Deuxfleurs/nixcfg
17
6
Fork 2
Code Issues 15 Pull requests 2 Projects Releases Wiki Activity

Simplify network configuration #11

Merged
lx merged 25 commits from simplify-network-config into main 2023-05-16 13:19:33 +00:00
Conversation 0 Commits 25 Files changed 43 +98 -167
15 changed files with 98 additions and 167 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files
Showing only changes of commit c08bc17cc0 - Show all commits

101
cluster/prod/cluster.nix
View file

@ -1,84 +1,73 @@
{ config, pkgs, ... } @ args: { config, pkgs, ... } @ args:
{ {
deuxfleurs.cluster_name = "prod"; deuxfleurs.clusterName = "prod";
# The IP range to use for the Wireguard overlay of this cluster # The IP range to use for the Wireguard overlay of this cluster
deuxfleurs.cluster_prefix = "10.83.0.0"; deuxfleurs.clusterPrefix = "10.83.0.0/16";
deuxfleurs.cluster_prefix_length = 16;
deuxfleurs.cluster_nodes = [ deuxfleurs.cluster_nodes = {
{ "concombre" = {
hostname = "concombre"; siteName = "neptune";
site_name = "neptune";
publicKey = "VvXT0fPDfWsHxumZqVShpS33dJQAdpJ1E79ZbCBJP34="; publicKey = "VvXT0fPDfWsHxumZqVShpS33dJQAdpJ1E79ZbCBJP34=";
IP = "10.83.1.1"; address = "10.83.1.1";
endpoint = "77.207.15.215:33731"; endpoint = "77.207.15.215:33731";
} };
{ "courgette" = {
hostname = "courgette"; siteName = "neptune";
site_name = "neptune";
publicKey = "goTkBJGmzrGDOAjUcdH9G0JekipqSMoaYQdB6IHnzi0="; publicKey = "goTkBJGmzrGDOAjUcdH9G0JekipqSMoaYQdB6IHnzi0=";
IP = "10.83.1.2"; address = "10.83.1.2";
endpoint = "77.207.15.215:33732"; endpoint = "77.207.15.215:33732";
} };
{ "celeri" = {
hostname = "celeri"; siteName = "neptune";
site_name = "neptune";
publicKey = "oZDAb8LoLW87ktUHyFFec0VaIar97bqq47mGbdVqJ0U="; publicKey = "oZDAb8LoLW87ktUHyFFec0VaIar97bqq47mGbdVqJ0U=";
IP = "10.83.1.3"; address = "10.83.1.3";
endpoint = "77.207.15.215:33733"; endpoint = "77.207.15.215:33733";
} };
{ "dahlia" = {
hostname = "dahlia"; siteName = "orion";
site_name = "orion";
publicKey = "EtRoWBYCdjqgXX0L+uWLg8KxNfIK8k9OTh30tL19bXU="; publicKey = "EtRoWBYCdjqgXX0L+uWLg8KxNfIK8k9OTh30tL19bXU=";
IP = "10.83.2.1"; address = "10.83.2.1";
endpoint = "82.66.80.201:33731"; endpoint = "82.66.80.201:33731";
} };
{ "diplotaxis" = {
hostname = "diplotaxis"; siteName = "orion";
site_name = "orion";
