Rename of Jude to Zeke

Since Jude is a now a server, we rename it to Zeke, for Ezekiel
Update of tailscale to auto-register nodes
Update kubernetes to install the etcd application
Update Zeke IP address and DNS bindings

home/default.nix

@@ -35,7 +35,7 @@ in
   "MacBook-Prolocal.local" = user "aarch64-darwin" "ivr" "gregory.hellings";
   "jude.thehellings.lan" = user "aarch64-darwin" "ivr" "gregory.hellings"; # This is annoying, but DNS is a pain for the shared docking station
   exodus = greg "exodus";
-  jude = greg "jude";
+  zeke = greg "zeke";
   isaiah = greg "isaiah";
   jeremiah = greg "jeremiah";
   linode = greg "linode";

hosts/baseline.nix

@@ -4,7 +4,6 @@
   overlays,
   pkgs,
   self,
-  top,
   ...
 }:
 let
@@ -148,11 +147,11 @@ in
           ];
           publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOjQjXq9WYU2Ki27BR9WwJ4ZruS/lJXbjC1b0Q42Adi0";
         };
-        jude = {
+        zeke = {
           extraHostNames = [
-            "jude.home"
+            "zeke.home"
-            "jude.thehellings.lan"
+            "zeke.thehellings.lan"
-            "jude-builder"
+            "zeke-builder"
           ];
           publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOos0zQePsa+T6Z2dsKbPOvEdrBQ8a6mx3s7pN6ysCI0";
         };
@@ -170,6 +169,7 @@ in
 
   # Enable the OpenSSH daemon for remote control
   services = {
+    locate.enable = true;
     openssh = {
       enable = true;
       settings.X11Forwarding = true;

hosts/default.nix

@@ -44,7 +44,7 @@ in
 {
   genesis = unstable { name = "genesis"; };
   exodus = unstable { name = "exodus"; };
-  jude = unstable { name = "jude"; };
+  zeke = unstable { name = "zeke"; };
   icdm-root = unstable { name = "icdm-root"; };
   linode = unstable { name = "linode"; };
   hosea = unstable { name = "hosea"; };

hosts/genesis/net/hosts

@@ -13,9 +13,10 @@
 10.42.1.7 hosea hosea.thehellings.lan
 10.42.1.8 jeremiah jeremiah.thehellings.lan minio-02.thehellings.lan
 10.42.1.9 ivr ivr.thehellings.lan
-10.42.1.10 jude jude.thehellings.lan
+# 10 - monitor
-10.42.1.11 jude1 jude1.thehellings.lan
+# 11 - old jude
 10.42.1.12 tv
+10.42.1.13 zeke zeke.thehellings.lan
 
 # VMs
 10.42.4.1 matrix matrix.thehellings.lan
@@ -34,7 +35,7 @@
 100.68.203.1 hosea.home hosea.shire-zebra.ts.net
 100.84.183.79 isaiah.home isaiah.shire-zebra.ts.net pgadmin.kubernetes postgres.kubernetes
 100.102.186.39 jeremiah.home jeremiah.shire-zebra.ts.net matrix.kubernetes
-100.90.74.19 jude.home
+100.90.74.19 zeke.home
 100.115.57.8 linode.home
 100.65.5.38 matrix.home matrix.shire-zebra.ts.net
 100.127.55.22 jellyfin.home

hosts/genesis/networking/dhcp.nix

@@ -107,7 +107,7 @@
           }
           {
             hw-address = "04:7c:16:d5:60:6f";
-            ip-address = "10.42.1.11"; # Jude - but straight in the motherboard
+            ip-address = "10.42.1.13"; # Zeke - but straight in the motherboard
           }
 
