bastion: expose the nixos config
This allows to deploy the machine with: nixos-rebuild --target-host bastion.nixos.org --flake .#bastion \ --use-remote-sudo switch Set the bastion as a trusted user to allow copy-closure.
zimbatm committed
Sep 8, 2021 at 17:44 UTC
fbdb021e651ef4799e6a92596fdd70d1a365b1a2
4 files changed
+101
-65
bastion/configuration.nix
new
+82
@@ -0,0 +1,82 @@
1
+flakes @ { self, nixpkgs, nix, nixops, nixos-channel-scripts }:
2
+
3
+{ config, lib, pkgs, ... }:
4
+let
5
+ sshKeys = import ../ssh-keys.nix;
6
+in
7
+{
8
+ imports = [
9
+ ../modules/common.nix
10
+ ../modules/hydra-mirror.nix
11
+ ../modules/prometheus
12
+ ../modules/tarball-mirror.nix
13
+ ../modules/wireguard.nix
14
+ ];
15
+
16
+ networking.hostName = "bastion";
17
+
18
+ system.configurationRevision = flakes.self.rev
19
+ or (throw "Cannot deploy from an unclean source tree!");
20
+
21
+ nix.registry.nixpkgs.flake = flakes.nixpkgs;
22
+ nix.nixPath = [ "nixpkgs=${flakes.nixpkgs}" ];
23
+ nix.trustedUsers = [ "deploy" ];
24
+
25
+ nixpkgs.overlays = [
26
+ nix.overlay
27
+ nixops.overlay
28
+ nixos-channel-scripts.overlay
29
+ ];
30
+
31
+ users.extraUsers.tarball-mirror.openssh.authorizedKeys.keys = [ sshKeys.eelco ];
32
+
33
+ users.extraUsers.deploy = {
34
+ description = "NixOps deployments";
35
+ isNormalUser = true;
36
+ openssh.authorizedKeys.keys =
37
+ [ sshKeys.eelco sshKeys.rob sshKeys.graham sshKeys.zimbatm sshKeys.amine ];
38
+ extraGroups = [ "wheel" ];
39
+ };
40
+
41
+ security.sudo.wheelNeedsPassword = false;
42
+
43
+ environment.systemPackages = [
44
+ pkgs.awscli
45
+ pkgs.nixops
46
+ pkgs.terraform-full
47
+ pkgs.tmux
48
+ ];
49
+
50
+ nix.gc.automatic = true;
51
+ nix.gc.dates = "daily";
52
+ nix.gc.options = ''--max-freed "$((30 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
53
+
54
+ services.openssh.enable = true;
55
+
56
+ # Temporary hack until we have proper users/roles.
57
+ services.openssh.extraConfig = ''
58
+ AcceptEnv AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY FASTLY_API_KEY GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL GIT_COMMITTER_NAME GIT_COMMITTER_EMAIL
59
+ '';
60
+
61
+ boot.loader.grub.enable = true;
62
+ boot.loader.grub.device = "/dev/disk/by-label/nixos";
63
+
64
+ fileSystems."/" = {
65
+ fsType = "ext4";
66
+ device = "/dev/disk/by-label/nixos";
67
+ };
68
+
69
+ fileSystems."/scratch" = {
70
+ autoFormat = true;
71
+ fsType = "ext4";
72
+ device = "/dev/nvme1n1";
73
+ };
74
+
75
+ # work around releases taking too much memory
76
+ swapDevices = [{ device = "/scratch/swapfile"; size = 32 * 1024; }];
77
+
78
+ # avoid swap as much as possible
79
+ boot.kernel.sysctl."vm.swappiness" = lib.mkDefault 0;
80
+
81
+ systemd.tmpfiles.rules = [ "d /scratch/hydra-mirror 0755 hydra-mirror users 10d" ];
82
+}
bastion/deploy.sh
new
+9
@@ -0,0 +1,9 @@
1
+#!/usr/bin/env bash
2
+#
3
+# Temporary deploy script to work around NixOps.
4
+#
5
+nixos-rebuild \
6
+ --flake ".#bastion" \
7
+ --target-host bastion.nixos.org \
8
+ --use-remote-sudo \
9
+ "$@"
bastion/flake.nix
+6
-2
@@ -6,11 +6,15 @@
6
inputs.nixops.inputs.nixpkgs.follows = "nixpkgs";
7
inputs.nix.inputs.nixpkgs.follows = "nixpkgs";
8
9
- outputs = { self, nixpkgs, nix, nixops, nixos-channel-scripts }: {
9
+ outputs = flakes @ { self, nixpkgs, nix, nixops, nixos-channel-scripts }: {
10
+ nixosConfigurations.bastion = nixpkgs.lib.nixosSystem {
11
+ system = "x86_64-linux";
12
+ modules = [ (import ./configuration.nix flakes) ];
13
+ };
14
15
nixopsConfigurations.default =
16
{ inherit nixpkgs; }
13
- // import ./network.nix { inherit self nixpkgs nix nixops nixos-channel-scripts; };
17
+ // import ./network.nix flakes;
18
19
};
20
}
bastion/network.nix
+4
-63
@@ -117,69 +117,10 @@ in
117
deployment.ec2.ebsInitialRootDiskSize = 40;
118
deployment.ec2.elasticIPv4 = resources.elasticIPs."bastion.nixos.org";
119
120
- imports =
121
- [ ../modules/common.nix
122
- ../modules/wireguard.nix
123
- ../modules/prometheus
124
- ../modules/tarball-mirror.nix
125
- ../modules/hydra-mirror.nix
126
- ];
120
+ imports = [ self.nixosConfigurations.bastion ];
121
128
- system.configurationRevision = flakes.self.rev
129
- or (throw "Cannot deploy from an unclean source tree!");
130
-
131
- nix.registry.nixpkgs.flake = flakes.nixpkgs;
132
- nix.nixPath = [ "nixpkgs=${flakes.nixpkgs}" ];
133
-
134
- nixpkgs.overlays =
135
- [ nix.overlay
136
- nixops.overlay
137
- nixos-channel-scripts.overlay
138
- ];
139
-
140
- users.extraUsers.tarball-mirror.openssh.authorizedKeys.keys = [ sshKeys.eelco ];
141
-
142
- users.extraUsers.deploy =
143
- { description = "NixOps deployments";
144
- isNormalUser = true;
145
- openssh.authorizedKeys.keys =
146
- [ sshKeys.eelco sshKeys.rob sshKeys.graham sshKeys.zimbatm sshKeys.amine ];
147
- extraGroups = [ "wheel" ];
148
- };
149
-
150
- security.sudo.wheelNeedsPassword = false;
151
-
152
- environment.systemPackages =
153
- [ pkgs.nixops
154
- pkgs.awscli
155
- pkgs.tmux
156
- pkgs.terraform-full
157
- ];
158
-
159
- nix.gc.automatic = true;
160
- nix.gc.dates = "daily";
161
- nix.gc.options = ''--max-freed "$((30 * 1024**3 - 1024 * $(df -P -k /nix/store | tail -n 1 | ${pkgs.gawk}/bin/awk '{ print $4 }')))"'';
162
-
163
-
164
- # Temporary hack until we have proper users/roles.
165
- services.openssh.extraConfig =
166
- ''
167
- AcceptEnv AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY FASTLY_API_KEY GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL GIT_COMMITTER_NAME GIT_COMMITTER_EMAIL
168
- '';
169
-
170
- fileSystems."/scratch" =
171
- { autoFormat = true;
172
- fsType = "ext4";
173
- device = "/dev/nvme1n1";
174
- ec2.disk = resources.ebsVolumes.scratch;
175
- };
176
-
177
- # work around releases taking too much memory
178
- swapDevices = [{device = "/scratch/swapfile"; size = 32 * 1024; }];
179
-
180
- # avoid swap as much as possible
181
- boot.kernel.sysctl."vm.swappiness" = lib.mkDefault 0;
182
-
183
- systemd.tmpfiles.rules = [ "d /scratch/hydra-mirror 0755 hydra-mirror users 10d" ];
122
+ fileSystems."/scratch" = {
123
+ ec2.disk = resources.ebsVolumes.scratch;
124
+ };
125
};
126
}