root
792217f640
buildbot/nix-eval Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-exodus Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-isaiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-genesis Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-linode Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-jeremiah Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-zeke Build done.
buildbot/nix-build gitea:greg/nixos#checks.x86_64-linux.nixos-hosea Build done.
buildbot/nix-build Build done.
Introduces a greg.nebula NixOS module and enables it across all managed
hosts for the nebula.thehellings.com overlay (CIDR: 10.157.0.0/16).
Architecture:
- linode: lighthouse + relay (public internet, UDP 4242)
- genesis: regular node + unsafe_routes router for 10.42.0.0/16 (home LAN)
- hosea, isaiah, jeremiah, zeke, exodus: regular nodes with unsafe_routes
pointing to genesis to reach the home LAN
Changes:
- modules/nixos/nebula.nix: new greg.nebula module
- isLighthouse / isRelay options
- unsafeRoutes option (tun.unsafe_routes)
- routesSubnet option: enables IP forwarding + nftables masquerade NAT
on the gateway host (genesis) so Nebula peers reach 10.42.0.0/16
- agenix secret reference per-host (secrets/nebula/<name>.key.age)
- opens UDP/4242 in the firewall
- modules/nixos/default.nix: import nebula.nix
- hosts/unstable/linode/default.nix: greg.nebula.isLighthouse = true
- hosts/unstable/genesis/default.nix: greg.nebula.routesSubnet = "10.42.0.0/16"
- hosts/unstable/{hosea,isaiah,jeremiah,zeke,exodus}/default.nix:
greg.nebula.enable = true with unsafeRoutes via genesis
- network.json: add nebulaIp field for each managed host
- secrets/secrets.nix: declare nebula/<host>.key.age entries
- secrets/nebula/README.md: full PKI bootstrap guide (CA, certs, agenix)
120 lines
3.3 KiB
Nix
120 lines
3.3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
metadata,
|
|
...
|
|
}:
|
|
{
|
|
imports = [
|
|
./hardware-configuration.nix
|
|
];
|
|
|
|
age.secrets = {
|
|
gitea-runner-isaiah-podman.file = ../../../secrets/gitea/runner-isaiah-podman.age;
|
|
gitea-workerPassword.file = ../../../secrets/gitea/workerPassword.age;
|
|
runner-reg.file = ../../../secrets/gitlab/kubernetes-k3s-local.age;
|
|
};
|
|
|
|
boot = {
|
|
binfmt.emulatedSystems = [ "aarch64-linux" ];
|
|
extraModprobeConfig = "options kvm_amd nested=1";
|
|
kernel.sysctl = {
|
|
"net.bridge.bridge-nf-call-ip6tables" = 0;
|
|
"net.bridge.bridge-nf-call-iptables" = 0;
|
|
"net.bridge.bridge-nf-call-arptables" = 0;
|
|
};
|
|
loader = {
|
|
efi = {
|
|
canTouchEfiVariables = true;
|
|
efiSysMountPoint = "/boot";
|
|
};
|
|
systemd-boot = {
|
|
enable = true;
|
|
};
|
|
};
|
|
supportedFilesystems = [ "ntfs" ];
|
|
};
|
|
|
|
greg = {
|
|
kubernetes = {
|
|
enable = true;
|
|
vipInterface = "enp38s0";
|
|
vip = metadata.hosts.${config.networking.hostName}.ip;
|
|
priority = 255;
|
|
};
|
|
nebula = {
|
|
enable = true;
|
|
unsafeRoutes = [
|
|
{
|
|
route = "10.42.0.0/16";
|
|
via = "10.157.0.2"; # genesis
|
|
}
|
|
];
|
|
};
|
|
podman.enable = true;
|
|
tailscale = {
|
|
enable = true;
|
|
tags = [ "home" ];
|
|
};
|
|
remote-builder.enable = true;
|
|
runner = {
|
|
enable = true;
|
|
qemu = true;
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
firewall = {
|
|
enable = true;
|
|
allowedTCPPorts = [ 80 ];
|
|
checkReversePath = lib.mkForce false;
|
|
};
|
|
hostName = "isaiah";
|
|
interfaces.enp38s0.useDHCP = true;
|
|
useDHCP = false;
|
|
};
|
|
|
|
services = {
|
|
gitea-actions-runner.instances.podman = {
|
|
enable = true;
|
|
labels = [
|
|
"debian-latest:docker://node:25-trixie"
|
|
|
|
"ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
|
|
"ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
|
|
"ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
|
|
|
|
"ubuntu-full-latest:docker://ghcr.io/catthehacker/ubuntu:full-latest"
|
|
"ubuntu-full-24.04:docker://ghcr.io/catthehacker/ubuntu:full-24.04"
|
|
"ubuntu-full-22.04:docker://ghcr.io/catthehacker/ubuntu:full-22.04"
|
|
|
|
"ubuntu-act-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest"
|
|
"ubuntu-act-24.04:docker://ghcr.io/catthehacker/ubuntu:act-24.04"
|
|
"ubuntu-act-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04"
|
|
|
|
"ubuntu-runner-latest:docker://ghcr.io/catthehacker/ubuntu:runner-latest"
|
|
"ubuntu-runner-24.04:docker://ghcr.io/catthehacker/ubuntu:runner-24.04"
|
|
"ubuntu-runner-22.04:docker://ghcr.io/catthehacker/ubuntu:runner-22.04"
|
|
|
|
"ubuntu-rust-latest:docker://ghcr.io/catthehacker/ubuntu:rust-latest"
|
|
"ubuntu-rust-24.04:docker://ghcr.io/catthehacker/ubuntu:rust-24.04"
|
|
"ubuntu-rust-22.04:docker://ghcr.io/catthehacker/ubuntu:rust-22.04"
|
|
|
|
"nix-latest:docker://src.thehellings.com/greg/builder:latest"
|
|
];
|
|
name = "isaiah-podman";
|
|
settings = {
|
|
container.force_pull = true;
|
|
runner.capacity = 7;
|
|
};
|
|
tokenFile = config.age.secrets.gitea-runner-isaiah-podman.path;
|
|
url = "https://gitea.shire-zebra.ts.net";
|
|
};
|
|
k3s.clusterInit = true; # This is the first node in the cluster
|
|
openssh = {
|
|
enable = true;
|
|
settings.PermitRootLogin = "yes";
|
|
};
|
|
};
|
|
}
|