134 lines
3.4 KiB
Nix
134 lines
3.4 KiB
Nix
# SPDX-FileCopyrightText: 2020 Luke Granger-Brown <depot@lukegb.com>
|
|
#
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
{ depot, lib, pkgs, rebuilder, config, ... }:
|
|
let
|
|
inherit (depot.ops) secrets;
|
|
|
|
internetAddresses = {
|
|
v4 = { local = "195.74.55.21"; remote = "195.74.55.20"; };
|
|
v6 = {
|
|
local = "2a03:ee40:8080:9:1::2";
|
|
remote = "2a03:ee40:8080:9:1::1";
|
|
};
|
|
};
|
|
in {
|
|
imports = [
|
|
../lib/bgp.nix
|
|
../lib/blade.nix
|
|
../lib/fup.nix
|
|
];
|
|
|
|
boot.loader.grub.device = "/dev/disk/by-id/usb-USB_SanDisk_3.2Gen1_0101cabb1ebdbdc0fd7b18edd207d43717c39c4a59d1b138b363e315841eca15743400000000000000000000443273100087260091558107b6a8e06e-0:0";
|
|
|
|
services.lukegbgp = {
|
|
enable = true;
|
|
config = {
|
|
local.routerID = internetAddresses.v4.local;
|
|
peering.veloxserv = {
|
|
local = {
|
|
asn = 205479;
|
|
v4 = internetAddresses.v4.local;
|
|
v6 = internetAddresses.v6.local;
|
|
};
|
|
remote = {
|
|
asn = 3170;
|
|
export_community = 4001;
|
|
routers = [{ v4 = internetAddresses.v4.remote; v6 = internetAddresses.v6.remote; }];
|
|
};
|
|
};
|
|
export.v4 = [ "92.118.28.0/24" ];
|
|
export.v6 = [ "2a09:a441::/32" ];
|
|
};
|
|
};
|
|
|
|
# Networking!
|
|
networking = {
|
|
hostName = "blade-tuvok";
|
|
hostId = "525229f7";
|
|
interfaces.br-public.ipv4.addresses = [{
|
|
address = "92.118.28.253";
|
|
prefixLength = 24;
|
|
}];
|
|
interfaces.br-public.ipv6.addresses = [{
|
|
address = "2a09:a441::fffe";
|
|
prefixLength = 48;
|
|
}];
|
|
interfaces.en-internet.ipv4.addresses = [{
|
|
address = internetAddresses.v4.local;
|
|
prefixLength = 31;
|
|
}];
|
|
interfaces.en-internet.ipv6.addresses = [{
|
|
address = internetAddresses.v6.local;
|
|
prefixLength = 126;
|
|
}];
|
|
defaultGateway = internetAddresses.v4.remote;
|
|
defaultGateway6 = internetAddresses.v6.remote;
|
|
firewall.allowedTCPPorts = [ 80 443 ];
|
|
firewall.extraCommands = "iptables -A INPUT -p vrrp -i br-mgmt -j ACCEPT";
|
|
};
|
|
my.ip.tailscale = "100.119.123.33";
|
|
my.blade.bay = 6;
|
|
my.blade.macAddress = {
|
|
internal = "e4:11:5b:ac:e3:fe";
|
|
storage = "e4:11:5b:ac:e4:02";
|
|
internet = "e4:11:5b:ac:e4:00";
|
|
};
|
|
|
|
services.ceph = {
|
|
mon.enable = true;
|
|
osd = {
|
|
enable = true;
|
|
daemons = [ "3" ];
|
|
};
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
recommendedTlsSettings = true;
|
|
recommendedGzipSettings = true;
|
|
virtualHosts."objdump.zxcvbnm.ninja" = {
|
|
useACMEHost = "objdump.zxcvbnm.ninja";
|
|
default = true;
|
|
forceSSL = true;
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:7480";
|
|
extraConfig = ''
|
|
proxy_redirect off;
|
|
client_max_body_size 0;
|
|
proxy_buffering off;
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
email = "letsencrypt@lukegb.com";
|
|
certs."objdump.zxcvbnm.ninja" = {
|
|
group = config.services.nginx.group;
|
|
dnsProvider = "cloudflare";
|
|
credentialsFile = secrets.cloudflareCredentials;
|
|
extraDomainNames = [
|
|
"*.objdump.zxcvbnm.ninja"
|
|
];
|
|
};
|
|
};
|
|
my.fup.listen = [
|
|
"0.0.0.0" "[::]"
|
|
];
|
|
|
|
services.keepalived = {
|
|
enable = true;
|
|
vrrpInstances.mgmtGateway = {
|
|
interface = "br-mgmt";
|
|
state = "MASTER";
|
|
priority = 50;
|
|
virtualIps = [
|
|
{ addr = "10.100.0.1/23"; }
|
|
{ addr = "92.118.28.1/24"; dev = "br-public"; }
|
|
];
|
|
virtualRouterId = 1;
|
|
};
|
|
};
|
|
}
|