this repo has no description
feat: initial NixOS support
+259
+19
infra/.modules/nixos/Makefile
+19
infra/.modules/nixos/Makefile
···
1
+
.POSIX:
2
+
3
+
.PHONY: *
4
+
default: switch
5
+
6
+
switch:
7
+
sudo nixos-rebuild \
8
+
--flake '.#netamos' \
9
+
--impure \
10
+
switch
11
+
12
+
update:
13
+
nix flake update
14
+
15
+
test:
16
+
@nix \
17
+
--experimental-features 'nix-command flakes' \
18
+
run \
19
+
'.#nixosConfigurations.test.config.system.build.vmWithDisko'
+146
infra/.modules/nixos/configuration.nix
+146
infra/.modules/nixos/configuration.nix
···
1
+
{ config, pkgs, ... }:
2
+
3
+
{
4
+
disko.devices = {
5
+
disk = {
6
+
main = {
7
+
type = "disk";
8
+
content = {
9
+
type = "gpt";
10
+
partitions = {
11
+
boot = {
12
+
size = "1M";
13
+
type = "EF02"; # for grub MBR
14
+
};
15
+
ESP = {
16
+
size = "1G";
17
+
type = "EF00";
18
+
content = {
19
+
type = "filesystem";
20
+
format = "vfat";
21
+
mountpoint = "/boot";
22
+
mountOptions = [ "umask=0077" ];
23
+
};
24
+
};
25
+
root = {
26
+
size = "100%";
27
+
content = {
28
+
type = "filesystem";
29
+
format = "ext4";
30
+
mountpoint = "/";
31
+
};
32
+
};
33
+
};
34
+
};
35
+
};
36
+
};
37
+
};
38
+
39
+
boot = {
40
+
loader = {
41
+
systemd-boot = {
42
+
enable = true;
43
+
};
44
+
efi = {
45
+
canTouchEfiVariables = true;
46
+
};
47
+
};
48
+
};
49
+
50
+
networking = {
51
+
networkmanager = {
52
+
enable = true;
53
+
};
54
+
firewall = {
55
+
# https://docs.k3s.io/installation/requirements#inbound-rules-for-k3s-server-nodes
56
+
allowedTCPPorts = [
57
+
6443
58
+
10250
59
+
];
60
+
allowedTCPPortRanges = [
61
+
{ from = 2379; to = 2380; }
62
+
];
63
+
};
64
+
};
65
+
66
+
time.timeZone = "Asia/Ho_Chi_Minh";
67
+
i18n.defaultLocale = "en_US.UTF-8";
68
+
69
+
nix = {
70
+
settings = {
71
+
experimental-features = [
72
+
"nix-command"
73
+
"flakes"
74
+
];
75
+
};
76
+
optimise.automatic = true;
77
+
gc = {
78
+
automatic = true;
79
+
dates = "weekly";
80
+
options = "--delete-older-than 30d";
81
+
};
82
+
};
83
+
84
+
services = {
85
+
openssh.enable = true;
86
+
k3s = {
87
+
enable = true;
88
+
role = "server";
89
+
extraFlags = toString [
90
+
"--disable-helm-controller"
91
+
"--disable-network-policy"
92
+
"--disable=traefik"
93
+
"--secrets-encryption=true"
94
+
95
+
# TODO not sure why it doesn't play nice with the registry config below
96
+
# "--snapshotter=stargz"
97
+
98
+
# TODO if the node doesn't have IPv6, this will fail, so we can't enable by default yet
99
+
# "--cluster-cidr=10.42.0.0/16,2001:cafe:42::/56"
100
+
# "--service-cidr=10.43.0.0/16,2001:cafe:43::/112"
101
+
];
102
+
};
103
+
yggdrasil = {
104
+
enable = true;
105
+
persistentKeys = true;
106
+
settings = {
107
+
Peers = [
108
+
# https://publicpeers.neilalexander.dev
109
+
"tls://sin.yuetau.net:6643" # Singapore
110
+
"tls://mima.localghost.org:443" # Philippines
111
+
"tls://133.18.201.69:54232" # Japan
112
+
"tls://vpn.itrus.su:7992" # Netherlands
113
+
"tls://ygg.jjolly.dev:3443" # United States
114
+
];
115
+
};
116
+
};
117
+
};
