diff --git a/home/baseline/nushell/functions.nu b/home/baseline/nushell/functions.nu index cd17999..70a4672 100644 --- a/home/baseline/nushell/functions.nu +++ b/home/baseline/nushell/functions.nu @@ -16,6 +16,38 @@ def nebulaIps [] { open /etc/nixos/network.json | get hosts | items { |h, e| $e.nebulaIp? } | where $it != null | sort } +def genNebulaCert [ --ips: string, --name: string ] { + let public = $'~/SynologyDrive/nebula/($name).key.pub' | path expand + let private = $'~/SynologyDrive/nebula/($name).key' | path expand + let cert = $'/etc/nixos/secrets/nebula/($name).crt' + let ca_cert = '~/SynologyDrive/nebula/ca.crt' | path expand + let ca_key = '~/SynologyDrive/nebula/ca.key' | path expand + + # Generate public key if there isn't one already + if ( not ($public | path exists) ) { + nebula-cert keygen -out-key $private -out-pub $public + } + # Clear old cert if there is one + if ( $cert | path exists) { + rm $cert + } + + # Create and sign certs + (nebula-cert sign + -ca-crt $ca_cert + -ca-key $ca_key + -name $name + -networks $ips + -out-crt $cert + -in-pub $public + ) + + # Agenix update + cd /etc/nixos/secrets + cat $private | agenix -e $'nebula/($name).key.age' +} + + def rebuild [ $target: string = "switch" ] { if (uname | get operating-system) == "Darwin" { sudo darwin-rebuild $target @@ -39,7 +71,8 @@ def deploy [ $host: string, $build: string = "" ] { if $buildhost == "linode" or $buildhost == "genesis" { $buildhost = "isaiah" } - nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost + colmena apply --on $host + #nixos-rebuild switch --sudo --use-substitutes --target-host $host --build-host $buildhost } def ff [ $file: string ] { diff --git a/hosts/unstable/genesis/networking.nix b/hosts/unstable/genesis/networking.nix index bf52637..bb63560 100644 --- a/hosts/unstable/genesis/networking.nix +++ b/hosts/unstable/genesis/networking.nix @@ -130,7 +130,7 @@ in lib.mapAttrs (domain: net: { master = true; - file = makeZoneFile (lib'.hostsByNet net metadata.hosts) domain; + file = makeZoneFile (lib'.hostsByNet net (metadata.hosts // metadata.external)) domain; }) { "shire-zebra.ts.net" = "tailscale"; diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix index 8d31678..3669fac 100644 --- a/modules/nixos/kubernetes.nix +++ b/modules/nixos/kubernetes.nix @@ -15,6 +15,8 @@ let sha256 = "sha256-Qs1qJmgZm8q9xZsORjT/N/wzpbWVVODXtzDpjnAYMuQ="; }; keepaliveIp = "10.42.5.1"; + nebulaName = "k3s.nebula.thehellings.com"; + nebulaIp = "10.157.100.1"; in { options.greg = { @@ -44,6 +46,13 @@ in }; config = lib.mkIf cfg.enable { + assertions = [ + { + assertion = config.greg.nebula.enable; + message = "Configure Nebula for this host, first"; + } + ]; + age.secrets = { bw_secret.file = ../../secrets/kubernetes/bw_secret.age; dendrite_key.file = ../../secrets/dendrite_key.age; @@ -97,6 +106,8 @@ in "--tls-san ${config.networking.hostName}.thehellings.lan" "--tls-san ${config.networking.hostName}.shire-zebra.ts.net" "--tls-san ${keepaliveIp}" + "--tls-san ${nebulaName}" + "--tls-san ${nebulaIp}" ]; manifests = { cert-manager.source = cert-manager; @@ -112,20 +123,37 @@ in keepalived = { enable = true; openFirewall = true; - vrrpInstances.kubernetes = { - interface = cfg.vipInterface; - priority = cfg.priority; - state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP"; - virtualIps = [ - { - addr = "${keepaliveIp}/16"; - dev = cfg.vipInterface; - } - ]; - virtualRouterId = 77; - extraConfig = '' - advert_int 1 - ''; + vrrpInstances = { + kubernetes = { + interface = cfg.vipInterface; + priority = cfg.priority; + state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP"; + virtualIps = [ + { + addr = "${keepaliveIp}/16"; + dev = cfg.vipInterface; + } + ]; + virtualRouterId = 77; + extraConfig = '' + advert_int 1 + ''; + }; + k3s-nebula = { + interface = "nebula0"; + priority = 1; + state = if (config.networking.hostName == "isaiah") then "MASTER" else "BACKUP"; + virtualIps = [ + { + addr = "${nebulaIp}/16"; + dev = "nebula0"; + } + ]; + virtualRouterId = 78; + extraConfig = '' + advert_int 1 + ''; + }; }; }; openiscsi = { diff --git a/network.json b/network.json index b3277a1..6d683dc 100644 --- a/network.json +++ b/network.json @@ -13,13 +13,6 @@ "ip": "10.42.1.17", "system": "x86_64-linux" }, - "chronicles": { - "ip": "10.42.1.4", - "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS", - "external": true, - "ts": "100.119.228.115", - "aliases": ["s3"] - }, "exodus": { "ip": null, "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFxmnCj2E9DxcnefPW+n4yCuLShxqr0p024riogdeXA3", @@ -35,15 +28,6 @@ "tags": ["router", "server"], "nebulaIp": "10.157.0.2" }, - "hermes": { - "external": true, - "ip": "10.42.1.18", - "mac": "BC:24:11:E4:72:AB", - "nebulaIp": "10.157.0.8", - "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFYyzz/9i5rXprCQj9IL1ulrbQ6E9BOSeOcvf4D/b0G", - "system": "x86_64-linux", - "tags": ["server"] - }, "hosea": { "ip": "10.42.1.7", "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKLIwkTTXA56sUlUjEulXXZRvZy5H4a5ZwgKWLlpkQDz", @@ -52,10 +36,6 @@ "tags": ["server"], "nebulaIp": "10.157.0.3" }, - "icdm-root": { - "external": true, - "system": "x86_64-linux" - }, "isaiah": { "builder": true, "ip": "10.42.1.6", @@ -85,11 +65,6 @@ "tags": ["builder", "kube", "server"], "nebulaIp": "10.157.0.5" }, - "joel": { - "external": true, - "ip": "10.42.0.4", - "ts": null - }, "gregs-MacBook-Pro-16-inch-Nov-2024": { "external": true, "system": "aarch64-darwin" @@ -118,58 +93,10 @@ "external": true, "system": "aarch64-darwin" }, - "nas1": { - "aliases": [ "*.nas1" ], - "external": true, - "ip": "10.42.1.14", - "ts": "100.114.187.61" - }, "nixos": { "external": true, "system": "x86_64-linux" }, - "printer": { - "external": true, - "ip": "10.42.1.3" - }, - "proxmoxtemplate": { - "external": true, - "system": "x86_64-linux" - }, - "pve2": { - "external": true, - "ip": "10.42.1.15", - "system": "x86_64-linux" - }, - "pve2bmc": { - "derp": "10.42.2.129", - "external": true, - "mac": "00:25:90:4b:34:e8", - "ip": "10.42.6.2", - "system": "ipmi" - }, - "pve3": { - "external": true, - "ip": "10.42.1.16", - "system": "x86_64-linux" - }, - "pve3bmc": { - "derp": "10.42.2.181", - "external": true, - "ip": "10.42.6.3", - "mac": "00:25:90:4a:dc:2e", - "system": "ipmi" - }, - "pve4": { - "external": true, - "ip": "10.42.1.17", - "system": "x86_64-linux" - }, - "pve4bmc": { - "external": true, - "ip": "10.42.6.4", - "system": "ipmi" - }, "wsl": { "external": true, "system": "aarch64-linux" @@ -184,5 +111,55 @@ "tags": ["builder", "kube", "server"], "nebulaIp": "10.157.0.6" } + }, + "external": { + "chronicles": { + "ip": "10.42.1.4", + "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEBecZUva9OnZuXLaBun6/1ITo5f9p0YMLPD+q0egLRS", + "ts": "100.119.228.115", + "aliases": ["s3"] + }, + "hermes": { + "ip": "10.42.1.18", + "mac": "BC:24:11:E4:72:AB", + "nebulaIp": "10.157.0.8", + "pubkey": "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILFYyzz/9i5rXprCQj9IL1ulrbQ6E9BOSeOcvf4D/b0G", + "tags": ["server"] + }, + "joel": { + "ip": "10.42.0.4" + }, + "k3s": { + "ip": "10.42.5.1", + "nebulaIp": "10.157.100.1" + }, + "nas1": { + "aliases": [ "*.nas1" ], + "ip": "10.42.1.14", + "ts": "100.114.187.61" + }, + "printer": { + "ip": "10.42.1.3" + }, + "pve2": { + "ip": "10.42.1.15" + }, + "pve2bmc": { + "ip": "10.42.6.2", + "mac": "00:25:90:4b:34:e8" + }, + "pve3": { + "ip": "10.42.1.16" + }, + "pve3bmc": { + "ip": "10.42.6.3", + "mac": "00:25:90:4a:dc:2e" + }, + "pve4": { + "ip": "10.42.1.17" + }, + "pve4bmc": { + "ip": "10.42.6.4" + } } } diff --git a/secrets/nebula/isaiah.crt b/secrets/nebula/isaiah.crt index 7c843f5..21f0602 100644 --- a/secrets/nebula/isaiah.crt +++ b/secrets/nebula/isaiah.crt @@ -1,6 +1,6 @@ -----BEGIN NEBULA CERTIFICATE V2----- -MIGloD+ABmlzYWlhaKEHBAUKnQAEEIUEac2MaYYEa668pYcgg4lMYGB2VakRFO6b -K9vHSLzjZpuqhBVQ7MReOwUHQKyCIBv+1Lr/E3Q6d99laLGdXRTss2SIL4OGBp8z -qqfEsAMpg0CyDSEYuL8GaHQq708GbCxhxFifCZaRTB+ReGBScmhT9XhIwSLHRRZJ -1TmoY4QvrdPOS3NAWvlawk/JUqN7SWQL +MIGsoEaABmlzYWlhaKEOBAUKnQAEEAQFCp1kARCFBGplFeuGBGuuvKWHIIOJTGBg +dlWpERTumyvbx0i842abqoQVUOzEXjsFB0CsgiDoVBJV1aKswyKPq1E4ZH9H21tx +2IB0pKfEqNVdOLVedYNAjZSaY/IreMGnplY6txmSNuqSpFe1UTEDu4MOGSeZTKsO +71y33z4AWsexnDD2ItFLT2rA5EgbApacaYF0AxtSCQ== -----END NEBULA CERTIFICATE V2----- diff --git a/secrets/nebula/isaiah.key.age b/secrets/nebula/isaiah.key.age index ff9490e..d87df00 100644 Binary files a/secrets/nebula/isaiah.key.age and b/secrets/nebula/isaiah.key.age differ diff --git a/secrets/nebula/jeremiah.crt b/secrets/nebula/jeremiah.crt index 69b457b..7e82195 100644 --- a/secrets/nebula/jeremiah.crt +++ b/secrets/nebula/jeremiah.crt @@ -1,6 +1,6 @@ -----BEGIN NEBULA CERTIFICATE V2----- -MIGnoEGACGplcmVtaWFooQcEBQqdAAUQhQRpzYxphgRrrrylhyCDiUxgYHZVqREU -7psr28dIvONmm6qEFVDsxF47BQdArIIgHXr6BLGmqfF92GXiN6MBj3ac0p/EtNYf -xR3/EdI5GnGDQIFxfV5fVwi26+IRk9QIFxyyFBtmsZyPbdxL8ca1WUPm3lCNA4BT -Knd9Y3Zlp6L35L4/dzSqAVoXu2nlHF6SOAA= +MIGuoEiACGplcmVtaWFooQ4EBQqdAAUQBAUKnWQBEIUEamUYxYYEa668pYcgg4lM +YGB2VakRFO6bK9vHSLzjZpuqhBVQ7MReOwUHQKyCIBHK000U9B0TVjuoTaMhQZFi +8cKytw8is2cqUW4XAENBg0CLM+fuJcMVMbk6VHmRhko4KUTaQzWG2dggEwskTWCf +IPXiTY2L/hInHSGFynIIe+Ux9hSRJ1W1KF4J8jq5LBwN -----END NEBULA CERTIFICATE V2----- diff --git a/secrets/nebula/jeremiah.key.age b/secrets/nebula/jeremiah.key.age index 06380aa..a696f1f 100644 Binary files a/secrets/nebula/jeremiah.key.age and b/secrets/nebula/jeremiah.key.age differ diff --git a/secrets/nebula/zeke.crt b/secrets/nebula/zeke.crt index 92d15ef..9a78250 100644 --- a/secrets/nebula/zeke.crt +++ b/secrets/nebula/zeke.crt @@ -1,6 +1,6 @@ -----BEGIN NEBULA CERTIFICATE V2----- -MIGjoD2ABHpla2WhBwQFCp0ABhCFBGnNjGmGBGuuvKWHIIOJTGBgdlWpERTumyvb -x0i842abqoQVUOzEXjsFB0CsgiCirKKbej7yAALn41C+MYmertD9LOv09gZ61ODF -wEcnB4NAfix/r3q+XLYe3egKUoqJUW2i11x0ST0hxqhJUd8LjHKirRyHsvUraMbG -c8x+CXsCPLgheGt548PpmrObQWtrBA== +MIGqoESABHpla2WhDgQFCp0ABhAEBQqdZAEQhQRqZRi1hgRrrrylhyCDiUxgYHZV +qREU7psr28dIvONmm6qEFVDsxF47BQdArIIg+FmKGTcvIvUcFdcguETRybn3jh58 +jJL6X5BHcmrxOWODQCfB4+92Zs/315a6I60PXsUaw3Jk0MQPLUuHykTO19imWsYa +DyKFlk26ePhczGlhO2svq9J8p0zce0w+TPveOw8= -----END NEBULA CERTIFICATE V2----- diff --git a/secrets/nebula/zeke.key.age b/secrets/nebula/zeke.key.age index 0e4f622..66a582e 100644 --- a/secrets/nebula/zeke.key.age +++ b/secrets/nebula/zeke.key.age @@ -1,41 +1,35 @@ age-encryption.org/v1 --> ssh-ed25519 87huqg 59/Hfejnlp8Qk6VTcVpsaB2su+p/LjxnXCI3+uoxeXs -DW3LJMJ7nK3ySrDVrZTUhOCiDBujWh2ycGjpfMkddJw --> ssh-ed25519 8UnW5Q 2ESBP1XYX71s9tlf1YC9lL+UmJPYjf5qiNNGUsEtnWU -jWRnunZ2ub0QAvQaRznVGTIPIxHrzw8B620zFeZUx3Y --> ssh-ed25519 UFfTmg Vs0zDRmw2scS8exINo2lBO1x2UqVXEElWFtCnGwrzWI -SQM1l0GhHyDqzvykuyvR62XCeQPl/JaEttZJXFdvSFo --> ssh-ed25519 KbVVUw WVNEfBAAEGP0O7vtL04/IaM9nCR57UJkTcT+96ZtaHQ -3m/lb1USu6Vng2+4IEfXsdNwF4NMuVjZ5H/1+QUX4Q8 --> ssh-ed25519 xNtnoA cWYQoTMQmxpFPDCsj8AGOqxx4ErhHnsMiOgJJvhjBCI -6GU/IeVZB1ECMAGYiL8tLPqgCuC2ujNcdSgzhOof7hI --> ssh-ed25519 aY2AXA n1f3kFHxIvt5CbiBq6Vs32zoZEeYC5aBAZz5lCUEuxI -OuFwQTJAdv2oMxzFbce6iqUa7SAu3aHMYU+D3L0gNbo --> ssh-ed25519 AQhf1g hjjixHEYRom6XjHsIf2pMZvcMNxfeBw79+ApOheQezc -/HvBy+L5eaz9NAShIeNfagE8LzamzxolD5ZIdapiyPA --> ssh-ed25519 mOmPfg JJQYaT1ch0i4xeMrCVCgzq25dy7GhqNCHGXTd3syHCI -4F+EQY7WbDJ8DwukaMelfYi9Q3LjYBpfhgCJVyXUtWI --> ssh-ed25519 YJiRbw eFi1X3pmVVmkCDl8Jr+lIv2LeuSbMg6WqrpezABmOR8 -2arsXH0pdYxINujCFonHrqwEDVr4qR5ugXix8uu+cOk --> ssh-ed25519 Nl/5yA ScYVPC1pyYkgweGi+hxQaXJ8UEnKta2VqbyHgSPTKCY -CLiTEjJ6ylD3SlzrFHaz8yHaqc5KbCs3x3ij8Mgdnks --> ssh-ed25519 GdLgCQ TQHucvsozqInbmCsh1GHZ2JF5pbUteT/W3XieSIfmj4 -Owq1wb9MdMD9pVJj24QCTvmkyh57Q2cKqfMRxj3ZFq4 --> ssh-ed25519 tOH/HQ KVKjt9GYmfcNOO7LTA1bypmtoYTYHgKWgD2dpD4zxUA -VjlWDbSZp0NHC9VfRONz8UH2JtvIQWzqc7V/gJef/5A --> ssh-ed25519 FpzvfQ gAlbAOE0Zz2A0391SyUKfLQDBt0+9HYPn54rG5HY/hM -4t/wJ7L7yJvnFkdonsKTBFza+C7gXr8AI1PMEH58sO8 --> ssh-ed25519 2UotMw rrb5P6bPLUibtQ8Pkz533mQe65XA4DZOyw7B3GV6oHg -Xs9cK2GZ3k2FgrHjIeB4DTe3gdahFFvS892siiAyEvI --> ssh-ed25519 kdPvzQ JTPJpaE97otqsADN017u6dw2h9DWlD2NkwIyT5+b8yo -QroD7owHZ4ThrVDBTJO3/wn6PK8wfrOwypjbjTxGkSM --> ssh-ed25519 onmXpg QuQjNKosTocZ4y2KRvqMISezBbSll9ERKBTtKEVMIRs -R0mgBtM2iZ6lcBzGC5hDz5G06G5O8FM2C1Vll2NW/Ag --> ssh-ed25519 CnhD0g tSMysXdWjfmoBkVXD/wCIUEikjH7jiuEFlmrbfjIkmE -xrkP8nl1nE+LvHA0vb1rOnQKNR/SB+KaqYBvJHDa3fs --> ssh-ed25519 4ep2UA o1Vut8uttNV4+3DuZ67gURlGdnRittoON/xPE05i838 -03mFKfz89r0EKnY4tRL1zd9jKarZFW9TdX9nvvgAOTU ---- At7cFNjOg5E5WlaySJtqRZoK2/Gu+sXMI/cITd1SOKA -6vz0{ݚj& wmeE,| -_aD#q]L"W( Ѷʹwm]O# -T k ɗgr]fT_'w;!N\g!Tcb7XmLx \ No newline at end of file +-> ssh-ed25519 8UnW5Q E8Ki3oFCl3dLp9gxZ7/Ene8NMM26OVJ4PMJQQYQnBm0 +3rC3LMfdPCvSsiwaVnAb7VHwyw7KjZKcASdWm0lDg5E +-> ssh-ed25519 UFfTmg 6q8nJbCIQe2IV/W/31OpuI6sZI833IbU+weSTU05Mng +EgiGZwIN0oRjw9pAaHjypWtswBA1c5PCkNeN9K4YlT8 +-> ssh-ed25519 xNtnoA cyxa8uxevJ9VEaYLg2g9rewcAMhsZRAPEkzqd9k6ngE +SedkkmBd4foxqB1MlCAkfIqO6ft5xnmLBa2cShzw/GI +-> ssh-ed25519 aY2AXA biY7lFtfvr6vBv/XBhZ6Uh7Hpj+Du0NuEjo2RMp6USI +5DgzmbEw5f6h4lHm7FlRZHXn4C9vCJ6IguXk7jZXxqM +-> ssh-ed25519 AQhf1g e3g+IdnzmuJZj3H4LWdbZ8yaj5GM21zz3HCgkzFG5Cg +oyzAIsqnL9ypSOCHINMu/+VM9TJeqgY9jLumhmAFIu8 +-> ssh-ed25519 mOmPfg o4pCs9ferfC6+OawWXsM5Wa/5q+4EN+lEg/diMrjVhQ +H1gSB90UuJaivo2MhinPQGCV+rmSX1ZWazfhOxIDcaM +-> ssh-ed25519 YJiRbw o33TjJkI7rc1DxXRMdgwoHfCqzU3sGd7BZo7Uw0I8iA +/PiNDHyAl54HYszKkRzsjuoAZ53Ly1Oizf6NUIDB+I4 +-> ssh-ed25519 Nl/5yA FUycbaA303kvgINg9eNM53lN6aUXQPBxWz9liuhZ6Vo +nNMPiq0w06WWfe73fpj/9ixunwgzZUCEi6pIKWuNWvQ +-> ssh-ed25519 GdLgCQ sD2xKKzEyD7GsnFJCrDi40sJX0yBIXLr3pLx1R6RT1g +ThDfA6T5/9cgAFKZPQtxGhKHdYOZx4sSQnoxzJMsLwc +-> ssh-ed25519 tOH/HQ YeQfSV5UxsYAMEIOq1FNpkNcM4LEA8zvcbOceZ/26ws +KMeeyObeOBmqxS6hqhVbDgvoB5jUJr8k21igT3rqoww +-> ssh-ed25519 FpzvfQ GbT7exaVbqJNP7LdV/wyye89yXuN6FI20j7ckx5r5nI +bNMqf7oY6NWVTPvVLOy+UpJKT0C9m6WunfdvMXCUZzk +-> ssh-ed25519 2UotMw Zpco9IYJXyl9wIZo22g/kp/OjfClOtUP2in+N0hYX3o +e68dEYPiNdlrSFaMTzvrhCz9/5V5zFAvrTnPtNSyI4c +-> ssh-ed25519 kdPvzQ 2j64L6rV5b5+sbKbNAGf9+7uKLgdBpKNv9umHtSW4wY +3y74VGUzKb9uhh3DvlkvZ5Jxtgfku7s1kDKrGDWUUvk +-> ssh-ed25519 onmXpg 8GDMsteOopCnaaVkXAoRMbGuXeKoSqpyZhLvbnEWBQU +X0HsZbpT4Wc/KO0TBwVSyjK6Zcbz1A34VCozNrMH4Lw +-> ssh-ed25519 CnhD0g uHIeQtUwcDRXdJpFglJ12ptOPP64yMP6WKPz00sAQ0c +yIKZNODIQSkNr4UilEHZzOBxeRA4G/sAbkppyOdUjkQ +-> ssh-ed25519 4ep2UA k+cteVM7cMWQk7xDcCZgWlZxgA4ZBmUlbZHQFmMoi0Q +YC2fptyb258arEdeOcPhCc3+z/vIgEElbqn2Ik3r2Lo +--- NJ2uO0A/UbPrw+IgObiiXTwV75xgsWTjYvLpTwznDXM +B -`8n=m5/szǼmSƠ&_WRp߲=iGFyEІIq:|-~$>bv~le/dVوqо€5ς|J _lZ2rPޗp. \ No newline at end of file