revert nftables ruleset

rm unused dep nix-templating

fix imports

.forgejo/workflows/ci.yaml

@@ -56,29 +56,3 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - run: nix build .#checks.x86_64-linux.deployment-panel -L
-
-  ## NOTE: NixOps4 does not provide a good “dry run” mode, so we instead check
-  ## proxies for resources, namely whether their `.#vmOptions.<machine>` and
-  ## `.#nixosConfigurations.<machine>` outputs evaluate and build correctly, and
-  ## whether we can dry run `infra/proxmox-*.sh` on them. This will not catch
-  ## everything, and in particular not issues in how NixOps4 wires up the
-  ## resources, but that is still something.
-  check-resources:
-    runs-on: native
-    steps:
-      - uses: actions/checkout@v4
-      - run: |
-          set -euC
-          echo ==================== [ VM Options ] ====================
-          machines=$(nix eval --impure --raw --expr 'with builtins; toString (attrNames (getFlake (toString ./.)).vmOptions)')
-          for machine in $machines; do
-            echo ~~~~~~~~~~~~~~~~~~~~~: $machine :~~~~~~~~~~~~~~~~~~~~~
-            nix build .#checks.x86_64-linux.vmOptions-$machine
-          done
-          echo
-          echo ==================== [ NixOS Configurations ] ====================
-          machines=$(nix eval --impure --raw --expr 'with builtins; toString (attrNames (getFlake (toString ./.)).nixosConfigurations)')
-          for machine in $machines; do
-            echo ~~~~~~~~~~~~~~~~~~~~~: $machine :~~~~~~~~~~~~~~~~~~~~~
-            nix build .#checks.x86_64-linux.nixosConfigurations-$machine
-          done

.forgejo/workflows/update.yaml

@@ -13,7 +13,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
       - name: Update pins
-        run: nix-shell --run "npins --verbose update"
+        run: nix-shell --run "npins update"
       - name: Create PR
         uses: https://github.com/KiaraGrouwstra/gitea-create-pull-request@f9f80aa5134bc5c03c38f5aaa95053492885b397
         with:

deployment/check/common/nixosTest.nix

@@ -48,8 +48,7 @@ in
     extraTestScript = mkOption { };
 
     sourceFileset = mkOption {
-      ## FIXME: grab `lib.types.fileset` from NixOS, once upstreaming PR
-      ## https://github.com/NixOS/nixpkgs/pull/428293 lands.
+      ## REVIEW: Upstream to nixpkgs?
       type = types.mkOptionType {
         name = "fileset";
         description = "fileset";

infra/common/options.nix

@@ -20,13 +20,16 @@ in
       '';
     };
 
-    isFediversityVm = mkOption {
-      type = types.bool;
+    proxmox = mkOption {
+      type = types.nullOr (
+        types.enum [
+          "procolix"
+          "fediversity"
+        ]
+      );
       description = ''
-        Whether the machine is a Fediversity VM or not. This is used to
-        determine whether the machine should be provisioned via Proxmox or not.
-        Machines that are _not_ Fediversity VM could be physical machines, or
-        VMs that live outside Fediversity, eg. on Procolix's Proxmox.
+        The Proxmox instance. This is used for provisioning only and should be
+        set to `null` if the machine is not a VM.
       '';
     };
 

infra/common/proxmox-qemu-vm.nix

@@ -1,14 +1,10 @@
-{ ... }:
-
+{ sources, ... }:
 {
   _class = "nixos";
 
-  ## FIXME: It would be nice, but the following leads to infinite recursion
-  ## in the way we currently plug `sources` in.
-  ##
-  # imports = [
-  #   "${sources.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
-  # ];
+  imports = [
+    "${sources.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
+  ];
 
   boot = {
     initrd = {

infra/common/resource.nix

@@ -2,6 +2,7 @@
   inputs,
   lib,
   config,
+  sources,
   keys,
   secrets,
   ...
@@ -31,10 +32,13 @@ in
   ## options that really need to be injected from the resource. Everything else
   ## should go into the `./nixos` subdirectory.
   nixos.module = {
-    imports = [
+    imports = with sources; [
+      "${agenix}/modules/age.nix"
+      "${disko}/module.nix"
+      "${vars}/options.nix"
+      "${vars}/backends/on-machine.nix"
       ./options.nix
       ./nixos
-      ./proxmox-qemu-vm.nix
     ];
 
