392 lines
12 KiB
Nix
392 lines
12 KiB
Nix
{
|
|
description = "Nix flake for my infrastructure";
|
|
inputs = {
|
|
agenix.url = "github:ryantm/agenix?rev=3a56735779db467538fb2e577eda28a9daacaca6";
|
|
terranix.url = "github:terranix/terranix";
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
|
|
nixinate.url = "github:matthewcroughan/nixinate";
|
|
nixos-dns.url = "github:Janik-Haag/nixos-dns";
|
|
nixos-dns.inputs.nixpkgs.follows = "nixpkgs";
|
|
nixpkgs-wayland = {
|
|
url = "github:nix-community/nixpkgs-wayland";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
home-manager = {
|
|
url = "github:nix-community/home-manager";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
nixos-generators = {
|
|
url = "github:nix-community/nixos-generators";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
alertmanager-ntfy.url = "github:alexbakker/alertmanager-ntfy";
|
|
kubenix.url = "github:hall/kubenix";
|
|
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
|
|
lix = {
|
|
url = "git+https://git@git.lix.systems/lix-project/lix?ref=refs/tags/2.90-beta.1";
|
|
flake = false;
|
|
};
|
|
lix-module = {
|
|
url = "git+https://git.lix.systems/lix-project/nixos-module";
|
|
inputs.lix.follows = "lix";
|
|
inputs.nixpkgs.follows = "nixpkgs";
|
|
};
|
|
emacs-overlay.url = "github:nix-community/emacs-overlay";
|
|
};
|
|
|
|
outputs = {
|
|
self,
|
|
nixpkgs,
|
|
lix-module,
|
|
nixos-generators,
|
|
nixinate,
|
|
home-manager,
|
|
agenix,
|
|
terranix,
|
|
alertmanager-ntfy,
|
|
nixpkgs-wayland,
|
|
nixos-dns,
|
|
nixos-hardware,
|
|
emacs-overlay,
|
|
...
|
|
} @ inputs: let
|
|
system = "x86_64-linux";
|
|
pkgs = import nixpkgs {
|
|
inherit system;
|
|
config.allowUnfree = true;
|
|
overlays = [emacs-overlay.overlay nixpkgs-wayland.overlay];
|
|
};
|
|
tf = terranix.lib.terranixConfiguration {
|
|
system = "x86_64-linux";
|
|
modules = [./terraform/main.nix];
|
|
};
|
|
dnsConfig = {
|
|
extraConfig = import ./dns/dns.nix;
|
|
};
|
|
generate = nixos-dns.utils.generate nixpkgs.legacyPackages.x86_64-linux;
|
|
octodns-cloudflare = pkgs.python311Packages.buildPythonPackage rec {
|
|
pname = "octodns-cloudflare";
|
|
version = "0.0.4";
|
|
src = pkgs.fetchFromGitHub {
|
|
owner = "octodns";
|
|
repo = pname;
|
|
rev = "main";
|
|
sha256 = "sha256-cBdR6LCIivR4L9PePy5ZOOhV/JdanlujWgueCQma9fo=";
|
|
};
|
|
doCheck = false;
|
|
propagatedBuildInputs = with pkgs.python3Packages; [
|
|
pyyaml
|
|
certifi
|
|
charset-normalizer
|
|
dnspython
|
|
fqdn
|
|
idna
|
|
natsort
|
|
pkgs.octodns
|
|
requests
|
|
python-dateutil
|
|
six
|
|
urllib3
|
|
# Specify dependencies
|
|
];
|
|
};
|
|
in {
|
|
devShells.x86_64-linux.default = with pkgs;
|
|
mkShell {
|
|
nativeBuildInputs = [
|
|
jq
|
|
opentofu
|
|
kubectl
|
|
k9s
|
|
terraform-ls
|
|
kubernetes-helm
|
|
nil
|
|
talosctl
|
|
dogdns
|
|
(octodns.withProviders (ps: [
|
|
octodns-providers.bind
|
|
octodns-cloudflare
|
|
]))
|
|
];
|
|
buildInputs = [];
|
|
};
|
|
dnsDebugConfig = nixos-dns.utils.debug.config dnsConfig;
|
|
|
|
packages.aarch64-linux = {
|
|
raspberry-pi = nixos-generators.nixosGenerate {
|
|
system = "aarch64-linux";
|
|
modules = [
|
|
(nixpkgs + "/nixos/modules/installer/sd-card/sd-image-aarch64-installer.nix")
|
|
./pi-imgs/pi-initial.nix
|
|
];
|
|
format = "sd-aarch64-installer";
|
|
};
|
|
};
|
|
packages.x86_64-linux = {
|
|