           ########################################

hosts/jude/default.nix

@@ -1,166 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  top,
-  ...
-}:
-
-{
-  imports = [
-    ./boot.nix
-    ./hardware-configuration.nix
-    ./virt.nix
-    ./work.nix
-    top.nix-hardware.nixosModules.system76
-  ];
-
-  boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
-
-  greg = {
-    tailscale.enable = true;
-    gnome.enable = false;
-    kde.enable = false;
-    kubernetes.enable = true;
-    podman.enable = true;
-    print.enable = true;
-    remote-builder.enable = true;
-  };
-
-  environment.systemPackages =
-    with pkgs;
-    lib.mkMerge [
-      [
-        # for Immersed
-        cudatoolkit
-        immersed
-        libva
-      ]
-      [
-        bind # For things like nslookup
-        create_ssl
-        distrobox
-        expect
-        fswatch
-        gimp
-        go
-        gparted
-        graphviz
-        flock
-        ffmpeg
-        handbrake
-        imagemagick
-        libtheora
-        libxml2
-        linode-cli
-        makemkv
-        oathToolkit
-        usbutils
-        ventoy
-      ]
-
-      [
-        # Video/Audio data composition framework tools like "gst-inspect", "gst-launch" ...
-        gst_all_1.gstreamer
-        gst_all_1.gst-plugins-base
-        gst_all_1.gst-plugins-good
-        gst_all_1.gst-plugins-bad
-        gst_all_1.gst-plugins-ugly
-        gst_all_1.gst-libav
-        gst_all_1.gst-vaapi
-      ]
-    ];
-
-  hardware = {
-    nvidia = {
-      modesetting.enable = true;
-      powerManagement = {
-        enable = false;
-        finegrained = false;
-      };
-      nvidiaSettings = true;
-      open = true;
-    };
-    system76 = {
-      firmware-daemon.enable = true;
-      #kernel-modules.enable = true;
-    };
-  };
-
-  networking = {
-    hostName = "jude";
-    networkmanager.enable = lib.mkForce true;
-    enableIPv6 = false;
-    useDHCP = false;
-    interfaces = {
-      # This seems to be direct mother board interface
-      enp12s0.useDHCP = true;
-      enp12s0.ipv4.addresses = [
-        {
-          address = "10.42.1.11";
-          prefixLength = 16;
-        }
-      ];
-    };
-    defaultGateway = {
-      address = "10.42.1.1";
-      interface = "enp12s0";
-    };
-    nameservers = [
-      "10.42.1.5"
-      "10.42.1.1"
-    ];
-    firewall = {
-      enable = false;
-      allowedTCPPorts = [ 21000 ];
-      allowedUDPPorts = [
-        21000
-        21010
-      ];
-    };
-  };
-
-  programs = {
-    adb.enable = true;
-    steam.enable = true;
-    nix-index = {
-      enable = true;
-      enableBashIntegration = false;
-      enableFishIntegration = false;
-      enableZshIntegration = false;
-    };
-    nix-ld.enable = false;
-  };
-
-  # Let's do a sound thing
-  services = {
-    k3s = {
-      disableAgent = true;
-      extraFlags =
-        let
-          ip = (builtins.head config.networking.interfaces.enp12s0.ipv4.addresses).address;
-        in
-        [
-          "--tls-san ${ip}"
-          #"--bind-address ${ip}"
-        ];
-    };
-    pipewire = {
-      enable = true;
-      alsa.enable = true;
-      audio.enable = true;
-      jack.enable = true;
-      pulse.enable = true;
-      wireplumber.enable = true;
-    };
-    pulseaudio.enable = false; # This conflicts with pipewire
-    locate.enable = true;
-    xserver.videoDrivers = [ "nvidia" ];
-  };
-
-  users.users.greg.extraGroups = [
-    "adbusers"
-    "kvm"
-    "podman"
-  ];
-}

hosts/jude/work.nix

@@ -1,14 +0,0 @@
-{ pkgs, ... }:
-
-{
-  services.mongodb = {
-    enable = false;
-  };
-  environment.systemPackages = with pkgs; [
-    mongodb-compass
-    pipenv-ivr
-    pre-commit
-    python311
-    stdenv.cc
-  ];
-}

