption_password
|
|
}
|
|
state {
|
|
enforced = true
|
|
method = method.aes_gcm.encryption_method
|
|
}
|
|
EOF
|
|
)
|
|
|
|
# shellcheck disable=SC2090
|
|
export TF_ENCRYPTION
|
|
'';
|
|
};
|
|
|
|
# Separate Fastly cache configuration for cache.clan.lol
|
|
terranixConfigurations.cache-new = {
|
|
workdir = "terraform-cache-new";
|
|
modules = [
|
|
self.modules.terranix.cache-new
|
|
];
|
|
terraformWrapper.package = cachePackage;
|
|
terraformWrapper.extraRuntimeInputs = [ inputs'.clan-core.packages.default ];
|
|
terraformWrapper.prefixText = ''
|
|
TF_VAR_passphrase=$(clan secrets get tf-passphrase)
|
|
export TF_VAR_passphrase
|
|
TF_ENCRYPTION=$(cat <<'EOF'
|
|
key_provider "pbkdf2" "state_encryption_password" {
|
|
passphrase = var.passphrase
|
|
}
|
|
method "aes_gcm" "encryption_method" {
|
|
keys = key_provider.pbkdf2.state_encryption_password
|
|
}
|
|
state {
|
|
enforced = true
|
|
method = method.aes_gcm.encryption_method
|
|
}
|
|
EOF
|
|
)
|
|
|
|
# shellcheck disable=SC2090
|
|
export TF_ENCRYPTION
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
}
|