Merge branch 'main' of gh:greg-hellings/nixos-config

home/hosts/jeremiah/default.nix

@@ -0,0 +1,4 @@
+{ pkgs, config, ... }:
+
+{
+}

home/hosts/jude/default.nix

@@ -11,4 +11,6 @@
 	greg.gui = true;
 	greg.sway = false;
 	greg.gnome = false;
+
+	programs.xonsh.sessionVariables.EFI_DIR = "${pkgs.OVMF.fd}/FV/";
 }

home/ssh/authorized_keys

@@ -4,3 +4,4 @@ ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMYzms+KIe5/bYF3uCyFjA5e1AgMPLIA3c4k417coqBe
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINnRc/kBhxcjpUtiRQY+BXnSObdp0jFL1395wAQxJip7 greg@jude
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself
 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrqJQvDspLi1vXQRJ/Z5kN/F8jCBHvaXjo+5zLuIYjR greg@hosea
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYIiecdyM9c7tXgR96983K3wqiJeQRMbrzGIF8Wy6uO greg@jeremiah

home/xonsh.nix

@@ -29,8 +29,6 @@
 
 			GOPATH = "${config.home.homeDirectory}/src/go";
 			GOBIN  = "${config.home.homeDirectory}/src/bin";
-
-			EFI_DIR = lib.mkIf pkgs.stdenv.isLinux "${pkgs.OVMF.fd}/FV/";
 		};
 
 		aliases = {

hosts/default.nix

@@ -43,6 +43,7 @@ in {
 	icdm-root = unstable { name = "icdm-root"; };
 	linode = machine { name = "linode"; };
 	hosea = unstable { name = "hosea"; };
+	jeremiah = unstable { name = "jeremiah"; };
 	myself = unstable { name = "myself"; };
 	iso = machine { name = "iso"; };
 	iso-beta = unstable { name = "iso"; };

hosts/genesis/networking.nix

@@ -184,8 +184,8 @@ in {
 					"98:da:c4:77:7f:4d,192.168.66.102"
 					"8c:85:80:1c:f9:d1,192.168.66.104"
 					"98:da:c4:77:82:7b,192.168.66.105"
-					"0c:80:63:41:74:73,192.168.66.106"
+					"0c:80:63:41:74:73,192.168.66.106"  # Front hall light switch
-					"98:da:c4:20:ea:db,192.168.66.107"  # HS220 switch
+					"98:da:c4:20:ea:db,192.168.66.107"  # Parlor light switch
 					"8c:49:62:aa:58:60,192.168.66.108"  # Roku, HiHandsome
 					"92:3e:11:c7:c5:be,192.168.66.109"
 					"d8:0d:17:19:60:62,192.168.66.112"

hosts/hosea/default.nix

@@ -31,13 +31,15 @@ in
 
 	networking = {
 		hostName = "hosea";
+		nameservers = [ "10.42.1.5" ];
+		defaultGateway = "10.42.1.1";
 		interfaces = {
 			"${wanInterface}".useDHCP = true;
 			"${lanInterface}" = {
 				useDHCP = false;
 				ipv4.addresses = [{
 					address = lanIpAddress;
-					prefixLength = 24;
+					prefixLength = 16;
 				}];
 			};
 		};

hosts/jeremiah/default.nix

@@ -0,0 +1,22 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking.hostName = "jeremiah"; # Define your hostname.
+  greg = {
+	home = true;
+	tailscale.enable = true;
+  };
+}

hosts/jeremiah/hardware-configuration.nix

@@ -0,0 +1,39 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "nvme" "xhci_pci" "ahci" "uas" "usbhid" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-amd" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/ffc167f5-d9e4-4b11-a5f1-f7da0550ad24";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/3047-870E";
+      fsType = "vfat";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp67s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp68s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlo2.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/jude/default.nix

@@ -51,6 +51,7 @@
 			distrobox
 			expect
 			gimp
+			go
 			gparted
 			gnucash
 			graphviz

hosts/myself/container-runner.nix

@@ -50,6 +50,12 @@ lib.attrsets.recursiveUpdate {
 
 	nixpkgs.config.allowUnfree = true;
 
