depot/ops/nixos/cofractal-ams01/default.nix

172 lines
3.9 KiB
Nix
Raw Normal View History

2023-01-17 22:09:48 +00:00
# SPDX-FileCopyrightText: 2023 Luke Granger-Brown <depot@lukegb.com>
#
# SPDX-License-Identifier: Apache-2.0
{ depot, lib, pkgs, config, ... }:
{
imports = [
../lib/zfs.nix
2023-01-18 23:41:42 +00:00
../lib/bgp.nix
2023-03-09 21:33:42 +00:00
../lib/nixbuild-distributed.nix
../lib/gitlab-runner-cacher.nix
2023-01-17 22:09:48 +00:00
];
2023-01-18 21:43:48 +00:00
# Otherwise _this_ machine won't enumerate things properly.
boot.zfs.devNodes = "/dev/disk/by-id";
2023-01-17 22:09:48 +00:00
boot.initrd = {
availableKernelModules = [
2023-01-18 21:43:48 +00:00
"nvme"
"xhci_pci"
2023-01-17 22:09:48 +00:00
"ahci"
"usb_storage"
2023-01-18 21:43:48 +00:00
"usbhid"
2023-01-17 22:09:48 +00:00
"sd_mod"
"sr_mod"
];
};
boot.kernelModules = [ "kvm-amd" ];
2023-01-18 21:43:48 +00:00
hardware.cpu.amd.updateMicrocode = true;
2023-01-17 22:09:48 +00:00
# Use the systemd-boot EFI boot loader.
boot.loader.systemd-boot.enable = true;
boot.loader.efi.canTouchEfiVariables = true;
2023-01-18 21:43:48 +00:00
boot.blacklistedKernelModules = [ "ib_core" "irdma" ];
2023-01-17 22:09:48 +00:00
powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
services.zfs.rollbackOnBoot = {
enable = true;
2023-01-18 21:43:48 +00:00
snapshot = "zfast/local/root@blank";
2023-01-17 22:09:48 +00:00
};
fileSystems = let
zfs = device: {
device = device;
fsType = "zfs";
};
in {
2023-01-18 21:43:48 +00:00
"/" = zfs "zfast/local/root";
"/nix" = zfs "zfast/local/nix";
"/tmp" = zfs "zfast/local/tmp";
2023-01-17 22:09:48 +00:00
2023-01-18 21:43:48 +00:00
"/persist" = zfs "zfast/safe/persist";
"/home" = (zfs "zslow/safe/home") // { neededForBoot = true; };
2023-01-17 22:09:48 +00:00
"/boot" = {
2023-01-18 21:43:48 +00:00
device = "/dev/disk/by-label/ESP";
fsType = "vfat";
};
"/boot2" = {
device = "/dev/disk/by-label/ESP2";
2023-01-17 22:09:48 +00:00
fsType = "vfat";
};
};
2023-01-18 21:43:48 +00:00
boot.loader.systemd-boot.extraInstallCommands = ''
rsync -a /boot/ /boot2/
'';
2023-01-17 22:09:48 +00:00
nix.settings.max-jobs = lib.mkDefault 8;
# Networking!
networking = {
hostName = "cofractal-ams01";
domain = "as205479.net";
hostId = "a1cf1a9f";
useNetworkd = true;
nameservers = [
"2001:4860:4860::8888"
"2001:4860:4860::8844"
"8.8.8.8"
"8.8.4.4"
];
2023-01-18 21:43:48 +00:00
bonds.bond0 = {
interfaces = [ "enp45s0f0" "enp45s0f1" ];
driverOptions = {
miimon = "100";
mode = "802.3ad";
};
2023-01-17 22:09:48 +00:00
};
2023-01-18 21:43:48 +00:00
defaultGateway6.address = "2a09:a446:1337:ffff::1";
interfaces.bond0 = {
ipv6.addresses = [
{ address = "2a09:a446:1337::10"; prefixLength = 64; }
{ address = "2a09:a446:1337:ffff::10"; prefixLength = 120; }
];
ipv4.addresses = [
{ address = "199.19.152.160"; prefixLength = 30; }
];
2023-01-17 22:09:48 +00:00
};
};
2023-01-18 21:43:48 +00:00
my.ip.tailscale = "100.94.187.27";
my.ip.tailscale6 = "fd7a:115c:a1e0:ab12:4843:cd96:625e:bb1b";
2023-01-17 22:09:48 +00:00
services.openssh.hostKeys = [
{
path = "/persist/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
{
path = "/persist/etc/ssh/ssh_host_rsa_key";
type = "rsa";
bits = 4096;
}
];
systemd.mounts = let
bindMount' = dir: {
unitConfig.RequiresMountsFor = dir;
options = "bind";
what = "/persist${dir}";
where = dir;
};
bindMountSvc = dir: svc: (bindMount' dir) // {
bindsTo = [svc];
partOf = [svc];
};
bindMountSvcDynamic = dir: svc: (bindMount' "/var/lib/private/${dir}") // {
requiredBy = [svc];
before = [svc];
wantedBy = ["multi-user.target"];
};
bindMount = dir: (bindMount' dir) // {
wantedBy = ["multi-user.target"];
};
in [
(bindMountSvc "/var/lib/tailscale" "tailscaled.service")
];
2023-01-18 23:41:42 +00:00
services.lukegbgp = let
local.asn = 205479;
in {
enable = true;
config = {
local = {
routerID = "199.19.152.160";
};
export.v4 = [ ];
export.v6 = [ "2a09:a446:1337::/48" ];
2023-01-18 23:41:42 +00:00
peering.cofractal = {
local = local // {
v6 = "2a09:a446:1337:ffff::10";
};
v4onv6 = true;
2023-01-18 23:41:42 +00:00
remote = {
asn = 26073;
export_community = 6000;
routers = [{
v6 = "2a09:a446:1337:ffff::2";
} {
v6 = "2a09:a446:1337:ffff::3";
}];
};
};
};
};
boot.binfmt.emulatedSystems = [ "aarch64-linux" ];
2023-01-17 22:09:48 +00:00
system.stateVersion = "23.05";
}