me/ncm
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore: cleanup/add private network

Browse source
This commit is contained in:
Adriano Caloiaro 2025-04-18 15:38:29 -06:00
parent 1e2ec949a5
commit 9d2e24fe1a
No known key found for this signature in database
GPG key ID: C2BC56DE73CE3F75
16 changed files with 150 additions and 128 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
build/result
View file

@ -1 +0,0 @@
/nix/store/gm74zrn6l1sxwl0n58vhf0d238wl7ass-nixos-disk-image

6
deploy/compute_providers/linode/main.tf
View file

@ -48,7 +48,11 @@ resource "linode_instance_config" "config" {
virt_mode = "paravirt"
interface {
purpose = "public"
purpose = "public"
}
interface {
purpose = "vpc"
subnet_id = linode_vpc_subnet.ncm.id
ipv4 {
vpc = local.node_private_ips.value[count.index]

2
deploy/compute_providers/linode/outputs.tf
View file

@ -6,7 +6,7 @@ output "node_details" {
label = instance.label
ipv4 = instance.ip_address
ipv6 = instance.ipv6
private_ipv4 = linode_instance_config.config[idx].interface[0].ipv4[0].vpc
private_ipv4 = linode_instance_config.config[idx].interface[1].ipv4[0].vpc
}
]
}

42
jobs/jobspecs/caddy.nomad.hcl
View file

@ -11,7 +11,6 @@ job "caddy" {
}
group "caddy" {
# Using ephemeral_disk to store Caddy data.
# The data directory must not be treated as a cache.
# Caddy stores TLS certificates, private keys, OCSP staples, and other necessary information to the data directory.
@ -107,6 +106,47 @@ weride.social {
dns hetzner {{ with nomadVar "nomad/jobs/caddy"}}{{ .dns_access_token }}{{ end }}
# ca https://acme-staging-v02.api.letsencrypt.org/directory
}
reverse_proxy /js/script.tagged-events.js {
to https://plausible.io
header_up Host "plausible.io"
}
reverse_proxy /api/event {
to https://plausible.io
header_up Host "plausible.io"
}
}
garbagespeak.com {
reverse_proxy http://{{ range nomadService "garbage-speak"}}{{ .Address }}:{{ .Port }}{{end}}
tls {
dns hetzner {{ with nomadVar "nomad/jobs/caddy"}}{{ .dns_access_token }}{{ end }}
# ca https://acme-staging-v02.api.letsencrypt.org/directory
}
reverse_proxy /js/script.tagged-events.js {
to https://plausible.io
header_up Host "plausible.io"
}
reverse_proxy /api/event {
to https://plausible.io
header_up Host "plausible.io"
}
}
bench.bike {
reverse_proxy http://{{ range nomadService "bench"}}{{ .Address }}:{{ .Port }}{{end}}
tls {
dns hetzner {{ with nomadVar "nomad/jobs/caddy"}}{{ .dns_access_token }}{{ end }}
# ca https://acme-staging-v02.api.letsencrypt.org/directory
}
reverse_proxy /js/script.tagged-events.js {
to https://plausible.io
header_up Host "plausible.io"
}
reverse_proxy /api/event {
to https://plausible.io
header_up Host "plausible.io"
}
}
adriano.fyi {
reverse_proxy /* {