publicKey = "HbLC938mysadMSOxWgq8+qrv+dBKzPP/43OMJp/3phA="; publicKey = "HbLC938mysadMSOxWgq8+qrv+dBKzPP/43OMJp/3phA=";
IP = "10.83.2.2"; address = "10.83.2.2";
endpoint = "82.66.80.201:33732"; endpoint = "82.66.80.201:33732";
} };
{ "doradille" = {
hostname = "doradille"; siteName = "orion";
site_name = "orion";
publicKey = "e1C8jgTj9eD20ywG08G1FQZ+Js3wMK/msDUE1wO3l1Y="; publicKey = "e1C8jgTj9eD20ywG08G1FQZ+Js3wMK/msDUE1wO3l1Y=";
IP = "10.83.2.3"; address = "10.83.2.3";
endpoint = "82.66.80.201:33733"; endpoint = "82.66.80.201:33733";
} };
{ "df-ykl" = {
hostname = "df-ykl"; siteName = "bespin";
site_name = "bespin";
publicKey = "bIjxey/VhBgVrLa0FxN/KISOt2XFmQeSh1MPivUq9gg="; publicKey = "bIjxey/VhBgVrLa0FxN/KISOt2XFmQeSh1MPivUq9gg=";
IP = "10.83.3.1"; address = "10.83.3.1";
endpoint = "109.136.55.235:33731"; endpoint = "109.136.55.235:33731";
} };
{ "df-ymf" = {
hostname = "df-ymf"; siteName = "bespin";
site_name = "bespin";
publicKey = "pUIKv8UBl586O7DBrHBsb9BgNU7WlYQ2r2RSNkD+JAQ="; publicKey = "pUIKv8UBl586O7DBrHBsb9BgNU7WlYQ2r2RSNkD+JAQ=";
IP = "10.83.3.2"; address = "10.83.3.2";
endpoint = "109.136.55.235:33732"; endpoint = "109.136.55.235:33732";
} };
{ "df-ymk" = {
hostname = "df-ymk"; siteName = "bespin";
site_name = "bespin";
publicKey = "VBmpo15iIJP7250NAsF+ryhZc3j+8TZFnE1Djvn5TXI="; publicKey = "VBmpo15iIJP7250NAsF+ryhZc3j+8TZFnE1Djvn5TXI=";
IP = "10.83.3.3"; address = "10.83.3.3";
endpoint = "109.136.55.235:33733"; endpoint = "109.136.55.235:33733";
} };
{ "abricot" = {
hostname = "abricot"; siteName = "scorpio";
site_name = "scorpio";
publicKey = "Sm9cmNZ/BfWVPFflMO+fuyiera4r203b/dKhHTQmBFg="; publicKey = "Sm9cmNZ/BfWVPFflMO+fuyiera4r203b/dKhHTQmBFg=";
IP = "10.83.4.1"; address = "10.83.4.1";
endpoint = "82.65.41.110:33741"; endpoint = "82.65.41.110:33741";
} };
]; };
# Bootstrap IPs for Consul cluster, # Bootstrap IPs for Consul cluster,
# these are IPs on the Wireguard overlay # these are IPs on the Wireguard overlay
@ -88,7 +77,7 @@
"10.83.3.1" # df-ykl "10.83.3.1" # df-ykl
]; ];
deuxfleurs.admin_accounts = { deuxfleurs.adminAccounts = {
lx = [ lx = [
# Keys for accessing nodes from outside # Keys for accessing nodes from outside
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJpaBZdYxHqMxhv2RExAOa7nkKhPBOHupMP3mYaZ73w9 lx@lindy" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJpaBZdYxHqMxhv2RExAOa7nkKhPBOHupMP3mYaZ73w9 lx@lindy"

