mirror of
https://github.com/sstent/nixos-cluster.git
synced 2025-12-06 06:01:54 +00:00
finish nomad, add consul, sops
This commit is contained in:
54
flake.lock
generated
54
flake.lock
generated
@@ -16,9 +16,61 @@
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs-stable": {
|
||||
"locked": {
|
||||
"lastModified": 1700342017,
|
||||
"narHash": "sha256-HaibwlWH5LuqsaibW3sIVjZQtEM/jWtOHX4Nk93abGE=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "decdf666c833a325cb4417041a90681499e06a41",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "release-23.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1700108881,
|
||||
"narHash": "sha256-+Lqybl8kj0+nD/IlAWPPG/RDTa47gff9nbei0u7BntE=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "7414e9ee0b3e9903c24d3379f577a417f0aae5f1",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixpkgs-unstable",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs"
|
||||
"nixpkgs": "nixpkgs",
|
||||
"sops-nix": "sops-nix"
|
||||
}
|
||||
},
|
||||
"sops-nix": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs_2",
|
||||
"nixpkgs-stable": "nixpkgs-stable"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1700362823,
|
||||
"narHash": "sha256-/H7XgvrYM0IbkpWkcdfkOH0XyBM5ewSWT1UtaLvOgKY=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "49a87c6c827ccd21c225531e30745a9a6464775c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
|
||||
29
flake.nix
29
flake.nix
@@ -1,27 +1,32 @@
|
||||
{
|
||||
description = "nix-configurations";
|
||||
|
||||
inputs = {
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
|
||||
sops-nix.url = github:Mic92/sops-nix;
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, ... }@inputs:
|
||||
let
|
||||
globalModules = [
|
||||
{
|
||||
system.configurationRevision = self.rev or self.dirtyRev or null;
|
||||
outputs = {
|
||||
self,
|
||||
nixpkgs,
|
||||
...
|
||||
} @ inputs: let
|
||||
globalModules = [
|
||||
{
|
||||
system.configurationRevision = self.rev or self.dirtyRev or null;
|
||||
}
|
||||
./modules/common.nix
|
||||
./modules/common.nix
|
||||
];
|
||||
in
|
||||
{
|
||||
in {
|
||||
formatter.x86_64-linux = nixpkgs.legacyPackages.x86_64-linux.alejandra;
|
||||
|
||||
nixosConfigurations = {
|
||||
odroid8 = nixpkgs.lib.nixosSystem {
|
||||
system = "aarch64-linux";
|
||||
modules = globalModules
|
||||
++ [ ./hosts/odroid8 ];
|
||||
modules =
|
||||
globalModules
|
||||
++ [./hosts/odroid8];
|
||||
};
|
||||
};
|
||||
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,10 +1,14 @@
|
||||
{ lib, pkgs, config, inputs, ... }: {
|
||||
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
nixpkgs.hostPlatform.system = "aarch64-linux";
|
||||
networking.hostName = "odroid8";
|
||||
|
||||
}
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
inputs,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
];
|
||||
|
||||
nixpkgs.hostPlatform.system = "aarch64-linux";
|
||||
networking.hostName = "odroid8";
