depot/ops/nixos/lib/common.nix

287 lines
9.8 KiB
Nix
Raw Normal View History

# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
#
# SPDX-License-Identifier: Apache-2.0
2020-10-25 11:36:16 +00:00
{ pkgs, config, depot, lib, rebuilder, ... }@args:
let
2022-01-04 14:00:45 +00:00
inherit (depot.ops) secrets;
2021-03-20 12:39:23 +00:00
switch-prebuilt = import ./switch-prebuilt.nix args;
# Default default priority is 1000; we use 900 here so we're higher priority,
# but lower priority than user-specified things. This is particularly
# important for our timezone setting, which otherwise conflicts with the one
# set by the Clickhouse module, which is used by e.g. bvm-logger.
mkDefault = lib.mkOverride 900;
in
{
2022-01-23 23:38:40 +00:00
imports = [
../../../third_party/home-manager/nixos
./vault-agent.nix
2022-03-06 22:26:49 +00:00
./vault-agent-acme.nix
2022-01-23 23:38:40 +00:00
];
options.my.specialisationName = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
};
2021-04-10 20:15:30 +00:00
options.my.rundeck.hostname = lib.mkOption {
type = lib.types.str;
default = config.networking.fqdn;
};
options.my.rundeck.expectedOnline = lib.mkOption {
type = lib.types.bool;
default = true;
};
options.my.rundeck.tags = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ "nixos" ];
};
2020-10-25 11:36:16 +00:00
options.my.home-manager.imports = lib.mkOption {
type = lib.types.listOf lib.types.path;
default = [ ./home-manager/common.nix ];
};
options.my.home-manager.system = lib.mkOption {
type = lib.types.nullOr lib.types.anything;
default = null;
2020-05-08 23:03:21 +00:00
};
options.my.prometheus.additionalExporterPorts = lib.mkOption {
type = lib.types.attrsOf lib.types.port;
default = {};
};
options.my.ip.tailscale = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = null;
};
options.my.deploy.enable = lib.mkOption {
type = lib.types.bool;
default = true;
};
options.my.deploy.args = lib.mkOption {
type = lib.types.str;
default = "";
};
2022-01-01 15:08:52 +00:00
options.my.scrapeJournal.enable = lib.mkOption {
type = lib.types.bool;
default = config.my.scrapeJournal.addr != null;
};
options.my.scrapeJournal.addr = lib.mkOption {
type = lib.types.nullOr lib.types.str;
default = if config.my.ip.tailscale == null then null else "${config.my.ip.tailscale}:19531";
2022-01-01 15:08:52 +00:00
};
2020-10-25 11:36:16 +00:00
config = {
hardware.enableRedistributableFirmware = true;
networking.search = [
2021-03-20 15:01:28 +00:00
"int.as205479.net"
"as205479.net"
];
services.resolved = {
enable = true;
2022-01-01 00:41:37 +00:00
llmnr = "false"; # LLMNR breaks search domains.
dnssec = "false"; # DNSSEC support in systemd-resolved is just broken.
domains = config.networking.search;
extraConfig = ''
# For global search domains to work, we also need global DNS servers.
DNS=8.8.8.8#dns.google [2001:4860:4860::8888]#dns.google 1.1.1.1#cloudflare-dns.com [2606:4700:4700::1111]#cloudflare-dns.com
'';
fallbackDns = [
"8.8.8.8"
"2001:4860:4860::8888"
"1.1.1.1"
"2606:4700:4700::1111"
];
};
my.rundeck.tags = [ "nixos" ];
2020-10-25 11:36:16 +00:00
nix = {
package = pkgs.nix_2_3; # Use a working nix.
nixPath = [ "depot=/home/lukegb/depot/" "nixpkgs=/home/lukegb/depot/third_party/nixpkgs/" ];
settings = {
trusted-users = [ "root" "@wheel" "deployer" ];
substituters = lib.mkForce [ "https://cache.nixos.org/" "s3://lukegb-nix-cache?endpoint=storage.googleapis.com&trusted=1" ];
trusted-substituters = lib.mkForce [ "https://cache.nixos.org/" "s3://lukegb-nix-cache?endpoint=storage.googleapis.com&trusted=1" ];
};
2020-10-25 11:36:16 +00:00
envVars = {
AWS_ACCESS_KEY_ID = "${depot.ops.secrets.nixCache.AWS_ACCESS_KEY_ID}";
AWS_SECRET_ACCESS_KEY = "${depot.ops.secrets.nixCache.AWS_SECRET_ACCESS_KEY}";
};
};
nixpkgs.config = depot.third_party.nixpkgsConfig;
documentation.nixos.enable = false; # I just use the website.
