From e9a4185401603ebe188267d7e50609445ce68889 Mon Sep 17 00:00:00 2001 From: Kiara Grouwstra Date: Mon, 24 Feb 2025 13:31:31 +0100 Subject: [PATCH 01/73] users: add kiara --- infra/common/nixos/users.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/infra/common/nixos/users.nix b/infra/common/nixos/users.nix index adb6d7c3..db2af31e 100644 --- a/infra/common/nixos/users.nix +++ b/infra/common/nixos/users.nix @@ -25,6 +25,14 @@ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOJzgwAYAoMexc1fBJxU08YmsiU9T4Ua8QFeE4/kZNZ5" ]; }; + + kiara = { + isNormalUser = true; + extraGroups = [ "wheel" ]; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDHTIqF4CAylSxKPiSo5JOPuocn0y2z38wOSsQ1MUaZ2" + ]; + }; }; security.sudo.wheelNeedsPassword = false; From c74fc4f927adb7d41c9280d6310d381a2d2f4ecc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Mon, 24 Feb 2025 14:49:53 +0100 Subject: [PATCH 02/73] Add VM for the front-end (#183) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit For now, I created yet another deployment. Basically, this seems to tell me that we only ever use: - one deployment per machine (when we change its configuration) - one big deployment for all of them (eg. for nixpkgs updates or new contributor) but that the current split into themes doesn't really work. I can discontinue it in another PR. `fedi201` is accessible under `fedi201.abundos.eu`. Its configuration lives in `infra/fedi201/default.nix`. This Nix file is a NixOps4 resource module, not a NixOS configuration module; you probably want to add a `nixos.module` field to it where you put your NixOS configuration. Reviewed-on: https://git.fediversity.eu/Fediversity/Fediversity/pulls/183 Reviewed-by: kiara Grouwstra Co-authored-by: Nicolas “Niols” Jeannerod Co-committed-by: Nicolas “Niols” Jeannerod --- infra/README.md | 1 + infra/fedi201/default.nix | 13 +++++++++++++ infra/flake-part.nix | 3 +++ keys/systems/fedi201.pub | 1 + 4 files changed, 18 insertions(+) create mode 100644 infra/fedi201/default.nix create mode 100644 keys/systems/fedi201.pub diff --git a/infra/README.md b/infra/README.md index 0643ed54..ac1cfe33 100644 --- a/infra/README.md +++ b/infra/README.md @@ -127,4 +127,5 @@ They host our stable infrastructure. vm02186 Procolix *unused* `other` vm02187 Procolix Wiki `web` fedi200 Fediversity Testing machine for Hans `hans` + fedi201 Fediversity FediPanel `kiara` fedi300 Fediversity Forgejo actions runner `git` diff --git a/infra/fedi201/default.nix b/infra/fedi201/default.nix new file mode 100644 index 00000000..c0d1bd90 --- /dev/null +++ b/infra/fedi201/default.nix @@ -0,0 +1,13 @@ +{ + fediversityVm = { + domain = "abundos.eu"; + ipv4 = { + address = "95.215.187.201"; + gateway = "95.215.187.1"; + }; + ipv6 = { + address = "2a00:51c0:13:1305::201"; + gateway = "2a00:51c0:13:1305::1"; + }; + }; +} diff --git a/infra/flake-part.nix b/infra/flake-part.nix index 496ab033..871176e7 100644 --- a/infra/flake-part.nix +++ b/infra/flake-part.nix @@ -86,6 +86,9 @@ let hans = [ "fedi200" ]; + kiara = [ + "fedi201" + ]; }; in diff --git a/keys/systems/fedi201.pub b/keys/systems/fedi201.pub new file mode 100644 index 00000000..1e769352 --- /dev/null +++ b/keys/systems/fedi201.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILhSlUo7L/TjoAILfLv/BDxlBT+rGudh9VoK50Uiu2lZ root@fedi201 From 1677c9f8d770c57c12ab3487c94530bada8b777d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Mon, 24 Feb 2025 14:54:28 +0100 Subject: [PATCH 03/73] Remove `environment.systemPackages` from VMs (#176) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Closes #25 Co-authored-by: kiara Grouwstra Reviewed-on: https://git.fediversity.eu/Fediversity/Fediversity/pulls/176 Reviewed-by: kiara Grouwstra Co-authored-by: Nicolas “Niols” Jeannerod Co-committed-by: Nicolas “Niols” Jeannerod --- infra/common/nixos/default.nix | 21 +-------------------- 1 file changed, 1 insertion(+), 20 deletions(-) diff --git a/infra/common/nixos/default.nix b/infra/common/nixos/default.nix index 623b1240..b870ab03 100644 --- a/infra/common/nixos/default.nix +++ b/infra/common/nixos/default.nix @@ -1,4 +1,4 @@ -{ lib, pkgs, ... }: +{ lib, ... }: let inherit (lib) mkDefault; @@ -22,23 +22,4 @@ in nix.extraOptions = '' experimental-features = nix-command flakes ''; - - environment.systemPackages = with pkgs; [ - (pkgs.vim_configurable.customize { - name = "vim"; - vimrcConfig.packages.myplugins = with pkgs.vimPlugins; { - start = [ vim-nix ]; # load plugin on startup - }; - vimrcConfig.customRC = '' - " your custom vimrc - set nocompatible - set backspace=indent,eol,start - " Turn on syntax highlighting by default - syntax on - " ... - ''; - }) - wget - subversion - ]; } From 0813eca20c58e28cd39494c3966b745b6507b839 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Mon, 24 Feb 2025 12:39:49 +0100 Subject: [PATCH 04/73] Add options for Proxmox and Proxmox VM id --- infra/common/options.nix | 24 ++++++++++++++++++++++++ infra/fedi200/default.nix | 2 ++ 2 files changed, 26 insertions(+) diff --git a/infra/common/options.nix b/infra/common/options.nix index 39c2e1d2..4ea5e62e 100644 --- a/infra/common/options.nix +++ b/infra/common/options.nix @@ -2,6 +2,7 @@ let inherit (lib) mkOption; + inherit (lib.types) types; in { @@ -13,6 +14,29 @@ in ''; }; + proxmox = mkOption { + type = types.nullOr ( + types.enum [ + "procolix" + "fediversity" + ] + ); + description = '' + The Proxmox instance. This is used for provisioning only and should be + set to `null` if the machine is not a VM. + ''; + }; + + vmId = mkOption { + # REVIEW: There is `types.ints.between` but maybe not `types.ints.above`? + type = types.nullOr (types.addCheck types.int (x: x >= 100)); + description = '' + The id of the machine in the corresponding Proxmox. This is used for + provisioning only and should be set to `null` if the machine is not a + VM. + ''; + }; + domain = mkOption { description = '' The domain hosting the machine. Most of the time, this will be either of diff --git a/infra/fedi200/default.nix b/infra/fedi200/default.nix index b8db0479..db9950ea 100644 --- a/infra/fedi200/default.nix +++ b/infra/fedi200/default.nix @@ -1,5 +1,7 @@ { fediversityVm = { + vmId = 200; + proxmox = "fediversity"; domain = "abundos.eu"; ipv4 = { address = "95.215.187.200"; From 71d1c612a4a169645f123ec3f0d199e4e0260e35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Mon, 24 Feb 2025 12:46:10 +0100 Subject: [PATCH 05/73] Get rid of `fedi300` It has been off for a long while now. We will just add a VM again if there is one ever. --- infra/README.md | 1 - infra/fedi300/default.nix | 40 --------------------- infra/fedi300/forgejo-actions-runner.nix | 44 ------------------------ infra/flake-part.nix | 1 - keys/systems/fedi300.pub | 1 - secrets/secrets.nix | 2 +- 6 files changed, 1 insertion(+), 88 deletions(-) delete mode 100644 infra/fedi300/default.nix delete mode 100644 infra/fedi300/forgejo-actions-runner.nix delete mode 100644 keys/systems/fedi300.pub diff --git a/infra/README.md b/infra/README.md index ac1cfe33..25250245 100644 --- a/infra/README.md +++ b/infra/README.md @@ -128,4 +128,3 @@ They host our stable infrastructure. vm02187 Procolix Wiki `web` fedi200 Fediversity Testing machine for Hans `hans` fedi201 Fediversity FediPanel `kiara` - fedi300 Fediversity Forgejo actions runner `git` diff --git a/infra/fedi300/default.nix b/infra/fedi300/default.nix deleted file mode 100644 index deb76c3a..00000000 --- a/infra/fedi300/default.nix +++ /dev/null @@ -1,40 +0,0 @@ -{ - fediversityVm = { - domain = "fediversity.eu"; - - ipv4 = { - address = "95.215.187.30"; - gateway = "95.215.187.1"; - }; - ipv6 = { - address = "2a00:51c0:12:1305::30"; - gateway = "2a00:51c0:13:1305::1"; - }; - }; - - nixos.module = - { lib, ... }: - { - imports = [ - ./forgejo-actions-runner.nix - ]; - - ## NOTE: This VM was created manually, which requires us to override the - ## default disko-based `fileSystems` definition. - fileSystems = lib.mkForce { - "/" = { - device = "/dev/disk/by-uuid/cbcfaf6b-39bd-4328-9f53-dea8a9d32ecc"; - fsType = "ext4"; - }; - - "/boot" = { - device = "/dev/disk/by-uuid/1A4E-07F4"; - fsType = "vfat"; - options = [ - "fmask=0022" - "dmask=0022" - ]; - }; - }; - }; -} diff --git a/infra/fedi300/forgejo-actions-runner.nix b/infra/fedi300/forgejo-actions-runner.nix deleted file mode 100644 index 39024b60..00000000 --- a/infra/fedi300/forgejo-actions-runner.nix +++ /dev/null @@ -1,44 +0,0 @@ -{ pkgs, config, ... }: - -{ - services.gitea-actions-runner = { - package = pkgs.forgejo-actions-runner; - - instances.default = { - enable = true; - - name = config.networking.fqdn; - url = "https://git.fediversity.eu"; - tokenFile = config.age.secrets.forgejo-runner-token.path; - - settings = { - log.level = "info"; - runner = { - file = ".runner"; - capacity = 24; - timeout = "3h"; - insecure = false; - fetch_timeout = "5s"; - fetch_interval = "2s"; - }; - }; - - ## This runner supports Docker (with a default Ubuntu image) and native - ## modes. In native mode, it contains a few default packages. - labels = [ - "docker:docker://node:16-bullseye" - "native:host" - ]; - - hostPackages = with pkgs; [ - bash - git - nix - nodejs - ]; - }; - }; - - ## For the Docker mode of the runner. - virtualisation.docker.enable = true; -} diff --git a/infra/flake-part.nix b/infra/flake-part.nix index 871176e7..cf26e87c 100644 --- a/infra/flake-part.nix +++ b/infra/flake-part.nix @@ -76,7 +76,6 @@ let machines = { git = [ "vm02116" - "fedi300" ]; web = [ "vm02187" ]; other = [ diff --git a/keys/systems/fedi300.pub b/keys/systems/fedi300.pub deleted file mode 100644 index 1f2f6a8c..00000000 --- a/keys/systems/fedi300.pub +++ /dev/null @@ -1 +0,0 @@ -ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGFH/Kvye5It8FojdjpsuyZQiU0kxj2wq7Zq/+61vxNn diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 10520da9..ae5f19ed 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -26,7 +26,7 @@ concatMapAttrs { forgejo-database-password = [ vm02116 ]; forgejo-email-password = [ vm02116 ]; - forgejo-runner-token = [ fedi300 ]; + forgejo-runner-token = [ ]; wiki-basicauth-htpasswd = [ vm02187 ]; wiki-password = [ vm02187 ]; wiki-smtp-password = [ vm02187 ]; From af4a0a0784cced4f2bb2df9033ec3edece3df23f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Mon, 24 Feb 2025 12:50:33 +0100 Subject: [PATCH 06/73] Add options for sockets, cores and memory --- infra/common/options.nix | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) diff --git a/infra/common/options.nix b/infra/common/options.nix index 4ea5e62e..d2c08c3a 100644 --- a/infra/common/options.nix +++ b/infra/common/options.nix @@ -37,6 +37,24 @@ in ''; }; + sockets = mkOption { + type = types.int; + description = "The number of sockets of the VM."; + default = 1; + }; + + cores = mkOption { + type = types.int; + description = "The number of cores of the VM."; + default = 1; + }; + + memory = mkOption { + type = types.int; + description = "The amount of memory of the VM in MiB."; + default = 2048; + }; + domain = mkOption { description = '' The domain hosting the machine. Most of the time, this will be either of From 10874c995e59ab068be532751d254d7e061ec1dd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Mon, 24 Feb 2025 12:50:43 +0100 Subject: [PATCH 07/73] Split sections in options --- infra/common/options.nix | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/infra/common/options.nix b/infra/common/options.nix index d2c08c3a..f2ff8147 100644 --- a/infra/common/options.nix +++ b/infra/common/options.nix @@ -7,6 +7,10 @@ let in { options.fediversityVm = { + + ########################################################################## + ## Meta + name = mkOption { description = '' The name of the machine. Most of the time, this will look like `vm02XXX` @@ -37,6 +41,9 @@ in ''; }; + ########################################################################## + ## Virtualised hardware + sockets = mkOption { type = types.int; description = "The number of sockets of the VM."; @@ -55,6 +62,9 @@ in default = 2048; }; + ########################################################################## + ## Networking + domain = mkOption { description = '' The domain hosting the machine. Most of the time, this