|
||||
}
|
||||
|
||||
@@ -1,149 +1,153 @@
|
||||
# Do not modify this file! It was generated by ‘nixos-generate-config’
|
||||
# and may be overwritten by future invocations. Please make changes
|
||||
# to /etc/nixos/configuration.nix instead.
|
||||
{ config, lib, pkgs, modulesPath, ... }:
|
||||
|
||||
{
|
||||
imports =
|
||||
[ (modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
modulesPath,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
(modulesPath + "/installer/scan/not-detected.nix")
|
||||
];
|
||||
|
||||
boot.initrd.availableKernelModules = [ "nvme" ];
|
||||
boot.initrd.kernelModules = [ ];
|
||||
boot.kernelModules = [ ];
|
||||
boot.extraModulePackages = [ ];
|
||||
boot.initrd.availableKernelModules = ["nvme"];
|
||||
boot.initrd.kernelModules = [];
|
||||
boot.kernelModules = [];
|
||||
boot.extraModulePackages = [];
|
||||
|
||||
fileSystems."/" =
|
||||
{ device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
|
||||
fsType = "ext4";
|
||||
};
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/44444444-4444-4444-8888-888888888888";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/mnt/Public" =
|
||||
{ device = "//192.168.1.109/Public";
|
||||
fsType = "cifs";
|
||||
};
|
||||
fileSystems."/mnt/Public" = {
|
||||
device = "//192.168.1.109/Public";
|
||||
fsType = "cifs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/c745de59-e3b3-18ef-df73-6fc001bb9dd0/init/secrets" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/c745de59-e3b3-18ef-df73-6fc001bb9dd0/init/secrets" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/c745de59-e3b3-18ef-df73-6fc001bb9dd0/init/private" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/c745de59-e3b3-18ef-df73-6fc001bb9dd0/init/private" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/c745de59-e3b3-18ef-df73-6fc001bb9dd0/finalsync/secrets" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/c745de59-e3b3-18ef-df73-6fc001bb9dd0/finalsync/secrets" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/c745de59-e3b3-18ef-df73-6fc001bb9dd0/finalsync/private" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/c745de59-e3b3-18ef-df73-6fc001bb9dd0/finalsync/private" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/d54a8ecf-1c4d-5fdf-f2c7-aa3992474498/setup/secrets" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/d54a8ecf-1c4d-5fdf-f2c7-aa3992474498/setup/secrets" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/d54a8ecf-1c4d-5fdf-f2c7-aa3992474498/setup/private" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/d54a8ecf-1c4d-5fdf-f2c7-aa3992474498/setup/private" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/d54a8ecf-1c4d-5fdf-f2c7-aa3992474498/tidy/secrets" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/d54a8ecf-1c4d-5fdf-f2c7-aa3992474498/tidy/secrets" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/d54a8ecf-1c4d-5fdf-f2c7-aa3992474498/tidy/private" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/d54a8ecf-1c4d-5fdf-f2c7-aa3992474498/tidy/private" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/d42e04fb-40c1-09a1-5470-ccde18a4f712/setup/secrets" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/d42e04fb-40c1-09a1-5470-ccde18a4f712/setup/secrets" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/d42e04fb-40c1-09a1-5470-ccde18a4f712/setup/private" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/d42e04fb-40c1-09a1-5470-ccde18a4f712/setup/private" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/d42e04fb-40c1-09a1-5470-ccde18a4f712/tidy/secrets" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/d42e04fb-40c1-09a1-5470-ccde18a4f712/tidy/secrets" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/d42e04fb-40c1-09a1-5470-ccde18a4f712/tidy/private" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/d42e04fb-40c1-09a1-5470-ccde18a4f712/tidy/private" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/280583b0-7b32-da09-5b6a-959362990ff8/setup/secrets" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/280583b0-7b32-da09-5b6a-959362990ff8/setup/secrets" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/280583b0-7b32-da09-5b6a-959362990ff8/setup/private" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/280583b0-7b32-da09-5b6a-959362990ff8/setup/private" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/280583b0-7b32-da09-5b6a-959362990ff8/tidy/secrets" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/280583b0-7b32-da09-5b6a-959362990ff8/tidy/secrets" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/280583b0-7b32-da09-5b6a-959362990ff8/tidy/private" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/280583b0-7b32-da09-5b6a-959362990ff8/tidy/private" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/0dc89489-57e5-a625-2771-023ee19d9e95/setup/secrets" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/0dc89489-57e5-a625-2771-023ee19d9e95/setup/secrets" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/0dc89489-57e5-a625-2771-023ee19d9e95/setup/private" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/0dc89489-57e5-a625-2771-023ee19d9e95/setup/private" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/0dc89489-57e5-a625-2771-023ee19d9e95/tidy/secrets" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/0dc89489-57e5-a625-2771-023ee19d9e95/tidy/secrets" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/0dc89489-57e5-a625-2771-023ee19d9e95/tidy/private" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/0dc89489-57e5-a625-2771-023ee19d9e95/tidy/private" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/9afdf338-fcbd-d955-f3fe-5d0e45f25a5c/setup/secrets" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/9afdf338-fcbd-d955-f3fe-5d0e45f25a5c/setup/secrets" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/9afdf338-fcbd-d955-f3fe-5d0e45f25a5c/setup/private" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/9afdf338-fcbd-d955-f3fe-5d0e45f25a5c/setup/private" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/9afdf338-fcbd-d955-f3fe-5d0e45f25a5c/tidy/secrets" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/9afdf338-fcbd-d955-f3fe-5d0e45f25a5c/tidy/secrets" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
fileSystems."/var/lib/nomad/alloc/9afdf338-fcbd-d955-f3fe-5d0e45f25a5c/tidy/private" =
|
||||
{ device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
fileSystems."/var/lib/nomad/alloc/9afdf338-fcbd-d955-f3fe-5d0e45f25a5c/tidy/private" = {
|
||||
device = "tmpfs";
|
||||
fsType = "tmpfs";
|
||||
};
|
||||
|
||||
swapDevices = [ ];
|
||||
swapDevices = [];
|
||||
|
||||
# Enables DHCP on each ethernet and wireless interface. In case of scripted networking
|
||||
# (the default) this is the recommended approach. When using systemd-networkd it's
|
||||
|
||||
@@ -1,23 +1,42 @@
|
||||
{ lib, pkgs, config, inputs, ... }: {
|
||||
|
||||
imports = [
|
||||
./mnt-public.nix
|
||||
./nomad.nix
|
||||
./odroid-m1-setleds.nix
|
||||
./odroid-m1.nix
|
||||
];
|
||||
|
||||
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.git
|
||||
pkgs.ncdu
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
inputs,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
./mnt-public.nix
|
||||
./nomad.nix
|
||||
./odroid-m1-setleds.nix
|
||||
./odroid-m1.nix
|
||||
inputs.sops-nix.nixosModules.sops
|
||||
];
|
||||
|
||||
###secretstore path variable
|
||||
options._secretstore = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${inputs.self}/secrets";
|
||||
description = "Path to the Secrets storage";
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
};
|
||||
users.extraUsers.root.initialPassword = lib.mkForce "odroid";
|
||||
}
|
||||
config = {
|
||||
system.stateVersion = "23.11"; # Did you read the comment?
|
||||
|
||||
sops = {
|
||||
defaultSopsFile = "${config._secretstore}/host-secrets.yaml";
|
||||
age.sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"];
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
pkgs.git
|
||||
pkgs.ncdu
|
||||
];
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PermitRootLogin = "yes";
|
||||
};
|
||||
users.extraUsers.root.initialPassword = lib.mkForce "odroid";
|
||||
};
|
||||
}
|
||||
|
||||
37
modules/consul.nix
Normal file
37
modules/consul.nix
Normal file
@@ -0,0 +1,37 @@
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
inputs,
|
||||
...
