Added server options for nomad and consul

config/consul.d/client.json

@@ -1,7 +1,4 @@
 {
-  "datacenter": "samfelag",
-  "data_dir": "/opt/consul",
-
   "tls": {
     "defaults": {
       "verify_incoming": false,
@@ -14,28 +11,5 @@
   },
   "auto_encrypt": {
       "tls": true
-  },
-
-  "bind_addr": "{{ GetInterfaceIP \"tailscale0\" }}",
-  "advertise_addr": "{{ GetInterfaceIP \"tailscale0\" }}",
-  "client_addr": "0.0.0.0",
-  "retry_join": ["100.80.195.56", "100.107.148.47"],
-
-  "ports": {
-    "grpc_tls": 8502
-  },
-
-  "acl": {
-    "enabled": true,
-    "default_policy": "allow",
-    "enable_token_persistence": true
-  },
-
-  "connect": {
-    "enabled": true
-  },
-
-  "performance": {
-    "raft_multiplier": 1
   }
 }

config/consul.d/common.json

@@ -0,0 +1,26 @@
+{
+  "datacenter": "samfelag",
+  "data_dir": "/opt/consul",
+
+  "bind_addr": "{{ GetInterfaceIP \"tailscale0\" }}",
+  "advertise_addr": "{{ GetInterfaceIP \"tailscale0\" }}",
+  "client_addr": "{{ GetInterfaceIP \"tailscale0\" }}",
+
+  "ports": {
+    "grpc_tls": 8502
+  },
+
+  "acl": {
+    "enabled": true,
+    "default_policy": "allow",
+    "enable_token_persistence": true
+  },
+
+  "connect": {
+    "enabled": true
+  },
+
+  "performance": {
+    "raft_multiplier": 1
+  }
+}

config/consul.d/server-list.json

@@ -0,0 +1,5 @@
+{
+  "retry_join": [
+      "100.80.195.56"
+  ]
+}

config/consul.d/server.json

@@ -0,0 +1,22 @@
+{
+  "server": true,
+  "bootstrap_expect": 1,
+  "ui_config": {
+    "enabled": true
+  },
+  "tls": {
+    "defaults": {
+      "verify_incoming": true,
+      "verify_outgoing": true,
+      "ca_file": "/etc/consul.d/certs/consul-agent-ca.pem",
+      "cert_file": "/etc/consul.d/certs/samfelag-server-consul-0.pem",
+      "key_file": "/etc/consul.d/certs/samfelag-server-consul-0-key.pem"
+    },
+    "internal_rpc": {
+      "verify_server_hostname": true
+    }
+  },
+  "auto_encrypt": {
+      "allow_tls": true
+  }
+}

config/nomad.d/client.json

@@ -0,0 +1,10 @@
+{
+    "client": {
+        "enabled": true,
+        "network_interface": "tailscale0",
+
+        "options": {
+            "docker.volumes.enabled": true
+        }
+    }
+}

config/nomad.d/common.json

@@ -0,0 +1,9 @@
+{
+  "datacenter": "samfelag",
+
+  "advertise": {
+    "http": "{{ GetInterfaceIP \"tailscale0\" }}",
+    "rpc": "{{ GetInterfaceIP \"tailscale0\" }}",
+    "serf": "{{ GetInterfaceIP \"tailscale0\" }}"
+  }
+}

config/nomad.d/host-reykjavik.json

@@ -0,0 +1,10 @@
+{
+    "client": {
+        "host_volume": {
+            "test": {
+              "path": "/mnt/raid1/nomad_volumes/nextcloud/nextcloud",
+              "read_only": false
+            }
+        }
+    }
+}

config/nomad.d/server.json

@@ -0,0 +1,6 @@
+{
+    "server": {
+      "enabled": true,
+      "bootstrap_expect": 1
+  }
+}

hosts/reykjavik/default.nix

@@ -39,6 +39,8 @@ in
     kind = "dark";
   };
 
+  # - Agenix ---------------------------------
+
   age.identityPaths = [
     "/home/marc/.ssh/id_ed25519"
   ];
@@ -62,10 +64,13 @@ in
     system.sshfs.enable = true;
 
     # - Server ----------------------------------
-    server.consul = {
+    # server.consul = {
-      enable = true;
+    #   enable = true;
-      agent-token = config.age.secrets."consul.d/agent-token-reykjavik.json".path;
+    #   agent-token = config.age.secrets."consul.d/agent-token-reykjavik.json".path;
-    };
+    # };
+    # server.nomad = {
+    #   enable = true;
+    # };
 
     # - Desktop ----------------------------------
     desktop = {

modules/secrets.nix

@@ -1,8 +1,14 @@
 { config, pkgs, lib, ... }:
+let
+  consulCfg = config.samfelag.modules.server.consul;
+  nomadCfg = config.samfelag.modules.server.nomad;
+in
 {
   config = {
     age.secrets = {
+    } //
     # Consul -------------------------------
+    lib.optionalAttrs consulCfg.enable {
       "consul.d/gossip.json" = {
         file = ../secrets/consul.d/gossip.json.age;
         owner = "consul";
@@ -21,6 +27,13 @@
         group = "consul";
         mode = "644";
       };
+    } //
+    # Nomad -------------------------------
+    lib.optionalAttrs nomadCfg.enable {
+      "nomad.d/consul-token.json" = {
+        file = ../secrets/nomad.d/consul-token.json.age;
+        mode = "644";
+      };
     };
   };
 }

modules/server/consul.nix

@@ -2,11 +2,18 @@
 
 let
   cfg = config.samfelag.modules.server.consul;
+  nameservers = config.networking.nomeservers;
 in
 {
   options.samfelag.modules.server.consul = {
     enable = lib.mkEnableOption "consul";
 
+    server = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Set to true if configured a server - otherwise a client is assumed";
+    };
+
     agent-token = lib.mkOption {
       type = lib.types.str;
       description = "Agent token config file (should be secret)";
@@ -17,30 +24,51 @@ in
     services.consul = {
       enable = true;
       webUi = true;
+    } // lib.optionalAttrs cfg.server {
+      extraConfig = {
+        recursors = config.networking.nameservers;
+      };
     };
 
     environment.etc = {
-      agent-ca = {
+      consul-agent-ca = {
         # Consul agent CA
         target = "consul.d/certs/consul-agent-ca.pem";
         source = config.age.secrets."consul.d/consul-agent-ca.pem".path;
       };
-      gossip = {
+      consul-gossip = {
         # Gossip encryption key
         target = "consul.d/gossip.json";
         source = config.age.secrets."consul.d/gossip.json".path;
       };
-      client = {
+      consul-common-cfg = {
-        # Client config
+        # Common config
-        target = "consul.d/client.json";
+        target = "consul.d/common.json";
-        source = ../../config/consul.d/client.json;
+        source = ../../config/consul.d/common.json;
       };
-      agent-token = {
+      consul-server-list = {
+        # Server list
+        target = "consul.d/server-list.json";
+        source = ../../config/consul.d/server-list.json;
+      };
+      consul-agent-token = {
         # Agent token
         target = "consul.d/agent-token.json";
         source = cfg.agent-token;
       };
+    } // (if cfg.server then {
+      consul-server-cfg = {
+        # Server config
+        target = "consul.d/server.json";
+        source = ../../config/consul.d/server.json;
       };
+    } else {
+      consul-client-cfg = {
+        # Client config
+        target = "consul.d/client.json";
+        source = ../../config/consul.d/client.json;
+      };
+    });
 
     # networking.firewall.allowedTCPPorts = [ 22 ];
   };

modules/server/nomad.nix

@@ -0,0 +1,49 @@
+{ config, lib, pkgs, self, ... }:
+
+let
+  cfg = config.samfelag.modules.server.nomad;
+in
+{
+  options.samfelag.modules.server.nomad = {
+    enable = lib.mkEnableOption "nomad";
+
+    server = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Set to true if configured a server - otherwise a client is assumed";
+    };
+
+  };
+  config = lib.mkIf cfg.enable {
+    # services.consul.enable = true;
+    services.nomad = {
+      enable = true;
+      extraSettingsPaths = [ "/etc/nomad.d" ];
+    };
+    environment.etc = {
+      # Common configuration
+      nomad-common-cfg = {
+        target = "nomad.d/common.json";
+        source = ../../config/nomad.d/common.json;
+      };
+      # Consul token
+      nomad-consul-token = {
+        target = "nomad.d/consul-token.json";
+        source = config.age.secrets."nomad.d/consul-token.json".path;
+      };
+      # Client configuration
+      nomad-client-cfg = {
+        target = "nomad.d/client.json";
+        source = ../../config/nomad.d/client.json;
+      };
+    } // lib.optionalAttrs cfg.server {
+      # Server configuration
+      nomad-server-cfg = {
+        target = "nomad.d/server.json";
+        source = ../../config/nomad.d/server.json;
+      };
+    };
+
+    # networking.firewall.allowedTCPPorts = [ 22 ];
+  };
+}

secrets/nomad.d/consul-token.json.age

@@ -0,0 +1,5 @@
+age-encryption.org/v1
+-> ssh-ed25519 GWuf0Q BbOx6cx+uu2ortgM+FKdQ58Mq/88oiilwQG4H9omY0c
+yfQ092ZhIXDUfRK/1McsaKo3RnGvbmjtZcU1k769GX0
+--- ddjUdGmBLlYX2jY3FuEr11FudpoSP+gI+0PxIsJ1BZo
+؉>_ÿüF¹$j?.<2E>Eœ´g·%kmÇ‘—ˆ9‘/zf…ù&g*VG^.ôÈ–T^¬ýHÛ·‰>ªp$Í+•–ÑEýqPù&mu ïLJóÔÚè½ÀqËÊ¢f…µæÉvOnŒÑúHªèîÿW¿<57>Áî±c8Mn¥Ólßpú<0B>¾ª°Õj'ô©ö’½xIŽ»ó'|

secrets/secrets.nix

@@ -8,4 +8,7 @@ in
   "consul.d/consul-agent-ca.pem.age".publicKeys = [id-reykjavik];
   # Agent tokens
   "consul.d/agent-token-reykjavik.json.age".publicKeys = [id-reykjavik];
+
+  # -- Nomad -------------------------------
+  "nomad.d/consul-token.json.age".publicKeys = [id-reykjavik];
 }