From cf086dc3e86039a07915445aa66bb82aebf9db0a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Tue, 1 Oct 2024 13:07:09 +0200 Subject: [PATCH] Import vm02186's configuration as a flake --- flake.nix | 24 +++++ gitea-runner.nix | 41 ++++++++ hardware-configuration.nix | 37 +++++++ procolix-configuration.nix | 192 +++++++++++++++++++++++++++++++++++++ 4 files changed, 294 insertions(+) create mode 100644 flake.nix create mode 100644 gitea-runner.nix create mode 100644 hardware-configuration.nix create mode 100644 procolix-configuration.nix diff --git a/flake.nix b/flake.nix new file mode 100644 index 0000000..178f7f6 --- /dev/null +++ b/flake.nix @@ -0,0 +1,24 @@ +{ + inputs = { + nixpkgs.url = "github:nixos/nixpkgs/nixos-24.05"; + snf.url = "git+https://git.fediversity.eu/fediversity/simple-nixos-fediverse.git"; + }; + + outputs = { self, nixpkgs, snf }: + let + vmName = "vm02186"; + + in { + nixosConfigurations.${vmName} = nixpkgs.lib.nixosSystem { + system = "x86_64-linux"; + + modules = [ + ./procolix-configuration.nix + ./hardware-configuration.nix + ./gitea-runner.nix + ]; + }; + + isoInstallers.${vmName} = snf.mkInstaller nixpkgs self.nixosConfigurations.${vmName}; + }; +} diff --git a/gitea-runner.nix b/gitea-runner.nix new file mode 100644 index 0000000..ddfb335 --- /dev/null +++ b/gitea-runner.nix @@ -0,0 +1,41 @@ +{ pkgs, config, ... }: + +{ + services.gitea-actions-runner = { + package = pkgs.forgejo-actions-runner; + + instances.default = { + enable = true; + + name = config.networking.fqdn; + url = "https://git.fediversity.eu"; + token = "MKmFPY4nxfR4zPYHIRLoiJdrrfkGmcRymj0GWOAk"; + + settings = { + log.level = "info"; + runner = { + file = ".runner"; + capacity = 24; + timeout = "3h"; + insecure = false; + fetch_timeout = "5s"; + fetch_interval = "2s"; + }; + }; + + ## This runner supports Docker (with a default Ubuntu image) and native + ## modes. In native mode, it contains a few default packages. + labels = ["docker:docker://node:16-bullseye" "native:host"]; + hostPackages = with pkgs; [ bash git nix nodejs ]; + }; + }; + + ## For the Docker mode of the runner. + virtualisation.docker.enable = true; + + ## The Nix configuration of the system influences the Nix configuration + ## in the workflow, and our workflows are often flake-based. + nix.extraOptions = '' + experimental-features = nix-command flakes + ''; +} diff --git a/hardware-configuration.nix b/hardware-configuration.nix new file mode 100644 index 0000000..08ef493 --- /dev/null +++ b/hardware-configuration.nix @@ -0,0 +1,37 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ "dm-snapshot" ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/833ac0f9-ad8c-45ae-a9bf-5844e378c44a"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/B4D5-3AF9"; + fsType = "vfat"; + options = [ "fmask=0022" "dmask=0022" ]; + }; + + swapDevices = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.ens18.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/procolix-configuration.nix b/procolix-configuration.nix new file mode 100644 index 0000000..08a6b18 --- /dev/null +++ b/procolix-configuration.nix @@ -0,0 +1,192 @@ +{ pkgs, ... }: + +{ + # Use the systemd-boot EFI boot loader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + networking = { + hostName = "vm02186"; + domain = "procolix.com"; + interfaces = { + eth0 = { + ipv4 = { + addresses = [ + { + address = "185.206.232.186"; + prefixLength = 24; + } + ]; + }; + ipv6 = { + addresses = [ + { + address = "2a00:51c0:12:1201::186"; + prefixLength = 64; + } + ]; + }; + }; + }; + defaultGateway = { + address = "185.206.232.1"; + interface = "eth0"; + }; + defaultGateway6 = { + address = "2a00:51c0:12:1201::1"; + interface = "eth0"; + }; + nameservers = [ "95.215.185.6" "95.215.185.7" ]; + firewall.enable = false; + nftables = { + enable = true; + ruleset = '' + #!