|
||||
}: {
|
||||
# virtualisation.docker.enable = true;
|
||||
|
||||
services.consul = {
|
||||
package = pkgs.consul_1_9;
|
||||
enable = true;
|
||||
webUi = true;
|
||||
extra_config = {
|
||||
bootstrap = false;
|
||||
bootstrap_expect = 7;
|
||||
encrypt = config.sops.secrets.consul_encrypt;
|
||||
performance = {
|
||||
raft_multiplier = 5;
|
||||
};
|
||||
recursors = [
|
||||
"192.168.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
|
||||
retry_join = [
|
||||
"192.168.1.221"
|
||||
"192.168.1.222"
|
||||
"192.168.1.225"
|
||||
"192.168.1.226"
|
||||
"192.168.1.227"
|
||||
"192.168.1.223"
|
||||
"192.168.1.224"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -1,8 +1,10 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
cfg = config.boot.loader.kboot-conf;
|
||||
|
||||
# The builder used to write during system activation
|
||||
@@ -19,8 +21,7 @@ let
|
||||
path = with pkgs.buildPackages; [coreutils gnused gnugrep];
|
||||
inherit (pkgs.buildPackages) bash;
|
||||
};
|
||||
in
|
||||
{
|
||||
in {
|
||||
options = {
|
||||
boot.loader.kboot-conf = {
|
||||
enable = mkOption {
|
||||
@@ -52,9 +53,10 @@ in
|
||||
};
|
||||
config = let
|
||||
args = "-g ${toString cfg.configurationLimit} -n ${config.hardware.deviceTree.name}";
|
||||
in mkIf cfg.enable {
|
||||
system.build.installBootLoader = lib.mkForce "${builder} ${args} -c";
|
||||
system.boot.loader.id = "kboot-conf";
|
||||
boot.loader.kboot-conf.populateCmd = "${populateBuilder} ${args}";
|
||||
};
|
||||
in
|
||||
mkIf cfg.enable {
|
||||
system.build.installBootLoader = lib.mkForce "${builder} ${args} -c";
|
||||
system.boot.loader.id = "kboot-conf";
|
||||
boot.loader.kboot-conf.populateCmd = "${populateBuilder} ${args}";
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,10 +1,14 @@
|
||||
{ lib, pkgs, config, inputs, ... }: {
|
||||
|
||||
fileSystems."/mnt/Public" = {
|
||||
device = "//192.168.1.109/Public";
|
||||
fsType = "cifs";
|
||||
# options = ["uid=0,gid=1000"];
|
||||
options = ["guest" "uid=1000"];
|
||||
};
|
||||
|
||||
}
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
inputs,
|
||||
...
|
||||
}: {
|
||||
fileSystems."/mnt/Public" = {
|
||||
device = "//192.168.1.109/Public";
|
||||
fsType = "cifs";
|
||||
# options = ["uid=0,gid=1000"];
|
||||
options = ["guest" "uid=1000"];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,42 +1,66 @@
|
||||
{ lib, pkgs, config, inputs, ... }: {
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
inputs,
|
||||
...
|
||||
}: {
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
services.nomad = {
|
||||
package = pkgs.nomad_1_6;
|
||||
dropPrivileges = false;
|
||||
enableDocker = true;
|
||||
enable = true;
|
||||
settings = {
|
||||
server = {
|
||||
enabled = true;
|
||||
bootstrap_expect = 3;
|
||||
start_join = ["192.168.1.221" "192.168.1.225" "192.168.1.226" "192.168.1.227" "192.168.1.222" "192.168.1.223" "192.168.1.224"];
|
||||
rejoin_after_leave = false;
|
||||
enabled_schedulers = ["service" "batch" "system"];
|
||||
num_schedulers = 4;
|
||||
node_gc_threshold = "24h";
|
||||
eval_gc_threshold = "1h";
|
||||
job_gc_threshold = "4h";
|
||||
deployment_gc_threshold = "1h";
|
||||
encrypt = "";
|
||||
raft_protocol = 3;
|
||||
};
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