nextdns-rewrites = pkgs.writeText "$out" (
|
|
builtins.toJSON (
|
|
((pkgs.callPackage ./dns/nextdns.nix) {}).data
|
|
)
|
|
);
|
|
dns = generate.octodnsConfig {
|
|
inherit dnsConfig;
|
|
config = {
|
|
processors = {
|
|
ttl-to-proxy = {
|
|
class = "octodns_cloudflare.processor.ttl.TtlToProxy";
|
|
ttl = 0;
|
|
};
|
|
};
|
|
providers = {
|
|
config = {
|
|
check_origin = false;
|
|
};
|
|
cloudflare = {
|
|
class = "octodns_cloudflare.CloudflareProvider";
|
|
token = "env/CLOUDFLARE_API_TOKEN";
|
|
min_ttl = 0;
|
|
update_pcent_threshold = 0.5;
|
|
delete_pcent_threshold = 0.5;
|
|
auto_ttl_target = 300;
|
|
};
|
|
};
|
|
};
|
|
zones = {
|
|
"gmem.ca." = {
|
|
processors = ["ttl-to-proxy"];
|
|
sources = ["config"];
|
|
targets = ["cloudflare"];
|
|
};
|
|
};
|
|
};
|
|
};
|
|
apps =
|
|
nixinate.nixinate.x86_64-linux self
|
|
// {
|
|
x86_64-linux = {
|
|
nextdns = {
|
|
type = "app";
|
|
program = toString (pkgs.writers.writePython3 "nextdns" {
|
|
libraries = [
|
|
pkgs.python3Packages.requests
|
|
];
|
|
flakeIgnore = ["E501"];
|
|
}
|
|
''
|
|
import json
|
|
import requests
|
|
import os
|
|
|
|
auth = os.getenv("NEXTDNS_API_KEY")
|
|
|
|
with open('${self.packages.x86_64-linux.nextdns-rewrites}', 'r') as file:
|
|
rewrites = json.load(file)
|
|
|
|
for profile in rewrites:
|
|
for rewrite in rewrites[profile]:
|
|
req = requests.post(
|
|
f'https://api.nextdns.io/profiles/{profile}/rewrites', data=json.dumps(rewrite),
|
|
headers={'X-Api-Key': auth, 'Content-Type': 'application/json'}
|
|
)
|
|
print(f'done {rewrite["name"]} -> {rewrite["content"]}')
|
|
'');
|
|
};
|
|
|
|
dns = {
|
|
type = "app";
|
|
program = toString (pkgs.writers.writeBash "diff" ''
|
|
set -o allexport
|
|
source .env.tf set
|
|
set +o allexport
|
|
${pkgs.octodns.withProviders (ps: [
|
|
pkgs.octodns-providers.bind
|
|
octodns-cloudflare
|
|
])}/bin/octodns-sync --config-file ${self.packages.x86_64-linux.dns}
|
|
'');
|
|
};
|
|
dns-do = {
|
|
type = "app";
|
|
program = toString (pkgs.writers.writeBash "diff" ''
|
|
set -o allexport
|
|
source .env.tf set
|
|
set +o allexport
|
|
${pkgs.octodns.withProviders (ps: [
|
|
pkgs.octodns-providers.bind
|
|
octodns-cloudflare
|
|
])}/bin/octodns-sync --config-file ${self.packages.x86_64-linux.dns} --doit
|
|
'');
|
|
};
|
|
tf-plan = {
|
|
type = "app";
|
|
program = toString (pkgs.writers.writeBash "plan" ''
|
|
if [[ -e terraform/config.tf.json ]]; then rm -f terraform/config.tf.json; fi
|
|
cp ${tf} terraform/config.tf.json \
|
|
&& ${pkgs.opentofu}/bin/tofu -chdir=terraform init \
|
|
&& ${pkgs.opentofu}/bin/tofu -chdir=terraform plan -out=plan.out
|
|
'');
|
|
};
|
|
tf-apply = {
|
|
type = "app";
|
|
program = toString (pkgs.writers.writeBash "apply" ''
|
|
if [[ -e terraform/config.tf.json ]]; then rm -f terraform/config.tf.json; fi
|
|
cp ${tf} terraform/config.tf.json \
|
|
&& ${pkgs.opentofu}/bin/tofu -chdir=terraform init \
|
|
&& ${pkgs.opentofu}/bin/tofu -chdir=terraform apply plan.out
|
|
'');
|
|
};
|
|
};
|
|
};
|
|
|
|
homeConfigurations."gsimmer" = home-manager.lib.homeManagerConfiguration {
|
|
inherit pkgs;
|
|
modules = [./nix/london/gsimmer.nix];
|
|
};
|
|
nixosConfigurations = {
|
|
london = nixpkgs.lib.nixosSystem {
|
|
inherit system pkgs;
|
|
modules = [
|
|
lix-module.nixosModules.default
|
|
(import ./nix/london/configuration.nix)
|
|
(import ./modules/cloudflare-warp.nix)