11
cluster/prod/node/abricot.nix
View file

@ -8,12 +8,7 @@
boot.loader.timeout = 20; boot.loader.timeout = 20;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "abricot"; deuxfleurs.hostName = "abricot";
deuxfleurs.staticIPv4.address = "192.168.1.41";
deuxfleurs.network_interface = "eno1"; deuxfleurs.staticIPv6.address = "2a01:e0a:e4:2dd0::41";
deuxfleurs.lan_ip = "192.168.1.41";
deuxfleurs.ipv6 = "2a01:e0a:e4:2dd0::41";
deuxfleurs.cluster_ip = "10.83.4.1";
deuxfleurs.is_raft_server = false;
} }

11
cluster/prod/node/celeri.nix
View file

@ -8,12 +8,7 @@
boot.loader.timeout = 20; boot.loader.timeout = 20;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "celeri"; deuxfleurs.hostName = "celeri";
deuxfleurs.staticIPv4.address = "192.168.1.33";
deuxfleurs.network_interface = "enp0s31f6"; deuxfleurs.staticIPv6.address = "2001:910:1204:1::33";
deuxfleurs.lan_ip = "192.168.1.33";
deuxfleurs.ipv6 = "2001:910:1204:1::33";
deuxfleurs.cluster_ip = "10.83.1.3";
deuxfleurs.is_raft_server = false;
} }

12
cluster/prod/node/concombre.nix
View file

@ -8,12 +8,8 @@
boot.loader.timeout = 20; boot.loader.timeout = 20;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "concombre"; deuxfleurs.hostName = "concombre";
deuxfleurs.staticIPv4.address = "192.168.1.31";
deuxfleurs.network_interface = "enp0s31f6"; deuxfleurs.staticIPv6.address = "2001:910:1204:1::31";
deuxfleurs.lan_ip = "192.168.1.31"; deuxfleurs.isRaftServer = true;
deuxfleurs.ipv6 = "2001:910:1204:1::31";
deuxfleurs.cluster_ip = "10.83.1.1";
deuxfleurs.is_raft_server = true;
} }

11
cluster/prod/node/courgette.nix
View file

@ -8,12 +8,7 @@
boot.loader.timeout = 20; boot.loader.timeout = 20;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "courgette"; deuxfleurs.hostName = "courgette";
deuxfleurs.staticIPv4.address = "192.168.1.32";
deuxfleurs.network_interface = "enp0s31f6"; deuxfleurs.staticIPv6.address = "2001:910:1204:1::32";
deuxfleurs.lan_ip = "192.168.1.32";
deuxfleurs.ipv6 = "2001:910:1204:1::32";
deuxfleurs.cluster_ip = "10.83.1.2";
deuxfleurs.is_raft_server = false;
} }

12
cluster/prod/node/dahlia.nix
View file

@ -7,12 +7,8 @@
boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "dahlia"; deuxfleurs.hostName = "dahlia";
deuxfleurs.staticIPv4.address = "192.168.1.11";
deuxfleurs.network_interface = "enp0s31f6"; deuxfleurs.staticIPv6.address = "2a01:e0a:28f:5e60::11";
deuxfleurs.lan_ip = "192.168.1.11"; deuxfleurs.isRaftServer = true;
deuxfleurs.ipv6 = "2a01:e0a:28f:5e60::11";
deuxfleurs.cluster_ip = "10.83.2.1";
deuxfleurs.is_raft_server = true;
} }

12
cluster/prod/node/df-ykl.nix
View file

@ -7,14 +7,10 @@
boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "df-ykl"; deuxfleurs.hostName = "df-ykl";
deuxfleurs.staticIPv4.address = "192.168.5.117";
deuxfleurs.network_interface = "enp0s31f6"; deuxfleurs.staticIPv6.address = "2a02:a03f:6510:5102:6e4b:90ff:fe3b:e86c";
deuxfleurs.lan_ip = "192.168.5.117"; deuxfleurs.isRaftServer = true;
deuxfleurs.ipv6 = "2a02:a03f:6510:5102:6e4b:90ff:fe3b:e86c";
deuxfleurs.cluster_ip = "10.83.3.1";
deuxfleurs.is_raft_server = true;
fileSystems."/mnt" = { fileSystems."/mnt" = {
device = "/dev/disk/by-uuid/f7aa396f-23d0-44d3-89cf-3cb00bbb6c3b"; device = "/dev/disk/by-uuid/f7aa396f-23d0-44d3-89cf-3cb00bbb6c3b";

