netboot-serve: split configuration to a separate module
Pierre Bourdon committed
Feb 22, 2024 at 09:58 UTC
211f6225ddad88bfd80135ccacbc7a914874ad92
2 files changed
+41
-38
delft/eris.nix
+2
-38
@@ -6,8 +6,9 @@ in
6
imports = [
7
./common.nix
8
../modules/hydra-mirror.nix
9
- ../modules/rfc39.nix
9
+ ../modules/netboot-serve.nix
10
../modules/prometheus
11
+ ../modules/rfc39.nix
12
../modules/tarball-mirror.nix
13
../modules/wireguard.nix
14
./eris/packet-spot-market-prices.nix
@@ -48,51 +49,14 @@ in
49
50
zramSwap.enable = true; # Channel scripts can be memory hungry.
51
51
- services.nix-netboot-serve = {
52
- enable = true;
53
- listen = "127.0.0.1:3001";
54
- };
55
-
56
- security.acme = {
57
- # these cert parameters are very specifically & carefully chosen for iPXE compatibility.
58
- certs."netboot.nixos.org" = {
59
- keyType = "rsa4096";
60
- extraLegoRunFlags = [
61
- # re: https://community.letsencrypt.org/t/production-chain-changes/150739/1
62
- # re: https://github.com/ipxe/ipxe/pull/116
63
- # re: https://github.com/ipxe/ipxe/pull/112
64
- # re: https://lists.ipxe.org/pipermail/ipxe-devel/2020-May/007042.html
65
- "--preferred-chain"
66
- "ISRG Root X1"
67
- ];
68
- extraLegoRenewFlags = [
69
- # re: https://community.letsencrypt.org/t/production-chain-changes/150739/1
70
- # re: https://github.com/ipxe/ipxe/pull/116
71
- # re: https://github.com/ipxe/ipxe/pull/112
72
- # re: https://lists.ipxe.org/pipermail/ipxe-devel/2020-May/007042.html
73
- "--preferred-chain"
74
- "ISRG Root X1"
75
- ];
76
- };
77
- };
78
-
52
services.nginx = {
53
enable = true;
54
recommendedProxySettings = true;
55
83
- sslProtocols = "TLSv1.2 TLSv1.3"; # iPXE only supports TLSv1.2
84
- sslCiphers = options.services.nginx.sslCiphers.default + ":AES256-SHA256"; # iPXE needs AES256-SHA256
85
-
56
eventsConfig = ''
57
worker_connections 4096;
58
'';
59
90
- virtualHosts."netboot.nixos.org" = {
91
- enableACME = true;
92
- forceSSL = true;
93
- locations."/".proxyPass = "http://127.0.0.1:3001/";
94
- };
95
-
60
virtualHosts."monitoring.nixos.org" = {
61
enableACME = true;
62
forceSSL = true;
modules/netboot-serve.nix
new
+39
@@ -0,0 +1,39 @@
1
+{ options, ... }:
2
+
3
+let
4
+ port = 3001;
5
+
6
+ # re: https://community.letsencrypt.org/t/production-chain-changes/150739/1
7
+ # re: https://github.com/ipxe/ipxe/pull/116
8
+ # re: https://github.com/ipxe/ipxe/pull/112
9
+ # re: https://lists.ipxe.org/pipermail/ipxe-devel/2020-May/007042.html
10
+ legoFlags = [ "--preferred-chain" "ISRG Root X1" ];
11
+in {
12
+ services.nix-netboot-serve = {
13
+ enable = true;
14
+ listen = "127.0.0.1:${toString port}";
15
+ };
16
+
17
+ security.acme = {
18
+ # These cert parameters are very specifically & carefully chosen for iPXE compatibility.
19
+ certs."netboot.nixos.org" = {
20
+ keyType = "rsa4096";
21
+ extraLegoRunFlags = legoFlags;
22
+ extraLegoRenewFlags = legoFlags;
23
+ };
24
+ };
25
+
26
+ services.nginx = {
27
+ enable = true;
28
+
29
+ sslProtocols = "TLSv1.2 TLSv1.3"; # iPXE only supports TLSv1.2
30
+ sslCiphers = options.services.nginx.sslCiphers.default + ":AES256-SHA256"; # iPXE needs AES256-SHA256
31
+
32
+ virtualHosts."netboot.nixos.org" = {
33
+ enableACME = true;
34
+ forceSSL = true;
35
+ locations."/".proxyPass = "http://127.0.0.1:${toString port}/";
36
+ };
37
+ };
38
+
39
+}