hosts/zeke/default.nix

@@ -0,0 +1,84 @@
+{
+  config,
+  lib,
+  top,
+  ...
+}:
+
+{
+  imports = [
+    ./boot.nix
+    ./hardware-configuration.nix
+    ./virt.nix
+    top.nix-hardware.nixosModules.system76
+  ];
+
+  boot.extraModulePackages = [ config.boot.kernelPackages.v4l2loopback ];
+
+  greg = {
+    tailscale.enable = true;
+    kubernetes.enable = true;
+    remote-builder.enable = true;
+  };
+
+  hardware = {
+    nvidia = {
+      modesetting.enable = true;
+      powerManagement = {
+        enable = false;
+        finegrained = false;
+      };
+      nvidiaSettings = true;
+      open = true;
+    };
+    system76 = {
+      firmware-daemon.enable = true;
+      #kernel-modules.enable = true;
+    };
+  };
+
+  networking = {
+    hostName = "zeke";
+    networkmanager.enable = lib.mkForce true;
+    enableIPv6 = false;
+    useDHCP = false;
+    interfaces = {
+      # This seems to be direct mother board interface
+      enp12s0.useDHCP = true;
+      enp12s0.ipv4.addresses = [
+        {
+          address = "10.42.1.13";
+          prefixLength = 16;
+        }
+      ];
+    };
+    defaultGateway = {
+      address = "10.42.1.1";
+      interface = "enp12s0";
+    };
+    nameservers = [
+      "10.42.1.5"
+      "10.42.1.1"
+    ];
+  };
+
+  # Let's do a sound thing
+  services = {
+    k3s = {
+      extraFlags =
+        let
+          ip = (builtins.head config.networking.interfaces.enp12s0.ipv4.addresses).address;
+        in
+        [
+          "--tls-san ${ip}"
+          #"--bind-address ${ip}"
+        ];
+    };
+    xserver.videoDrivers = [ "nvidia" ];
+  };
+
+  users.users.greg.extraGroups = [
+    "kvm"
+    "podman"
+  ];
+}

hosts/zeke/virt.nix

@@ -20,12 +20,6 @@ in
 {
   specialisation = {
     vbox.configuration = {
-
-      greg = {
-        podman.enable = lib.mkForce false;
-        vmdev.enable = lib.mkForce false;
-      };
-
       users.extraGroups.vboxusers.members = [ "greg" ];
 
       virtualisation = {
@@ -81,8 +75,6 @@ in
     ];
   };
 
-  greg.vmdev.enable = true;
-
   hardware.graphics.enable = true;
 
   services.gitlab-runner = {

manifests/databases/ingress.yaml

@@ -18,7 +18,7 @@ spec:
       - 100.68.203.1 # hosea
       - 100.84.183.79 # isaiah
       - 100.102.186.39 # jeremiah
-      - 100.90.74.19 # jude
+      - 100.90.74.19 # zeke
       - 100.115.57.8 # linode
       - 100.65.5.38 # matrix
       - 100.127.55.22 # jellyfin

modules/nixos/kubernetes.nix

@@ -27,6 +27,7 @@ in
     };
 
     environment.systemPackages = [
+      pkgs.etcd
       pkgs.fluxcd
       pkgs.kubectl-cnpg
       pkgs.kubernetes-helm

modules/nixos/tailscale.nix

@@ -9,13 +9,19 @@ in
   };
 
   config = lib.mkIf cfg.enable {
-    services.tailscale.enable = true;
+    age.secrets.tailscale-key.file = ../../secrets/tailscale.age;
-    networking.firewall.checkReversePath = "loose";
     boot.kernel.sysctl = {
       "net.ipv4.ip_forward" = "1";
       "net.ipv6.conf.all.forwarding" = "1";
     };
     environment.systemPackages = [ config.services.tailscale.package ];
+    networking.firewall.checkReversePath = "loose";
+    services.tailscale = {
+      enable = true;
+      authKeyFile = config.age.secrets.tailscale-key.path;
+      authKeyParameters.preauthorized = true;
+      useRoutingFeatures = "both";
+    };
     systemd.services.tailscaled.partOf = [ "network-online.target" ];
   };
 }

secrets/secrets.nix

@@ -48,6 +48,7 @@ in
 {
   # Demo of how to create it
   "matrix.age".publicKeys = everyone;
+  "tailscale.age".publicKeys = everyone;
   # At the point where you want to use it, put
   # age.secrets.matrix.file = ../../secrets/matrix.age;
   # Then you can reference the file at /run/agenix/matrix

