diff --git a/home/hosts/jeremiah/default.nix b/home/hosts/jeremiah/default.nix new file mode 100644 index 0000000..dbaa756 --- /dev/null +++ b/home/hosts/jeremiah/default.nix @@ -0,0 +1,4 @@ +{ pkgs, config, ... }: + +{ +} diff --git a/home/hosts/jude/default.nix b/home/hosts/jude/default.nix index eefc406..39c1645 100644 --- a/home/hosts/jude/default.nix +++ b/home/hosts/jude/default.nix @@ -11,4 +11,6 @@ greg.gui = true; greg.sway = false; greg.gnome = false; + + programs.xonsh.sessionVariables.EFI_DIR = "${pkgs.OVMF.fd}/FV/"; } diff --git a/home/ssh/authorized_keys b/home/ssh/authorized_keys index 767fc22..4f434cd 100644 --- a/home/ssh/authorized_keys +++ b/home/ssh/authorized_keys @@ -4,3 +4,4 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrqJQvDspLi1vXQRJ/Z5kN/F8jCBHvaXjo+5zLuIYjR greg@hosea +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYIiecdyM9c7tXgR96983K3wqiJeQRMbrzGIF8Wy6uO greg@jeremiah diff --git a/home/xonsh.nix b/home/xonsh.nix index 25c5c6f..411ef8e 100644 --- a/home/xonsh.nix +++ b/home/xonsh.nix @@ -29,8 +29,6 @@ GOPATH = "${config.home.homeDirectory}/src/go"; GOBIN = "${config.home.homeDirectory}/src/bin"; - - EFI_DIR = lib.mkIf pkgs.stdenv.isLinux "${pkgs.OVMF.fd}/FV/"; }; aliases = { diff --git a/hosts/default.nix b/hosts/default.nix index 0ccbccd..edb844c 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -43,6 +43,7 @@ in { icdm-root = unstable { name = "icdm-root"; }; linode = machine { name = "linode"; }; hosea = unstable { name = "hosea"; }; + jeremiah = unstable { name = "jeremiah"; }; myself = unstable { name = "myself"; }; iso = machine { name = "iso"; }; iso-beta = unstable { name = "iso"; }; diff --git a/hosts/genesis/networking.nix b/hosts/genesis/networking.nix index 075c296..147e51a 100644 --- a/hosts/genesis/networking.nix +++ b/hosts/genesis/networking.nix @@ -184,8 +184,8 @@ in { "98:da:c4:77:7f:4d,192.168.66.102" "8c:85:80:1c:f9:d1,192.168.66.104" "98:da:c4:77:82:7b,192.168.66.105" - "0c:80:63:41:74:73,192.168.66.106" - "98:da:c4:20:ea:db,192.168.66.107" # HS220 switch + "0c:80:63:41:74:73,192.168.66.106" # Front hall light switch + "98:da:c4:20:ea:db,192.168.66.107" # Parlor light switch "8c:49:62:aa:58:60,192.168.66.108" # Roku, HiHandsome "92:3e:11:c7:c5:be,192.168.66.109" "d8:0d:17:19:60:62,192.168.66.112" diff --git a/hosts/hosea/default.nix b/hosts/hosea/default.nix index 5531e5b..c6deb75 100644 --- a/hosts/hosea/default.nix +++ b/hosts/hosea/default.nix @@ -31,13 +31,15 @@ in networking = { hostName = "hosea"; + nameservers = [ "10.42.1.5" ]; + defaultGateway = "10.42.1.1"; interfaces = { "${wanInterface}".useDHCP = true; "${lanInterface}" = { useDHCP = false; ipv4.addresses = [{ address = lanIpAddress; - prefixLength = 24; + prefixLength = 16; }]; }; }; diff --git a/hosts/jeremiah/default.nix b/hosts/jeremiah/default.nix new file mode 100644 index 0000000..0b465a7 --- /dev/null +++ b/hosts/jeremiah/default.nix @@ -0,0 +1,22 @@ +# Edit this configuration file to define what should be installed on +# your system. Help is available in the configuration.nix(5) man page +# and in the NixOS manual (accessible by running ‘nixos-help’). + +{ config, pkgs, ... }: + +{ + imports = + [ # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; + + # Bootloader. + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = true; + + networking.hostName = "jeremiah"; # Define your hostname. + greg = { + home = true; + tailscale.enable = true; + }; +} diff --git a/hosts/jeremiah/hardware-configuration.nix b/hosts/jeremiah/hardware-configuration.nix new file mode 100644 index 0000000..fcd7de1 --- /dev/null +++ b/hosts/jeremiah/hardware-configuration.nix @@ -0,0 +1,39 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "uas" "usbhid" "sd_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-amd" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24"; + fsType = "ext4"; + }; + + fileSystems."/boot" = + { device = "/dev/disk/by-uuid/3047-870E"; + fsType = "vfat"; + }; + + swapDevices = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp67s0.useDHCP = lib.mkDefault true; + # networking.interfaces.enp68s0.useDHCP = lib.mkDefault true; + # networking.interfaces.wlo2.