@cryptotaxi247 / infra-1 / commits / 7b6a016a

non-critical-infra: hetzner-01 bootstraping

Julien Malka committed Aug 1, 2023 at 13:53 UTC 7b6a016aabec8570a20cfd2e2a1086c428bd2d5c
7 files changed +435
.gitignore
+3
@@ -2,3 +2,6 @@
2
3 # Terraform
4 .terraform*
5 +
6 +# Direnv
7 +.direnv
non-critical-infra/.envrc new
+1
@@ -0,0 +1 @@
1 +use flake
non-critical-infra/flake.lock new
+216
@@ -0,0 +1,216 @@
1 +{
2 + "nodes": {
3 + "colmena": {
4 + "inputs": {
5 + "flake-compat": "flake-compat",
6 + "flake-utils": "flake-utils",
7 + "nixpkgs": "nixpkgs",
8 + "stable": "stable"
9 + },
10 + "locked": {
11 + "lastModified": 1688224393,
12 + "narHash": "sha256-rsAvFNhRFzTF7qyb6WprLFghJnRxMFjvD2e5/dqMp4I=",
13 + "owner": "zhaofengli",
14 + "repo": "colmena",
15 + "rev": "19384f3ee2058c56021e4465a3ec57e84a47d8dd",
16 + "type": "github"
17 + },
18 + "original": {
19 + "owner": "zhaofengli",
20 + "repo": "colmena",
21 + "type": "github"
22 + }
23 + },
24 + "disko": {
25 + "inputs": {
26 + "nixpkgs": "nixpkgs_2"
27 + },
28 + "locked": {
29 + "lastModified": 1690739034,
30 + "narHash": "sha256-roW02IaiQ3gnEEDMCDWL5YyN+C4nBf/te6vfL7rG0jk=",
31 + "owner": "nix-community",
32 + "repo": "disko",
33 + "rev": "4015740375676402a2ee6adebc3c30ea625b9a94",
34 + "type": "github"
35 + },
36 + "original": {
37 + "owner": "nix-community",
38 + "repo": "disko",
39 + "type": "github"
40 + }
41 + },
42 + "flake-compat": {
43 + "flake": false,
44 + "locked": {
45 + "lastModified": 1650374568,
46 + "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=",
47 + "owner": "edolstra",
48 + "repo": "flake-compat",
49 + "rev": "b4a34015c698c7793d592d66adbab377907a2be8",
50 + "type": "github"
51 + },
52 + "original": {
53 + "owner": "edolstra",
54 + "repo": "flake-compat",
55 + "type": "github"
56 + }
57 + },
58 + "flake-utils": {
59 + "locked": {
60 + "lastModified": 1659877975,
61 + "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
62 + "owner": "numtide",
63 + "repo": "flake-utils",
64 + "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
65 + "type": "github"
66 + },
67 + "original": {
68 + "owner": "numtide",
69 + "repo": "flake-utils",
70 + "type": "github"
71 + }
72 + },
73 + "flake-utils_2": {
74 + "inputs": {
75 + "systems": "systems"
76 + },
77 + "locked": {
78 + "lastModified": 1689068808,
79 + "narHash": "sha256-6ixXo3wt24N/melDWjq70UuHQLxGV8jZvooRanIHXw0=",
80 + "owner": "numtide",
81 + "repo": "flake-utils",
82 + "rev": "919d646de7be200f3bf08cb76ae1f09402b6f9b4",
83 + "type": "github"
84 + },
85 + "original": {
86 + "owner": "numtide",
87 + "repo": "flake-utils",
88 + "type": "github"
89 + }
90 + },
91 + "nixpkgs": {
92 + "locked": {
93 + "lastModified": 1683408522,
94 + "narHash": "sha256-9kcPh6Uxo17a3kK3XCHhcWiV1Yu1kYj22RHiymUhMkU=",
95 + "owner": "NixOS",