28
jobs/main.tf
View file

@ -118,6 +118,34 @@ resource "nomad_variable" "weride" {
}
}
resource "nomad_variable" "garbage_speak" {
path = "nomad/jobs/garbage_speak"
namespace = nomad_namespace.default.name
items = {
SMTP_PASSWORD = var.gs_smtp_password
}
}
resource "nomad_variable" "bench" {
path = "nomad/jobs/bench"
namespace = nomad_namespace.default.name
items = {
SMTP_PASSWORD = var.bench_smtp_password
MAILGUN_API_KEY = var.bench_mailgun_api_key
TWILIO_ACCOUNT_SID = var.bench_twilio_account_sid
TWILIO_AUTH_TOKEN = var.bench_twilio_auth_token
TWILIO_PHONE_NUMBER = var.bench_twilio_phone_number
TWILIO_VERIFICATION_SERVICE_ID = var.bench_twilio_verification_service_id
TWILIO_VERIFICATION_WEBHOOK_SERVICE_ID = var.bench_twilio_verification_webhook_service_id
STRIPE_API_KEY = var.bench_stripe_api_key
STRIPE_PUBLIC_KEY = var.bench_stripe_public_key
STRIPE_PREMIUM_UPGRADE_URL = var.bench_stripe_premium_upgrade_url
STRIPE_WEBHOOK_SIGNING_SECRET = var.bench_stripe_webhook_signing_secret
STRIPE_CONNECT_WEBHOOK_SIGNING_SECRET = var.bench_stripe_connect_webhook_signing_secret
GOOGLE_OAUTH_JSON = var.bench_google_oauth_json
}
}
#####################################################################################################################
# Volumes

35
jobs/variables.tf
View file

@ -35,6 +35,41 @@ variable "dns_access_token" {
# default = "1.7.2"
# }
# GS
variable "gs_smtp_password" {
description = "garbagespeak.com smtp password"
}
# /GS
# Bench
variable "bench_smtp_password" {
}
variable "bench_mailgun_api_key" {
}
variable "bench_twilio_account_sid" {
}
variable "bench_twilio_auth_token" {
}
variable "bench_twilio_phone_number" {
}
variable "bench_twilio_verification_service_id" {
}
variable "bench_twilio_verification_webhook_service_id" {
}
variable "bench_stripe_api_key" {
}
variable "bench_stripe_public_key" {
}
variable "bench_stripe_premium_upgrade_url" {
}
variable "bench_stripe_webhook_signing_secret" {
}
variable "bench_stripe_connect_webhook_signing_secret" {
}
variable "bench_google_oauth_json" {
}
# / Bench
# Postgres
variable "postgres_user" {
description = "The primary postgres admin username for the postgres instance"

36
operate/hosts/ncm-0/default.nix
View file

@ -18,9 +18,12 @@
hostName = "ncm-0";
nftables.enable = true;
firewall = {
# always allow traffic from the tailnet
trustedInterfaces = ["tailscale0" "eth1"];
allowedTCPPorts = [22 80 443];
logRefusedConnections = true;
logRefusedPackets = true;
checkReversePath = false;
# always allow traffic from the tailnet and internal network
trustedInterfaces = ["tailscale0" "enp0s5" "podman0" "veth0"];
allowedTCPPorts = [22 80 443 24017];
allowedUDPPorts = [config.services.tailscale.port];
};
};
@ -42,11 +45,6 @@
};
};
# age.secrets.docker_auth_json = {
# file = ./secrets/docker_ghcr_auth_config_json.age;
# path = "/run/containers/0/auth.json";
# };
age.secrets.tailscale_auth_key = {
file = ./secrets/tailscale_auth_key;
};
@ -67,28 +65,6 @@
'')
];
#
# TEST: authentication to private repo
#
# environment.variables = {
# XDG_RUNTIME_DIR = "/var/run/user/0";
# };
# Define a systemd service to create files in /var/run/user/0
# systemd.services."create-incus-ghcr-auth-file" = {
# description = "Create ghcr.io auth file for incus to retrieve private images";
# after = ["default.target"];
# wantedBy = ["default.target"];
# serviceConfig = {
# ExecStart = ''${pkgs.bashInteractive}/bin/bash -c 'echo {\\"auths\\":{ \\"ghcr.io\\": {\\"auth\\": \\"YWNhbG9pYXJvOiBnaHBfVnN4dzc4YXZ6N0lBeXQyejVrcGpZQTJXV21XbUZNMzlZdkMxIA==\\"}}} > /var/run/user/0/containers/auth.json' '';
# ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/run/user/0/containers";
# Restart = "no";
# };
# };
#
# /TEST: authentication to private repo
#
users.users = {
root = {
openssh.authorizedKeys.keys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCx/tvR11RUMbYaauuHPxR3j79vm1Hxg+Y3LXR+rLgZ7N/2ulvIzLLZgVuIUbmJHDqkp9Au5zZPMZjsKbaqQ8V75wSEcyaSMbaxC9PaNDCwEHMJWaz8XPQe5IjVRE5O+4sTyh7ZBx+NMQmPcQbrNInoKuy4EjFmwTW/t0xYo/sCrC0NX0cCyeBwii2JdFXytXfxF+RMzGNXw1xfcOFJe6F7JdS/Cpf/0fe+VmNg8d0nic4Obcb/djYsRLAAC6Cvb+4i3EBZWl+9Ih9hId8bFCRKhI6TmGT2z4YUTa+v+3j/JZUh1gD5n4vRGf8QjLj9N6DrBnKcbywwqyqnLhTLgBBN35rcLdU1k3n0NorRRDCU0Lg/ejsFe3oi2FmOwNmmd8zqBNZHjJTi5Wy63EXMFwHltEY2M+hAhgWsQ5U4zuVPgv1HfD6LYPodRwhdZivwTNr2IClAiVVxR//O0WtrRXrrEM5uudj+Y30/ah7bn9Mje86UV0TqfS2tdjtMkySHL+M= adriano@z1"];