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/hosts/jude/default.nix b/hosts/jude/default.nix index e6103d0..ce86564 100644 --- a/hosts/jude/default.nix +++ b/hosts/jude/default.nix @@ -51,6 +51,7 @@ distrobox expect gimp + go gparted gnucash graphviz diff --git a/hosts/myself/container-runner.nix b/hosts/myself/container-runner.nix index 75226f5..440d547 100644 --- a/hosts/myself/container-runner.nix +++ b/hosts/myself/container-runner.nix @@ -50,6 +50,12 @@ lib.attrsets.recursiveUpdate { nixpkgs.config.allowUnfree = true; + users.users.gitlab-runner = { + isSystemUser = true; + group = "kvm"; + extraGroups = [ "kvm" ]; + }; + services = { gitlab-runner = { enable = true; @@ -78,6 +84,15 @@ lib.attrsets.recursiveUpdate { "network-online.target" "systemd-resolved.service" ]; + serviceConfig = { + DevicePolicy = lib.mkForce "auto"; + PrivateDevices = false; + ProtectKernelModules = false; + DevicesAllow = [ "/dev/kvm" "/dev/mem" ]; + DynamicUser = lib.mkForce false; + User = "root"; + Group = "kvm"; + }; }; system.stateVersion = lib.mkForce "24.05"; diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index 8eaa9e9..2e8c634 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -39,55 +39,20 @@ in { }; systemd.services = { - "container@gitlab-runner-qemu" = { - # Now moved to a separate machine - conflicts = [ - "container@gitlab-runner-vbox.service" - ]; + "gitlab-runner" = { serviceConfig = { DevicePolicy = lib.mkForce "auto"; + DevicesAllow = [ "/dev/kvm" "/dev/mem" ]; + EnvironmentFile = config.age.secrets.docker-auth.path; ExecStopPost = [ "${pkgs.kmod}/bin/rmmod kvm_amd kvm" ]; ExecStartPre = [ - "${pkgs.kmod}/bin/modprobe kvm" - "${pkgs.kmod}/bin/modprobe kvm_amd" + "+${pkgs.kmod}/bin/modprobe kvm" + "+${pkgs.kmod}/bin/modprobe kvm_amd" ]; + PrivateDevices = false; + ProtectKernelModules = false; }; }; - gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path; - }; - - ##################################################################################### - #################### QEmu Runner #################################################### - ##################################################################################### - containers.gitlab-runner-qemu = container { - autoStart = true; - bindMounts = { - "/dev/kvm" = { - hostPath = "/dev/kvm"; - isReadOnly = false; - }; - "/dev/mem" = { - hostPath = "/dev/mem"; - isReadOnly = false; - }; - }; - extraFlags = [ - "--property=DeviceAllow=/dev/kvm" - ]; - hostAddress = "192.168.201.1"; - localAddress = "192.168.201.2"; - config = ((import ./container-runner.nix) { - inherit inputs overlays; - name = "qemu"; - packages = with pkgs; [ qemu_full qemu_kvm ]; - extra = { - virtualisation.libvirtd = { - enable = true; - onBoot = "ignore"; - package = pkgs.libvirt-greg; - }; - }; - }); }; ##################################################################################### @@ -108,6 +73,7 @@ in { ##################################################################################### age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age; age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age; + age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age; services.gitlab-runner = { enable = true; settings = { @@ -144,10 +110,35 @@ in { "/cache" ]; }; + qemu = { + executor = "shell"; + limit = 5; + registrationConfigFile = config.age.secrets.runner-qemu.path; + environmentVariables = { + EFI_DIR = "${pkgs.OVMF.fd}/FV/"; + }; + }; }; }; virtualisation = { docker.enable = true; oci-containers.backend = "docker"; }; + environment.systemPackages = with pkgs; [ + curl + gawk + git + p7zip + packer + pup + (python3.withPackages (p: with p; [ pip pyyaml virtualenv ]) ) + qemu_full + qemu_kvm + shellcheck + unzip + xonsh + xorriso + vagrant + wget + ]; } diff --git a/hosts/myself/matrix.nix b/hosts/myself/matrix.nix index bc0b4c5..8dc250d 100644 --- a/hosts/myself/matrix.nix +++ b/hosts/myself/matrix.nix @@ -5,6 +5,8 @@ let conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql"; in { + environment.systemPackages = with pkgs; [ upgrade-pg-cluster ]; + greg.containers.matrix = { tailscale = true; subnet = "204"; diff --git a/modules/nixos/ceph.nix b/modules/nixos/ceph.nix new file mode 100644 index 0000000..95a14e0 --- /dev/null +++ b/modules/nixos/ceph.nix @@ -0,0 +1,2 @@ +# This is a good