96 + "repo": "nixpkgs",
97 + "rev": "897876e4c484f1e8f92009fd11b7d988a121a4e7",
98 + "type": "github"
99 + },
100 + "original": {
101 + "owner": "NixOS",
102 + "ref": "nixos-unstable",
103 + "repo": "nixpkgs",
104 + "type": "github"
105 + }
106 + },
107 + "nixpkgs_2": {
108 + "locked": {
109 + "lastModified": 1689168768,
110 + "narHash": "sha256-mCw3LPg2jJkapvJpkd1IZ8k0IJlSG2ECvz3vcOAu+Uo=",
111 + "owner": "NixOS",
112 + "repo": "nixpkgs",
113 + "rev": "6fd9edc94426a3c050ad589c8f033b5ca55454c7",
114 + "type": "github"
115 + },
116 + "original": {
117 + "owner": "NixOS",
118 + "ref": "nixpkgs-unstable",
119 + "repo": "nixpkgs",
120 + "type": "github"
121 + }
122 + },
123 + "nixpkgs_3": {
124 + "locked": {
125 + "lastModified": 1690726002,
126 + "narHash": "sha256-cACz6jCJZtsZHGCJAN4vMobxzH5s6FCOTZHMrh/Hu0M=",
127 + "owner": "NixOS",
128 + "repo": "nixpkgs",
129 + "rev": "391e8db1f06c3f74c2d313a73135515023af3993",
130 + "type": "github"
131 + },
132 + "original": {
133 + "owner": "NixOS",
134 + "ref": "nixos-23.05",
135 + "repo": "nixpkgs",
136 + "type": "github"
137 + }
138 + },
139 + "nixpkgs_4": {
140 + "locked": {
141 + "lastModified": 1690327932,
142 + "narHash": "sha256-Fv7PYZxN4eo0K6zXhHG/vOc+e2iuqQ5ywDrh0yeRjP0=",
143 + "owner": "NixOS",
144 + "repo": "nixpkgs",
145 + "rev": "a9b47d85504bdd199e90846622c76aa0bfeabfac",
146 + "type": "github"
147 + },
148 + "original": {
149 + "owner": "NixOS",
150 + "ref": "nixos-unstable-small",
151 + "repo": "nixpkgs",
152 + "type": "github"
153 + }
154 + },
155 + "root": {
156 + "inputs": {
157 + "colmena": "colmena",
158 + "disko": "disko",
159 + "flake-utils": "flake-utils_2",
160 + "nixpkgs": "nixpkgs_3",
161 + "srvos": "srvos"
162 + }
163 + },
164 + "srvos": {
165 + "inputs": {
166 + "nixpkgs": "nixpkgs_4"
167 + },
168 + "locked": {
169 + "lastModified": 1691135985,
170 + "narHash": "sha256-v/4w9KWRODFl2tRORtIaCwAGUTsbmcKXHotlk3MLIxE=",
171 + "owner": "numtide",
172 + "repo": "srvos",
173 + "rev": "7441dd53b72d2f94866e00991d21614df78c124f",
174 + "type": "github"
175 + },
176 + "original": {
177 + "owner": "numtide",
178 + "repo": "srvos",
179 + "type": "github"
180 + }
181 + },
182 + "stable": {
183 + "locked": {
184 + "lastModified": 1669735802,
185 + "narHash": "sha256-qtG/o/i5ZWZLmXw108N2aPiVsxOcidpHJYNkT45ry9Q=",
186 + "owner": "NixOS",
187 + "repo": "nixpkgs",
188 + "rev": "731cc710aeebecbf45a258e977e8b68350549522",
189 + "type": "github"
190 + },
191 + "original": {
192 + "owner": "NixOS",
193 + "ref": "nixos-22.11",
194 + "repo": "nixpkgs",
195 + "type": "github"
196 + }
197 + },
198 + "systems": {
199 + "locked": {
200 + "lastModified": 1681028828,
201 + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
202 + "owner": "nix-systems",
203 + "repo": "default",
204 + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
205 + "type": "github"
206 + },
207 + "original": {
208 + "owner": "nix-systems",
209 + "repo": "default",
210 + "type": "github"
211 + }
212 + }
213 + },
214 + "root": "root",
215 + "version": 7
216 +}
non-critical-infra/flake.nix new
+57
@@ -0,0 +1,57 @@
1 +{
2 + description = "Non critical nixos org infra";
3 +
4 + inputs = {
5 + nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.05";
6 + colmena.url = "github:zhaofengli/colmena";
7 + flake-utils.url = "github:numtide/flake-utils";
8 + disko.url = "github:nix-community/disko";
9 + srvos.url = "github:numtide/srvos";
10 + };
11 +
12 + outputs = { self, nixpkgs, flake-utils, colmena, disko, srvos, ... }@inputs:
13 + let
14 + importConfig = path: (lib.mapAttrs (name: value: import (path + "/${name}/default.nix")) (lib.filterAttrs (_: v: v == "directory") (builtins.readDir path)));
15 + lib = nixpkgs.lib;
16 + in
17 + {
18 +
19 + nixosConfigurations = builtins.mapAttrs
20 + (name: value: nixpkgs.lib.nixosSystem {
21 + lib = lib;
22 + system = "x86_64-linux";
23 + specialArgs = {
24 + inherit inputs;
25 + };
26 + modules = [ value disko.nixosModules.disko ];
27 + extraModules = [ inputs.colmena.nixosModules.deploymentOptions ];
28 +
29 + })
30 + (importConfig ./hosts);
31 +
32 + colmena =
33 + {
34 + meta = {
35 + nixpkgs = import inputs.nixpkgs { system = "x86_64-linux"; };
36 + nodeNixpkgs = builtins.mapAttrs (_: v: v.pkgs) self.nixosConfigurations;
37 + nodeSpecialArgs = builtins.mapAttrs (_: v: v._module.specialArgs) self.nixosConfigurations;
38 + specialArgs.lib = lib;
39 + };
40 + } // builtins.mapAttrs
41 + (_: v: {
42 + imports = v._module.args.modules;
43 + })
44 + self.nixosConfigurations;
45 +
46 + } // flake-utils.lib.eachDefaultSystem (system:
47 + let pkgs = nixpkgs.legacyPackages.${system};
48 + in {
49 + devShell =
50 + pkgs.mkShell {
51 + buildInputs = [
52 + colmena.packages.${system}.colmena
53 + ];
54 + };
55 + });
56 +
57 +}
non-critical-infra/hosts/hetzner-01/default.nix new
+64
@@ -0,0 +1,64 @@
1 +{ config, pkgs, lib, inputs, ... }:
2 +
3 +{
4 + imports =
5 + [
6 + ./hardware.nix
7 + inputs.srvos.nixosModules.server
8 + inputs.srvos.nixosModules.hardware-hetzner-online-amd
9 + ];
10 +
11 +
12 + deployment = {
13 + targetHost = "65.109.26.213";
14 + targetUser = "root";
15 + };
16 +
17 + # Bootloader.
18 + boot.loader.grub.enable = true;
19 + boot.supportedFilesystems = [ "zfs" ];
20 + boot.loader.grub.mirroredBoots = [
21 + { path = "/boot-1"; devices = [ "/dev/disk/by-id/nvme-SAMSUNG_MZQL23T8HCLS-00A07_S64HNJ0T508051" ]; }
22 + { path = "/boot-2"; devices = [ "/dev/disk/by-id/nvme-SAMSUNG_MZQL23T8HCLS-00A07_S64HNJ0T508053" ]; }
23 + ];
24 + boot.loader.grub.useOSProber = true;
25 +
26 +
27 + networking.hostName = "hetzner-01"; # Define your hostname.
