depot/ops/nixos/rexxar/default.nix

# SPDX-FileCopyrightText: 2024 Luke Granger-Brown <depot@lukegb.com>
#
# SPDX-License-Identifier: Apache-2.0

{ depot, lib, pkgs, config, ... }:
{
  imports = [
    ../lib/zfs.nix
    ../lib/bgp.nix
  ];

  # Otherwise _this_ machine won't enumerate things properly.
  boot.zfs.devNodes = "/dev/disk/by-id";

  boot.initrd = {
    availableKernelModules = [
      "nvme"
      "xhci_pci"
      "ahci"
      "usb_storage"
      "usbhid"
      "sd_mod"
      "sr_mod"
    ];
    systemd.enable = true;
    systemd.services."zfs-import-zu2" = {
      after = [ "zfs-import-zboot.service" ];
      requires = [ "zfs-import-zboot.service" ];

      script = lib.mkBefore ''
        test -d /sysroot/persist || mount -t zfs zboot/local/root /sysroot
        test -f /sysroot/persist/zu2-key || mount -t zfs zboot/safe/persist /sysroot/persist
        ln -s /sysroot/persist /persist
      '';
    };
  };
  security.tpm2.enable = true;
  boot.kernelModules = [ "kvm-amd" ];
  hardware.cpu.amd.updateMicrocode = true;
  boot.kernelParams = [
    "nomodeset"
  ];
  environment.systemPackages = with pkgs; [
    clevis
  ];

  # Use the systemd-boot EFI boot loader.
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;

  powerManagement.cpuFreqGovernor = lib.mkDefault "performance";
  services.zfs.rollbackOnBoot = {
    enable = true;
    snapshot = "zboot/local/root@blank";
  };

  fileSystems = let
    zfs = device: {
      device = device;
      fsType = "zfs";
    };
  in {
    "/" = zfs "zboot/local/root";
    "/nix" = zfs "zboot/local/nix";
    "/persist" = zfs "zboot/safe/persist";

    "/store" = zfs "zu2/safe/store";
    "/home" = (zfs "zu2/safe/home") // { neededForBoot = true; };

    "/boot" = {
      device = "/dev/disk/by-label/ESP";
      fsType = "vfat";
    };
    "/boot2" = {
      device = "/dev/disk/by-label/ESP2";
      fsType = "vfat";
    };
  };
  boot.loader.systemd-boot.extraInstallCommands = ''
    rsync -a /boot/ /boot2/
  '';

  nix.settings.max-jobs = lib.mkDefault 8;

  # Networking!
  networking = {
    hostName = "rexxar";
    domain = "as205479.net";
    hostId = "b46c2ae9";
    useNetworkd = true;
  };
  systemd.network = {
    networks."10-enp9s0f0" = {
      matchConfig.Name = "enp9s0f0";
      networkConfig.VLAN = [ "vl-velox1" "vl-linx" ];
    };
    networks."10-enp9s0f1" = {
      matchConfig.Name = "enp9s0f1";
      networkConfig.VLAN = [ "vl-velox2" ];
    };
    netdevs."20-vl-velox1" = {
      netdevConfig = {
        Name = "vl-velox1";
        Kind = "vlan";
        MACAddress = "8C:1F:64:0B:6F:00";
      };
      vlanConfig = {
        Id = 100;
      };
    };
    networks."20-vl-velox1" = {
      matchConfig.Name = "vl-velox1";
      address = [
        "195.74.55.21/31"
        "2a03:ee40:8080:9:1::2/126"
      ];
      networkConfig.DNS = [
        "2001:4860:4860::8888"
        "2001:4860:4860::8844"
        "8.8.8.8"
        "8.8.4.4"
        "1.1.1.1"
      ];
      networkConfig.DNSDefaultRoute = true;
      routes = [{ routeConfig = {
        Gateway = "195.74.55.20";
      }; } { routeConfig = {
        Gateway = "2a03:ee40:8080:9:1::1";
      }; }];
    };
    netdevs."20-vl-velox2" = {
      netdevConfig = {
        Name = "vl-velox2";
        Kind = "vlan";
        MACAddress = "8C:1F:64:0B:6F:01";
      };
      vlanConfig = {
        Id = 100;
      };
    };
    networks."20-vl-velox2" = {
      matchConfig.Name = "vl-velox2";
      address = [
        "195.74.55.23/31"
        "2a03:ee40:8080:9:2::2/126"
      ];
      networkConfig.DNS = [
        "2001:4860:4860::8888"
        "2001:4860:4860::8844"
        "8.8.8.8"
        "8.8.4.4"
        "1.1.1.1"
      ];
      networkConfig.DNSDefaultRoute = true;
      routes = [{ routeConfig = {
        Gateway = "195.74.55.22";
      }; } { routeConfig = {
        Gateway = "2a03:ee40:8080:9:2::1";
      }; }];
    };
    netdevs."20-vl-linx" = {
      netdevConfig = {
        Name = "vl-linx";
        Kind = "vlan";
        MACAddress = "8C:1F:64:0B:6F:02";
      };
      vlanConfig = {
        Id = 200;
      };
    };
    networks."20-vl-linx" = {
      matchConfig.Name = "vl-linx";
      address = [
        "195.66.224.58/21"
        "2001:7f8:4::3:22a7:1/48"
      ];
      networkConfig = {
        IPv6LinkLocalAddressGenerationMode = "eui64";
        LLMNR = false;
        MulticastDNS = false;
        IPv6AcceptRA = false;
        IPv4ProxyARP = false;
        IPv6ProxyNDP = false;
        IPv6SendRA = false;
      };
    };
  };
  my.ip.tailscale = "100.97.110.48";
  my.ip.tailscale6 = "fd7a:115c:a1e0::3a01:6e30";
  #my.coredns.bind = [ "bond0" "tailscale0" "127.0.0.1" "::1" ];

  services.openssh.hostKeys = [
    {
      path = "/persist/etc/ssh/ssh_host_ed25519_key";
      type = "ed25519";
    }
    {
      path = "/persist/etc/ssh/ssh_host_rsa_key";
      type = "rsa";
      bits = 4096;
    }
  ];

  systemd.mounts = let
    bindMount' = dir: {
      unitConfig.RequiresMountsFor = dir;
      options = "bind";
      what = "/persist${dir}";
      where = dir;
    };
    bindMountSvc = dir: svc: (bindMount' dir) // {
      requiredBy = [svc];
      before = [svc];
      wantedBy = ["multi-user.target"];
    };
    bindMountSvcDynamic = dir: svc: (bindMount' "/var/lib/private/${dir}") // {
      requiredBy = [svc];
      before = [svc];
      wantedBy = ["multi-user.target"];
    };
    bindMount = dir: (bindMount' dir) // {
      wantedBy = ["multi-user.target"];
    };
  in [
    (bindMountSvc "/var/lib/tailscale" "tailscaled.service")
    (bindMountSvc "/var/lib/libvirt" "libvirt.service")
  ];

  system.stateVersion = "24.05";
}