     ## Inject the shared options from the resource's `config` into the NixOS

infra/flake-part.nix

@@ -14,57 +14,88 @@ let
     mkOption
     evalModules
     filterAttrs
-    mapAttrs'
-    deepSeq
     ;
   inherit (lib.attrsets) genAttrs;
 
-  commonResourceModule = {
-    # TODO(@fricklerhandwerk): this is terrible but IMO we should just ditch
-    # flake-parts and have our own data model for how the project is organised
-    # internally
-    _module.args = {
-      inherit
-        inputs
-        keys
-        secrets
-        sources
-        ;
+  ## Given a machine's name and whether it is a test VM, make a resource module,
+  ## except for its missing provider. (Depending on the use of that resource, we
+  ## will provide a different one.)
+  makeResourceModule =
+    { vmName, isTestVm }:
+    {
+      # TODO(@fricklerhandwerk): this is terrible but IMO we should just ditch flake-parts and have our own data model for how the project is organised internally
+      _module.args = {
+        inherit
+          inputs
+          keys
+          secrets
+          ;
+      };
+
+      nixos.module.imports = [
+        ./common/proxmox-qemu-vm.nix
+      ];
+
+      nixos.specialArgs = {
+        inherit sources;
+      };
+
+      imports =
+        [
+          ./common/resource.nix
+        ]
+        ++ (
+          if isTestVm then
+            [
+              ../machines/operator/${vmName}
+              {
+                nixos.module.users.users.root.openssh.authorizedKeys.keys = [
+                  # allow our panel vm access to the test machines
+                  keys.panel
+                ];
+              }
+            ]
+          else
+            [
+              ../machines/dev/${vmName}
+            ]
+        );
+      fediversityVm.name = vmName;
     };
 
-    ## FIXME: It would be preferrable to have those `sources`-related imports in
-    ## the modules that use them. However, doing so triggers infinite recursions
-    ## because of the way we propagate `sources`. `sources` must be propagated by
-    ## means of `specialArgs`, but this requires a bigger change.
-    nixos.module.imports = [
-      "${sources.nixpkgs}/nixos/modules/profiles/qemu-guest.nix"
-      "${sources.agenix}/modules/age.nix"
-      "${sources.disko}/module.nix"
-      "${sources.home-manager}/nixos"
-      "${sources.vars}/options.nix"
-      "${sources.vars}/backends/on-machine.nix"
-    ];
-
-    imports = [
-      ./common/resource.nix
-    ];
-  };
-
   ## Given a list of machine names, make a deployment with those machines'
   ## configurations as resources.
   makeDeployment =
     vmNames:
     { providers, ... }:
     {
-      providers.local = inputs.nixops4.modules.nixops4Provider.local;
-      resources = genAttrs vmNames (vmName: {
-        type = providers.local.exec;
-        imports = [
-          inputs.nixops4-nixos.modules.nixops4Resource.nixos
-          commonResourceModule
-          ../machines/dev/${vmName}
-        ];
-      });
+      # XXX: this type merge is for adding `specialArgs` to resource modules
+      options.resources = mkOption {
+        type =
+          with lib.types;
+          lazyAttrsOf (submoduleWith {
+            class = "nixops4Resource";
+            modules = [ ];
+            # TODO(@fricklerhandwerk): we may want to pass through all of `specialArgs`
+            # once we're sure it's sane. leaving it here for better control during refactoring.
+            specialArgs = {
+              inherit sources;
+            };
+          });
+      };
+      config = {
+        providers.local = inputs.nixops4.modules.nixops4Provider.local;
+        resources = genAttrs vmNames (vmName: {
+          type = providers.local.exec;
+          imports = [
+            inputs.nixops4-nixos.modules.nixops4Resource.nixos
+            (makeResourceModule {
+              inherit vmName;
+              isTestVm = false;
+            })
+          ];
+        });
+      };
     };
   makeDeployment' = vmName: makeDeployment [ vmName ];
 