client = {
|
||||
enabled = true;
|
||||
node_class = "";
|
||||
no_host_uuid = false;
|
||||
servers = ["192.168.1.221:4647" "192.168.1.225:4647" "192.168.1.226:4647" "192.168.1.227:4647" "192.168.1.222:4647" "192.168.1.223:4647" "192.168.1.224:4647"];
|
||||
max_kill_timeout = "30s";
|
||||
network_speed = 0;
|
||||
cpu_total_compute = 0;
|
||||
gc_interval = "1m";
|
||||
gc_disk_usage_threshold = 80;
|
||||
gc_inode_usage_threshold = 70;
|
||||
gc_parallel_destroys = 2;
|
||||
reserved = {
|
||||
cpu = 0;
|
||||
memory = 200;
|
||||
disk = 0;
|
||||
};
|
||||
options = {
|
||||
"docker.caps.whitelist" = "SYS_ADMIN,NET_ADMIN,chown,dac_override,fsetid,fowner,mknod,net_raw,setgid,setuid,setfcap,setpcap,net_bind_service,sys_chroot,kill,audit_write,sys_module";
|
||||
"driver.raw_exec.enable" = "1";
|
||||
"docker.volumes.enabled" = "True";
|
||||
"docker.privileged.enabled" = "true";
|
||||
"docker.auth.config" = "/root/.docker/config.json";
|
||||
};
|
||||
};
|
||||
|
||||
services.nomad = {
|
||||
package = pkgs.nomad_1_6;
|
||||
dropPrivileges = false;
|
||||
enableDocker = true;
|
||||
enable = true;
|
||||
settings = {
|
||||
client = {
|
||||
enabled = true;
|
||||
node_class = "";
|
||||
no_host_uuid = false;
|
||||
servers = ["192.168.1.221:4647" "192.168.1.225:4647" "192.168.1.226:4647" "192.168.1.227:4647" "192.168.1.222:4647" "192.168.1.223:4647" "192.168.1.224:4647"];
|
||||
max_kill_timeout = "30s";
|
||||
network_speed = 0;
|
||||
cpu_total_compute = 0;
|
||||
gc_interval = "1m";
|
||||
gc_disk_usage_threshold = 80;
|
||||
gc_inode_usage_threshold = 70;
|
||||
gc_parallel_destroys = 2;
|
||||
reserved = {
|
||||
cpu = 0;
|
||||
memory = 200;
|
||||
disk = 0;
|
||||
custom = {
|
||||
"telemetry" = {
|
||||
"prometheus_metrics" = true;
|
||||
"publish_allocation_metrics" = true;
|
||||
"publish_node_metrics" = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
options = {
|
||||
"docker.caps.whitelist" = "SYS_ADMIN,NET_ADMIN,chown,dac_override,fsetid,fowner,mknod,net_raw,setgid,setuid,setfcap,setpcap,net_bind_service,sys_chroot,kill,audit_write,sys_module";
|
||||
"driver.raw_exec.enable" = "1";
|
||||
"docker.volumes.enabled" = "True";
|
||||
"docker.privileged.enabled" = "true";
|
||||
"docker.auth.config" = "/root/.docker/config.json";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
||||
|
||||
};
|
||||
}
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,13 +1,16 @@
|
||||
{ lib, pkgs, config, inputs, ... }: {
|
||||
|
||||
|
||||
systemd.services.setleds = {
|
||||
script = ''
|
||||
echo "Setting Odroid LEDs"
|
||||
echo none > /sys/class/leds/blue\:heartbeat/trigger
|
||||
cat /sys/class/leds/blue\:heartbeat/trigger
|
||||
'';
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
|
||||
}
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
inputs,
|
||||
...
|
||||
}: {
|
||||
systemd.services.setleds = {
|
||||
script = ''
|
||||
echo "Setting Odroid LEDs"
|
||||
echo none > /sys/class/leds/blue\:heartbeat/trigger
|
||||
cat /sys/class/leds/blue\:heartbeat/trigger
|
||||
'';
|
||||
wantedBy = ["multi-user.target"];
|
||||
};
|
||||
}
|
||||
|
||||
@@ -1,36 +1,38 @@
|
||||
{ lib, pkgs, config, inputs, ... }: {
|
||||
{
|
||||
lib,
|
||||
pkgs,
|
||||
config,
|
||||
inputs,
|
||||
...