+	users.users.gitlab-runner = {
+		isSystemUser = true;
+		group = "kvm";
+		extraGroups = [ "kvm" ];
+	};
+
 	services = {
 		gitlab-runner = {
 			enable = true;
@@ -78,6 +84,15 @@ lib.attrsets.recursiveUpdate {
 			"network-online.target"
 			"systemd-resolved.service"
 		];
+		serviceConfig = {
+			DevicePolicy = lib.mkForce "auto";
+			PrivateDevices = false;
+			ProtectKernelModules = false;
+			DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
+			DynamicUser = lib.mkForce false;
+			User = "root";
+			Group = "kvm";
+		};
 	};
 
 	system.stateVersion = lib.mkForce "24.05";

hosts/myself/git.nix

@@ -39,55 +39,20 @@ in  {
 	};
 
 	systemd.services = {
-		"container@gitlab-runner-qemu" = {
+		"gitlab-runner" = {
-			# Now moved to a separate machine
-			conflicts = [
-				"container@gitlab-runner-vbox.service"
-			];
 			serviceConfig = {
 				DevicePolicy = lib.mkForce "auto";
+				DevicesAllow = [ "/dev/kvm" "/dev/mem" ];
+				EnvironmentFile = config.age.secrets.docker-auth.path;
 				ExecStopPost = [ "${pkgs.kmod}/bin/rmmod kvm_amd kvm" ];
 				ExecStartPre = [
-					"${pkgs.kmod}/bin/modprobe kvm"
+					"+${pkgs.kmod}/bin/modprobe kvm"
-					"${pkgs.kmod}/bin/modprobe kvm_amd"
+					"+${pkgs.kmod}/bin/modprobe kvm_amd"
 				];
+				PrivateDevices = false;
+				ProtectKernelModules = false;
 			};
 		};
-		gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path;
-	};
-
-	#####################################################################################
-	#################### QEmu Runner ####################################################
-	#####################################################################################
-	containers.gitlab-runner-qemu = container {
-		autoStart = true;
-		bindMounts = {
-			"/dev/kvm" = {
-				hostPath = "/dev/kvm";
-				isReadOnly = false;
-			};
-			"/dev/mem" = {
-				hostPath = "/dev/mem";
-				isReadOnly = false;
-			};
-		};
-		extraFlags = [
-			"--property=DeviceAllow=/dev/kvm"
-		];
-		hostAddress = "192.168.201.1";
-		localAddress = "192.168.201.2";
-		config = ((import ./container-runner.nix) {
-			inherit inputs overlays;
-			name = "qemu";
-			packages = with pkgs; [ qemu_full qemu_kvm ];
-			extra = {
-				virtualisation.libvirtd = {
-					enable = true;
-					onBoot = "ignore";
-					package = pkgs.libvirt-greg;
-				};
-			};
-		});
 	};
 
 	#####################################################################################
@@ -108,6 +73,7 @@ in  {
 	#####################################################################################
 	age.secrets.runner-reg.file = ../../secrets/gitlab/myself-podman-runner-reg.age;
 	age.secrets.docker-auth.file = ../../secrets/gitlab/docker-auth.age;
+	age.secrets.runner-qemu.file = ../../secrets/gitlab/myself-qemu-runner-reg.age;
 	services.gitlab-runner = {
 		enable = true;
 		settings = {
@@ -144,10 +110,35 @@ in  {
 					"/cache"
 				];
 			};
+			qemu = {
+				executor = "shell";
+				limit = 5;
+				registrationConfigFile = config.age.secrets.runner-qemu.path;
+				environmentVariables = {
+					EFI_DIR = "${pkgs.OVMF.fd}/FV/";
+				};
+			};
 		};
 	};
 	virtualisation = {
 		docker.enable = true;
 		oci-containers.backend = "docker";
 	};
+	environment.systemPackages = with pkgs; [
+		curl
+		gawk
+		git
+		p7zip
+		packer
+		pup
+		(python3.withPackages (p: with p; [ pip pyyaml virtualenv ]) )
+		qemu_full
+		qemu_kvm
+		shellcheck
+		unzip
+		xonsh
+		xorriso
+		vagrant
+		wget
+	];
 }

hosts/myself/matrix.nix

@@ -5,6 +5,8 @@ let
 	conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
 in
 {
+	environment.systemPackages = with pkgs; [ upgrade-pg-cluster ];
+
 	greg.containers.matrix = {
 		tailscale = true;
 		subnet = "204";

modules/nixos/ceph.nix

@@ -0,0 +1,2 @@
+# This is a good source for a Ceph dealio
+# https://gist.github.com/nh2/13425a1f18b4c1ce82edb63c10b163c9

modules/nixos/db.nix

@@ -18,6 +18,7 @@ in {
 		services = {
 			postgresql = {
 				enable = true;
+				package = pkgs.postgresql_15;
 				checkConfig = true;
 				ensureDatabases = dbs;
 				ensureUsers = map (db: { name = db; ensureDBOwnership = true; }) dbs;

overlays/default.nix

@@ -60,6 +60,7 @@ in rec {
 	setup-ssh = prev.callPackage ./setup-ssh {
 		pkgs = final.pkgs;
 	};
+	upgrade-pg-cluster = prev.callPackage ./upgrade-pg-cluster.nix {};
 
