chore: move charts into manifests

hosts/baseline.nix

@@ -53,9 +53,25 @@
 
   # Network Manager pulls in too many deps
   networking = {
+    extraHosts =
+      let
+        onNetwork =
+          attr: _k: v:
+          (builtins.hasAttr attr v) && v.${attr} != null;
+        getIPs =
+          attr: domain:
+          (lib.mapAttrsToList (host: v: "${builtins.getAttr attr v} ${host}.${domain}") (
+            lib.filterAttrs (onNetwork attr) metadata.hosts
+          ));
+      in
+      builtins.concatStringsSep "\n" (
+        (getIPs "ts" "shire-zebra.ts.net")
+        ++ (getIPs "nebulaIp" "nebula.thehellings.com")
+        ++ (getIPs "nebulaIp" "nebula")
+        ++ (getIPs "ip" "thehellings.lan")
+      );
     search = [
-      "thehellings.lan"
+      "nebula.thehellings.com"
-      "home"
     ];
     networkmanager.enable = false;
   };
@@ -114,17 +130,23 @@
     };
   };
 
-  security.sudo.extraRules = [
+  security = {
-    {
+    sudo-rs = {
-      users = [ "greg" ];
+      enable = true;
-      commands = [
+      extraRules = [
         {
-          command = "ALL";
+          users = [ "greg" ];
-          options = [ "NOPASSWD" ];
+          commands = [
+            {
+              command = "ALL";
+              options = [ "NOPASSWD" ];
+            }
+          ];
         }
       ];
-    }
+    };
-  ];
+    sudo.enable = false;
+  };
 
   # Define a user account. Don't forget to set a password with ‘passwd’.
   users.users.greg = {

hosts/unstable/exodus/default.nix

@@ -18,7 +18,11 @@
 
   boot = {
     loader = {
-      systemd-boot.enable = true;
+      systemd-boot = {
+        enable = true;
+        memtest86.enable = true;
+        netbootxyz.enable = true;
+      };
       efi.canTouchEfiVariables = true;
     };
     binfmt.emulatedSystems = [

manifests/helm/external-secrets.yaml

@@ -0,0 +1,33 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: external-secrets
+  namespace: external-secrets
+spec:
+  interval: "24h"
+  url: "https://charts.external-secrets.io/"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: external-secrets
+  namespace: external-secrets
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: external-secrets
+      version: "2.3.0"
+      sourceRef:
+        kind: HelmRepository
+        name: external-secrets
+      interval: "1h"
+  values:
+    crds:
+      create: true
+    includeCRDs: true

manifests/helm/kustomization.yaml

@@ -1,3 +1,6 @@
 resources:
+  - kyverno.yaml
+  - external-secrets.yaml
+  - tailscale.yaml
   - longhorn.yaml # Needed for storage
   - traefik.yaml

manifests/helm/kyverno.yaml

@@ -0,0 +1,40 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kyverno-system
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: kyverno
+  namespace: kyverno-system
+spec:
+  interval: "24h"
+  url: "https://kyverno.github.io/kyverno/"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kyverno
+  namespace: kyverno-system
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: kyverno
+      version: "1.17.1"
+      sourceRef:
+        kind: HelmRepository
+        name: kyverno
+      interval: "1h"
+  values:
+    admissionController:
+      replicas: 3
+    backgroundController:
+      replicas: 3
+    cleanupController:
+      replicas: 2
+    reportsController:
+      replicas: 2
+    crds:
+      install: true

manifests/helm/longhorn.yaml

@@ -19,6 +19,11 @@ metadata:
   namespace: longhorn-system
 spec:
   interval: 10m
+  dependsOn:
+    - name: tailscale-operator
+      namespace: tailscale
+    - name: kyverno
+      namespace: kyverno
   chart:
     spec:
       chart: longhorn

manifests/helm/tailscale.yaml

@@ -1,3 +1,36 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: tailscale
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: tailscale
+  namespace: tailscale
+spec:
+  interval: "24h"
+  url: "https://pkgs.tailscale.com/helmcharts"
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: tailscale
+  namespace: tailscale
+spec:
+  interval: 10m
+  dependsOn:
+    - name: external-secrets
+      namespace: external-secrets
+  chart:
+    spec:
+      chart: tailscale-operator
+      version: "1.96.5"
+      sourceRef:
+        kind: HelmRepository
+        name: tailscale
+      interval: "1h"
+---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:

modules/nixos/kubernetes.nix

@@ -2,7 +2,6 @@
   config,
   lib,
   pkgs,
-  top,
   ...
 }:
 let
@@ -86,43 +85,6 @@ in
     services = {
       k3s = {
         enable = true;
-        autoDeployCharts = {
-          external-secrets = {
-            inherit (top.charts.chartsMetadata.external-secrets.external-secrets) repo version;
-            enable = true;
-            name = top.charts.chartsMetadata.external-secrets.external-secrets.chart;
-            hash = "sha256-dPuUWthwN6L0jdAKRpkDtDedGyDUxUlJrwkvUNwLsrU=";
-            createNamespace = true;
-            targetNamespace = "external-secrets";
-            values = {
-              crds.create = true;
-              includeCRDs = true;
-            };
-          };
-          kyverno = {
-            inherit (top.charts.chartsMetadata.kyverno.kyverno) repo version;
-            enable = true;
-            name = top.charts.chartsMetadata.kyverno.kyverno.chart;
-            hash = "sha256-sNdFEupwfnYSo2iGqKwTadPtXfcbyM1kuisavpiGUyU=";
-            createNamespace = true;
-            targetNamespace = "kyverno-system";
-            values = {
-              admissionController.replicas = 3;
-              backgroundController.replicas = 3;
-              cleanupController.replicas = 2;
-              reportsController.replicas = 2;
-              crds.install = true;
-            };
-          };
-          tailscale = {
-            inherit (top.charts.chartsMetadata.tailscale.tailscale-operator) repo version;
-            enable = true;
-            name = top.charts.chartsMetadata.tailscale.tailscale-operator.chart;
-            hash = "sha256-BtZ24mCT2GMHE9iR+2xuIkB+4m1r2OC3WLkY3jC3i3I=";
-            createNamespace = true;
-            targetNamespace = "tailscale";
-          };
-        };
         extraFlags = [
           "--cluster-cidr=10.211.0.0/16"
           "--service-cidr=10.221.0.0/16"
@@ -138,7 +100,6 @@ in
           cert-manager.source = cert-manager;
           flux.source = flux;
           node-annotations.source = ../../manifests/auto/nodes.yaml;
-          operator-oauth.source = ../../manifests/auto/operator-oauth.yaml;
         };
         role = if cfg.agentOnly then "agent" else "server";
         serverAddr = lib.mkIf (