11
cluster/prod/node/df-ymf.nix
View file

@ -7,14 +7,9 @@
boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "df-ymf"; deuxfleurs.hostName = "df-ymf";
deuxfleurs.staticIPv4.address = "192.168.5.134";
deuxfleurs.network_interface = "enp0s31f6"; deuxfleurs.staticIPv6.address = "2a02:a03f:6510:5102:6e4b:90ff:fe3a:6174";
deuxfleurs.lan_ip = "192.168.5.134";
deuxfleurs.ipv6 = "2a02:a03f:6510:5102:6e4b:90ff:fe3a:6174";
deuxfleurs.cluster_ip = "10.83.3.2";
deuxfleurs.is_raft_server = false;
fileSystems."/mnt" = { fileSystems."/mnt" = {
device = "/dev/disk/by-uuid/fec20a7e-5019-4747-8f73-77f3f196c122"; device = "/dev/disk/by-uuid/fec20a7e-5019-4747-8f73-77f3f196c122";

11
cluster/prod/node/df-ymk.nix
View file

@ -7,14 +7,9 @@
boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true; boot.loader.efi.canTouchEfiVariables = true;
networking.hostName = "df-ymk"; deuxfleurs.hostName = "df-ymk";
deuxfleurs.staticIPv4.address = "192.168.5.116";
deuxfleurs.network_interface = "enp0s31f6"; deuxfleurs.staticIPv6.address = "2a02:a03f:6510:5102:6e4b:90ff:fe3b:e939";
deuxfleurs.lan_ip = "192.168.5.116";
deuxfleurs.ipv6 = "2a02:a03f:6510:5102:6e4b:90ff:fe3b:e939";
deuxfleurs.cluster_ip = "10.83.3.3";
deuxfleurs.is_raft_server = false;
fileSystems."/mnt" = { fileSystems."/mnt" = {
device = "/dev/disk/by-uuid/51d95b17-0e06-4a73-9e4e-ae5363cc4015"; device = "/dev/disk/by-uuid/51d95b17-0e06-4a73-9e4e-ae5363cc4015";

11
cluster/prod/node/diplotaxis.nix
View file

@ -8,12 +8,7 @@
boot.loader.grub.version = 2; boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/nvme0n1"; # or "nodev" for efi only boot.loader.grub.device = "/dev/nvme0n1"; # or "nodev" for efi only
networking.hostName = "diplotaxis"; deuxfleurs.hostName = "diplotaxis";
deuxfleurs.staticIPv4.address = "192.168.1.12";
deuxfleurs.network_interface = "enp0s31f6"; deuxfleurs.staticIPv6.address = "2a01:e0a:28f:5e60::12";
deuxfleurs.lan_ip = "192.168.1.12";
deuxfleurs.ipv6 = "2a01:e0a:28f:5e60::12";
deuxfleurs.cluster_ip = "10.83.2.2";
deuxfleurs.is_raft_server = false;
} }

11
cluster/prod/node/doradille.nix
View file

@ -8,12 +8,7 @@
boot.loader.grub.version = 2; boot.loader.grub.version = 2;
boot.loader.grub.device = "/dev/nvme0n1"; # or "nodev" for efi only boot.loader.grub.device = "/dev/nvme0n1"; # or "nodev" for efi only
networking.hostName = "doradille"; deuxfleurs.hostName = "doradille";
deuxfleurs.staticIPv4.address = "192.168.1.13";
deuxfleurs.network_interface = "enp0s31f6"; deuxfleurs.staticIPv6.address = "2a01:e0a:28f:5e60::13";
deuxfleurs.lan_ip = "192.168.1.13";
deuxfleurs.ipv6 = "2a01:e0a:28f:5e60::13";
deuxfleurs.cluster_ip = "10.83.2.3";
deuxfleurs.is_raft_server = false;
} }