@@ -79,29 +110,21 @@ let
         fediversity = import ../services/fediversity;
       }
       {
-        garageConfigurationResource = {
-          imports = [
-            commonResourceModule
-            ../machines/operator/test01
-          ];
+        garageConfigurationResource = makeResourceModule {
+          vmName = "test01";
+          isTestVm = true;
         };
-        mastodonConfigurationResource = {
-          imports = [
-            commonResourceModule
-            ../machines/operator/test06 # somehow `test02` has a problem - use test06 instead
-          ];
+        mastodonConfigurationResource = makeResourceModule {
+          vmName = "test06"; # somehow `test02` has a problem - use test06 instead
+          isTestVm = true;
         };
-        peertubeConfigurationResource = {
-          imports = [
-            commonResourceModule
-            ../machines/operator/test05
-          ];
+        peertubeConfigurationResource = makeResourceModule {
+          vmName = "test05";
+          isTestVm = true;
         };
-        pixelfedConfigurationResource = {
-          imports = [
-            commonResourceModule
-            ../machines/operator/test04
-          ];
+        pixelfedConfigurationResource = makeResourceModule {
+          vmName = "test04";
+          isTestVm = true;
         };
         atticConfigurationResource = makeResourceModule {
           vmName = "test12";
@@ -118,63 +141,54 @@ let
     ## this is only needed to expose NixOS configurations for provisioning
     ## purposes, and eventually all of this should be handled by NixOps4.
     options = {
-      nixos.module = mkOption { type = lib.types.deferredModule; }; # NOTE: not just `nixos` otherwise merging will go wrong
+      nixos.module = mkOption { }; # NOTE: not just `nixos` otherwise merging will go wrong
       nixpkgs = mkOption { };
       ssh = mkOption { };
     };
   };
 
   makeResourceConfig =
-    { vmName, isTestVm }:
+    vm:
     (evalModules {
       modules = [
         nixops4ResourceNixosMockOptions
-        commonResourceModule
-        (if isTestVm then ../machines/operator/${vmName} else ../machines/dev/${vmName})
+        (makeResourceModule vm)
       ];
     }).config;
 
   ## Given a VM name, make a NixOS configuration for this machine.
   makeConfiguration =
     isTestVm: vmName:
-    import "${sources.nixpkgs}/nixos" {
-      configuration = (makeResourceConfig { inherit vmName isTestVm; }).nixos.module;
-      system = "x86_64-linux";
+    let
+      inherit (sources) nixpkgs;
+    in
+    import "${nixpkgs}/nixos" {
+      modules = [
+        (makeResourceConfig { inherit vmName isTestVm; }).nixos.module
+      ];
     };
 
-  makeVmOptions =
-    isTestVm: vmName:
-    let
-      config = (makeResourceConfig { inherit vmName isTestVm; }).fediversityVm;
-    in
-    if config.isFediversityVm then
-      {
-        inherit (config)
-          vmId
-          description
-          sockets
-          cores
-          memory
-          diskSize
-          hostPublicKey
-          unsafeHostPrivateKey
-          ;
-      }
-    else
-      null;
+  makeVmOptions = isTestVm: vmName: {
+    inherit ((makeResourceConfig { inherit vmName isTestVm; }).fediversityVm)
+      proxmox
+      vmId
+      description
+
+      sockets
+      cores
+      memory
+      diskSize
+
+      hostPublicKey
+      unsafeHostPrivateKey
+      ;
+  };
 
   listSubdirectories = path: attrNames (filterAttrs (_: type: type == "directory") (readDir path));
 
   machines = listSubdirectories ../machines/dev;
   testMachines = listSubdirectories ../machines/operator;
 
-  nixosConfigurations =
-    genAttrs machines (makeConfiguration false)
-    // genAttrs testMachines (makeConfiguration true);
-  vmOptions =
-    filterAttrs (_: value: value != null) # Filter out non-Fediversity VMs
-      (genAttrs machines (makeVmOptions false) // genAttrs testMachines (makeVmOptions true));
-
 in
 {
   _class = "flake";
@@ -198,23 +212,10 @@ in
       )
     );
   };
-  flake = { inherit nixosConfigurations vmOptions; };
-
-  perSystem =
-    { pkgs, ... }:
-    {
-      checks =
-        mapAttrs' (name: nixosConfiguration: {
-          name = "nixosConfigurations-${name}";
-          value = nixosConfiguration.config.system.build.toplevel;
-        }) nixosConfigurations
-        // mapAttrs' (name: vmOptions: {
-          name = "vmOptions-${name}";
-          ## Check that VM options builds/evaluates correctly. `deepSeq e1
-          ## e2` evaluates `e1` strictly in depth before returning `e2`. We
-          ## use this trick because checks need to be derivations, which VM
-          ## options are not.
-          value = deepSeq vmOptions pkgs.hello;
-        }) vmOptions;
-    };
+  flake.nixosConfigurations =
+    genAttrs machines (makeConfiguration false)
+    // genAttrs testMachines (makeConfiguration true);
+  flake.vmOptions =
+    genAttrs machines (makeVmOptions false)
+    // genAttrs testMachines (makeVmOptions true);
 }

infra/proxmox-provision.sh

@@ -179,9 +179,15 @@ grab_vm_options () {
     --log-format raw --quiet
   )
 