/usr/sbin/nft -f + + flush ruleset + + ########### define usefull variables here ##################### + define wan = eth0 + define ssh_allow = { + 83.161.147.127/32, # host801 ipv4 + 95.215.185.92/32, # host088 ipv4 + 95.215.185.211/32, # host089 ipv4 + 95.215.185.34/32, # nagios2 ipv4 + 95.215.185.181/32, # ansible.procolix.com + 95.215.185.235/32, # ansible-hq + } + define snmp_allow = { + 95.215.185.31/32, # cacti ipv4 + } + define nrpe_allow = { + 95.215.185.34/32, # nagios2 ipv4 + } + + ########### here starts the automated bit ##################### + table inet filter { + chain input { + type filter hook input priority 0; + policy drop; + + # established/related connections + ct state established,related accept + ct state invalid drop + + # Limit ping requests. + ip protocol icmp icmp type echo-request limit rate over 10/second burst 50 packets drop + ip6 nexthdr icmpv6 icmpv6 type echo-request limit rate over 10/second burst 50 packets drop + + # loopback interface + iifname lo accept + + # icmp + ip protocol icmp icmp type { destination-unreachable, echo-reply, echo-request, source-quench, time-exceeded } accept + # Without the nd-* ones ipv6 will not work. + ip6 nexthdr icmpv6 icmpv6 type { destination-unreachable, echo-reply, echo-request, nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert, packet-too-big, parameter-problem, time-exceeded } accept + + # open tcp ports: sshd (22) + tcp dport {ssh} accept + + # open tcp ports: snmp (161) + ip saddr $snmp_allow udp dport {snmp} accept + + # open tcp ports: nrpe (5666) + ip saddr $nrpe_allow tcp dport {nrpe} accept + + # open tcp ports: http (80,443) + tcp dport {http,https} accept + } + chain forward { + type filter hook forward priority 0; + } + chain output { + type filter hook output priority 0; + } + } + + table ip nat { + chain postrouting { + } + chain prerouting { + } + } + ''; + }; + }; + + + # Set your time zone. + time.timeZone = "Europe/Amsterdam"; + + # Select internationalisation properties. + i18n.defaultLocale = "en_US.UTF-8"; + + # Define a user account. Don't forget to set a password with ‘passwd’. + users.users.root.hashedPassword = "$y$j9T$WXvLAUqArJJusuC017FCW0$.rfMOeyx/BsClkJFi5hLcynrSk.njWmfiB6Uy.9th3A"; + + users.users.procolix = { + isNormalUser = true; + extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. + hashedPassword = "$y$j9T$UH8Dh/poTCCZ3PXk43au6/$iYen8VUEVvv7SIPqteNtTPKktLxny3TbqvjUwhvi.6B"; + openssh.authorizedKeys.keys = [ + "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAotfCIjLoDlHOe+++kVS1xiBPaS8mC5FypgrxDrDVst6SHxMTca2+IScMajzUZajenvNAoZOwIsyAPacT8OHeyFvV5Y7G874Qa+cZVqJxLht9gdXxr1GNabU3RfhhCh272dUeIKIqfgsRsM2HzdnZCMDavS1Yo+f+RhhHhnJIua+NdVFo21vPrpsz+Cd0M1NhojARLajrTHvEXW0KskUnkbfgxT0vL9jeRZxdgMS+a9ZoR5dbzOxQHWfbP8N04Xc+7CweMlvKwlWuAE/xDb5XLNHorfGWFvZuVhptJN8jPaaVS25wsmsF5IbaAuSZfzCtBdFQhIloUhy0L6ZisubHjQ== procolix@sshnode1" + "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAuT3C0f3nyQ7SwUvXcFmEYEgwL+crY6iK0Bhoi9yfn4soz3fhfMKyKSwc/0RIlRnrz3xnkyJiV0vFeU7AC1ixbGCS3T9uc0G1x0Yedd9n2yR8ZJmkdyfjZ5KE4YvqZ3f6UZn5Mtj+7tGmyp+ee+clLSHzsqeyDiX0FIgFmqiiAVJD6qeKPFAHeWz9b2MOXIBIw+fSLOpx0rosCgesOmPc8lgFvo+dMKpSlPkCuGLBPj2ObT4sLjc98NC5z8sNJMu3o5bMbiCDR9JWgx9nKj+NlALwk3Y/nzHSL/DNcnP5vz2zbX2CBKjx6ju0IXh6YKlJJVyMsH9QjwYkgDQVmy8amQ== procolix@sshnode2" + ]; + packages = with pkgs; [ + ]; + }; + + users.users.niols = { + isNormalUser = true; + extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEElREJN0AC7lbp+5X204pQ5r030IbgCllsIxyU3iiKY niols@wallace" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBkQXv/VRZLfV0wNN9PHedmKWyAIfpPUCdaznHZNIDkS niols@orianne/fediversity" + ]; + packages = with pkgs; [ + ]; + }; + + users.users.valentin = { + isNormalUser = true; + extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user. + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOJzgwAYAoMexc1fBJxU08YmsiU9T4Ua8QFeE4/kZNZ5" + ]; + packages = with pkgs; [ + ]; + }; + + # List packages installed in system profile. To search, run: + # $ nix search wget + environment.systemPackages = with pkgs; [ + (pkgs.vim_configurable.customize { + name = "vim"; + vimrcConfig.packages.myplugins = with pkgs.vimPlugins; { + start = [ vim-nix ]; # load plugin on startup + }; + vimrcConfig.customRC = '' + " your custom vimrc + set nocompatible + set backspace=indent,eol,start + " Turn on syntax highlighting by default + syntax on + " ... + ''; + }) + wget + ]; + + # List services that you want to enable: + + # Enable the OpenSSH daemon. + services.openssh.enable = true; + + # This value determines the NixOS release from which the default + # settings for stateful data, like file locations and database versions + # on your system were taken. It‘s perfectly fine and recommended to leave + # this value at the release version of the first install of this system. + # Before changing this value read the documentation for this option + # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html). + system.stateVersion = "24.05"; # Did you read the comment? +}