3
operate/hosts/ncm-0/nomad.nix
View file

@ -59,6 +59,9 @@
"public" = {
interface = "enp0s4";
};
"private" = {
cidr = "10.0.1.2/24";
};
};
artifact = {
# Workaround for landlock issue: https://github.com/hashicorp/nomad/issues/18721

4
operate/hosts/ncm-0/secrets/secrets.nix
View file

@ -1,6 +1,6 @@
# Use ssh-keyscan <SERVER> to fetch the below keys for target systems (SSH server must be running on system)
let
in {
tailscale_auth_key.publicKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCx/tvR11RUMbYaauuHPxR3j79vm1Hxg+Y3LXR+rLgZ7N/2ulvIzLLZgVuIUbmJHDqkp9Au5zZPMZjsKbaqQ8V75wSEcyaSMbaxC9PaNDCwEHMJWaz8XPQe5IjVRE5O+4sTyh7ZBx+NMQmPcQbrNInoKuy4EjFmwTW/t0xYo/sCrC0NX0cCyeBwii2JdFXytXfxF+RMzGNXw1xfcOFJe6F7JdS/Cpf/0fe+VmNg8d0nic4Obcb/djYsRLAAC6Cvb+4i3EBZWl+9Ih9hId8bFCRKhI6TmGT2z4YUTa+v+3j/JZUh1gD5n4vRGf8QjLj9N6DrBnKcbywwqyqnLhTLgBBN35rcLdU1k3n0NorRRDCU0Lg/ejsFe3oi2FmOwNmmd8zqBNZHjJTi5Wy63EXMFwHltEY2M+hAhgWsQ5U4zuVPgv1HfD6LYPodRwhdZivwTNr2IClAiVVxR//O0WtrRXrrEM5uudj+Y30/ah7bn9Mje86UV0TqfS2tdjtMkySHL+M= adriano@z1" ""];
linode_cli_pat.publicKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCx/tvR11RUMbYaauuHPxR3j79vm1Hxg+Y3LXR+rLgZ7N/2ulvIzLLZgVuIUbmJHDqkp9Au5zZPMZjsKbaqQ8V75wSEcyaSMbaxC9PaNDCwEHMJWaz8XPQe5IjVRE5O+4sTyh7ZBx+NMQmPcQbrNInoKuy4EjFmwTW/t0xYo/sCrC0NX0cCyeBwii2JdFXytXfxF+RMzGNXw1xfcOFJe6F7JdS/Cpf/0fe+VmNg8d0nic4Obcb/djYsRLAAC6Cvb+4i3EBZWl+9Ih9hId8bFCRKhI6TmGT2z4YUTa+v+3j/JZUh1gD5n4vRGf8QjLj9N6DrBnKcbywwqyqnLhTLgBBN35rcLdU1k3n0NorRRDCU0Lg/ejsFe3oi2FmOwNmmd8zqBNZHjJTi5Wy63EXMFwHltEY2M+hAhgWsQ5U4zuVPgv1HfD6LYPodRwhdZivwTNr2IClAiVVxR//O0WtrRXrrEM5uudj+Y30/ah7bn9Mje86UV0TqfS2tdjtMkySHL+M= adriano@z1" ""];