+  proxmox=$(echo "$options" | jq -r .proxmox)
   vm_id=$(echo "$options" | jq -r .vmId)
   description=$(echo "$options" | jq -r .description)
 
+  if [ "$proxmox" != fediversity ]; then
+    die "I do not know how to provision things that are not Fediversity VMs,
+but I got proxmox = '%s' for VM %s." "$proxmox" "$vm_name"
+  fi
+
   sockets=$(echo "$options" | jq -r .sockets)
   cores=$(echo "$options" | jq -r .cores)
   memory=$(echo "$options" | jq -r .memory)

infra/proxmox-remove.sh

@@ -167,10 +167,16 @@ grab_vm_options () {
       --log-format raw --quiet
     )
 
+    proxmox=$(echo "$options" | jq -r .proxmox)
     vm_id=$(echo "$options" | jq -r .vmId)
 
-    printf 'done grabing VM options for VM %s. Got id: %d.\n' \
-      "$vm_name" "$vm_id"
+    if [ "$proxmox" != fediversity ]; then
+      die "I do not know how to remove things that are not Fediversity VMs,
+  but I got proxmox = '%s' for VM %s." "$proxmox" "$vm_name"
+    fi
+
+    printf 'done grabing VM options for VM %s. Found VM %d on %s Proxmox.\n' \
+      "$vm_name" "$vm_id" "$proxmox"
   fi
 }
 

machines/dev/fedi200/default.nix

@@ -2,9 +2,8 @@
   _class = "nixops4Resource";
 
   fediversityVm = {
-    name = "fedi200";
-    isFediversityVm = true;
     vmId = 200;
+    proxmox = "fediversity";
     description = "Testing machine for Hans";
 
     domain = "abundos.eu";
@@ -17,10 +16,4 @@
       gateway = "2a00:51c0:13:1305::1";
     };
   };
-
-  nixos.module = {
-    imports = [
-      ../../../services/fediversity/attic
-    ];
-  };
 }

machines/dev/fedi201/default.nix

@@ -2,9 +2,8 @@
   _class = "nixops4Resource";
 
   fediversityVm = {
-    name = "fedi201";
-    isFediversityVm = true;
     vmId = 201;
+    proxmox = "fediversity";
     description = "FediPanel";
 
     domain = "abundos.eu";
@@ -20,6 +19,7 @@
 
   nixos.module = {
     imports = [
+      ../../../infra/common/proxmox-qemu-vm.nix
       ./fedipanel.nix
     ];
   };

machines/dev/fedi201/fedipanel.nix

@@ -1,5 +1,6 @@
 {
   config,
+  sources,
   ...
 }:
 let
@@ -10,6 +11,7 @@ in
 
   imports = [
     (import ../../../panel { }).module
+    "${sources.home-manager}/nixos"
   ];
 
   security.acme = {

machines/dev/forgejo-ci/default.nix

@@ -20,9 +20,7 @@ in
   ssh.host = mkForce "forgejo-ci";
 
   fediversityVm = {
-    name = "forgejo-ci";
     domain = "procolix.com";
-    isFediversityVm = false;
 
     ipv4 = {
       interface = "enp1s0f0";

machines/dev/vm02116/default.nix

@@ -2,9 +2,8 @@
   _class = "nixops4Resource";
 
   fediversityVm = {
-    name = "vm02116";
-    isFediversityVm = false;
     vmId = 2116;
+    proxmox = "procolix";
     description = "Forgejo";
 
     ipv4.address = "185.206.232.34";
@@ -15,6 +14,7 @@
     { lib, ... }:
     {
       imports = [
+        ../../../infra/common/proxmox-qemu-vm.nix
         ./forgejo.nix
       ];
 

machines/dev/vm02187/default.nix

@@ -2,9 +2,8 @@
   _class = "nixops4Resource";
 
   fediversityVm = {
-    name = "vm02187";
-    isFediversityVm = false;
     vmId = 2187;
+    proxmox = "procolix";
     description = "Wiki";
 
     ipv4.address = "185.206.232.187";
@@ -15,6 +14,7 @@
     { lib, ... }:
     {
       imports = [
+        ../../../infra/common/proxmox-qemu-vm.nix
         ./wiki.nix
       ];
 