118
+
119
+
# TODO switch to services.k3s.registries https://github.com/NixOS/nixpkgs/pull/292023
120
+
# Static ClusterIP so we can pull from the internal registry without going through an ingress for better performance
121
+
# Alternatively this can be done by resolving DNS on the node via CoreDNS in some way, maybe via /etc/resolv.conf?
122
+
# nix-shell -p dig --command "dig @10.43.0.10 zot.zot.svc.cluster.local"
123
+
environment.etc."rancher/k3s/registries.yaml".text = ''
124
+
mirrors:
125
+
zot.zot.svc.cluster.local:
126
+
endpoint:
127
+
- http://10.43.0.50:5000
128
+
'';
129
+
130
+
users.users.admin = {
131
+
isNormalUser = true;
132
+
description = "Admin";
133
+
extraGroups = [
134
+
"networkmanager"
135
+
"wheel"
136
+
];
137
+
packages = with pkgs; [
138
+
neovim
139
+
git
140
+
gnumake
141
+
tmux
142
+
];
143
+
};
144
+
145
+
system.stateVersion = "23.11";
146
+
}
+48
infra/.modules/nixos/flake.lock
+48
infra/.modules/nixos/flake.lock
···
1
+
{
2
+
"nodes": {
3
+
"disko": {
4
+
"inputs": {
5
+
"nixpkgs": [
6
+
"nixpkgs"
7
+
]
8
+
},
9
+
"locked": {
10
+
"lastModified": 1731274291,
11
+
"narHash": "sha256-cZ0QMpv5p2a6WEE+o9uu0a4ma6RzQDOQTbm7PbixWz8=",
12
+
"owner": "nix-community",
13
+
"repo": "disko",
14
+
"rev": "486250f404f4a4f4f33f8f669d83ca5f6e6b7dfc",
15
+
"type": "github"
16
+
},
17
+
"original": {
18
+
"owner": "nix-community",
19
+
"repo": "disko",
20
+
"type": "github"
21
+
}
22
+
},
23
+
"nixpkgs": {
24
+
"locked": {
25
+
"lastModified": 1731239293,
26
+
"narHash": "sha256-q2yjIWFFcTzp5REWQUOU9L6kHdCDmFDpqeix86SOvDc=",
27
+
"owner": "NixOS",
28
+
"repo": "nixpkgs",
29
+
"rev": "9256f7c71a195ebe7a218043d9f93390d49e6884",
30
+
"type": "github"
31
+
},
32
+
"original": {
33
+
"owner": "NixOS",
34
+
"ref": "nixos-24.05",
35
+
"repo": "nixpkgs",
36
+
"type": "github"
37
+
}
38
+
},
39
+
"root": {
40
+
"inputs": {
41
+
"disko": "disko",
42
+
"nixpkgs": "nixpkgs"
43
+
}
44
+
}
45
+
},
46
+
"root": "root",
47
+
"version": 7
48
+
}
+31
infra/.modules/nixos/flake.nix
+31
infra/.modules/nixos/flake.nix
···
1
+
{
2
+
description = "Netamos";
3
+
4
+
inputs = {
5
+
nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
6
+
disko = {
7
+
url = "github:nix-community/disko";
8
+
inputs.nixpkgs.follows = "nixpkgs";
9
+
};
10
+
};
11
+
12
+
outputs = { self, nixpkgs, disko }: {
13
+
nixosConfigurations = {
14
+
netamos = nixpkgs.lib.nixosSystem {
15
+
system = "x86_64-linux"; # TODO support multiple systems
16
+
modules = [
17
+
disko.nixosModules.disko
18
+
./configuration.nix
19
+
];
20
+
};
21
+
test = nixpkgs.lib.nixosSystem {
22
+
system = "x86_64-linux"; # TODO support multiple systems
23
+
modules = [
24
+
disko.nixosModules.disko
25
+
./configuration.nix
26
+
./test.nix
27
+
];
28
+
};
29
+
};
30
+
};
31
+
}
+15
infra/.modules/nixos/test.nix
+15
infra/.modules/nixos/test.nix