root
792217f640
buildbot/nix-eval Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-exodus Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-isaiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-genesis Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-linode Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-jeremiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-zeke Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-hosea Build done.
buildbot/nix-build Build done.
Introduces a greg.nebula NixOS module and enables it across all managed
hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16).
Architecture:
- linode: lighthouse + relay (public internet, UDP 4242)
- genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN)
- hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes
pointing to genesis to reach the home LAN
Changes:
- modules/nixos/nebula.nix: new greg.nebula module
- isLighthouse / isRelay options
- unsafeRoutes option (tun.unsafe_routes)
- routesSubnet option: enables IP forwarding + nftables masquerade NAT
on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16
- agenix secret reference per-host (secrets/nebula/<name>.key.age)
- opens UDP/4242 in the firewall
- modules/nixos/default.nix: import nebula.nix
- hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true
- hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16"
- hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix:
greg.nebula.enable = true with unsafeRoutes via genesis
- network.json: add nebulaIp field for each managed host
- secrets/secrets.nix: declare nebula/<host>.key.age entries
- secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)
This is a unified repo to contain my personal configurations for NixOS machines.
How To Use This
Go through the normal process to setup a NixOS system during installation.
- Boot from an appropriate medium
- Parition the drives
- Mount them
- Before you generate out the configuration, clone this repoistory to your /etc/nixos folder
- Run the configuration generator. It should only genreate the hardware-configuration.nix file, which this repo gitignores
- Create a folder and file with the machine name in
hosts/<machine>/default.nix - Add
hosts/default.nixan appropriate entry for the machine you are building - Create a file
home/hosts/<machine>/default.nixwith the new machine name as well
Adding new hosts
To add a new host, create a folder in the directory hosts/ that matches the name of
the target system. Each host must contain, minimally, a default.nix file that serves
as the basis of configuring that host.
Test build a VM for your system
nom build ".#nixosConfigurations.<host>.config.system.build.vmexport QEMU_NET_OPTS="hostfwd=tcp::2221-:22"to export the SSH port./result/bin/run-<host>-vm