depot/ops/nixos/blade-tuvok/default.nix

90 lines
2.3 KiB
Nix
Raw Normal View History

# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
#
# SPDX-License-Identifier: Apache-2.0
{ depot, lib, pkgs, rebuilder, config, ... }:
let
inherit (depot.ops) secrets;
in {
imports = [
../lib/blade.nix
];
boot.loader.grub.device = "/dev/disk/by-id/usb-USB_SanDisk_3.2Gen1_0101cabb1ebdbdc0fd7b18edd207d43717c39c4a59d1b138b363e315841eca15743400000000000000000000443273100087260091558107b6a8e06e-0:0";
# Networking!
networking = {
hostName = "blade-tuvok";
hostId = "525229f7";
2021-03-12 14:47:08 +00:00
interfaces.en-internet.ipv4.addresses = [{
address = "195.74.55.21";
prefixLength = 31;
}];
2021-03-12 14:47:08 +00:00
interfaces.en-internet.ipv6.addresses = [{
address = "2a03:ee40:8080:9:1::2";
prefixLength = 126;
}];
defaultGateway = "195.74.55.20";
defaultGateway6 = "2a03:ee40:8080:9:1::1";
2021-03-19 21:27:42 +00:00
firewall.allowedTCPPorts = [ 80 443 ];
2021-03-20 01:08:33 +00:00
firewall.extraCommands = "iptables -A INPUT -p vrrp -i br-mgmt -j ACCEPT";
};
my.ip.tailscale = "100.119.123.33";
2021-03-12 14:47:08 +00:00
my.blade.bay = 6;
my.blade.macAddress = {
internal = "e4:11:5b:ac:e3:fe";
storage = "e4:11:5b:ac:e4:02";
internet = "e4:11:5b:ac:e4:00";
};
2021-02-09 01:17:54 +00:00
services.ceph = {
mon.enable = true;
2021-02-09 22:29:11 +00:00
osd = {
enable = true;
daemons = [ "3" ];
};
2021-02-09 01:17:54 +00:00
};
2021-03-19 19:45:03 +00:00
services.nginx = {
enable = true;
recommendedTlsSettings = true;
recommendedGzipSettings = true;
virtualHosts."objdump.zxcvbnm.ninja" = {
useACMEHost = "objdump.zxcvbnm.ninja";
default = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://localhost:7480";
extraConfig = ''
proxy_redirect off;
client_max_body_size 0;
proxy_buffering off;
'';
};
};
};
security.acme = {
acceptTerms = true;
email = "letsencrypt@lukegb.com";
certs."objdump.zxcvbnm.ninja" = {
group = config.services.nginx.group;
dnsProvider = "cloudflare";
credentialsFile = secrets.cloudflareCredentials;
extraDomainNames = [
"*.objdump.zxcvbnm.ninja"
];
};
};
2021-03-20 01:08:33 +00:00
services.keepalived = {
enable = true;
vrrpInstances.mgmtGateway = {
interface = "br-mgmt";
state = "MASTER";
priority = 50;
virtualIps = [{ addr = "10.100.0.1/23"; }];
virtualRouterId = 1;
};
};
}