tailscale_auth_key.publicKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCx/tvR11RUMbYaauuHPxR3j79vm1Hxg+Y3LXR+rLgZ7N/2ulvIzLLZgVuIUbmJHDqkp9Au5zZPMZjsKbaqQ8V75wSEcyaSMbaxC9PaNDCwEHMJWaz8XPQe5IjVRE5O+4sTyh7ZBx+NMQmPcQbrNInoKuy4EjFmwTW/t0xYo/sCrC0NX0cCyeBwii2JdFXytXfxF+RMzGNXw1xfcOFJe6F7JdS/Cpf/0fe+VmNg8d0nic4Obcb/djYsRLAAC6Cvb+4i3EBZWl+9Ih9hId8bFCRKhI6TmGT2z4YUTa+v+3j/JZUh1gD5n4vRGf8QjLj9N6DrBnKcbywwqyqnLhTLgBBN35rcLdU1k3n0NorRRDCU0Lg/ejsFe3oi2FmOwNmmd8zqBNZHjJTi5Wy63EXMFwHltEY2M+hAhgWsQ5U4zuVPgv1HfD6LYPodRwhdZivwTNr2IClAiVVxR//O0WtrRXrrEM5uudj+Y30/ah7bn9Mje86UV0TqfS2tdjtMkySHL+M= adriano@z1" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILUJR7tGcQEwWj9lGEoC2sqWzxFif1BFddYzZfcfTFp+"];
linode_cli_pat.publicKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCx/tvR11RUMbYaauuHPxR3j79vm1Hxg+Y3LXR+rLgZ7N/2ulvIzLLZgVuIUbmJHDqkp9Au5zZPMZjsKbaqQ8V75wSEcyaSMbaxC9PaNDCwEHMJWaz8XPQe5IjVRE5O+4sTyh7ZBx+NMQmPcQbrNInoKuy4EjFmwTW/t0xYo/sCrC0NX0cCyeBwii2JdFXytXfxF+RMzGNXw1xfcOFJe6F7JdS/Cpf/0fe+VmNg8d0nic4Obcb/djYsRLAAC6Cvb+4i3EBZWl+9Ih9hId8bFCRKhI6TmGT2z4YUTa+v+3j/JZUh1gD5n4vRGf8QjLj9N6DrBnKcbywwqyqnLhTLgBBN35rcLdU1k3n0NorRRDCU0Lg/ejsFe3oi2FmOwNmmd8zqBNZHjJTi5Wy63EXMFwHltEY2M+hAhgWsQ5U4zuVPgv1HfD6LYPodRwhdZivwTNr2IClAiVVxR//O0WtrRXrrEM5uudj+Y30/ah7bn9Mje86UV0TqfS2tdjtMkySHL+M= adriano@z1" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILUJR7tGcQEwWj9lGEoC2sqWzxFif1BFddYzZfcfTFp+"];
}