28 + networking.hostId = "745b334a";
29 +
30 + disko.devices = import ./disko.nix;
31 +
32 + # Set your time zone.
33 + time.timeZone = "UTC";
34 +
35 + environment.systemPackages = with pkgs; [
36 + neovim
37 + ];
38 +
39 + services.openssh.enable = true;
40 +
41 + networking.firewall.allowedTCPPorts = [ ];
42 + networking.firewall.allowedUDPPorts = [ ];
43 +
44 + systemd.network.networks."10-uplink".networkConfig.Address = "2a01:4f9:5a:186c::2";
45 +
46 + users.users.root.openssh.authorizedKeys.keyFiles = [
47 + (pkgs.fetchurl {
48 + url = "https://github.com/JulienMalka.keys";
49 + sha256 = "sha256-yH84N5aPt9MJDuvaDf9BvnM+z9yaUKYxU7W2Bf89174=";
50 + })
51 + (pkgs.fetchurl {
52 + url = "https://github.com/zimbatm.keys";
53 + sha256 = "sha256-QEOYK1aoF626VTTjlcFtY020NSCfiCnBRQfrNfl0j5s=";
54 + })
55 + (pkgs.fetchurl {
56 + url = "https://github.com/mweinelt.keys";
57 + sha256 = "sha256-gAD2jUc5SBWuuiRGgJEmb0I7rR/jti1FMxVuA0BtILk=";
58 + })
59 + ];
60 +
61 + system.stateVersion = "23.05";
62 +
63 +}
64 +
non-critical-infra/hosts/hetzner-01/disko.nix new
+80
@@ -0,0 +1,80 @@
1 +let
2 + partitions = [
3 + {
4 + name = "grub";
5 + start = "0";
6 + end = "1M";
7 + part-type = "primary";
8 + flags = [ "bios_grub" ];
9 + }
10 + {
11 + name = "boot";
12 + start = "1M";
13 + end = "1G";
14 + part-type = "primary";
15 + content = {
16 + type = "filesystem";
17 + format = "vfat";
18 + };
19 + }
20 + {
21 + name = "root";
22 + start = "1G";
23 + end = "100%";
24 + part-type = "primary";
25 + bootable = true;
26 + content = {
27 + type = "zfs";
28 + pool = "zroot";
29 + };
30 + }
31 + ];
32 +in
33 +{
34 + disk = {
35 + nvme0n1 = {
36 + type = "disk";
37 + device = "/dev/nvme0n1";
38 + content = {
39 + type = "table";
40 + format = "gpt";
41 + inherit partitions;
42 + };
43 + };
44 + nvme1n1 = {
45 + type = "disk";
46 + device = "/dev/nvme1n1";
47 + content = {
48 + type = "table";
49 + format = "gpt";
50 + inherit partitions;
51 + };
52 + };
53 + };
54 +
55 + zpool = {
56 + zroot = {
57 + type = "zpool";
58 + mode = "mirror";
59 + rootFsOptions = {
60 + compression = "lz4";
61 + "com.sun:auto-snapshot" = "true";
62 + mountpoint = "none";
63 + };
64 + datasets = {
65 + "root" = {
66 + type = "zfs_fs";
67 + options.mountpoint = "none";
68 + mountpoint = null;
69 + };
70 + "root/nixos" = {
71 + type = "zfs_fs";
72 + options.mountpoint = "/";
73 + mountpoint = "/";
74 + };
75 + };
76 + };
77 + };
78 +}
79 +
80 +
non-critical-infra/hosts/hetzner-01/hardware.nix new
+14
@@ -0,0 +1,14 @@
1 +{ config, lib, ... }:
2 +
3 +{
4 +
5 + boot.initrd.kernelModules = [ ];
6 + boot.kernelModules = [ ];
7 + boot.extraModulePackages = [ ];
8 +
9 + swapDevices = [ ];
10 +
11 + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
12 + hardware.cpu.amd.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
13 +}
14 +