will be either of From 4fda719992516d5624905207ff3140b30d600f43 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Mon, 24 Feb 2025 12:52:19 +0100 Subject: [PATCH 08/73] Expose VM options in the flake --- infra/flake-part.nix | 33 +++++++++++++++++++++++++++------ 1 file changed, 27 insertions(+), 6 deletions(-) diff --git a/infra/flake-part.nix b/infra/flake-part.nix index cf26e87c..81dba2ac 100644 --- a/infra/flake-part.nix +++ b/infra/flake-part.nix @@ -56,23 +56,40 @@ let }; }; + makeResourceConfig = + vmName: + (evalModules { + modules = [ + nixops4ResourceNixosMockOptions + (makeResourceModule vmName) + ]; + }).config; + makeConfigurations = concatMapAttrs ( _: vmNames: genAttrs vmNames ( vmName: inputs.nixpkgs.lib.nixosSystem { modules = [ - (evalModules { - modules = [ - nixops4ResourceNixosMockOptions - (makeResourceModule vmName) - ]; - }).config.nixos.module + (makeResourceConfig vmName).nixos.module ]; } ) ); + makeVmOptions = concatMapAttrs ( + _: vmNames: + genAttrs vmNames (vmName: { + inherit ((makeResourceConfig vmName).fediversityVm) + proxmox + vmId + sockets + cores + memory + ; + }) + ); + machines = { git = [ "vm02116" @@ -94,6 +111,10 @@ in { flake.lib.makeInstallerIso = import ./makeInstallerIso.nix; + ## REVIEW: It would probably make more sense to have the VM names as parent of + ## the corresponding resource, NixOS configuration, and VM options, rather + ## than the contrary. nixops4Deployments = makeDeployments (addDefaultDeployment machines); flake.nixosConfigurations = makeConfigurations machines; + flake.vmOptions = makeVmOptions machines; } From 4ae3fc27be18103aa2117023b71ce5fd717e7b96 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Mon, 24 Feb 2025 13:03:29 +0100 Subject: [PATCH 09/73] Have the provisioning script grab options from the flake --- infra/proxmox-provision.sh | 74 ++++++++++++++++---------------------- 1 file changed, 31 insertions(+), 43 deletions(-) diff --git a/infra/proxmox-provision.sh b/infra/proxmox-provision.sh index a789bbf6..22207af4 100755 --- a/infra/proxmox-provision.sh +++ b/infra/proxmox-provision.sh @@ -18,35 +18,23 @@ mkdir $tmpdir api_url= username= password= -sockets=1 -cores=1 -memory=2048 -vm_ids= +vm_names= debug=false help () { cat <` and `nixosConfigurations.` to get the informations that +it needs. Options: --api-url STR Base URL of the Proxmox API (required) --username STR Username, with provider (eg. niols@pve; required) --password STR Password (required) - --cores INT Number of cores (default: $cores) - --memory INT Memory (default: $memory) - --sockets INT Number of sockets (default: $sockets) - --debug Run this script in debug mode (default: $debug) -h|-?|--help Show this help and exit @@ -54,7 +42,6 @@ Options can also be provided by adding assignments to a '.proxmox' file in the current working directory. For instance, it could contain: api_url=https://192.168.51.81:8006/api2/json - cores=7 username=mireille@pve debug=true @@ -82,32 +69,24 @@ while [ $# -gt 0 ]; do --username) readonly username="$1"; shift ;; --password) readonly password="$1"; shift ;; - --sockets) sockets=$1; shift ;; - --cores) cores=$1; shift ;; - --memory) memory=$1; shift ;; - --debug) debug=true ;; -h|-\?|--help) help; exit 0 ;; -*) die_with_help "Unknown argument: '%s'." "$argument" ;; - *) vm_ids="$vm_ids $argument" ;; + *) vm_names="$vm_names $argument" ;; esac done -if [ -z "$vm_ids" ]; then - die_with_help "Required: at least one VM id." +if [ -z "$vm_names" ]; then + die_with_help "Required: at least one VM name." fi if [ -z "$api_url" ] || [ -z "$username" ] || [ -z "$password" ]; then die_with_help "Required: '--api-url', '--username' and '--password'." fi -readonly sockets -readonly cores -readonly memory - ## FIXME: When we figure out how to use other nodes than node051. # if [ -z "$node" ]; then # printf 'Picking random node...' @@ -178,6 +157,19 @@ proxmox_sync () ( done ) +################################################################################ +## Grab VM option +## +## Takes the name of the VM and an option and grabs `vmOptions..