Add bastion server
Eelco Dolstra committed
Jul 4, 2018 at 15:59 UTC
fcda2b490c3ef76f6c48ab305488590730ef281a
2 files changed
+96
bastion/network.nix
new
+95
@@ -0,0 +1,95 @@
1
+let
2
+ region = "eu-west-1";
3
+ zone = "eu-west-1a";
4
+ accessKeyId = "lb-nixos";
5
+in
6
+
7
+{
8
+ resources.ec2KeyPairs.default =
9
+ { inherit region accessKeyId;
10
+ };
11
+
12
+ resources.vpc.bastion-vpc =
13
+ {
14
+ inherit region accessKeyId;
15
+ instanceTenancy = "default";
16
+ enableDnsSupport = true;
17
+ enableDnsHostnames = true;
18
+ cidrBlock = "10.0.0.0/16";
19
+ };
20
+
21
+ resources.vpcSubnets.bastion-subnet =
22
+ { resources, lib, ... }:
23
+ {
24
+ inherit region zone accessKeyId;
25
+ vpcId = resources.vpc.bastion-vpc;
26
+ cidrBlock = "10.0.0.0/19";
27
+ mapPublicIpOnLaunch = true;
28
+ };
29
+
30
+ resources.ec2SecurityGroups.bastion-sg =
31
+ { resources, lib, ... }:
32
+ {
33
+ inherit region accessKeyId;
34
+ vpcId = resources.vpc.bastion-vpc;
35
+ rules =
36
+ [ { toPort = 22; fromPort = 22; sourceIp = "213.125.166.74/32"; } # Utrecht office
37
+ { toPort = 22; fromPort = 22; sourceIp = "131.180.119.77/32"; } # wendy
38
+ ];
39
+ };
40
+
41
+ resources.vpcRouteTables.bastion-route-table =
42
+ { resources, ... }:
43
+ {
44
+ inherit region accessKeyId;
45
+ vpcId = resources.vpc.bastion-vpc;
46
+ };
47
+
48
+ resources.vpcRouteTableAssociations.bastion-assoc =
49
+ { resources, ... }:
50
+ {
51
+ inherit region accessKeyId;
52
+ subnetId = resources.vpcSubnets.bastion-subnet;
53
+ routeTableId = resources.vpcRouteTables.bastion-route-table;
54
+ };
55
+
56
+ resources.vpcInternetGateways.bastion-igw =
57
+ { resources, ... }:
58
+ {
59
+ inherit region accessKeyId;
60
+ vpcId = resources.vpc.bastion-vpc;
61
+ };
62
+
63
+ resources.vpcRoutes.bastion-route =
64
+ { resources, ... }:
65
+ {
66
+ inherit region accessKeyId;
67
+ routeTableId = resources.vpcRouteTables.bastion-route-table;
68
+ destinationCidrBlock = "0.0.0.0/0";
69
+ gatewayId = resources.vpcInternetGateways.bastion-igw;
70
+ };
71
+
72
+ resources.elasticIPs."bastion.nixos.org" =
73
+ { inherit region accessKeyId;
74
+ vpc = true;
75
+ };
76
+
77
+ bastion =
78
+ { config, pkgs, resources, ... }:
79
+
80
+ { deployment.targetEnv = "ec2";
81
+ deployment.ec2.tags.Name = "NixOS.org Infrastructure Deployment Server";
82
+ deployment.owners = [ "edolstra@gmail.com" "rob.vermaas@gmail.com" ];
83
+ deployment.ec2.region = region;
84
+ deployment.ec2.zone = zone;
85
+ deployment.ec2.instanceType = "t2.medium";
86
+ deployment.ec2.accessKeyId = accessKeyId;
87
+ deployment.ec2.keyPair = resources.ec2KeyPairs.default;
88
+ deployment.ec2.securityGroups = [];
89
+ deployment.ec2.securityGroupIds = [ resources.ec2SecurityGroups.bastion-sg.name ];
90
+ deployment.ec2.subnetId = resources.vpcSubnets.bastion-subnet;
91
+ deployment.ec2.associatePublicIpAddress = true;
92
+ deployment.ec2.ebsInitialRootDiskSize = 40;
93
+ deployment.ec2.elasticIPv4 = resources.elasticIPs."bastion.nixos.org";
94
+ };
95
+}
nixos-org/network.nix
+1
@@ -28,6 +28,7 @@ in
28
29
resources.elasticIPs."nixos.org" =
30
{ inherit region accessKeyId;
31
+ vpc = true;
32
};
33
34
resources.ec2KeyPairs.default =