36
operate/hosts/ncm-1/default.nix
View file

@ -18,9 +18,12 @@
hostName = "ncm-1";
nftables.enable = true;
firewall = {
# always allow traffic from the tailnet
trustedInterfaces = ["tailscale0" "eth1"];
allowedTCPPorts = [22 80 443];
logRefusedConnections = true;
logRefusedPackets = true;
checkReversePath = false;
# always allow traffic from the tailnet and internal network
trustedInterfaces = ["tailscale0" "enp0s5" "podman0" "veth0"];
allowedTCPPorts = [22 80 443 24017];
allowedUDPPorts = [config.services.tailscale.port];
};
};
@ -42,11 +45,6 @@
};
};
# age.secrets.docker_auth_json = {
# file = ./secrets/docker_ghcr_auth_config_json.age;
# path = "/run/containers/0/auth.json";
# };
age.secrets.tailscale_auth_key = {
file = ./secrets/tailscale_auth_key;
};
@ -67,28 +65,6 @@
'')
];
#
# TEST: authentication to private repo
#
# environment.variables = {
# XDG_RUNTIME_DIR = "/var/run/user/0";
# };
# Define a systemd service to create files in /var/run/user/0
# systemd.services."create-incus-ghcr-auth-file" = {
# description = "Create ghcr.io auth file for incus to retrieve private images";
# after = ["default.target"];
# wantedBy = ["default.target"];
# serviceConfig = {
# ExecStart = ''${pkgs.bashInteractive}/bin/bash -c 'echo {\\"auths\\":{ \\"ghcr.io\\": {\\"auth\\": \\"YWNhbG9pYXJvOiBnaHBfVnN4dzc4YXZ6N0lBeXQyejVrcGpZQTJXV21XbUZNMzlZdkMxIA==\\"}}} > /var/run/user/0/containers/auth.json' '';
# ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/run/user/0/containers";
# Restart = "no";
# };
# };
#
# /TEST: authentication to private repo
#
users.users = {
root = {
openssh.authorizedKeys.keys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCx/tvR11RUMbYaauuHPxR3j79vm1Hxg+Y3LXR+rLgZ7N/2ulvIzLLZgVuIUbmJHDqkp9Au5zZPMZjsKbaqQ8V75wSEcyaSMbaxC9PaNDCwEHMJWaz8XPQe5IjVRE5O+4sTyh7ZBx+NMQmPcQbrNInoKuy4EjFmwTW/t0xYo/sCrC0NX0cCyeBwii2JdFXytXfxF+RMzGNXw1xfcOFJe6F7JdS/Cpf/0fe+VmNg8d0nic4Obcb/djYsRLAAC6Cvb+4i3EBZWl+9Ih9hId8bFCRKhI6TmGT2z4YUTa+v+3j/JZUh1gD5n4vRGf8QjLj9N6DrBnKcbywwqyqnLhTLgBBN35rcLdU1k3n0NorRRDCU0Lg/ejsFe3oi2FmOwNmmd8zqBNZHjJTi5Wy63EXMFwHltEY2M+hAhgWsQ5U4zuVPgv1HfD6LYPodRwhdZivwTNr2IClAiVVxR//O0WtrRXrrEM5uudj+Y30/ah7bn9Mje86UV0TqfS2tdjtMkySHL+M= adriano@z1"];

3
operate/hosts/ncm-1/nomad.nix
View file

@ -59,6 +59,9 @@
"public" = {
interface = "enp0s4";
};
"private" = {
cidr = "10.0.1.2/24";
};
};
artifact = {
# Workaround for landlock issue: https://github.com/hashicorp/nomad/issues/18721