10
cluster/prod/site/bespin.nix
View file

@ -1,13 +1,9 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
deuxfleurs.site_name = "bespin"; deuxfleurs.siteName = "bespin";
deuxfleurs.lan_default_gateway = "192.168.5.254"; deuxfleurs.staticIPv4.defaultGateway = "192.168.5.254";
deuxfleurs.ipv6_default_gateway = "2a02:a03f:6510:5102::1"; deuxfleurs.cnameTarget = "bespin.site.deuxfleurs.fr.";
deuxfleurs.lan_ip_prefix_length = 24;
deuxfleurs.ipv6_prefix_length = 64;
deuxfleurs.nameservers = [ "192.168.5.254" ];
deuxfleurs.cname_target = "bespin.site.deuxfleurs.fr.";
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];
} }

12
cluster/prod/site/neptune.nix
View file

@ -1,14 +1,10 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
deuxfleurs.site_name = "neptune"; deuxfleurs.siteName = "neptune";
deuxfleurs.lan_default_gateway = "192.168.1.1"; deuxfleurs.staticIPv4.defaultGateway = "192.168.1.1";
deuxfleurs.ipv6_default_gateway = "2001:910:1204:1::1"; deuxfleurs.cnameTarget = "neptune.site.deuxfleurs.fr.";
deuxfleurs.lan_ip_prefix_length = 24; deuxfleurs.publicIPv4 = "77.207.15.215";
deuxfleurs.ipv6_prefix_length = 64;
deuxfleurs.nameservers = [ "192.168.1.1" ];
deuxfleurs.cname_target = "neptune.site.deuxfleurs.fr.";
deuxfleurs.public_ipv4 = "77.207.15.215";
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];
} }

17
cluster/prod/site/orion.nix
View file

@ -1,14 +1,15 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
deuxfleurs.site_name = "orion"; deuxfleurs.siteName = "orion";
deuxfleurs.lan_default_gateway = "192.168.1.254"; deuxfleurs.staticIPv4.defaultGateway = "192.168.1.254";
deuxfleurs.ipv6_default_gateway = "2a01:e0a:28f:5e60::1"; # Setting an IPv6 default gateway will disable RA for now.
deuxfleurs.lan_ip_prefix_length = 24; # Adding this for now as Orion has the mail servers and we are
deuxfleurs.ipv6_prefix_length = 64; # not yet confident we can disable this without getting ourselves
deuxfleurs.nameservers = [ "192.168.1.254" ]; # banned by sending from unwanted IPs (although it should be ok).
deuxfleurs.cname_target = "orion.site.deuxfleurs.fr."; deuxfleurs.staticIPv6.defaultGateway = "2a01:e0a:28f:5e60::1";
deuxfleurs.public_ipv4 = "82.66.80.201"; deuxfleurs.cnameTarget = "orion.site.deuxfleurs.fr.";
deuxfleurs.publicIPv4 = "82.66.80.201";
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];
} }

12
cluster/prod/site/scorpio.nix
View file

@ -1,14 +1,10 @@
{ config, pkgs, ... }: { config, pkgs, ... }:
{ {
deuxfleurs.site_name = "scorpio"; deuxfleurs.siteName = "scorpio";
deuxfleurs.lan_default_gateway = "192.168.1.254"; deuxfleurs.staticIPv4.defaultGateway = "192.168.1.254";
deuxfleurs.ipv6_default_gateway = "2a01:e0a:e4:2dd0::1"; deuxfleurs.cnameTarget = "scorpio.site.deuxfleurs.fr.";
deuxfleurs.lan_ip_prefix_length = 24; deuxfleurs.publicIPv4 = "82.65.41.110";
deuxfleurs.ipv6_prefix_length = 64;
deuxfleurs.nameservers = [ "192.168.1.254" ];
deuxfleurs.cname_target = "scorpio.site.deuxfleurs.fr.";
deuxfleurs.public_ipv4 = "82.65.41.110";
networking.firewall.allowedTCPPorts = [ 80 443 ]; networking.firewall.allowedTCPPorts = [ 80 443 ];
} }