source for a Ceph dealio +# https://gist.github.com/nh2/13425a1f18b4c1ce82edb63c10b163c9 diff --git a/modules/nixos/db.nix b/modules/nixos/db.nix index 60c4d56..ec551d1 100644 --- a/modules/nixos/db.nix +++ b/modules/nixos/db.nix @@ -18,6 +18,7 @@ in { services = { postgresql = { enable = true; + package = pkgs.postgresql_15; checkConfig = true; ensureDatabases = dbs; ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs; diff --git a/overlays/default.nix b/overlays/default.nix index 0a660f9..648d8cf 100644 --- a/overlays/default.nix +++ b/overlays/default.nix @@ -60,6 +60,7 @@ in rec { setup-ssh = prev.callPackage ./setup-ssh { pkgs = final.pkgs; }; + upgrade-pg-cluster = prev.callPackage ./upgrade-pg-cluster.nix {}; # Overrides of packages brew = prev.callPackage ./homebrew.nix {}; diff --git a/overlays/inject.nix b/overlays/inject.nix index 6837e6f..04f648e 100644 --- a/overlays/inject.nix +++ b/overlays/inject.nix @@ -17,13 +17,40 @@ ${git}/bin/git clone http://github.com/greg-hellings/nixos-config nixos mkdir -p "/etc/nixos/hosts/''${hostname}" # Prepares everything for the flake usage -cp /etc/nixos.bk/configuration.nix "/etc/nixos/hosts/''${hostname}/default.nix" +#cp /etc/nixos.bk/configuration.nix "/etc/nixos/hosts/''${hostname}/default.nix" +cat << EOF > "/etc/nixos/hosts/''${hostname}/default.nix" +{ pkgs, config, ... }: + +{ + imports = [ ./hardware-configuration.nix ]; + + boot.loader = { + systemd-boot.enable = true; + efi.canTouchEfiVariables = true; + }; + + networking.hostName = "''${hostname}"; + greg = { + home = true; + tailscale.enable = true; + }; +} +EOF cp /etc/nixos.bk/hardware-configuration.nix "/etc/nixos/hosts/''${hostname}/hardware-configuration.nix" +# Prepare home-manager portion for setup +mkdir -p "/etc/nixos/home/hosts/''${hostname}" +cat << EOF > "/etc/nixos/home/hosts/''${hostname}/default.nix" +{ pkgs, config, ... }: + +{ +} +EOF + # Prepares it for injecting the use case into the flake usage cp /etc/nixos.bk/hardware-configuration.nix /etc/nixos chown -R greg nixos -echo "Now you should be able to just run 'nixos-rebuild switch' to enable the flake functionality" -echo "After that and adding the entry to the flake, run 'nixos-rebuild boot --flake '.#''${hostname}' and reboot" +echo "Now you should be able to just run `nixos-rebuild switch` to enable the flake functionality" +echo "After that and adding the entry to the flake, run `nixos-rebuild boot --flake '.#''${hostname}'` and reboot" '' diff --git a/overlays/upgrade-pg-cluster.nix b/overlays/upgrade-pg-cluster.nix new file mode 100644 index 0000000..a22e36e --- /dev/null +++ b/overlays/upgrade-pg-cluster.nix @@ -0,0 +1,24 @@ +{ postgresql_15, postgresql_14, writeScriptBin, ... }: + +let + newPostgres = postgresql_15; + oldPostgres = postgresql_14; +in writeScriptBin "upgrade-pg-cluster" '' + set -eux + systemctl stop postgresql + + export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}" + export NEWBIN="${newPostgres}/bin" + + export OLDDATA="/var/lib/postgresql/${oldPostgres.psqlSchema}" + export OLDBIN="${oldPostgres}/bin" + + install -d -m 0700 -o postgres -g postgres "$NEWDATA" + cd "$NEWDATA" + sudo -u postgres "$NEWBIN/initdb" -D "$NEWDATA" + + sudo -u postgres "$NEWBIN/pg_upgrade" \ + --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \ + --old-bindir "$OLDBIN" --new-bindir "$NEWBIN" \ + "$@" +'' diff --git a/secrets/gitlab/myself-qemu-runner-reg.age b/secrets/gitlab/myself-qemu-runner-reg.age index 31bd193..cd270e6 100644 Binary files a/secrets/gitlab/myself-qemu-runner-reg.age and b/secrets/gitlab/myself-qemu-runner-reg.age differ diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 99d64bd..ac70882 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -17,6 +17,7 @@ let user_linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode"; user_myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself"; user_hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrqJQvDspLi1vXQRJ/Z5kN/F8jCBHvaXjo+5zLuIYjR greg@hosea"; + user_jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYIiecdyM9c7tXgR96983K3wqiJeQRMbrzGIF8Wy6uO greg@jeremiah"; users = [ user_genesis_virt @@ -25,6 +26,7 @@ let user_linode user_myself user_hosea + user_jeremiah ]; everyone = systems ++ users;