machines/operator/test01/default.nix

@@ -2,9 +2,8 @@
   _class = "nixops4Resource";
 
   fediversityVm = {
-    name = "test01";
-    isFediversityVm = true;
     vmId = 7001;
+    proxmox = "fediversity";
 
     hostPublicKey = builtins.readFile ./ssh_host_ed25519_key.pub;
     unsafeHostPrivateKey = builtins.readFile ./ssh_host_ed25519_key;

machines/operator/test02/default.nix

@@ -2,9 +2,8 @@
   _class = "nixops4Resource";
 
   fediversityVm = {
-    name = "test02";
-    isFediversityVm = true;
     vmId = 7002;
+    proxmox = "fediversity";
 
     hostPublicKey = builtins.readFile ./ssh_host_ed25519_key.pub;
     unsafeHostPrivateKey = builtins.readFile ./ssh_host_ed25519_key;

machines/operator/test03/default.nix

@@ -2,9 +2,8 @@
   _class = "nixops4Resource";
 
   fediversityVm = {
-    name = "test03";
-    isFediversityVm = true;
     vmId = 7003;
+    proxmox = "fediversity";
 
     hostPublicKey = builtins.readFile ./ssh_host_ed25519_key.pub;
     unsafeHostPrivateKey = builtins.readFile ./ssh_host_ed25519_key;

machines/operator/test04/default.nix

@@ -2,9 +2,8 @@
   _class = "nixops4Resource";
 
   fediversityVm = {
-    name = "test04";
-    isFediversityVm = true;
     vmId = 7004;
+    proxmox = "fediversity";
 
     hostPublicKey = builtins.readFile ./ssh_host_ed25519_key.pub;
     unsafeHostPrivateKey = builtins.readFile ./ssh_host_ed25519_key;

machines/operator/test05/default.nix

@@ -2,9 +2,8 @@
   _class = "nixops4Resource";
 
   fediversityVm = {
-    name = "test05";
-    isFediversityVm = true;
     vmId = 7005;
+    proxmox = "fediversity";
 
     hostPublicKey = builtins.readFile ./ssh_host_ed25519_key.pub;
     unsafeHostPrivateKey = builtins.readFile ./ssh_host_ed25519_key;

machines/operator/test06/default.nix

@@ -2,9 +2,8 @@
   _class = "nixops4Resource";
 
   fediversityVm = {
-    name = "test06";
-    isFediversityVm = true;
     vmId = 7006;
+    proxmox = "fediversity";
 
     hostPublicKey = builtins.readFile ./ssh_host_ed25519_key.pub;
     unsafeHostPrivateKey = builtins.readFile ./ssh_host_ed25519_key;

machines/operator/test11/default.nix

@@ -2,9 +2,8 @@
   _class = "nixops4Resource";
 
   fediversityVm = {
-    name = "test11";
-    isFediversityVm = true;
     vmId = 7011;
+    proxmox = "fediversity";
 
     hostPublicKey = builtins.readFile ./ssh_host_ed25519_key.pub;
     unsafeHostPrivateKey = builtins.readFile ./ssh_host_ed25519_key;

machines/operator/test12/default.nix

@@ -2,9 +2,8 @@
   _class = "nixops4Resource";
 
   fediversityVm = {
-    name = "test12";
-    isFediversityVm = true;
     vmId = 7012;
+    proxmox = "fediversity";
 
     hostPublicKey = builtins.readFile ./ssh_host_ed25519_key.pub;
     unsafeHostPrivateKey = builtins.readFile ./ssh_host_ed25519_key;

machines/operator/test13/default.nix

@@ -2,9 +2,8 @@
   _class = "nixops4Resource";
 
   fediversityVm = {
-    name = "test13";
-    isFediversityVm = true;
     vmId = 7013;
+    proxmox = "fediversity";
 
     hostPublicKey = builtins.readFile ./ssh_host_ed25519_key.pub;
     unsafeHostPrivateKey = builtins.readFile ./ssh_host_ed25519_key;

machines/operator/test14/default.nix

@@ -2,9 +2,8 @@
   _class = "nixops4Resource";
 
   fediversityVm = {
-    name = "test14";
-    isFediversityVm = true;
     vmId = 7014;
+    proxmox = "fediversity";
 
     hostPublicKey = builtins.readFile ./ssh_host_ed25519_key.pub;
     unsafeHostPrivateKey = builtins.readFile ./ssh_host_ed25519_key;