|
|
(import ./modules/vfio.nix)
|
|
home-manager.nixosModules.home-manager
|
|
{
|
|
home-manager.useGlobalPkgs = true;
|
|
home-manager.useUserPackages = true;
|
|
home-manager.users.gsimmer = import ./nix/london/gsimmer.nix;
|
|
}
|
|
];
|
|
};
|
|
oracle-gitea-runner = nixpkgs.lib.nixosSystem {
|
|
system = "aarch64-linux";
|
|
modules = [
|
|
(import ./nix/oracle-gitea-runner/configuration.nix)
|
|
{
|
|
_module.args.nixinate = {
|
|
host = "143.47.229.209";
|
|
sshUser = "root";
|
|
buildOn = "remote";
|
|
substituteOnTarget = true;
|
|
hermetic = false;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
oracle-stream = nixpkgs.lib.nixosSystem {
|
|
system = "aarch64-linux";
|
|
modules = [
|
|
(import ./nix/oracle-stream/configuration.nix)
|
|
{
|
|
_module.args.nixinate = {
|
|
host = "100.98.25.34";
|
|
sshUser = "root";
|
|
buildOn = "remote";
|
|
substituteOnTarget = true;
|
|
hermetic = false;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
monitoring = nixpkgs.lib.nixosSystem {
|
|
system = "aarch64-linux";
|
|
modules = [
|
|
(import ./nix/monitoring/configuration.nix)
|
|
agenix.nixosModules.default
|
|
alertmanager-ntfy.nixosModules.x86_64-linux.default
|
|
{
|
|
_module.args.nixinate = {
|
|
host = "100.126.232.130";
|
|
sshUser = "root";
|
|
buildOn = "remote";
|
|
substituteOnTarget = true;
|
|
hermetic = false;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
nas = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
(import ./nix/nas/configuration.nix)
|
|
agenix.nixosModules.default
|
|
home-manager.nixosModules.home-manager
|
|
{
|
|
home-manager.users.gsimmer = import ./nix/nas/home.nix;
|
|
_module.args.nixinate = {
|
|
host = "vancouver";
|
|
sshUser = "gsimmer";
|
|
buildOn = "remote";
|
|
substituteOnTarget = true;
|
|
hermetic = false;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
proxmox-k3s-node-1 = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
agenix.nixosModules.default
|
|
(import ./nix/proxmox-k3s-node/configuration.nix)
|
|
{
|
|
_module.args.nixinate = {
|
|
host = "proxmox-node-1";
|
|
sshUser = "gsimmer";
|
|
buildOn = "remote";
|
|
substituteOnTarget = true;
|
|
hermetic = false;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
dnsmasq = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
agenix.nixosModules.default
|
|
(import ./nix/dnsmasq/configuration.nix)
|
|
{
|
|
_module.args.nixinate = {
|
|
host = "192.168.50.87";
|
|
sshUser = "root";
|
|
buildOn = "remote";
|
|
substituteOnTarget = true;
|
|
hermetic = false;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
dnsmasq-floof = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
agenix.nixosModules.default
|
|
(import ./nix/dnsmasq-floof/configuration.nix)
|
|
{
|
|
_module.args.nixinate = {
|
|
host = "10.230.101.104";
|
|
sshUser = "root";
|
|
buildOn = "remote";
|
|
substituteOnTarget = true;
|
|
hermetic = false;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
minecraft-server = nixpkgs.lib.nixosSystem {
|
|
system = "x86_64-linux";
|
|
modules = [
|
|
agenix.nixosModules.default
|
|
(import ./nix/minecraft-server/configuration.nix)
|
|
{
|
|
_module.args.nixinate = {
|
|
host = "192.168.50.13";
|
|
sshUser = "root";
|
|
buildOn = "remote";
|
|
substituteOnTarget = true;
|
|
hermetic = false;
|
|
};
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|