2020-10-25 11:36:16 +00:00
i18n.defaultLocale = "en_GB.UTF-8";
console.keyMap = "us";
2020-10-25 11:36:16 +00:00
time.timeZone = mkDefault "Etc/UTC";
2020-11-05 02:03:20 +00:00
zramSwap = {
enable = true;
memoryMax = 4 * 1024 * 1024 * 1024;
};
2020-10-25 11:36:16 +00:00
environment.systemPackages = with pkgs; [
2020-11-17 02:21:46 +00:00
vim rxvt_unicode.terminfo tmux rebuilder tailscale rsync libarchive tcpdump restic
2021-12-21 08:13:20 +00:00
alacritty.terminfo kitty.terminfo
2021-03-20 12:11:45 +00:00
iftop htop jq
2021-04-10 22:17:28 +00:00
depot.nix.pkgs.mercurial
2021-03-20 12:39:23 +00:00
switch-prebuilt
2020-10-25 11:36:16 +00:00
];
2022-01-08 21:45:18 +00:00
networking.useDHCP = false;
2020-10-25 11:36:16 +00:00
networking.firewall = {
allowPing = true;
logRefusedConnections = false;
};
2020-10-25 11:36:16 +00:00
2020-10-25 12:00:15 +00:00
environment.homeBinInPath = true;
security.pam.enableSSHAgentAuth = true;
2020-10-25 12:00:15 +00:00
2020-10-25 11:36:16 +00:00
users.mutableUsers = false;
users.users = let secrets = depot.ops.secrets; in {
root.hashedPassword = secrets.passwordHashes.root;
lukegb = {
isNormalUser = true;
uid = 1000;
extraGroups = [ "wheel" "audio" ];
2020-10-25 11:36:16 +00:00
hashedPassword = secrets.passwordHashes.lukegb;
openssh.authorizedKeys.keyFiles = [
../../secrets/lukegb_totoro.pub
../../secrets/lukegb_termius.pub
../../secrets/lukegb_porcorosso_win.pub
../../secrets/lukegb_porcorosso_wsl.pub
2020-11-03 15:25:03 +00:00
../../secrets/lukegb_porcorosso_linux.pub
../../secrets/lukegb_red_solo.pub
];
2020-10-25 11:36:16 +00:00
};
deployer = {
isSystemUser = true;
uid = 1001;
group = "deployer";
2020-10-25 11:36:16 +00:00
hashedPassword = "!";
useDefaultShell = true;
home = "/var/lib/deployer";
createHome = true;
openssh.authorizedKeys.keyFiles = [
../../secrets/deployer_ed25519.pub
../../secrets/rundeck_deployer_rsa.pub
2020-10-25 11:36:16 +00:00
];
};
2020-05-09 00:10:20 +00:00
};
users.groups.deployer = {};
2020-10-25 11:36:16 +00:00
security.sudo.extraRules = [{
users = [ "deployer" ];
commands = [{
command = "${rebuilder}/bin/rebuilder";
options = [ "NOPASSWD" ];
2021-03-20 12:39:23 +00:00
} {
command = "${switch-prebuilt}/bin/switch-prebuilt";
options = [ "NOPASSWD" ];
2020-10-25 11:36:16 +00:00
}];
2020-05-09 00:10:20 +00:00
}];
2020-10-25 11:36:16 +00:00
security.sudo.extraConfig = ''
Defaults:deployer !requiretty
'';
2020-10-25 11:36:16 +00:00
programs.mtr.enable = true;
services.openssh.enable = true;
services.tailscale.enable = true;
networking.firewall.interfaces.tailscale0 = {
# Just allow anything in on tailscale0.
allowedTCPPortRanges = [{ from = 0; to = 65535; }];
allowedUDPPortRanges = [{ from = 0; to = 65535; }];
};
2020-10-25 11:36:16 +00:00
boot = {
kernelModules = [ "tcp_bbr" ];
kernel.sysctl."net.ipv4.tcp_congestion_control" = "bbr";
kernel.sysctl."net.core.default_qdisc" = "fq_codel";
};
2020-10-25 11:36:16 +00:00
# Clean up daily.
nix.gc = {
automatic = mkDefault true;
2020-10-25 11:36:16 +00:00
dates = "*-*-* 05:00:00";
2021-03-19 21:29:54 +00:00
options = "--delete-older-than 7d";
2020-10-25 11:36:16 +00:00
};
home-manager.useUserPackages = true;
home-manager.useGlobalPkgs = true;
systemd.services."home-manager-lukegb" = {
before = [ "display-manager.service" ];
wantedBy = [ "multi-user.target" ];
};
2020-10-25 11:36:16 +00:00
home-manager.users.lukegb = { pkgs, ... }: ({
imports = [ ({
_module.args = args // {
configName = null;
};
2020-10-25 11:36:16 +00:00
})] ++ config.my.home-manager.imports ++ (
lib.optional (config.my.home-manager.system != null) config.my.home-manager.system
);
});
services.prometheus.exporters.node = {
enable = true;
enabledCollectors = [ "systemd" "textfile" ];
extraFlags = [
"--collector.textfile.directory=/run/prometheus-textfile-exports"
];
};
system.activationScripts.node-exporter = {
text = ''
test -d /run/prometheus-textfile-exports || mkdir /run/prometheus-textfile-exports
my_version_string="$(cat "$systemConfig/nixos-version")"
my_hash_string="$(readlink -f "$systemConfig" | ${pkgs.gnugrep}/bin/grep -Eo '\b[0-9a-df-np-sv-z]{32}\b')"
my_specialisation="$(cat "$systemConfig/specialisation-name" 2>/dev/null || true)"
echo "nixos_running_system{version=\"$my_version_string\", hash=\"$my_hash_string\", specialisation=\"$my_specialisation\"} 1" > /run/prometheus-textfile-exports/running_system.prom
my_version_string="$(cat "/run/booted-system/nixos-version")"
my_hash_string="$(readlink -f "/run/booted-system" | ${pkgs.gnugrep}/bin/grep -Eo '\b[0-9a-df-np-sv-z]{32}\b')"
my_specialisation="$(cat "/run/booted-system/specialisation-name" 2>/dev/null || true)"
echo "nixos_booted_system{version=\"$my_version_string\", hash=\"$my_hash_string\", specialisation=\"$my_specialisation\"} 1" > /run/prometheus-textfile-exports/booted_system.prom
'';
};
boot.postBootCommands = lib.mkAfter ''
test -d /run/prometheus-textfile-exports || mkdir /run/prometheus-textfile-exports
my_version_string="$(cat "/run/booted-system/nixos-version")"
my_hash_string="$(readlink -f "/run/booted-system" | ${pkgs.gnugrep}/bin/grep -Eo '\b[0-9a-df-np-sv-z]{32}\b')"
my_specialisation="$(cat "/run/booted-system/specialisation-name" 2>/dev/null || true)"
echo "nixos_booted_system{version=\"$my_version_string\", hash=\"$my_hash_string\", specialisation=\"$my_specialisation\"} 1" > /run/prometheus-textfile-exports/booted_system.prom
'';
system.extraSystemBuilderCmds = lib.mkAfter ''
echo "${if config.my.specialisationName == null then "" else config.my.specialisationName}" > $out/specialisation-name
'';
system.nixos.tags = lib.mkBefore ([
depot.version
] ++ lib.optional (config.my.specialisationName != null) "specialisation-${config.my.specialisationName}");
2021-01-19 23:41:47 +00:00
services.nginx = {
recommendedTlsSettings = true;
recommendedOptimisation = true;
recommendedGzipSettings = true;
recommendedProxySettings = true;
};
2021-01-30 18:47:12 +00:00
services.fwupd.enable = true;
2022-01-01 15:08:52 +00:00
# This is enabled independently of my.scrapeJournal.enable.
services.journald.enableHttpGateway = config.my.ip.tailscale != null;
systemd.sockets.systemd-journal-gatewayd.socketConfig = lib.optionalAttrs (config.my.ip.tailscale != null) {
2022-01-01 15:08:52 +00:00
ListenStream = [ "" "${config.my.ip.tailscale}:19531" ];
FreeBind = true;
};
};
2020-07-08 18:36:21 +00:00
}