kubernauts/iac
Watch
0
0
Fork
You've already forked iac
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

🔥

Browse source
This commit is contained in:
XenGi 2026-08-27 23:35:11 +02:00
commit b2e7fde9ec
Signed by: xengi
SSH key fingerprint: SHA256:dM+fLZGsDvyv6kunjE8bGduL24VsCFB4LEOSdmRHdG0
14 changed files with 131 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

BIN
fastfetch.png Normal file
View file

Binary file not shown.
Side by side

After

Width:  |  Height:  |  Size: 128 KiB

2
flake.nix
View file

@ -24,7 +24,7 @@
nixpkgs-k8s,
flake-utils,
agenix,
NixVirt,
NixVirt,
# k8nix,
}:
{

17
hosts/common.nix
View file

@ -36,10 +36,19 @@
useXkbConfig= true;
};
environment.systemPackages = with pkgs; [
git
users.users.root.openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICW1+Ml8R9x1LCJaZ8bIZ1qIV4HCuZ6x7DziFW+0Nn5T xengi@kanae_2022-12-09"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICmb+mJfo84IagUaRoDEqY9ROjjQUOQ7tMclpN6NDPrX xengi@kota_2022-01-16"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyklb7dvEHH0VBEMmTUQFKHN6ekBQqkDKj09+EilUIQ xengi@lucy_2018-09-08"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICjv9W8WXq9QGkgmANNPQR24/I1Pm1ghxNIHftEI+jlZ xengi@mayu_2021-06-11"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGhyfD+8jMl6FDSADb11sfAsJk0KNoVzjjiDRZjUOtmf xengi@nana_2019-08-16"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMPtGqhV7io3mhIoZho4Yf7eCo0sUZvjT2NziM2PkXSo xengi@nyu_2017-10-11"
];
system.stateVersion = "25.11";
}
environment.systemPackages = with pkgs; [
git
vim
];
system.stateVersion = "26.05";
}

5
hosts/control-plane/default.nix Normal file
View file

@ -0,0 +1,5 @@
{}:
{
imports = [../common.nix];
}

14
hosts/kaede/base.nix
View file

@ -2,7 +2,7 @@
{
boot = {
initrd.availableKernelModules = [ "ahci" "xhci_pci" "ehci_pci" "megaraid_sas" "nvme" "usbhid" "usb_storage" "sd_mod" "sr_mod" ];
initrd.availableKernelModules = [ "ahci" "xhci_pci" "ehci_pci" "megaraid_sas" "nvme" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
kernelModules = [ "kvm-intel" ];
loader = {
systemd-boot.enable = true;
@ -12,7 +12,7 @@
swraid = {
enable = true;
mdadmConf = ''
ARRAY /dev/md/ROOT metadata=1.2 UUID=acd8260f-e30f-2f3f-74f7-e51ee905a498
ARRAY /dev/md/ROOT metadata=1.2 UUID=41506d64-f386-474c-abe1-0142d9c57d84
MAILADDR root@localhost
'';
};
@ -20,20 +20,20 @@
fileSystems = {
"/" = {
device = "/dev/disk/by-uuid/e44cfa13-868e-4d26-b3de-5a8ae92bb055";
device = "/dev/disk/by-uuid/41506d64-f386-474c-abe1-0142d9c57d84";
fsType = "ext4";
options = [ "discard" "noatime" ];
};
"/boot" = {
device = "/dev/disk/by-uuid/AD5C-950B";
device = "/dev/disk/by-uuid/49B7-9286";
fsType = "vfat";
options = [ "fmask=0022" "dmask=0022" "discard" "noatime" ];
};
};
swapDevices = [
{ device = "/dev/disk/by-uuid/e8825b01-f91e-4c4f-8916-bffeb6fac0cd"; }
{ device = "/dev/disk/by-uuid/5b53c0b9-ab57-4992-8e81-957e19c7b685"; }
{ device = "/dev/disk/by-uuid/e8825b01-f91e-4c4f-8916-bffeb6fac0cd"; }
];
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
@ -48,6 +48,7 @@
environment.systemPackages = with pkgs; [
git
vim
];
virtualisation = {
@ -62,6 +63,5 @@
#rootDevice = "/dev/disk/by-label/nixos";
#mountHostNixStore = true;
system.stateVersion = "25.11";
system.stateVersion = "26.05";
}

