From f9f1357b8eb7f7d90ebc42950dc151be93e1a68f Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Wed, 2 Jul 2025 11:55:35 -0500 Subject: [PATCH] Rename of Jude to Zeke Since Jude is a now a server, we rename it to Zeke, for Ezekiel Update of tailscale to auto-register nodes Update kubernetes to install the etcd application Update Zeke IP address and DNS bindings --- home/default.nix | 2 +- home/hosts/{jude => zeke}/default.nix | 0 hosts/baseline.nix | 10 +- hosts/default.nix | 2 +- hosts/genesis/net/hosts | 7 +- hosts/genesis/networking/dhcp.nix | 2 +- hosts/jude/default.nix | 166 ------------------ hosts/jude/work.nix | 14 -- hosts/{jude => zeke}/boot.nix | 0 hosts/zeke/default.nix | 84 +++++++++ .../{jude => zeke}/hardware-configuration.nix | 0 hosts/{jude => zeke}/virt.nix | 8 - manifests/databases/ingress.yaml | 2 +- modules/nixos/kubernetes.nix | 1 + modules/nixos/tailscale.nix | 10 +- secrets/secrets.nix | 1 + secrets/tailscale.age | 40 +++++ 17 files changed, 147 insertions(+), 202 deletions(-) rename home/hosts/{jude => zeke}/default.nix (100%) delete mode 100644 hosts/jude/default.nix delete mode 100644 hosts/jude/work.nix rename hosts/{jude => zeke}/boot.nix (100%) create mode 100644 hosts/zeke/default.nix rename hosts/{jude => zeke}/hardware-configuration.nix (100%) rename hosts/{jude => zeke}/virt.nix (94%) create mode 100644 secrets/tailscale.age diff --git a/home/default.nix b/home/default.nix index c7e7eb8..29caf42 100644 --- a/home/default.nix +++ b/home/default.nix @@ -35,7 +35,7 @@ in "MacBook-Prolocal.local" = user "aarch64-darwin" "ivr" "gregory.hellings"; "jude.thehellings.lan" = user "aarch64-darwin" "ivr" "gregory.hellings"; # This is annoying, but DNS is a pain for the shared docking station exodus = greg "exodus"; - jude = greg "jude"; + zeke = greg "zeke"; isaiah = greg "isaiah"; jeremiah = greg "jeremiah"; linode = greg "linode"; diff --git a/home/hosts/jude/default.nix b/home/hosts/zeke/default.nix similarity index 100% rename from home/hosts/jude/default.nix rename to home/hosts/zeke/default.nix diff --git a/hosts/baseline.nix b/hosts/baseline.nix index 510e9a0..fc580f7 100644 --- a/hosts/baseline.nix +++ b/hosts/baseline.nix @@ -4,7 +4,6 @@ overlays, pkgs, self, - top, ... }: let @@ -148,11 +147,11 @@ in ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0"; }; - jude = { + zeke = { extraHostNames = [ - "jude.home" - "jude.thehellings.lan" - "jude-builder" + "zeke.home" + "zeke.thehellings.lan" + "zeke-builder" ]; publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0"; }; @@ -170,6 +169,7 @@ in # Enable the OpenSSH daemon for remote control services = { + locate.enable = true; openssh = { enable = true; settings.X11Forwarding = true; diff --git a/hosts/default.nix b/hosts/default.nix index 9975175..1e132df 100644 --- a/hosts/default.nix +++ b/hosts/default.nix @@ -44,7 +44,7 @@ in { genesis = unstable { name = "genesis"; }; exodus = unstable { name = "exodus"; }; - jude = unstable { name = "jude"; }; + zeke = unstable { name = "zeke"; }; icdm-root = unstable { name = "icdm-root"; }; linode = unstable { name = "linode"; }; hosea = unstable { name = "hosea"; }; diff --git a/hosts/genesis/net/hosts b/hosts/genesis/net/hosts index cc877ec..53dafd0 100644 --- a/hosts/genesis/net/hosts +++ b/hosts/genesis/net/hosts @@ -13,9 +13,10 @@ 10.42.1.7 hosea hosea.thehellings.lan 10.42.1.8 jeremiah jeremiah.thehellings.lan minio-02.thehellings.lan 10.42.1.9 ivr ivr.thehellings.lan -10.42.1.10 jude jude.thehellings.lan -10.42.1.11 jude1 jude1.thehellings.lan +# 10 - monitor +# 11 - old jude 10.42.1.12 tv +10.42.1.13 zeke zeke.thehellings.lan # VMs 10.42.4.1 matrix matrix.thehellings.lan @@ -34,7 +35,7 @@ 100.68.203.1 hosea.home hosea.shire-zebra.ts.net 100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes postgres.kubernetes 100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes -100.90.74.19 jude.home +100.90.74.19 zeke.home 100.115.57.8 linode.home 100.65.5.38 matrix.home matrix.shire-zebra.ts.net 100.127.55.22 jellyfin.home diff --git a/hosts/genesis/networking/dhcp.nix b/hosts/genesis/networking/dhcp.nix index 63bb46f..8572be3 100644 --- a/hosts/genesis/networking/dhcp.nix +++ b/hosts/genesis/networking/dhcp.nix @@ -107,7 +107,7 @@ } { hw-address = "04:7c:16:d5:60:6f"; - ip-address = "10.42.1.11"; # Jude - but straight in the motherboard + ip-address = "10.42.1.13"; # Zeke - but straight in the motherboard } ######################################## diff --git a/hosts/jude/default.nix b/hosts/jude/default.nix deleted file mode 100644 index 7462e58..0000000 --- a/hosts/jude/default.nix +++ /dev/null @@ -1,166 +0,0 @@ -{ - config, - lib, - pkgs, - top, - ... -}: - -{ - imports = [ - ./boot.nix - ./hardware-configuration.nix - ./virt.nix - ./work.nix - top.nix-hardware.nixosModules.system76 - ]; - - boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ]; - - greg = { - tailscale.enable = true; - gnome.enable = false; - kde.enable = false; - kubernetes.enable = true; - podman.enable = true; - print.enable = true; - remote-builder.enable = true; - }; - - environment.systemPackages = - with pkgs; - lib.mkMerge [ - [ - # for Immersed - cudatoolkit - immersed - libva - ] - [ - bind # For things like nslookup - create_ssl - distrobox - expect - fswatch - gimp - go - gparted - graphviz - flock - ffmpeg - handbrake - imagemagick - libtheora - libxml2 - linode-cli - makemkv - oathToolkit - usbutils - ventoy - ] - - [ - # Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ... - gst_all_1.gstreamer - gst_all_1.gst-plugins-base - gst_all_1.gst-plugins-good - gst_all_1.gst-plugins-bad - gst_all_1.gst-plugins-ugly - gst_all_1.gst-libav - gst_all_1.gst-vaapi - ] - ]; - - hardware = { - nvidia = { - modesetting.enable = true; - powerManagement = { - enable = false; - finegrained = false; - }; - nvidiaSettings = true; - open = true; - }; - system76 = { - firmware-daemon.enable = true; - #kernel-modules.enable = true; - }; - }; - - networking = { - hostName = "jude"; - networkmanager.enable = lib.mkForce true; - enableIPv6 = false; - useDHCP = false; - interfaces = { - # This seems to be direct mother board interface - enp12s0.useDHCP = true; - enp12s0.ipv4.addresses = [ - { - address = "10.42.1.11"; - prefixLength = 16; - } - ]; - }; - defaultGateway = { - address = "10.42.1.1"; - interface = "enp12s0"; - }; - nameservers = [ - "10.42.1.5" - "10.42.1.1" - ]; - firewall = { - enable = false; - allowedTCPPorts = [ 21000 ]; - allowedUDPPorts = [ - 21000 - 21010 - ]; - }; - }; - - programs = { - adb.enable = true; - steam.enable = true; - nix-index = { - enable = true; - enableBashIntegration = false; - enableFishIntegration = false; - enableZshIntegration = false; - }; - nix-ld.enable = false; - }; - - # Let's do a sound thing - services = { - k3s = { - disableAgent = true; - extraFlags = - let - ip = (builtins.head config.networking.interfaces.enp12s0.ipv4.addresses).address; - in - [ - "--tls-san ${ip}" - #"--bind-address ${ip}" - ]; - }; - pipewire = { - enable = true; - alsa.enable = true; - audio.enable = true; - jack.enable = true; - pulse.enable = true; - wireplumber.enable = true; - }; - pulseaudio.enable = false; # This conflicts with pipewire - locate.enable = true; - xserver.videoDrivers = [ "nvidia" ]; - }; - - users.users.greg.extraGroups = [ - "adbusers" - "kvm" - "podman" - ]; -} diff --git a/hosts/jude/work.nix b/hosts/jude/work.nix deleted file mode 100644 index a51b511..0000000 --- a/hosts/jude/work.nix +++ /dev/null @@ -1,14 +0,0 @@ -{ pkgs, ... }: - -{ - services.mongodb = { - enable = false; - }; - environment.systemPackages = with pkgs; [ - mongodb-compass - pipenv-ivr - pre-commit - python311 - stdenv.cc - ]; -} diff --git a/hosts/jude/boot.nix b/hosts/zeke/boot.nix similarity index 100% rename from hosts/jude/boot.nix rename to hosts/zeke/boot.nix diff --git a/hosts/zeke/default.nix b/hosts/zeke/default.nix new file mode 100644 index 0000000..c1df80a --- /dev/null +++ b/hosts/zeke/default.nix @@ -0,0 +1,84 @@ +{ + config, + lib, + top, + ... +}: + +{ + imports = [ + ./boot.nix + ./hardware-configuration.nix + ./virt.nix + top.nix-hardware.nixosModules.system76 + ]; + + boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ]; + + greg = { + tailscale.enable = true; + kubernetes.enable = true; + remote-builder.enable = true; + }; + + hardware = { + nvidia = { + modesetting.enable = true; + powerManagement = { + enable = false; + finegrained = false; + }; + nvidiaSettings = true; + open = true; + }; + system76 = { + firmware-daemon.enable = true; + #kernel-modules.enable = true; + }; + }; + + networking = { + hostName = "zeke"; + networkmanager.enable = lib.mkForce true; + enableIPv6 = false; + useDHCP = false; + interfaces = { + # This seems to be direct mother board interface + enp12s0.useDHCP = true; + enp12s0.ipv4.addresses = [ + { + address = "10.42.1.13"; + prefixLength = 16; + } + ]; + }; + defaultGateway = { + address = "10.42.1.1"; + interface = "enp12s0"; + }; + nameservers = [ + "10.42.1.5" + "10.42.1.1" + ]; + }; + + # Let's do a sound thing + services = { + k3s = { + extraFlags = + let + ip = (builtins.head config.networking.interfaces.enp12s0.ipv4.addresses).address; + in + [ + "--tls-san ${ip}" + #"--bind-address ${ip}" + ]; + }; + xserver.videoDrivers = [ "nvidia" ]; + }; + + users.users.greg.extraGroups = [ + "kvm" + "podman" + ]; +} diff --git a/hosts/jude/hardware-configuration.nix b/hosts/zeke/hardware-configuration.nix similarity index 100% rename from hosts/jude/hardware-configuration.nix rename to hosts/zeke/hardware-configuration.nix diff --git a/hosts/jude/virt.nix b/hosts/zeke/virt.nix similarity index 94% rename from hosts/jude/virt.nix rename to hosts/zeke/virt.nix index c04871d..b1943be 100644 --- a/hosts/jude/virt.nix +++ b/hosts/zeke/virt.nix @@ -20,12 +20,6 @@ in { specialisation = { vbox.configuration = { - - greg = { - podman.enable = lib.mkForce false; - vmdev.enable = lib.mkForce false; - }; - users.extraGroups.vboxusers.members = [ "greg" ]; virtualisation = { @@ -81,8 +75,6 @@ in ]; }; - greg.vmdev.enable = true; - hardware.graphics.enable = true; services.gitlab-runner = { diff --git a/manifests/databases/ingress.yaml b/manifests/databases/ingress.yaml index 21d8ecc..c42fb46 100644 --- a/manifests/databases/ingress.yaml +++ b/manifests/databases/ingress.yaml @@ -18,7 +18,7 @@ spec: - 100.68.203.1 # hosea - 100.84.183.79 # isaiah - 100.102.186.39 # jeremiah - - 100.90.74.19 # jude + - 100.90.74.19 # zeke - 100.115.57.8 # linode - 100.65.5.38 # matrix - 100.127.55.22 # jellyfin diff --git a/modules/nixos/kubernetes.nix b/modules/nixos/kubernetes.nix index a30cf49..d3aed94 100644 --- a/modules/nixos/kubernetes.nix +++ b/modules/nixos/kubernetes.nix @@ -27,6 +27,7 @@ in }; environment.systemPackages = [ + pkgs.etcd pkgs.fluxcd pkgs.kubectl-cnpg pkgs.kubernetes-helm diff --git a/modules/nixos/tailscale.nix b/modules/nixos/tailscale.nix index 810930c..ff7fe78 100644 --- a/modules/nixos/tailscale.nix +++ b/modules/nixos/tailscale.nix @@ -9,13 +9,19 @@ in }; config = lib.mkIf cfg.enable { - services.tailscale.enable = true; - networking.firewall.checkReversePath = "loose"; + age.secrets.tailscale-key.file = ../../secrets/tailscale.age; boot.kernel.sysctl = { "net.ipv4.ip_forward" = "1"; "net.ipv6.conf.all.forwarding" = "1"; }; environment.systemPackages = [ config.services.tailscale.package ]; + networking.firewall.checkReversePath = "loose"; + services.tailscale = { + enable = true; + authKeyFile = config.age.secrets.tailscale-key.path; + authKeyParameters.preauthorized = true; + useRoutingFeatures = "both"; + }; systemd.services.tailscaled.partOf = [ "network-online.target" ]; }; } diff --git a/secrets/secrets.nix b/secrets/secrets.nix index 0282f14..2fa244c 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -48,6 +48,7 @@ in { # Demo of how to create it "matrix.age".publicKeys = everyone; + "tailscale.age".publicKeys = everyone; # At the point where you want to use it, put # age.secrets.matrix.file = ../../secrets/matrix.age; # Then you can reference the file at /run/agenix/matrix diff --git a/secrets/tailscale.age b/secrets/tailscale.age new file mode 100644 index 0000000..77154c9 --- /dev/null +++ b/secrets/tailscale.age @@ -0,0 +1,40 @@ +age-encryption.org/v1 +-> ssh-ed25519 64uajw eoKKdFba2XcbCVKnIOtdC2ONeyi/dE1twqMaSqXKkEc +prfPB9NCpJo8tzzuhWznhxvMldAi0YTPUhW6AWiQvE4 +-> ssh-ed25519 oyEmTw DLXlNmyaCz7tmSfQPl/SwTQ+wOdNNYbFTm1Y76PpBzg +YJBWt1zdMO47Om7gs38SCeMa7dw+t5/73TgDSYaUdZI +-> ssh-ed25519 mOmPfg bTVKIB7INbEG+PXSL8YcP74fy7ECQKt/MPmTDpCiQQo +AfZYePt24h0ELGArl//fJiR/7slWdrc/Ezxu0LqxQUk +-> ssh-ed25519 YJiRbw WsRrdW0GeYO3VJyZWpQ29LTRfTt0nPdVBgmMc6YAwgU +I4npJcHxKOMVYjbfw69sZCCPIucjFiEt0h5vjSDw7RM +-> ssh-ed25519 aY2AXA whCyGvPQiNn1PSYLXx37fFWDwYDcK+r0MPQJYQcAIDg +/b9ANzkjXLRuubCtUZW6egQaUkugRmzd29tVet2hT9w +-> ssh-ed25519 xNtnoA 180eVN3lr/cMHjz4PGMMk1+G/y8Dot2sWn4bSIdYTS4 +K0RjcWsvMS28wlvA1MAluika8zbdxgunYI7JCQ07M70 +-> ssh-ed25519 AQhf1g ctCXtqVmBCPhEGFOzqh1C3XSqEaE9f28yNSJvWp/ZTo +bD+cbqv2TOugtvSyk6wxqA0GtlOvIQuUNKtizfzhvOA +-> ssh-ed25519 B8wa7Q UTJugYfOOIbaJnekia96nyfMRRbGbgmbJnAOdtQXkXw ++qMZomWoP83M8df0ENMxhLOI+SbYAsXnpEgsqc58RWg +-> ssh-ed25519 8UnW5Q xQNVaJMaPWSpZa1YmTBrq8IYU8bt8tqNWjbDdmmLnlk +s9SsfK5M6VaAYUe+xsDn2Hb3bBrG5jsj/nnQC2q5KyU +-> ssh-ed25519 0/WsKg Q62P2TPgR7ZGrh3IQ44GR36BE138xXvitpqjUka9DB0 +X6cXT+KX3b+6eocOUMj7HnYIL6McDaEAkHcJtNG0zXA +-> ssh-ed25519 Nl/5yA QzloGeZn8MJJJXoYZWIyfROOInYc8DMtChwNFdo2oHQ +ZRpi/vsdZ9AhBQ3y4Ef80EVQASh+LV5oaQ6ORRZJq0A +-> ssh-ed25519 GdLgCQ /YUxOpKyfXyRVKpvbVo2WFUPI1ybsV6r4Qc5lePTuyI +AlpzElB1nmreZgxXra7m9Bmg01CmEE4cCa55iQsOus8 +-> ssh-ed25519 tOH/HQ D8XB9uWUjvxuuY1Cw91OgM0HTBjHR53jdXzTz6vSPW4 +CNDdFdCx/DpDinLfmkzC2+eqhmMeeFKlb4E8uL5+7p8 +-> ssh-ed25519 FpzvfQ Q+BhCWFka6CjuBQkq52YL6h5zgAIxOFBi0XotIsSg1A +QTjopNycjnDN+7QWBkpanaxvyAlJSuoiZXX4qt/Wap4 +-> ssh-ed25519 kdPvzQ hEuPZpdsql8cgOIzh275mcCllJ4LiRXcgytuh422CD4 +P/yZGDmUxCUI2Mw8n3mvtLTe3AQS35PwEtd7t8opNOI +-> ssh-ed25519 onmXpg aHON6nzJV7CaoFcaiwRjKIGZ0Iuwt0sg9/6xm88K1HU +egBgoaXi/yG/p7ZgbxcMblj1whEeXY1nc854G2CPEfU +-> ssh-ed25519 CnhD0g 14R8ZAmBI40N78Y7E9yPzzAxN3pV3aprrW3/ww/pYTo +y3ntuDWMEKfaIWQSJGAkP9bfH4RiRRPLzkeHtJknPSg +-> ssh-ed25519 4ep2UA RByTE9k8SWeuY1lC/cnfukePKjkOWN2PErHox+br/B4 +n5v3/oGmyoxcqMG95zdSuBKJ+LQHO1ODAOmXyYkrd4U +--- IWNk1uhB1uTeMC1V9zajj5S3WQ223Jp/VjUUI98mDZk +ۊ9:YQ);O#,N<,