secrets/tailscale.age

@@ -0,0 +1,40 @@
+age-encryption.org/v1
+-> ssh-ed25519 64uajw eoKKdFba2XcbCVKnIOtdC2ONeyi/dE1twqMaSqXKkEc
+prfPB9NCpJo8tzzuhWznhxvMldAi0YTPUhW6AWiQvE4
+-> ssh-ed25519 oyEmTw DLXlNmyaCz7tmSfQPl/SwTQ+wOdNNYbFTm1Y76PpBzg
+YJBWt1zdMO47Om7gs38SCeMa7dw+t5/73TgDSYaUdZI
+-> ssh-ed25519 mOmPfg bTVKIB7INbEG+PXSL8YcP74fy7ECQKt/MPmTDpCiQQo
+AfZYePt24h0ELGArl//fJiR/7slWdrc/Ezxu0LqxQUk
+-> ssh-ed25519 YJiRbw WsRrdW0GeYO3VJyZWpQ29LTRfTt0nPdVBgmMc6YAwgU
+I4npJcHxKOMVYjbfw69sZCCPIucjFiEt0h5vjSDw7RM
+-> ssh-ed25519 aY2AXA whCyGvPQiNn1PSYLXx37fFWDwYDcK+r0MPQJYQcAIDg
+/b9ANzkjXLRuubCtUZW6egQaUkugRmzd29tVet2hT9w
+-> ssh-ed25519 xNtnoA 180eVN3lr/cMHjz4PGMMk1+G/y8Dot2sWn4bSIdYTS4
+K0RjcWsvMS28wlvA1MAluika8zbdxgunYI7JCQ07M70
+-> ssh-ed25519 AQhf1g ctCXtqVmBCPhEGFOzqh1C3XSqEaE9f28yNSJvWp/ZTo
+bD+cbqv2TOugtvSyk6wxqA0GtlOvIQuUNKtizfzhvOA
+-> ssh-ed25519 B8wa7Q UTJugYfOOIbaJnekia96nyfMRRbGbgmbJnAOdtQXkXw
++qMZomWoP83M8df0ENMxhLOI+SbYAsXnpEgsqc58RWg
+-> ssh-ed25519 8UnW5Q xQNVaJMaPWSpZa1YmTBrq8IYU8bt8tqNWjbDdmmLnlk
+s9SsfK5M6VaAYUe+xsDn2Hb3bBrG5jsj/nnQC2q5KyU
+-> ssh-ed25519 0/WsKg Q62P2TPgR7ZGrh3IQ44GR36BE138xXvitpqjUka9DB0
+X6cXT+KX3b+6eocOUMj7HnYIL6McDaEAkHcJtNG0zXA
+-> ssh-ed25519 Nl/5yA QzloGeZn8MJJJXoYZWIyfROOInYc8DMtChwNFdo2oHQ
+ZRpi/vsdZ9AhBQ3y4Ef80EVQASh+LV5oaQ6ORRZJq0A
+-> ssh-ed25519 GdLgCQ /YUxOpKyfXyRVKpvbVo2WFUPI1ybsV6r4Qc5lePTuyI
+AlpzElB1nmreZgxXra7m9Bmg01CmEE4cCa55iQsOus8
+-> ssh-ed25519 tOH/HQ D8XB9uWUjvxuuY1Cw91OgM0HTBjHR53jdXzTz6vSPW4
+CNDdFdCx/DpDinLfmkzC2+eqhmMeeFKlb4E8uL5+7p8
+-> ssh-ed25519 FpzvfQ Q+BhCWFka6CjuBQkq52YL6h5zgAIxOFBi0XotIsSg1A
+QTjopNycjnDN+7QWBkpanaxvyAlJSuoiZXX4qt/Wap4
+-> ssh-ed25519 kdPvzQ hEuPZpdsql8cgOIzh275mcCllJ4LiRXcgytuh422CD4
+P/yZGDmUxCUI2Mw8n3mvtLTe3AQS35PwEtd7t8opNOI
+-> ssh-ed25519 onmXpg aHON6nzJV7CaoFcaiwRjKIGZ0Iuwt0sg9/6xm88K1HU
+egBgoaXi/yG/p7ZgbxcMblj1whEeXY1nc854G2CPEfU
+-> ssh-ed25519 CnhD0g 14R8ZAmBI40N78Y7E9yPzzAxN3pV3aprrW3/ww/pYTo
+y3ntuDWMEKfaIWQSJGAkP9bfH4RiRRPLzkeHtJknPSg
+-> ssh-ed25519 4ep2UA RByTE9k8SWeuY1lC/cnfukePKjkOWN2PErHox+br/B4
+n5v3/oGmyoxcqMG95zdSuBKJ+LQHO1ODAOmXyYkrd4U
+--- IWNk1uhB1uTeMC1V9zajj5S3WQ223Jp/VjUUI98mDZk
+ÛŠ�¶êèó9:YQ);O#ûÃ,N<,<S B½ã•÷æQœ]ýæ¿cYç�cG’!(Oú�Ät«T
+ž®*U]ˆ‹LîpNúèÇ?‹žƒèÐßÖˆ¾T£KÈ2@Ãm