diff --git a/docs/hosts.org b/docs/hosts.org index 1e18faf..0c3c211 100644 --- a/docs/hosts.org +++ b/docs/hosts.org @@ -1,5 +1,5 @@ #+title: Hosts -* Setting up a new vult host +* Setting up a new vultr host ** Generate a password for your host #+begin_src bash pass generate samfelag/ @@ -60,5 +60,7 @@ Host remotehost IdentityFile ~/.ssh/remotehost #+END_SRC * List of hosts -** [[file:../hosts/reykjavik/README.org][Reykjavik]] -** [[file:../hosts/kopavogur/README.org][Kopavogur]] +** [[file:../hosts/reykjavik/reykjavik.org][Reykjavik]] +** [[file:../hosts/kopavogur/kopavogur.org][Kopavogur]] +** [[file:../hosts/thingvellir/thingvellir.org][Thingvellir]] +** [[file:../hosts/quinto/quinto.org][Quinto]] diff --git a/hosts/skaftafell/default.nix b/hosts/skaftafell/default.nix new file mode 100644 index 0000000..7a759a1 --- /dev/null +++ b/hosts/skaftafell/default.nix @@ -0,0 +1,61 @@ +{ config, pkgs, lib, inputs, ... }: + +with lib; +{ + imports = [ + ./hardware.nix + ./secrets.nix + ]; + + # - Basic -------------------------------------- + + user.name = "marc"; + user.shell = pkgs.zsh; + networking = { + hostName = "skaftafell"; + firewall = { + enable = false; + # allowedUDPPorts = [ + # 53 # DNS (pihole + unbound) + # 8600 # Consul DNS + # ]; + }; + }; + + # - Bootloader --------------------------------- + + boot.loader.grub = { + enable = true; + device = "/dev/vda"; + }; + + # - Agenix --------------------------------- + + age.identityPaths = [ + "/home/marc/.ssh/id_ed25519" + ]; + + # - Modules ------------------------------------ + + samfelag.modules = { + # - Common ----------------------------------- + # See modules/common.nix for common packages installed + + # - System ----------------------------------- + system.utils.enable = true; + system.gpg.enable = true; + system.pass.enable = true; + system.ssh.enable = true; + system.sshfs.enable = true; + + # - Server ---------------------------------- + # server.vatnajokull.enable = true; + + # - Editors and development ------------------ + dev.git.userName = "marc"; + dev.git.userEmail = "marc@sastre.cat"; + + dev.docker.enable = true; + dev.docker.users = ["marc"]; + }; +} diff --git a/hosts/skaftafell/hardware.nix b/hosts/skaftafell/hardware.nix new file mode 100644 index 0000000..8d24782 --- /dev/null +++ b/hosts/skaftafell/hardware.nix @@ -0,0 +1,36 @@ +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = [ ]; + + boot = { + initrd = { + availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "sr_mod" "virtio_blk" ]; + kernelModules = [ ]; + }; + kernelModules = [ ]; + extraModulePackages = [ ]; + }; + + fileSystems = { + "/" = { + device = "/dev/disk/by-label/nixos"; + fsType = "ext4"; + }; + }; + + swapDevices = [ + { device = "/dev/disk/by-label/swap"; } + ]; + + networking = { + useDHCP = lib.mkDefault true; + interfaces = { + ens3.useDHCP = lib.mkDefault true; + }; + nameservers = [ "108.61.10.10" ]; + }; + + virtualisation.hypervGuest.enable = true; + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/hosts/skaftafell/secrets.nix b/hosts/skaftafell/secrets.nix