|
||||
}: {
|
||||
imports = [
|
||||
./kboot-conf
|
||||
];
|
||||
|
||||
imports = [
|
||||
./kboot-conf
|
||||
];
|
||||
boot.loader.grub.enable = false;
|
||||
boot.loader.kboot-conf.enable = true;
|
||||
# Use kernel >6.6
|
||||
boot.kernelPackages = pkgs.linuxPackages_latest;
|
||||
# Stop ZFS breasking the build
|
||||
boot.supportedFilesystems = lib.mkForce ["btrfs" "cifs" "f2fs" "jfs" "ntfs" "reiserfs" "vfat" "xfs"];
|
||||
|
||||
boot.loader.grub.enable = false;
|
||||
boot.loader.kboot-conf.enable = true;
|
||||
# Use kernel >6.6
|
||||
boot.kernelPackages = pkgs.linuxPackages_latest;
|
||||
# Stop ZFS breasking the build
|
||||
boot.supportedFilesystems = lib.mkForce [ "btrfs" "cifs" "f2fs" "jfs" "ntfs" "reiserfs" "vfat" "xfs" ];
|
||||
# I'm not completely sure if some of these could be omitted,
|
||||
# but want to make sure disk access works
|
||||
boot.initrd.availableKernelModules = [
|
||||
"nvme"
|
||||
"nvme-core"
|
||||
"phy-rockchip-naneng-combphy"
|
||||
"phy-rockchip-snps-pcie3"
|
||||
];
|
||||
# Petitboot uses this port and baud rate on the boards serial port,
|
||||
# it's probably good to keep the options same for the running
|
||||
# kernel for serial console access to work well
|
||||
boot.kernelParams = ["console=ttyS2,1500000"];
|
||||
hardware.deviceTree.name = "rockchip/rk3568-odroid-m1.dtb";
|
||||
|
||||
# I'm not completely sure if some of these could be omitted,
|
||||
# but want to make sure disk access works
|
||||
boot.initrd.availableKernelModules = [
|
||||
"nvme"
|
||||
"nvme-core"
|
||||
"phy-rockchip-naneng-combphy"
|
||||
"phy-rockchip-snps-pcie3"
|
||||
];
|
||||
# Petitboot uses this port and baud rate on the boards serial port,
|
||||
# it's probably good to keep the options same for the running
|
||||
# kernel for serial console access to work well
|
||||
boot.kernelParams = [ "console=ttyS2,1500000" ];
|
||||
hardware.deviceTree.name = "rockchip/rk3568-odroid-m1.dtb";
|
||||
|
||||
# Turn on flakes.
|
||||
##nix.package = pkgs.nixVersions.stable;
|
||||
nix.extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
|
||||
system.stateVersion = "23.11"; # Did you read the comment?
|
||||
|
||||
}
|
||||
# Turn on flakes.
|
||||
##nix.package = pkgs.nixVersions.stable;
|
||||
nix.extraOptions = ''
|
||||
experimental-features = nix-command flakes
|
||||
'';
|
||||
}
|
||||
|
||||
57
secrets/host-secrets.yaml
Normal file
57
secrets/host-secrets.yaml
Normal file
@@ -0,0 +1,57 @@
|
||||
consul_encrypt: ENC[AES256_GCM,data:SXOUCI7VytPdTffb/QLjEu+eu3bKim7Hqk5cQHWPBhs0ludnWsivL076vYY=,iv:lSAANYT33+qnQKuKnQ8Yl1mjGsRuDLFCr+dlxXxyflA=,tag:OQg/AM7MN4xY/ELwZl4ikw==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
azure_kv: []
|
||||
hc_vault: []
|
||||
age:
|
||||
