root
792217f640
buildbot/nix-eval Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-exodus Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-isaiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-genesis Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-linode Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-jeremiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-zeke Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-hosea Build done.
buildbot/nix-build Build done.
Introduces a greg.nebula NixOS module and enables it across all managed
hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16).
Architecture:
- linode: lighthouse + relay (public internet, UDP 4242)
- genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN)
- hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes
pointing to genesis to reach the home LAN
Changes:
- modules/nixos/nebula.nix: new greg.nebula module
- isLighthouse / isRelay options
- unsafeRoutes option (tun.unsafe_routes)
- routesSubnet option: enables IP forwarding + nftables masquerade NAT
on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16
- agenix secret reference per-host (secrets/nebula/<name>.key.age)
- opens UDP/4242 in the firewall
- modules/nixos/default.nix: import nebula.nix
- hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true
- hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16"
- hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix:
greg.nebula.enable = true with unsafeRoutes via genesis
- network.json: add nebulaIp field for each managed host
- secrets/secrets.nix: declare nebula/<host>.key.age entries
- secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)
100 lines
1.6 KiB
Nix
100 lines
1.6 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
top,
|
|
...
|
|
}:
|
|
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
top.nix-hardware.nixosModules.framework-11th-gen-intel
|
|
];
|
|
|
|
age.secrets = {
|
|
compose-attic.file = ../../../secrets/compose/attic.env.age;
|
|
};
|
|
|
|
boot = {
|
|
loader = {
|
|
systemd-boot.enable = true;
|
|
efi.canTouchEfiVariables = true;
|
|
};
|
|
binfmt.emulatedSystems = [
|
|
"i686-linux"
|
|
"aarch64-linux"
|
|
];
|
|
};
|
|
|
|
greg = {
|
|
home = true;
|
|
gnome.enable = true;
|
|
nebula = {
|
|
enable = true;
|
|
unsafeRoutes = [
|
|
{
|
|
route = "10.42.0.0/16";
|
|
via = "10.157.0.2"; # genesis
|
|
}
|
|
];
|
|
};
|
|
podman.enable = true;
|
|
print.enable = true;
|
|
tailscale = {
|
|
enable = true;
|
|
tags = [ "mobile" ];
|
|
};
|
|
runner = {
|
|
enable = true;
|
|
qemu = true;
|
|
};
|
|
};
|
|
|
|
hardware = {
|
|
graphics = {
|
|
enable = true;
|
|
extraPackages = with pkgs; [
|
|
intel-media-driver
|
|
intel-vaapi-driver
|
|
vpl-gpu-rt
|
|
];
|
|
};
|
|
};
|
|
|
|
nix.settings = {
|
|
extra-platforms = config.boot.binfmt.emulatedSystems;
|
|
system-features = [ "gccarch-x86-64-v3" ];
|
|
};
|
|
|
|
networking = {
|
|
hostName = "exodus";
|
|
networkmanager.enable = lib.mkForce true;
|
|
};
|
|
|
|
programs = {
|
|
steam = {
|
|
enable = true;
|
|
protontricks.enable = true;
|
|
};
|
|
};
|
|
|
|
services = {
|
|
fprintd.enable = true;
|
|
fwupd = {
|
|
enable = true;
|
|
extraRemotes = [ "lvfs-testing" ];
|
|
};
|
|
};
|
|
|
|
virtualisation = {
|
|
oci-containers.backend = "podman";
|
|
};
|
|
|
|
users.users.greg.extraGroups = [
|
|
"adbusers"
|
|
"kvm"
|
|
"podman"
|
|
];
|
|
}
|