From ab901fc81d483f24334680a53cacd6b981bb37a7 Mon Sep 17 00:00:00 2001 From: Alex Auvolat Date: Tue, 23 Aug 2022 23:55:15 +0200 Subject: [PATCH] Remove wesher, reconfigure staging without it --- cluster/staging/cluster.nix | 45 +++++++----- deploy_nixos | 6 +- deploy_wesher_key | 4 -- gen_wesher_key | 17 ----- nix/configuration.nix | 7 -- nix/deuxfleurs.nix | 97 ++++++++++++++++++------- nix/wesher.nix | 25 ------- nix/wesher_service.nix | 137 ------------------------------------ 8 files changed, 106 insertions(+), 232 deletions(-) delete mode 100755 deploy_wesher_key delete mode 100755 gen_wesher_key delete mode 100644 nix/wesher.nix delete mode 100644 nix/wesher_service.nix diff --git a/cluster/staging/cluster.nix b/cluster/staging/cluster.nix index 0836dcb..d71b274 100644 --- a/cluster/staging/cluster.nix +++ b/cluster/staging/cluster.nix @@ -3,16 +3,36 @@ { deuxfleurs.cluster_name = "staging"; - # Bootstrap nodes for Wesher overlay network - services.wesher.join = [ - "192.168.1.21" # cariacou - "192.168.1.22" # carcajou - "192.168.1.23" # caribou - ]; + # The IP range to use for the Wireguard overlay of this cluster + deuxfleurs.cluster_prefix = "10.14.0.0"; + deuxfleurs.cluster_prefix_length = 16; - # The IP range to use for the Wesher overlay of this cluster - deuxfleurs.wesher_cluster_prefix = "10.14.0.0"; - deuxfleurs.wesher_cluster_prefix_length = 16; + deuxfleurs.cluster_nodes = [ + { + hostname = "cariacou"; + site_name = "neptune"; + publicKey = "qxrtfn2zRVnN52Y5NYumyU3/FcRMnh3kJ2C37JfrczA="; + IP = "10.14.179.56"; + lan_endpoint = "192.168.1.21:33799"; + endpoint = "192.168.1.21:33799"; ## TODO nat + } + { + hostname = "carcajou"; + site_name = "neptune"; + publicKey = "7Nm7pMmyS7Nts1MB+loyD8u84ODxHPTkDu+uqQR6yDk="; + IP = "10.14.252.121"; + lan_endpoint = "192.168.1.22:33799"; + endpoint = "192.168.1.22:33799"; ## TODO nat + } + { + hostname = "caribou"; + site_name = "neptune"; + publicKey = "X1OlfgjZDdJw3yTg0ytGFlJZXzqT0yHJmYP15R9IpD8="; + IP = "10.14.181.82"; + lan_endpoint = "192.168.1.23:33799"; + endpoint = "192.168.1.23:33799"; ## TODO nat + } + ]; # Bootstrap IPs for Consul cluster, # these are IPs on the Wesher overlay @@ -22,13 +42,6 @@ "10.14.252.121" # carcajou ]; - # Add wesher hosts to /etc/hosts, needed for elasticsearch - networking.extraHosts = '' -10.14.181.82 caribou -10.14.179.56 cariacou -10.14.242.121 carcajou - ''; - deuxfleurs.admin_accounts = { lx = [ # Keys for accessing nodes from outside diff --git a/deploy_nixos b/deploy_nixos index 30691e0..f62843d 100755 --- a/deploy_nixos +++ b/deploy_nixos @@ -3,10 +3,12 @@ copy nix/configuration.nix /etc/nixos/configuration.nix copy nix/deuxfleurs.nix /etc/nixos/deuxfleurs.nix copy nix/remote-unlock.nix /etc/nixos/remote-unlock.nix -copy nix/wesher.nix /etc/nixos/wesher.nix -copy nix/wesher_service.nix /etc/nixos/wesher_service.nix copy cluster/$CLUSTER/cluster.nix /etc/nixos/cluster.nix copy cluster/$CLUSTER/node/$NIXHOST.nix /etc/nixos/node.nix