new file mode 100644 index 0000000..36ff274 --- /dev/null +++ b/hosts/skaftafell/secrets.nix @@ -0,0 +1,6 @@ +{ ... }: + +{ + age.secrets = { + }; +} diff --git a/hosts/skaftafell/skaftafell.org b/hosts/skaftafell/skaftafell.org new file mode 100644 index 0000000..3656e6f --- /dev/null +++ b/hosts/skaftafell/skaftafell.org @@ -0,0 +1,2 @@ +* Skaftafell +Servidor a Vultr diff --git a/secrets/consul.d/agent-token-reykjavik.json.age b/secrets/consul.d/agent-token-reykjavik.json.age index bd3438b..899f529 100644 Binary files a/secrets/consul.d/agent-token-reykjavik.json.age and b/secrets/consul.d/agent-token-reykjavik.json.age differ diff --git a/secrets/consul.d/agent-token-thingvellir.json.age b/secrets/consul.d/agent-token-thingvellir.json.age index aa3d55c..82e0887 100644 Binary files a/secrets/consul.d/agent-token-thingvellir.json.age and b/secrets/consul.d/agent-token-thingvellir.json.age differ diff --git a/secrets/consul.d/consul-agent-ca-key.pem.age b/secrets/consul.d/consul-agent-ca-key.pem.age index d72f03b..3e87e3e 100644 Binary files a/secrets/consul.d/consul-agent-ca-key.pem.age and b/secrets/consul.d/consul-agent-ca-key.pem.age differ diff --git a/secrets/consul.d/consul-agent-ca.pem.age b/secrets/consul.d/consul-agent-ca.pem.age index 1c6912a..40e1a6a 100644 Binary files a/secrets/consul.d/consul-agent-ca.pem.age and b/secrets/consul.d/consul-agent-ca.pem.age differ diff --git a/secrets/consul.d/gossip.json.age b/secrets/consul.d/gossip.json.age index b7f0ecd..82fbe35 100644 --- a/secrets/consul.d/gossip.json.age +++ b/secrets/consul.d/gossip.json.age @@ -1,10 +1,11 @@ age-encryption.org/v1 --> ssh-ed25519 GWuf0Q HU052z43DHXbPh4m0Cn8YWEabVMdT9Ab9ZvnRTkiGiM -jsGBcbgj1JeYBdvnRqKT310VnWqZmRYIE+LbkPVmDxs --> ssh-ed25519 zhVGHw 1oy7y5z6KQy+JYRIPyqfeCgJUbGWdo77NiGnVRA0QRk -qNrRnats5cFFv8K3YUtUXdSwhWkgcBGTeDlhWTkrNRM --> ssh-ed25519 kNjiNQ IWfsJxXu1Kg6Z5p1qNBopU0RkYt7/s6jw/DJDQXpTHc -ouzaIxV7Y+pE8t/8s4Vk/AO/MccUpgHGhn1cq6C+E08 ---- LL3bXyeMTogvYXqjhwL75j64P9bNIFG2pwFanjOYm2o -)>F=!vE`e*mOgJ+CT -w+tΫp[^8kRY_= 8xg! \ No newline at end of file +-> ssh-ed25519 GWuf0Q bW+hxNOISsRCrRS0OOIAPPju119EgOotwZ6niLAFzkw +lz23ChdAIsATg/mKc91fNLlGGJ9NFUt9uNYq0cHJPk0 +-> ssh-ed25519 zhVGHw v4g1bMvVf9kB61WkvkyI1mucwtHrml9Fe8Byya+dcUQ +ag6FoKKpdEwB3rW2zYAoOp66J2dgpp1GFA50qpXUSqg +-> ssh-ed25519 kNjiNQ MUk4rt+iiLSapgtAwip2W482ElclcU/TEY++ZRftEj4 +rSp4fJxuyfVy62NcE458e9KB28c5vfLUiH/j8Lfpg3g +-> ssh-ed25519 W0CP4A O25wWVlFCtMYyWwyc0vgHzVyFQWzjwDGbkewVsHZ5Wg +yEatTfY8VwvAviaXYQKKDIz/ergEoMIjNa0MnUZ5tmY +--- 4is/3sp6dIeifbWEOrhsHd9Ff7lnRXHvMJPN/PDzJs4 +8Jj] r}6 a##wP%_tb?$ x9>5yasl(w- DJJKFrp}s0* \ No newline at end of file diff --git a/secrets/consul.d/samfelag-server-thingvellir-key.pem.age b/secrets/consul.d/samfelag-server-thingvellir-key.pem.age index f1db351..ec91e68 100644 Binary files a/secrets/consul.d/samfelag-server-thingvellir-key.pem.age and b/secrets/consul.d/samfelag-server-thingvellir-key.pem.age differ diff --git a/secrets/consul.d/samfelag-server-thingvellir.pem.age b/secrets/consul.d/samfelag-server-thingvellir.pem.age index 64d3d6f..3e1226f 100644 Binary files a/secrets/consul.d/samfelag-server-thingvellir.pem.age and b/secrets/consul.d/samfelag-server-thingvellir.pem.age differ diff --git a/secrets/nomad.d/consul-token-client.json.age b/secrets/nomad.d/consul-token-client.json.age index 8795ea4..4e0d771 100644 Binary files a/secrets/nomad.d/consul-token-client.json.age and b/secrets/nomad.d/consul-token-client.json.age differ diff --git a/secrets/nomad.d/consul-token-server.json.age b/secrets/nomad.d/consul-token-server.json.age index 08a7bbf..9ceaf94 100644 --- a/secrets/nomad.d/consul-token-server.json.age +++ b/secrets/nomad.d/consul-token-server.json.age @@ -1,7 +1,7 @@ age-encryption.org/v1 --> ssh-ed25519 GWuf0Q GSvUmcsNXSkoVOD8V/UP+KAGfKX4REahFDmwlROkoSw -ruTijdplgtQZP3wjnNGemh3a0omKK95xsfXzkWce0lM --> ssh-ed25519 kNjiNQ zT/ticPDHAujEWqSUrPaGsgPBdbaLvLQ/RSMz5C0aW8 -JTy+b/N6yjfPtrhYXkFWb26PGa+b/M1DVKeGsW2oimg ---- TKdmCeaBKPBBIkKvUqqqQz9DQigRuLRT2ZFto7Jtqr0 -W3Lj䯕'HgRs;wۑցt{E"v17%&({˝E.3SzNcVҷlˆfWu5d2  \ No newline at end of file +-> ssh-ed25519 GWuf0Q Iz+zbIXV2o+GBZCHEv6YWi+JjaQuU4T+g21TVPrQr1c +op3yyGCAU+GQtm0k+gbq/yUvHDXmWcTMc4kRi7O7x+s +-> ssh-ed25519 kNjiNQ EATD3QCgsJQU+K0JG1vRxzO3DhYme+KodKaTWopeNVk +mM9A5+jdhB0Qkx/7uR/3Vs7YnzjZ2qgTKedHDxWtolU +--- SGjf+G9rCCrDr6oqk58hkiP5o+BQpZ1RrxmC/r0soz8 + !#YCPpRIn%v~pԸFOKjdAڃ7 jy@P<(Jpa$(AZMbj \ No newline at end of file diff --git a/secrets/secrets.nix b/secrets/secrets.nix index fe0de82..db3259a 100644 --- a/secrets/secrets.nix +++ b/secrets/secrets.nix @@ -2,7 +2,8 @@ let id-reykjavik = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFwwpKfxNmUyBoPZqz1jYc6arCdHPvJrEsBN49m/P3By"; id-hvannadal = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICy1ocZywBvFHpIj+FvaC7QspRWuLXjy6fwakq9t+0Ev"; id-thingvellir = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEIvWEwYayFK8iRb4g2+cnQXlqiMBu3aWxTahXkaCNG7"; - id-quinto = " ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINxgIT2+aoP+ZLMPupV8M0UwCLX6A3s+H6z3BJPCjJc0"; + id-quinto = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINxgIT2+aoP+ZLMPupV8M0UwCLX6A3s+H6z3BJPCjJc0"; + id-skaftafell = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINA2DjHGlJOComWzUzbr/vdT74r7VBJLkmekn8b6783q"; # --- Host lists --- # Since we want to be able to manage/edit all secrets from reykjavik, we create helper lists that @@ -10,11 +11,13 @@ let reykjavik = [id-reykjavik]; thingvellir = [id-reykjavik id-thingvellir]; quinto = [id-reykjavik id-quinto]; + skaftafell = [id-reykjavik id-skaftafell]; samfelag-hosts = [ id-reykjavik id-hvannadal id-thingvellir + id-skaftafell ]; in { diff --git a/secrets/ssh-keys/id_skaftafell.gpg b/secrets/ssh-keys/id_skaftafell.gpg new file mode 100644 index 0000000..9201f27 Binary files /dev/null and b/secrets/ssh-keys/id_skaftafell.gpg differ diff --git a/secrets/ssh-keys/id_skaftafell.pub b/secrets/ssh-keys/id_skaftafell.pub new file mode 100644 index 0000000..5c1c01f --- /dev/null +++ b/secrets/ssh-keys/id_skaftafell.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINA2DjHGlJOComWzUzbr/vdT74r7VBJLkmekn8b6783q marc@reykjavik