2
hosts/kaede/default.nix
View file

@ -3,10 +3,10 @@
{
imports = [
./base.nix
./hardware.nix
./networking.nix
./users.nix
./programs.nix
./services.nix
];
}

49
hosts/kaede/hardware.nix Normal file
View file

@ -0,0 +1,49 @@
{ ... }:
{
swapDevices = [];
hardware = {
graphics = {
enable = true;
extraPackages = with pkgs; [
intel-media-driver
intel-ocl
intel-vaapi-driver
];
};
nvidia = {
# Modesetting is required.
modesetting.enable = true;
# Nvidia power management. Experimental, and can cause sleep/suspend to fail.
powerManagement.enable = false;
# Fine-grained power management. Turns off GPU when not in use.
# Experimental and only works on modern Nvidia GPUs (Turing or newer).
powerManagement.finegrained = false;
# Use the NVidia open source kernel module (not to be confused with the
# independent third-party "nouveau" open source driver).
# Support is limited to the Turing and later architectures. Full list of
# supported GPUs is at:
# https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus
# Only available from driver 515.43.04+
# Do not disable this unless your GPU is unsupported or if you have a good reason to.
open = true;
# Enable the Nvidia settings menu,
# accessible via `nvidia-settings`.
nvidiaSettings = false;
# Update for NVIDA GPU headless mode, i.e. nvidia-persistenced.
# It ensures all GPUs stay awake even during headless mode.
nvidiaPersistenced = true;
# Optionally, you may need to select the appropriate driver version for your specific GPU.
package = config.boot.kernelPackages.nvidiaPackages.stable;
#package = config.boot.kernelPackages.nvidiaPackages.mkDriver {
# version = "565.57.01";
# sha256_64bit = "sha256-8pMskvrdQ8WyNBvkU/xPc/CtcYXCa7ekP73oGuKfH+M=";
# sha256_aarch64 = "sha256-s8ZAVKvRNXpjxRYqM3E5oss5FdqW+tv1qQC2pDjfG+s=";
# openSha256 = "sha256-/32Zf0dKrofTmPZ3Ratw4vDM7B+OgpC4p7s+RHUjCrg=";
# settingsSha256 = "sha256-kQsvDgnxis9ANFmwIwB7HX5MkIAcpEEAHc8IBOLdXvk=";
# persistencedSha256 = "sha256-E2J2wYYyRu7Kc3MMZz/8ZIemcZg68rkzvqEwFAL3fFs=";
#};
};
};
}

37
hosts/kaede/networking.nix
View file

@ -2,28 +2,41 @@
{
networking = {
hostName = "kaede";
domain = "xengi.de";
search = [ "xengi.de" ];
hostName = "k8s";
domain = "berlin.ccc.de";
search = [ "berlin.ccc.de" ];
useNetworkd = true;
dhcpcd.enable = false;
nftables.enable = true;
useDHCP = false;
nameservers = [
"2606:4700:4700::1111#one.one.one.one"
"2620:fe::fe#dns.quad9.net"
"1.1.1.1#one.one.one.one"
"9.9.9.9#dns.quad9.net"
"2001:678:560:42::1"
];
defaultGateway6 = {
address = "fe80::6eb3:11ff:fe11:8f55";
interface = "eno4";
};
defaultGateway = {
address = "217.115.0.182";
interface = "eno3";
address = "195.160.172.5";
interface = "eno4";
};
interfaces.eno3 = {
ipv6.addresses = [{ address = "2a00:1328:e100:1::6d"; prefixLength = 127; }];
ipv4.addresses = [{ address = "217.115.0.183"; prefixLength = 31; }];
ipv6.addresses = [{ address = "2001:678:560:42::88"; prefixLength = 64; }];
ipv4.addresses = [{ address = "195.160.172.88"; prefixLength = 24; }];
};
firewall.enable = true;
};
services.resolved = {
enable = true;
settings.Resolve = {
DNSOverTLS = "opportunistic";
DNSSEC = "allow-downgrade";
FallbackDNS = [
"2606:4700:4700::1111#one.one.one.one"
"1.1.1.1#one.one.one.one"
];
LLMNR = true;
MulticastDNS = true;
};
};
}

2
hosts/kaede/programs.nix
View file

@ -2,7 +2,6 @@
{
programs = {
fish.enable = true;
vim = {
enable = true;
defaultEditor = true;
@ -28,4 +27,3 @@
};
};
}

1
hosts/kaede/services.nix
View file

@ -22,4 +22,3 @@
};
};
}

23
hosts/kaede/users.nix
View file

@ -1,23 +0,0 @@
{ pkgs, ... }:
{
users.users.xengi = {
isNormalUser = true;
extraGroups = [ "wheel" "libvirtd" ];
shell = pkgs.fish;
packages = with pkgs; [
fastfetch
kitty # for terminfo
];
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICW1+Ml8R9x1LCJaZ8bIZ1qIV4HCuZ6x7DziFW+0Nn5T xengi@kanae_2022-12-09"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICmb+mJfo84IagUaRoDEqY9ROjjQUOQ7tMclpN6NDPrX xengi@kota_2022-01-16"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyklb7dvEHH0VBEMmTUQFKHN6ekBQqkDKj09+EilUIQ xengi@lucy_2018-09-08"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICjv9W8WXq9QGkgmANNPQR24/I1Pm1ghxNIHftEI+jlZ xengi@mayu_2021-06-11"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGhyfD+8jMl6FDSADb11sfAsJk0KNoVzjjiDRZjUOtmf xengi@nana_2019-08-16"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMPtGqhV7io3mhIoZho4Yf7eCo0sUZvjT2NziM2PkXSo xengi@nyu_2017-10-11"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILwYcSxbP6Hon//kZFIZJSHdqvsJ6AyCwH4JP9/t4q46 xengi@yuka_2020-12-16"
];
};
}

5
hosts/worker/default.nix Normal file
View file

@ -0,0 +1,5 @@
{}:
{
imports = [../common.nix];
}

24
services/etcd.nix
View file

@ -1,9 +1,29 @@
{ pkgs, ... }:
{ config, pkgs, ... }:
let
ip = (builtins.head config.networking.interfaces.enp1s0.ipv6.addresses).address;
controlPlaneIps = ["fd00::1" "fd00::2" "fd00::3"];
controlPlaneIpSet = builtins.concatStringsSep ", " controlPlaneIps;
in
{
services.etcd = {
enable = true;
package = pkgs.etcd_3_6;
trustedCaFile = config.age.secrets.etcd_ca_crt.path;
peerTrustedCaFile = config.age.secrets.etcd_peer_ca_crt.path;
peerClientCertAuth = true;
listenPeerUrls = ["https://[${ip}]:2380"];
listenClientUrls = ["https://[${ip}]:2379"];
initialCluster = ["${config.services.etcd.name}=https://${ip}:2380"];
clientCertAuth = true;
#peerKeyFile = config.age.secrets.etcd_peer_key.path;
#peerCertFile = config.age.secrets.etcd_peer_crt.path;
#keyFile = config.age.secrets.etcd_server_key.path;
#certFile = config.age.secrets.etcd_server_key.path;
};
}
networking.firewall.extraInputRules = ''
ip6 saddr {${controlPlaneIpSet} ip6 daddr ${ip} tcp dport 2380 accept comment "Allow etcd peers"
ip6 saddr {${controlPlaneIpSet} ip6 daddr ${ip} tcp dport 2379 accept comment "Allow etcd clients"
'';
}

5
vm.nix Normal file
View file

@ -0,0 +1,5 @@
{ ... }:
{
virtualisation.qemu.guestAgent.enable = true;
}