4
operate/hosts/ncm-1/secrets/secrets.nix
View file

@ -1,6 +1,6 @@
# Use ssh-keyscan <SERVER> to fetch the below keys for target systems (SSH server must be running on system)
let
in {
tailscale_auth_key.publicKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCx/tvR11RUMbYaauuHPxR3j79vm1Hxg+Y3LXR+rLgZ7N/2ulvIzLLZgVuIUbmJHDqkp9Au5zZPMZjsKbaqQ8V75wSEcyaSMbaxC9PaNDCwEHMJWaz8XPQe5IjVRE5O+4sTyh7ZBx+NMQmPcQbrNInoKuy4EjFmwTW/t0xYo/sCrC0NX0cCyeBwii2JdFXytXfxF+RMzGNXw1xfcOFJe6F7JdS/Cpf/0fe+VmNg8d0nic4Obcb/djYsRLAAC6Cvb+4i3EBZWl+9Ih9hId8bFCRKhI6TmGT2z4YUTa+v+3j/JZUh1gD5n4vRGf8QjLj9N6DrBnKcbywwqyqnLhTLgBBN35rcLdU1k3n0NorRRDCU0Lg/ejsFe3oi2FmOwNmmd8zqBNZHjJTi5Wy63EXMFwHltEY2M+hAhgWsQ5U4zuVPgv1HfD6LYPodRwhdZivwTNr2IClAiVVxR//O0WtrRXrrEM5uudj+Y30/ah7bn9Mje86UV0TqfS2tdjtMkySHL+M= adriano@z1" ""];
linode_cli_pat.publicKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCx/tvR11RUMbYaauuHPxR3j79vm1Hxg+Y3LXR+rLgZ7N/2ulvIzLLZgVuIUbmJHDqkp9Au5zZPMZjsKbaqQ8V75wSEcyaSMbaxC9PaNDCwEHMJWaz8XPQe5IjVRE5O+4sTyh7ZBx+NMQmPcQbrNInoKuy4EjFmwTW/t0xYo/sCrC0NX0cCyeBwii2JdFXytXfxF+RMzGNXw1xfcOFJe6F7JdS/Cpf/0fe+VmNg8d0nic4Obcb/djYsRLAAC6Cvb+4i3EBZWl+9Ih9hId8bFCRKhI6TmGT2z4YUTa+v+3j/JZUh1gD5n4vRGf8QjLj9N6DrBnKcbywwqyqnLhTLgBBN35rcLdU1k3n0NorRRDCU0Lg/ejsFe3oi2FmOwNmmd8zqBNZHjJTi5Wy63EXMFwHltEY2M+hAhgWsQ5U4zuVPgv1HfD6LYPodRwhdZivwTNr2IClAiVVxR//O0WtrRXrrEM5uudj+Y30/ah7bn9Mje86UV0TqfS2tdjtMkySHL+M= adriano@z1" ""];
tailscale_auth_key.publicKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCx/tvR11RUMbYaauuHPxR3j79vm1Hxg+Y3LXR+rLgZ7N/2ulvIzLLZgVuIUbmJHDqkp9Au5zZPMZjsKbaqQ8V75wSEcyaSMbaxC9PaNDCwEHMJWaz8XPQe5IjVRE5O+4sTyh7ZBx+NMQmPcQbrNInoKuy4EjFmwTW/t0xYo/sCrC0NX0cCyeBwii2JdFXytXfxF+RMzGNXw1xfcOFJe6F7JdS/Cpf/0fe+VmNg8d0nic4Obcb/djYsRLAAC6Cvb+4i3EBZWl+9Ih9hId8bFCRKhI6TmGT2z4YUTa+v+3j/JZUh1gD5n4vRGf8QjLj9N6DrBnKcbywwqyqnLhTLgBBN35rcLdU1k3n0NorRRDCU0Lg/ejsFe3oi2FmOwNmmd8zqBNZHjJTi5Wy63EXMFwHltEY2M+hAhgWsQ5U4zuVPgv1HfD6LYPodRwhdZivwTNr2IClAiVVxR//O0WtrRXrrEM5uudj+Y30/ah7bn9Mje86UV0TqfS2tdjtMkySHL+M= adriano@z1" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKbgB/dhJKY4lX8jmvY0C9enBHDnP5sx5GOYqFQlR+op"];
linode_cli_pat.publicKeys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCx/tvR11RUMbYaauuHPxR3j79vm1Hxg+Y3LXR+rLgZ7N/2ulvIzLLZgVuIUbmJHDqkp9Au5zZPMZjsKbaqQ8V75wSEcyaSMbaxC9PaNDCwEHMJWaz8XPQe5IjVRE5O+4sTyh7ZBx+NMQmPcQbrNInoKuy4EjFmwTW/t0xYo/sCrC0NX0cCyeBwii2JdFXytXfxF+RMzGNXw1xfcOFJe6F7JdS/Cpf/0fe+VmNg8d0nic4Obcb/djYsRLAAC6Cvb+4i3EBZWl+9Ih9hId8bFCRKhI6TmGT2z4YUTa+v+3j/JZUh1gD5n4vRGf8QjLj9N6DrBnKcbywwqyqnLhTLgBBN35rcLdU1k3n0NorRRDCU0Lg/ejsFe3oi2FmOwNmmd8zqBNZHjJTi5Wy63EXMFwHltEY2M+hAhgWsQ5U4zuVPgv1HfD6LYPodRwhdZivwTNr2IClAiVVxR//O0WtrRXrrEM5uudj+Y30/ah7bn9Mje86UV0TqfS2tdjtMkySHL+M= adriano@z1" "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKbgB/dhJKY4lX8jmvY0C9enBHDnP5sx5GOYqFQlR+op"];
}