 	# Overrides of packages
 	brew = prev.callPackage ./homebrew.nix {};

overlays/inject.nix

@@ -17,13 +17,40 @@ ${git}/bin/git clone http://github.com/greg-hellings/nixos-config nixos
 mkdir -p "/etc/nixos/hosts/''${hostname}"
 
 # Prepares everything for the flake usage
-cp /etc/nixos.bk/configuration.nix "/etc/nixos/hosts/''${hostname}/default.nix"
+#cp /etc/nixos.bk/configuration.nix "/etc/nixos/hosts/''${hostname}/default.nix"
+cat << EOF > "/etc/nixos/hosts/''${hostname}/default.nix"
+{ pkgs, config, ... }:
+
+{
+	imports = [ ./hardware-configuration.nix ];
+
+	boot.loader = {
+		systemd-boot.enable = true;
+		efi.canTouchEfiVariables = true;
+	};
+
+	networking.hostName = "''${hostname}";
+	greg = {
+		home = true;
+		tailscale.enable = true;
+	};
+}
+EOF
 cp /etc/nixos.bk/hardware-configuration.nix "/etc/nixos/hosts/''${hostname}/hardware-configuration.nix"
 
+# Prepare home-manager portion for setup
+mkdir -p "/etc/nixos/home/hosts/''${hostname}"
+cat << EOF > "/etc/nixos/home/hosts/''${hostname}/default.nix"
+{ pkgs, config, ... }:
+
+{
+}
+EOF
+
 # Prepares it for injecting the use case into the flake usage
 cp /etc/nixos.bk/hardware-configuration.nix /etc/nixos
 chown -R greg nixos
 
-echo "Now you should be able to just run 'nixos-rebuild switch' to enable the flake functionality"
+echo "Now you should be able to just run `nixos-rebuild switch` to enable the flake functionality"
-echo "After that and adding the entry to the flake, run 'nixos-rebuild boot --flake '.#''${hostname}' and reboot"
+echo "After that and adding the entry to the flake, run `nixos-rebuild boot --flake '.#''${hostname}'` and reboot"
 ''

overlays/upgrade-pg-cluster.nix

@@ -0,0 +1,24 @@
+{ postgresql_15, postgresql_14, writeScriptBin, ... }:
+
+let
+	newPostgres = postgresql_15;
+	oldPostgres = postgresql_14;
+in writeScriptBin "upgrade-pg-cluster" ''
+	set -eux
+	systemctl stop postgresql
+
+	export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
+	export NEWBIN="${newPostgres}/bin"
+
+	export OLDDATA="/var/lib/postgresql/${oldPostgres.psqlSchema}"
+	export OLDBIN="${oldPostgres}/bin"
+
+	install -d -m 0700 -o postgres -g postgres "$NEWDATA"
+	cd "$NEWDATA"
+	sudo -u postgres "$NEWBIN/initdb" -D "$NEWDATA"
+
+	sudo -u postgres "$NEWBIN/pg_upgrade" \
+	    --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
+	    --old-bindir "$OLDBIN" --new-bindir "$NEWBIN" \
+	    "$@"
+''

secrets/secrets.nix

@@ -17,6 +17,7 @@ let
 	user_linode = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINAX6pNx5mbwIa8X+GzktyNijfYmJUpgROFpRxSW9js0 greg@linode";
 	user_myself = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAl6DJVrPSujvJSAEA5Q8tRrzfJs/c6DMwqwQEUFffIR greg@myself";
 	user_hosea = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGrqJQvDspLi1vXQRJ/Z5kN/F8jCBHvaXjo+5zLuIYjR greg@hosea";
+	user_jeremiah = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIYIiecdyM9c7tXgR96983K3wqiJeQRMbrzGIF8Wy6uO greg@jeremiah";
 
 	users = [
 		user_genesis_virt
@@ -25,6 +26,7 @@ let
 		user_linode
 		user_myself
 		user_hosea
+		user_jeremiah
 	];
 
 	everyone = systems ++ users;