- recipient: age1jvqe2j70h97844nkz34z9k4epx3uahx50cx75ss8mty2dnxlrf7qqv9a0g
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArcGNQbHNXZFQ3bTZYUHNW
|
||||
bWUyMElwcVBqTFJFV1Q2Mm1YSW8wR3NnbWxZCnkxRDRuWCtBTjB3MlpNZTZsYmx1
|
||||
SkVOUDd6RFRxVHBla2xUV1lwYXJ1WFUKLS0tIFEwVkJqYmRBclBTR0NyUW9wMXE3
|
||||
NVNFa1I3Y0RFYW1lei9JOVp3eDVkc0EKpd8JLzE+XTJcRhT1kwF0SQTt7QmOWpLF
|
||||
C2+J/gFf/8H43tRD6MxpzgSTJ/480mshnrlnAX6yqgn/CMEP/XrEVA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1jvf8rd8krchw3ph0w2let8clvyuzcdhq2ug6sm7tx86refc2z5vq4w6lxr
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBadXR3OCtWRXZTRW5jaFVQ
|
||||
RTZpa05nVHIxS2FYaW10TWxnYlpxc3BENWlnCnFXL1FZanJvc0FmZnVYcXlVS29Y
|
||||
dHdHY2dENSt1NGl0QzlxQkZCLzkyUEUKLS0tIDRNMXowUmZmZkdvUjhaVjdQWnBF
|
||||
N1E0djlJVDdjK0hCbTdZSSthWityUFUKhAj6O0Ss+ZzJ65as8WT++9VIErPRs7hX
|
||||
w9cMAzuaq2BJrYuZqbMdbDqmgMoBMu3CX2TieIjCsX/5IGr8mqxH2Q==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1t6zzuxzzlfvqfhcvj3vyngfguxrw960c5u9hjwd05k5q9zp7l3gqyjatew
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhSXlxalMwcDdtcUllY1Rn
|
||||
U0JEYk5UL29qdzFkTTNHQXdFSWZWWE1YaDJrCjB5T0ZEM3dYMjlOZ3IyRGRrZng1
|
||||
cndYRENOT0Q2VFg1WDF5UG1zLzQzVEkKLS0tIENoeGxyS1dlbGF4d053ZlVTTE1v
|
||||
elN4aWU1cVN5OXNobDhWN1pMelp5YTgKZXi4Sru1X9QMQPT2f7ryas/WmB+etVN3
|
||||
/liTOTpUP/Ea7n1T0blO3XvDqLeKHLhKUwQ0S6JTAPZxMRL16ia/sA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age187fdx6pc2559tjh03jrcwp6yj8whd70h666g8a0ptyr0z49tfcsssdx6au
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2YkM1LzlCWEFUZmQwcEtQ
|
||||
eVBaV2lNeFlTajRHZWU3ZWNXYUNMbUxMRlFJCjJBLzQ1bEptYVYvbzhKKzhuTi9k
|
||||
Wk1kWlpINS9NYWFRajFKWGNkL1hBU2sKLS0tIGU4cVVIVTluOTRUdE5GbXRTVlhT
|
||||
dUszUWNQUzJxdndJTUlGS1g0amdjb0EKz4Uem2Z5lj5LJcOOFMy8HQWQSMVRiXwm
|
||||
UeqbLYqgQ74ThpQoH2HfBIjCoacK1u1+StEzOeVXaT+o+a0WtOfnIA==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1m3zny0wn4smrwhjrvw8qay8438l06v49h0fg4s3c6mpjyuq28vwsp5wvdk
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjcW9xOVd0YnVkL0JheHI0
|
||||
WTBoOFVzTzhZS1MxT1hFWEZ1cUl3QzFZeWljCmpGWUh1UHVpTXJ5dWd1OVQvNllj
|
||||
QXg0MTFuY1NaRXdyWVc3M2M1alc3dFkKLS0tIHE1SytvR3Z6MWZjNzhBY2pRU3NU
|
||||
bVo5cFZ1L2dSaThjemtsMUcrcURla2sKM+nUlPzQwdCK/8gt19qi6PX0tMEWuol+
|
||||
5QOPqkjklkFoiBFKtpHOpW/xnzUQWo86HM84G1NiMsAotWblGEPK1A==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2023-11-19T21:14:46Z"
|
||||
mac: ENC[AES256_GCM,data:TeiGhX9oHxtSSxXxYJORFVxfam8rBtyu4+1w/uj8lzTwJKE9+fxQipMC0hKxiBR478Wxf22RSlkMR0Pb5x09FLWwFJcBmh7W5C4tYmAjM+Fo+ACK/lJndavbE0EFcWLhbm6RYRg86J/vxcyxNVJ8/gc0IE228p2EuqrtfnI87SQ=,iv:dJTSgnriZ9dHfzV4yFt0mjcq2vplTnmTTx3XCdTECBM=,tag:aWQH7y7Jcn+FoylF3IXpsg==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.7.3
|
||||
Reference in New Issue
Block a user