copy cluster/$CLUSTER/node/$NIXHOST.site.nix /etc/nixos/site.nix +cmd 'mkdir -p /var/lib/deuxfleurs/wireguard-keys' +cmd 'test -f /var/lib/deuxfleurs/wireguard-keys/private || (wg genkey > /var/lib/deuxfleurs/wireguard-keys/private; chmod 600 /var/lib/deuxfleurs/wireguard-keys/private)' +cmd 'echo "Public key: $(wg pubkey < /var/lib/deuxfleurs/wireguard-keys/private)"' + cmd nixos-rebuild switch --show-trace diff --git a/deploy_wesher_key b/deploy_wesher_key deleted file mode 100755 index 8f7ed77..0000000 --- a/deploy_wesher_key +++ /dev/null @@ -1,4 +0,0 @@ -#!/usr/bin/env ./sshtool - -write_pass deuxfleurs/cluster/$CLUSTER/wesher_key /var/lib/wesher/secrets -cmd systemctl restart wesher diff --git a/gen_wesher_key b/gen_wesher_key deleted file mode 100755 index c66fade..0000000 --- a/gen_wesher_key +++ /dev/null @@ -1,17 +0,0 @@ -#!/usr/bin/env sh - -cd $(dirname $0) - -CLUSTER="$1" -if [ -z "$CLUSTER" ] || [ ! -d "cluster/$CLUSTER" ]; then - echo "Usage: $0 " - echo "The cluster name must be the name of a subdirectory of cluster/" - exit 1 -fi - -K=deuxfleurs/cluster/$CLUSTER/wesher_key -if ! pass $K >/dev/null; then - pass insert -m $K < ${keysPath} - fi - '' else '' - if [ ! -e ${keysPath} ] - then - mkdir --mode=700 -p ${builtins.dirOf keysPath} - echo "WESHER_CLUSTER_KEY=$(head -c 32 /dev/urandom | base64)" > ${keysPath} - fi - ''; - - systemd.services.wesher = { - description = "wesher wireguard overlay mesh network manager"; - bindsTo = [ "network-online.target" ]; - after = [ "network-online.target" ]; - wantedBy = [ "multi-user.target" ]; - - environment = { - WESHER_JOIN = builtins.concatStringsSep "," cfg.join; - WESHER_CLUSTER_PORT = builtins.toString cfg.clusterPort; - WESHER_WIREGUARD_PORT = builtins.toString cfg.wireguardPort; - WESHER_OVERLAY_NET = cfg.overlayNet; - WESHER_INTERFACE = cfg.interface; - WESHER_LOG_LEVEL = cfg.logLevel; - WESHER_NO_ETC_HOSTS = "true"; - } - // (if (cfg.bindAddr != null) then { WESHER_BIND_ADDR = cfg.bindAddr; } else {}) - // (if (cfg.bindIface != null) then { WESHER_BIND_IFACE = cfg.bindIface; } else {}) - ; - - serviceConfig = { - ExecStart = "${binWesher}"; - Restart = "always"; - - EnvironmentFile = keysPath; - - User = "wesher"; - DynamicUser = true; - StateDirectory = "wesher"; - - AmbientCapabilities = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; - CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE"; - MemoryDenyWriteExecute = true; - ProtectControlGroups = true; - ProtectKernelModules = true; - ProtectKernelTunables = true; - RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK"; - RestrictNamespaces = true; - RestrictRealtime = true; - SystemCallArchitectures = "native"; - SystemCallFilter = "~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @resources"; - }; - }; - - networking.firewall.allowedUDPPorts = mkIf cfg.enable [ cfg.clusterPort cfg.wireguardPort ]; - networking.firewall.allowedTCPPorts = mkIf cfg.enable [ cfg.clusterPort ]; - }); -}