Deuxfleurs
/
nixcfg
17
6
Fork 2
Code Issues 8 Pull Requests 2 Projects Releases Wiki Activity
Nix system configuration for Deuxfleurs clusters
328 Commits 8 Branches 0 Tags 1.8 MiB
HCL 40%
JavaScript 24%
Nix 18.6%
Shell 5.4%
Smarty 4.3%
Other 7.7%
Go to file
Alex 87bb031ed0
Migrate prod cluster secrets to new format 		2022-12-25 22:31:18 +01:00
cluster Migrate prod cluster secrets to new format 2022-12-25 22:31:18 +01:00
doc reorganize some things 2022-12-24 22:59:37 +01:00
experimental reorganize some things 2022-12-24 22:59:37 +01:00
nix Replace deploy_wg by a NixOS activation script 2022-12-14 18:02:30 +01:00
.gitignore Modularize and prepare to support multiple clusters 2022-02-09 12:09:49 +01:00
README.md reorganize some things 2022-12-24 22:59:37 +01:00
convertsecrets Improve secretmgr more, update secrets for staging 2022-12-25 22:12:38 +01:00
deploy_nixos cleanup 2022-12-23 00:07:02 +01:00
deploy_passwords cleanup 2022-12-23 00:07:02 +01:00
deploy_pki Add origan node in staging cluster (+ refactor system.stateVersion) 2022-12-11 22:37:28 +01:00
gen_pki Fix access to consul for non-server nodes 2022-08-24 16:58:50 +02:00
passwd edited passwd command to set bash as interpreter 2022-11-09 19:02:02 +01:00
restic_summary cleanup 2022-12-23 00:07:02 +01:00
secretmgr Improve secretmgr more, update secrets for staging 2022-12-25 22:12:38 +01:00
ssh_known_hosts Add origan node in staging cluster (+ refactor system.stateVersion) 2022-12-11 22:37:28 +01:00
sshtool reorganize some things 2022-12-24 22:59:37 +01:00
tlsproxy changed shebang of tlsproxy file to bash, because trap failed with sh (trap is a builtin of bash) 2022-11-09 18:53:21 +01:00
upgrade_nixos Staging: ability to run Nix jobs using exec2 driver 2022-11-28 22:58:39 +01:00

README.md

Deuxfleurs on NixOS!

This repository contains code to run Deuxfleur's infrastructure on NixOS.

Our abstraction stack

We try to build a generic abstraction stack between our different resources (CPU, RAM, disk, etc.) and our services (Chat, Storage, etc.), we develop our own tools when needed.

Our first abstraction level is the NixOS level, which installs a bunch of standard components:

  • Wireguard: provides encrypted communication between remote nodes
  • Nomad: schedule containers and handle their lifecycle
  • Consul: distributed key value store + lock + service discovery
  • Docker: package, distribute and isolate applications

Then, inside our Nomad+Consul orchestrator, we deploy a number of base services:

  • Garage: S3-compatible lightweight object store for self-hosted geo-distributed deployments (we also have a legacy glusterfs cluster)
  • DiploNAT: network automation (firewalling, upnp igd)
  • Bottin: authentication and authorization (LDAP protocol, consul backend)
  • Guichet: a dashboard for our users and administrators
  • Stolon + PostgreSQL: distributed relational database
  • Prometheus + Grafana: monitoring

Some services we provide based on this abstraction:

  • Websites: Garage (static) + fediverse blog (Plume)
  • Chat: Synapse + Element Web (Matrix protocol)
  • Email: Postfix SMTP + Dovecot IMAP + opendkim DKIM + Sogo webmail | Alps webmail (experimental)
  • Visioconference: Jitsi
  • Collaboration: CryptPad

As a generic abstraction is provided, deploying new services should be easy.

How to use this?

See the following documentation topics: