diff --git a/fastfetch.png b/fastfetch.png new file mode 100644 index 0000000..2bc4cf7 Binary files /dev/null and b/fastfetch.png differ diff --git a/hosts/common.nix b/hosts/common.nix index 15eed06..8f94339 100644 --- a/hosts/common.nix +++ b/hosts/common.nix @@ -59,9 +59,19 @@ useXkbConfig= true; }; +<<<<<<< HEAD + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICW1+Ml8R9x1LCJaZ8bIZ1qIV4HCuZ6x7DziFW+0Nn5T xengi@kanae_2022-12-09" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICmb+mJfo84IagUaRoDEqY9ROjjQUOQ7tMclpN6NDPrX xengi@kota_2022-01-16" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICyklb7dvEHH0VBEMmTUQFKHN6ekBQqkDKj09+EilUIQ xengi@lucy_2018-09-08" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICjv9W8WXq9QGkgmANNPQR24/I1Pm1ghxNIHftEI+jlZ xengi@mayu_2021-06-11" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGhyfD+8jMl6FDSADb11sfAsJk0KNoVzjjiDRZjUOtmf xengi@nana_2019-08-16" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMPtGqhV7io3mhIoZho4Yf7eCo0sUZvjT2NziM2PkXSo xengi@nyu_2017-10-11" + ]; + environment.systemPackages = with pkgs; [ - vim git + vim ]; programs = { @@ -92,5 +102,6 @@ }; security.sudo.execWheelOnly = true; -} + system.stateVersion = "26.05"; +} diff --git a/hosts/control-plane/default.nix b/hosts/control-plane/default.nix new file mode 100644 index 0000000..9e09fa3 --- /dev/null +++ b/hosts/control-plane/default.nix @@ -0,0 +1,5 @@ +{}: + +{ + imports = [../common.nix]; +} diff --git a/hosts/kaede/base.nix b/hosts/kaede/base.nix new file mode 100644 index 0000000..9c7ef9b --- /dev/null +++ b/hosts/kaede/base.nix @@ -0,0 +1,67 @@ +{ config, lib, pkgs, ... }: + +{ + boot = { + initrd.availableKernelModules = [ "ahci" "xhci_pci" "ehci_pci" "megaraid_sas" "nvme" "usb_storage" "usbhid" "sd_mod" "sr_mod" ]; + kernelModules = [ "kvm-intel" ]; + loader = { + systemd-boot.enable = true; + efi.canTouchEfiVariables = true; + }; + kernelPackages = pkgs.linuxPackages_latest; + swraid = { + enable = true; + mdadmConf = '' + ARRAY /dev/md/ROOT metadata=1.2 UUID=41506d64-f386-474c-abe1-0142d9c57d84 + MAILADDR root@localhost + ''; + }; + }; + + fileSystems = { + "/" = { + device = "/dev/disk/by-uuid/41506d64-f386-474c-abe1-0142d9c57d84"; + fsType = "ext4"; + options = [ "discard" "noatime" ]; + }; + "/boot" = { + device = "/dev/disk/by-uuid/49B7-9286"; + fsType = "vfat"; + options = [ "fmask=0022" "dmask=0022" "discard" "noatime" ]; + }; + }; + + swapDevices = [ + { device = "/dev/disk/by-uuid/5b53c0b9-ab57-4992-8e81-957e19c7b685"; } + { device = "/dev/disk/by-uuid/e8825b01-f91e-4c4f-8916-bffeb6fac0cd"; } + ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; + + time.timeZone = "Europe/Berlin"; + + console = { + font = "Lat2-Terminus16"; + useXkbConfig= true; + }; + + environment.systemPackages = with pkgs; [ + git + vim + ]; + + virtualisation = { + #useEFIBoot = true; + libvirtd = { + enable = true; + nss.enableGuest = true; + startDelay = 1; + onShutdown = "shutdown"; + }; + }; + #rootDevice = "/dev/disk/by-label/nixos"; + #mountHostNixStore = true; + + system.stateVersion = "26.05"; +} diff --git a/hosts/kaede/default.nix b/hosts/kaede/default.nix index 11d81b3..eb9385e 100644 --- a/hosts/kaede/default.nix +++ b/hosts/kaede/default.nix @@ -2,7 +2,13 @@ { imports = [ - ../common.nix +<<<<<<< HEAD + ./base.nix + ./hardware.nix + ./networking.nix + ./users.nix + ./programs.nix + ./services.nix ../../services/openssh.nix ]; @@ -79,4 +85,3 @@ system.stateVersion = "25.11"; } - diff --git a/hosts/kaede/hardware.nix b/hosts/kaede/hardware.nix new file mode 100644 index 0000000..a758415 --- /dev/null +++ b/hosts/kaede/hardware.nix @@ -0,0 +1,49 @@ +{ ... }: + +{ + swapDevices = []; + + hardware = { + graphics = { + enable = true; + extraPackages = with pkgs; [ + intel-media-driver + intel-ocl + intel-vaapi-driver + ]; + }; + nvidia = { + # Modesetting is required. + modesetting.enable = true; + # Nvidia power management. Experimental, and can cause sleep/suspend to fail. + powerManagement.enable = false; + # Fine-grained power management. Turns off GPU when not in use. + # Experimental and only works on modern Nvidia GPUs (Turing or newer). + powerManagement.finegrained = false; + # Use the NVidia open source kernel module (not to be confused with the + # independent third-party "nouveau" open source driver). + # Support is limited to the Turing and later architectures. Full list of + # supported GPUs is at: + # https://github.com/NVIDIA/open-gpu-kernel-modules#compatible-gpus + # Only available from driver 515.43.04+ + # Do not disable this unless your GPU is unsupported or if you have a good reason to. + open = true; + # Enable the Nvidia settings menu, + # accessible via `nvidia-settings`. + nvidiaSettings = false; + # Update for NVIDA GPU headless mode, i.e. nvidia-persistenced. + # It ensures all GPUs stay awake even during headless mode. + nvidiaPersistenced = true; + # Optionally, you may need to select the appropriate driver version for your specific GPU. + package = config.boot.kernelPackages.nvidiaPackages.stable; + #package = config.boot.kernelPackages.nvidiaPackages.mkDriver { + # version = "565.57.01"; + # sha256_64bit = "sha256-8pMskvrdQ8WyNBvkU/xPc/CtcYXCa7ekP73oGuKfH+M="; + # sha256_aarch64 = "sha256-s8ZAVKvRNXpjxRYqM3E5oss5FdqW+tv1qQC2pDjfG+s="; + # openSha256 = "sha256-/32Zf0dKrofTmPZ3Ratw4vDM7B+OgpC4p7s+RHUjCrg="; + # settingsSha256 = "sha256-kQsvDgnxis9ANFmwIwB7HX5MkIAcpEEAHc8IBOLdXvk="; + # persistencedSha256 = "sha256-E2J2wYYyRu7Kc3MMZz/8ZIemcZg68rkzvqEwFAL3fFs="; + #}; + }; + }; +} diff --git a/hosts/kaede/networking.nix b/hosts/kaede/networking.nix new file mode 100644 index 0000000..3bc6dee --- /dev/null +++ b/hosts/kaede/networking.nix @@ -0,0 +1,42 @@ +{ ... }: + +{ + networking = { + hostName = "k8s"; + domain = "berlin.ccc.de"; + search = [ "berlin.ccc.de" ]; + useNetworkd = true; + dhcpcd.enable = false; + nftables.enable = true; + useDHCP = false; + nameservers = [ + "2001:678:560:42::1" + ]; + defaultGateway6 = { + address = "fe80::6eb3:11ff:fe11:8f55"; + interface = "eno4"; + }; + defaultGateway = { + address = "195.160.172.5"; + interface = "eno4"; + }; + interfaces.eno3 = { + ipv6.addresses = [{ address = "2001:678:560:42::88"; prefixLength = 64; }]; + ipv4.addresses = [{ address = "195.160.172.88"; prefixLength = 24; }]; + }; + firewall.enable = true; + }; + services.resolved = { + enable = true; + settings.Resolve = { + DNSOverTLS = "opportunistic"; + DNSSEC = "allow-downgrade"; + FallbackDNS = [ + "2606:4700:4700::1111#one.one.one.one" + "1.1.1.1#one.one.one.one" + ]; + LLMNR = true; + MulticastDNS = true; + }; + }; +} diff --git a/hosts/kaede/programs.nix b/hosts/kaede/programs.nix new file mode 100644 index 0000000..0c2fc08 --- /dev/null +++ b/hosts/kaede/programs.nix @@ -0,0 +1,29 @@ +{ pkgs, ... }: + +{ + programs = { + vim = { + enable = true; + defaultEditor = true; + }; + htop = { + enable = true; + settings = { + highlight_base_name = true; + show_cpu_frequency = true; + show_cpu_temperature = true; + update_process_names = true; + color_scheme = "6"; + }; + }; + tmux = { + enable = true; + terminal = "screen-256color"; + shortcut = "a"; + plugins = with pkgs.tmuxPlugins; [ sensible ]; + newSession = true; + historyLimit = 10000; + clock24 = true; + }; + }; +} diff --git a/hosts/kaede/services.nix b/hosts/kaede/services.nix new file mode 100644 index 0000000..ce5700e --- /dev/null +++ b/hosts/kaede/services.nix @@ -0,0 +1,24 @@ +{ ... }: + +{ + services = { + openssh = { + enable = true; + ports = [ 10022 ]; + openFirewall = true; + banner = '' + __ __ __ + /'__`\ /\ \ /'_ `\ + ___ /\_\L\ \\ \ \/'\ /\ \L\ \ ____ + /'___\/_/_\_<_\ \ , < \/_> _ <_ /',__\ + /\ \__/ /\ \L\ \\ \ \\`\ /\ \L\ \/\__, `\ + \ \____\\ \____/ \ \_\ \_\ \____/\/\____/ + \/____/ \/___/ \/_/\/_/\/___/ \/___/ + ''; + settings = { + PasswordAuthentication = false; + KbdInteractiveAuthentication = false; + }; + }; + }; +} diff --git a/hosts/worker/default.nix b/hosts/worker/default.nix new file mode 100644 index 0000000..9e09fa3 --- /dev/null +++ b/hosts/worker/default.nix @@ -0,0 +1,5 @@ +{}: + +{ + imports = [../common.nix]; +} diff --git a/services/etcd.nix b/services/etcd.nix index 42d30a2..d374a48 100644 --- a/services/etcd.nix +++ b/services/etcd.nix @@ -1,8 +1,32 @@ -{ pkgs, ... }: +{ config, pkgs, ... }: +let + ip = (builtins.head config.networking.interfaces.enp1s0.ipv6.addresses).address; + controlPlaneIps = ["fd00::1" "fd00::2" "fd00::3"]; + controlPlaneIpSet = builtins.concatStringsSep ", " controlPlaneIps; +in { services.etcd = { enable = true; package = pkgs.etcd_3_6; + trustedCaFile = config.age.secrets.etcd_ca_crt.path; + peerTrustedCaFile = config.age.secrets.etcd_peer_ca_crt.path; + peerClientCertAuth = true; + listenPeerUrls = ["https://[${ip}]:2380"]; + listenClientUrls = ["https://[${ip}]:2379"]; + initialCluster = ["${config.services.etcd.name}=https://${ip}:2380"]; + clientCertAuth = true; + #peerKeyFile = config.age.secrets.etcd_peer_key.path; + #peerCertFile = config.age.secrets.etcd_peer_crt.path; + #keyFile = config.age.secrets.etcd_server_key.path; + #certFile = config.age.secrets.etcd_server_key.path; }; +<<<<<<< HEAD + + networking.firewall.extraInputRules = '' + ip6 saddr {${controlPlaneIpSet} ip6 daddr ${ip} tcp dport 2380 accept comment "Allow etcd peers" + ip6 saddr {${controlPlaneIpSet} ip6 daddr ${ip} tcp dport 2379 accept comment "Allow etcd clients" + ''; +======= +>>>>>>> b9de4f3c256492a785e296898739a5e4674025fc } diff --git a/vm.nix b/vm.nix new file mode 100644 index 0000000..c2aec9e --- /dev/null +++ b/vm.nix @@ -0,0 +1,5 @@ +{ ... }: + +{ + virtualisation.qemu.guestAgent.enable = true; +}