tixie/nixcfg
1
0
Fork 0
forked from Deuxfleurs/nixcfg
Code Pull requests Activity
Nix system configuration for Deuxfleurs clusters
422 commits 9 branches 0 tags 1.8 MiB
HCL 40%
JavaScript 24%
Nix 18.7%
Shell 5.4%
Smarty 4.3%
Other 7.6%
Find a file
Quentin Dufour 3befdea206
nix: allow wireguard + logs
2023-04-28 09:26:32 +02:00
cluster Garage backup to SFTP target hosted by Max 2023-04-20 12:10:07 +02:00
doc wgautomesh actually on prod 2023-03-24 12:01:38 +01:00
experimental staging: deploy things on bespin 2023-01-04 10:06:06 +01:00
nix nix: allow wireguard + logs 2023-04-28 09:26:32 +02:00
.gitignore Modularize and prepare to support multiple clusters 2022-02-09 12:09:49 +01:00
deploy_nixos wgautomesh actually on prod 2023-03-24 12:01:38 +01:00
deploy_passwords cleanup 2022-12-23 00:07:02 +01:00
deploy_pki added scorpio site and abricot node 2023-03-15 17:10:38 +01:00
gen_pki Fix access to consul for non-server nodes 2022-08-24 16:58:50 +02:00
passwd edited passwd command to set bash as interpreter 2022-11-09 19:02:02 +01:00
README.md better classification 2023-03-27 12:26:01 +02:00
restic_summary cleanup 2022-12-23 00:07:02 +01:00
secretmgr Improve secretmgr more, update secrets for staging 2022-12-25 22:12:38 +01:00
sshtool fix cleanup of deploypass 2023-03-15 17:49:31 +01:00
tlsproxy Remove hardcoded years in deuxfleurs.nix 2023-01-01 19:43:35 +01:00
upgrade_nixos upgrade nixos 2023-03-15 17:50:06 +01:00

README.md

Deuxfleurs on NixOS!

This repository contains code to run Deuxfleur's infrastructure on NixOS.

Our abstraction stack

We try to build a generic abstraction stack between our different resources (CPU, RAM, disk, etc.) and our services (Chat, Storage, etc.), we develop our own tools when needed.

Our first abstraction level is the NixOS level, which installs a bunch of standard components:

  • Wireguard: provides encrypted communication between remote nodes
  • Nomad: schedule containers and handle their lifecycle
  • Consul: distributed key value store + lock + service discovery
  • Docker: package, distribute and isolate applications

Then, inside our Nomad+Consul orchestrator, we deploy a number of base services:

  • Data management
    • Garage: S3-compatible lightweight object store for self-hosted geo-distributed deployments
    • Stolon + PostgreSQL: distributed relational database
  • Network Control Plane
    • DiploNAT: - network automation (firewalling, upnp igd)
    • D53 - update DNS entries (A and AAAA) dynamically based on Nomad service scheduling and local node info
    • Tricot - a dynamic reverse proxy for nomad+consul inspired by traefik
    • wgautomesh - a dynamic wireguard mesh configurator
  • User Management
    • Bottin: authentication and authorization (LDAP protocol, consul backend)
    • Guichet: a dashboard for our users and administrators7
  • Observability
    • Prometheus + Grafana: monitoring

Some services we provide based on this abstraction:

  • Websites: Garage (static) + fediverse blog (Plume)
  • Chat: Synapse + Element Web (Matrix protocol)
  • Email: Postfix SMTP + Dovecot IMAP + opendkim DKIM + Sogo webmail | Alps webmail (experimental)
  • Visioconference: Jitsi
  • Collaboration: CryptPad

As a generic abstraction is provided, deploying new services should be easy.

How to use this?

See the following documentation topics: