Experiment with different nixOS deploy mechanisms.

master
josiah 1 year ago
parent 25a21a54c9
commit bdcf751dee

@ -0,0 +1,37 @@
# common/default.nix
# inputs to this NixOS module. We don't use any here
# so we can ignore them all.
{ ... }:
{
imports = [
# User account definitions
./users
];
# clean /tmp on boot.
boot.cleanTmpDir = true;
# Automatically optimize the Nix store to save space
# by hard-linking identical files together. These savings
# add up.
#nix.settings.autoOptimiseStore = true;
# Limit the systemd journal to 100 MB of disk or the
# last 7 days of logs, whichever happens first.
services.journald.extraConfig = ''
SystemMaxUse=100M
MaxFileSec=7day
'';
# Use systemd-resolved for DNS lookups, but disable
# its dnssec support because it is kinda broken in
# surprising ways.
# Who is surprised that dnssec is broken? no one.
# services.resolved = {
# enable = true;
# dnssec = "false";
# };
}

@ -0,0 +1,35 @@
# common/users/default.nix
# Inputs to this NixOS module, in this case we are
# using `pkgs` so I can configure my favorite shell fish
# and `config` so we can make my SSH key also work with
# the root user.
{ config, pkgs, ... }:
{
# The block that specifies my user account.
users.users.josiah = {
isNormalUser = true;
shell = pkgs.bash;
# My SSH keys.
openssh.authorizedKeys.keys = [
# Replace this with your SSH key!
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAZhFDzl1lbhWJ7MiTV3+Z1EY8M5b4cH/+ju4uo1d91 admin"
];
};
users.users.alice = {
isNormalUser = true;
shell = pkgs.bash;
extraGroups = [ "wheel" ]; # Enable sudo for the user.
# My SSH keys.
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPAZhFDzl1lbhWJ7MiTV3+Z1EY8M5b4cH/+ju4uo1d91 admin"
];
packages = with pkgs; [ emacs vim ];
};
# Use my SSH keys for logging in as root.
users.users.root.openssh.authorizedKeys.keys =
config.users.users.alice.openssh.authorizedKeys.keys;
}

@ -0,0 +1,23 @@
{
description = "Test deployment for my server cluster";
# For accessing `deploy-rs`'s utility Nix functions
inputs.deploy-rs.url = "github:serokell/deploy-rs";
outputs = { self, nixpkgs, deploy-rs }: {
nixosConfigurations.seraph = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [ ../hosts/seraph/configuration.nix ];
};
deploy.nodes.seraph.profiles.system = {
user = "alice";
sshUser = "alice";
remoteBuild = false;
path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.some-random-system;
};
# This is highly advised, and will prevent many possible mistakes
checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib;
};
}

@ -0,0 +1,293 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running nixos-help).
{ config, pkgs, ... }:
let
unstableTarball = fetchTarball
"https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
in {
imports = [ # Include the results of the hardware scan.
./hardware-configuration.nix
];
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "hoyden"; # Define your hostname.
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
# Set your time zone.
time.timeZone = "US/Central";
# The global useDHCP flag is deprecated, therefore explicitly set to false here.
# Per-interface useDHCP will be mandatory in the future, so this generated config
# replicates the default behaviour.
networking.useDHCP = false;
networking.interfaces.eno1.useDHCP = true;
networking.interfaces.wlp0s20f3.useDHCP = true;
# Configure network proxy if necessary
# networking.proxy.default = "http://user:password@proxy:port/";
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
# Select internationalisation properties.
# i18n.defaultLocale = "en_US.UTF-8";
# console = {
# font = "Lat2-Terminus16";
# keyMap = "us";
# };
fonts.fonts = with pkgs; [
# Serif fonts
roboto
ttf_bitstream_vera
liberation_ttf
dejavu_fonts
# Emoji
openmoji-color
];
fonts.fontconfig = { defaultFonts = { emoji = [ "OpenMoji Color" ]; }; };
# Enable the X11 windowing system.
services.xserver = {
enable = true;
autoRepeatDelay = 150;
# autoRepeatInterval = something; # this is configurable so i'm leaving it here, but not sure that i need it.
displayManager.sddm.enable = true;
desktopManager.plasma5.enable = true;
windowManager.awesome = {
enable = true;
luaModules = with pkgs.luaPackages; [
luarocks # is the package manager for Lua modules
luadbi-mysql # Database abstraction layer
];
};
};
services.flatpak.enable = true;
# try and handle some of the dumb long term storage optimiztaion issues with nixos:
nix.gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 30d";
};
# This is probalby not gonna work, but is a rough analogue to what I did before
# pkgs.writeTextFile {
# name = "plasma-awesome-xsession";
# destination = "/share/xsessions/plasma-awesome.desktop";
# text = ''
# [Desktop Entry]
# Type=XSession
# Exec=env KDEWM=/run/current-system/sw/bin/awesome /run/current-system/sw/bin/startplasma-x11
# DesktopNames=KDE (awesome)
# Name=Plasma (awesome)
# Comment=Plasma by KDE w/awesome
# '';
# } // {
# providedSessions = [ "plasma-awesome" ];
# }
# Configure keymap in X11
# services.xserver.layout = "us";
# services.xserver.xkbOptions = "eurosign:e";
# Enable CUPS to print documents.
# services.printing.enable = true;
# Enable sound.
sound.enable = true;
hardware.pulseaudio.enable = true;
# Enable touchpad support (enabled default in most desktopManager).
# services.xserver.libinput.enable = true;
# enable docker, virtualbox, virtualization shit
virtualisation.docker.enable = true;
virtualisation.virtualbox.host.enable = false;
virtualisation.virtualbox.host.enableExtensionPack = false;
# Define a user account. Don't forget to set a password with passwd.
users.users.josiah = {
isNormalUser = true;
extraGroups =
[ "wheel" "audio" "sound" "video" "docker" "vboxusers" "adbusers" ];
};
nixpkgs.config.allowUnfree = true;
# List packages installed in system profile. To search, run:
# $ nix search wget
nixpkgs.config = {
packageOverrides = pkgs: {
unstable = import unstableTarball { config = config.nixpkgs.config; };
};
};
environment.systemPackages = with pkgs; [
# build shit
morph
autoconf
yarn
automake
gnumake
wget
gcc-arm-embedded
xorg.libX11
vim
konsole
patchelf
docker
# jlj dev
# python-language-server
# python38Packages.python-language-server
# jlj utils
darktable
digikam
offlineimap
unzip
ansible
python38
python38Packages.pip
python38Packages.setuptools
pipenv
bitwarden
chromium
magic-wormhole
firefox
unstable.nyxt
emacs
emacsPackages.flyspell-correct
nixfmt
mu
ispell
obsidian
zeal
git
keychain
os-prober
lsof
wireguard-tools
tailscale
fortune
youtube-dl
gcc8
dfu-util
scrot
qbittorrent
obs-studio
texlive.combined.scheme-full
# jlj sound
pavucontrol
# jlj comms
unstable.element-desktop
slack
discord
konversation
unstable.signal-desktop
newsflash # same maker as feedreader, newer, less features, actively maintained.
zoom-us
spectral
jitsi-meet-electron
# jlj de
syncthingtray
unstable.synology-drive-client
barrier
pinentry
acpi
awesome
networkmanagerapplet
arc-icon-theme
rofi
i3lock
vlc
unstable.thunderbird
birdtray # tray icon for thunderbird
peruse
libsForQt5.ark
# tauon # this is a good music player but it doesn't come bundled proper in nixos; install via flatpak you bitch
# rsi stuff
rsibreak
workrave
espanso # text expander
xclip # c&p from cli / required for espanso
libnotify # required for espanso
arc-icon-theme
# kde specific stuff
kde-gtk-config
libsForQt5.kde-cli-tools
arc-kde-theme
# jlj games
lutris
steam
vulkan-tools
];
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
# programs.mtr.enable = true;
programs.gnupg.agent = {
enable = true;
enableSSHSupport = true;
pinentryFlavor = "qt";
};
programs.adb.enable = true;
# List services that you want to enable:
services = {
syncthing = {
enable = true;
user = "josiah";
dataDir = "/home/josiah/dhd"; # Default folder for new synced folders
configDir =
"/home/josiah/.config/syncthing"; # Folder for Syncthing's settings and keys
};
tailscale.enable = true;
openssh.enable = true;
};
# this works properly
fileSystems."/home/josiah/network-share/syn-nas/usenet" = {
device = "192.168.1.221:/volume1/usenet";
fsType = "nfs";
};
fileSystems."/home/josiah/network-share/sainthood/homes" = {
device = "sainthood.home.jowj.net:/volume3/homes/";
options = [ "nfsvers=3" ];
fsType = "nfs";
};
# this doens't work right
# fileSystems."/home/josiah/network-share/sainthood/homes" = {
# #device = "//sainthood.home.jowj.net/volume3/homes/";
# device = "//sainthood.home.jowj.net//volume3/homes/";
# fsType = "cifs";
# options = let
# # this line prevents hanging on network split
# automount_opts = "x-systemd.automount,noauto,x-systemd.idle-timeout=60,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
# in ["${automount_opts},credentials=/etc/nixos/smb-secrets"];
# };
# Open ports in the firewall.
# networking.firewall.allowedTCPPorts = [ ... ];
# networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
networking.firewall.enable = false;
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.11"; # Did you read the comment?
}

@ -0,0 +1,34 @@
# Do not modify this file! It was generated by nixos-generate-config
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports =
[ (modulesPath + "/installer/scan/not-detected.nix")
];
boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "usb_storage" "sd_mod" "sdhci_pci" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" =
{ device = "/dev/disk/by-uuid/4dd471ee-c6af-40d4-b9af-b0f99466af02";
fsType = "ext4";
};
fileSystems."/boot" =
{ device = "/dev/disk/by-uuid/D357-6F39";
fsType = "vfat";
};
swapDevices =
[ { device = "/dev/disk/by-uuid/a5f80549-0f7b-484b-a951-18d12138af67"; }
];
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
# high-resolution display
hardware.video.hidpi.enable = lib.mkDefault true;
}

@ -0,0 +1,96 @@
# Edit this configuration file to define what should be installed on
# your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running nixos-help).
{ config, pkgs, ... }:
{
imports = [ # Include the results of the hardware scan.
./hardware-configuration.nix
];
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "seraph"; # Define your hostname.
# Pick only one of the below networking options.
# networking.wireless.enable = true; # Enables wireless support via wpa_supplicant.
networking.networkmanager.enable =
true; # Easiest to use and most distros use this by default.
# Set your time zone.
time.timeZone = "US/Central";
# Configure network proxy if necessary
# networking.proxy.default = "http://user:password@proxy:port/";
# networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
# Select internationalisation properties.
# i18n.defaultLocale = "en_US.UTF-8";
# console = {
# font = "Lat2-Terminus16";
# keyMap = "us";
# useXkbConfig = true; # use xkbOptions in tty.
# };
# Enable the X11 windowing system.
# services.xserver.enable = true;
# Configure keymap in X11
services.xserver.layout = "us";
# Enable CUPS to print documents.
# services.printing.enable = true;
# Enable sound.
# sound.enable = true;
# hardware.pulseaudio.enable = true;
# Enable touchpad support (enabled default in most desktopManager).
# services.xserver.libinput.enable = true;
# List packages installed in system profile. To search, run:
# $ nix search wget
# environment.systemPackages = with pkgs; [
# vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
# wget
# ];
# Some programs need SUID wrappers, can be configured further or are
# started in user sessions.
# programs.mtr.enable = true;
# programs.gnupg.agent = {
# enable = true;
# enableSSHSupport = true;
# };
# List services that you want to enable:
# Enable the OpenSSH daemon.
services = {
tailscale.enable = true;
openssh.enable = true;
};
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 22 80 443 ];
networking.firewall.checkReversePath = "loose";
# networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
# networking.firewall.enable = false;
# Copy the NixOS configuration file and link it from the resulting system
# (/run/current-system/configuration.nix). This is useful in case you
# accidentally delete configuration.nix.
# system.copySystemConfiguration = true;
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
# on your system were taken. Its perfectly fine and recommended to leave
# this value at the release version of the first install of this system.
# Before changing this value read the documentation for this option
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "22.11"; # Did you read the comment?
}

@ -0,0 +1,37 @@
# Do not modify this file! It was generated by nixos-generate-config
# and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }:
{
imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
boot.initrd.availableKernelModules =
[ "xhci_pci" "ahci" "usbhid" "usb_storage" "sd_mod" ];
boot.initrd.kernelModules = [ ];
boot.kernelModules = [ "kvm-intel" ];
boot.extraModulePackages = [ ];
fileSystems."/" = {
device = "/dev/disk/by-uuid/3662ca72-d69f-42fe-a049-0f1ed2b81334";
fsType = "ext4";
};
fileSystems."/boot" = {
device = "/dev/disk/by-uuid/97D6-2BED";
fsType = "vfat";
};
swapDevices = [ ];
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
# (the default) this is the recommended approach. When using systemd-networkd it's
# still possible to use this option, but it's recommended to use it in conjunction
# with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
networking.useDHCP = lib.mkDefault true;
# networking.interfaces.enp0s31f6.useDHCP = lib.mkDefault true;
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
hardware.cpu.intel.updateMicrocode =
lib.mkDefault config.hardware.enableRedistributableFirmware;
}

@ -0,0 +1 @@
/nix/store/mfkpmn5rfvpj05gggrc10nr8w5xb75d1-morph

@ -0,0 +1 @@
hoyden:mzRpcmjuqPqre3Si990zXvAeD9xwqRJMezGsxdXV2vTayggi7ycd8bhQlPQGg3u2YhjbaztvTo1bogdeAlI/bg==

@ -0,0 +1 @@
hoyden:2soIIu8nHfG4UJT0BoN7tmIY22s7b06NW6IHXgJSP24=

@ -0,0 +1,28 @@
# ops/home/network.nix
{
# Configuration for the network in general.
network = { description = "home.jowj.net cluster definition"; };
# This specifies the configuration for
# `seraph` as a NixOS module.
"seraph" = { config, pkgs, lib, ... }: {
deployment.targetUser = "alice";
deployment.targetHost = "seraph";
# Import seraph configuration.nix
imports = [
../../hosts/seraph/configuration.nix
../../common ];
};
# "hoyden" = { config, pkgs, lib, ... }: {
# deployment.targetUser = "josiah";
# deployment.targetHost = "hoyden";
# # Import seraph configuration.nix
# imports = [ ../../hosts/hoyden/configuration.nix ];
# };
}

@ -0,0 +1,22 @@
#!/usr/bin/env nix-shell
# Specify the packages we are using in this
# script as well as the fact that we are running it
# in bash.
#! nix-shell -p morph -i bash
# Explode on any error.
set -e
# Build the system configurations for every
# machine in this network and register them as
# garbage collector roots so `nix-collect-garbage`
# doesn't sweep them away.
morph build --keep-result ~/Documents/projects/adc/nixos-configs/ops/home/network.nix
# Push the config to the hosts.
morph push ~/Documents/projects/adc/nixos-configs/ops/home/network.nix
# Activate the NixOS configuration on the
# network.
morph deploy ~/Documents/projects/adc/nixos-configs/ops/home/network.nix test

@ -0,0 +1,40 @@
let
pkgs = import (import ../nixpkgs.nix) {};
in
{
network = {
inherit pkgs;
description = "simple hosts";
ordering = {
tags = [ "db" "web" ];
};
};
"web01" = { config, pkgs, ... }: {
deployment.tags = [ "web" ];
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
services.nginx.enable = true;
fileSystems = {
"/" = { label = "nixos"; fsType = "ext4"; };
"/boot" = { label = "boot"; fsType = "vfat"; };
};
};
"db01" = { config, pkgs, ... }: {
deployment.tags = [ "db" ];
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
services.postgresql.enable = true;
fileSystems = {
"/" = { label = "nixos"; fsType = "ext4"; };
"/boot" = { label = "boot"; fsType = "vfat"; };
};
};
}
Loading…
Cancel
Save