36
operate/hosts/ncm-2/default.nix
View file

@ -18,9 +18,12 @@
hostName = "ncm-2";
nftables.enable = true;
firewall = {
# always allow traffic from the tailnet
trustedInterfaces = ["tailscale0" "eth1"];
allowedTCPPorts = [22 80 443];
logRefusedConnections = true;
logRefusedPackets = true;
checkReversePath = false;
# always allow traffic from the tailnet and internal network
trustedInterfaces = ["tailscale0" "enp0s5" "podman0" "veth0"];
allowedTCPPorts = [22 80 443 24017];
allowedUDPPorts = [config.services.tailscale.port];
};
};
@ -42,11 +45,6 @@
};
};
# age.secrets.docker_auth_json = {
# file = ./secrets/docker_ghcr_auth_config_json.age;
# path = "/run/containers/0/auth.json";
# };
age.secrets.tailscale_auth_key = {
file = ./secrets/tailscale_auth_key;
};
@ -67,28 +65,6 @@
'')
];
#
# TEST: authentication to private repo
#
# environment.variables = {
# XDG_RUNTIME_DIR = "/var/run/user/0";
# };
# Define a systemd service to create files in /var/run/user/0
# systemd.services."create-incus-ghcr-auth-file" = {
# description = "Create ghcr.io auth file for incus to retrieve private images";
# after = ["default.target"];
# wantedBy = ["default.target"];
# serviceConfig = {
# ExecStart = ''${pkgs.bashInteractive}/bin/bash -c 'echo {\\"auths\\":{ \\"ghcr.io\\": {\\"auth\\": \\"YWNhbG9pYXJvOiBnaHBfVnN4dzc4YXZ6N0lBeXQyejVrcGpZQTJXV21XbUZNMzlZdkMxIA==\\"}}} > /var/run/user/0/containers/auth.json' '';
# ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/run/user/0/containers";
# Restart = "no";
# };
# };
#
# /TEST: authentication to private repo
#
users.users = {
root = {
openssh.authorizedKeys.keys = ["ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCx/tvR11RUMbYaauuHPxR3j79vm1Hxg+Y3LXR+rLgZ7N/2ulvIzLLZgVuIUbmJHDqkp9Au5zZPMZjsKbaqQ8V75wSEcyaSMbaxC9PaNDCwEHMJWaz8XPQe5IjVRE5O+4sTyh7ZBx+NMQmPcQbrNInoKuy4EjFmwTW/t0xYo/sCrC0NX0cCyeBwii2JdFXytXfxF+RMzGNXw1xfcOFJe6F7JdS/Cpf/0fe+VmNg8d0nic4Obcb/djYsRLAAC6Cvb+4i3EBZWl+9Ih9hId8bFCRKhI6TmGT2z4YUTa+v+3j/JZUh1gD5n4vRGf8QjLj9N6DrBnKcbywwqyqnLhTLgBBN35rcLdU1k3n0NorRRDCU0Lg/ejsFe3oi2FmOwNmmd8zqBNZHjJTi5Wy63EXMFwHltEY2M+hAhgWsQ5U4zuVPgv1HfD6LYPodRwhdZivwTNr2IClAiVVxR//O0WtrRXrrEM5uudj+Y30/ah7bn9Mje86UV0TqfS2tdjtMkySHL+M= adriano@z1"];

3
operate/hosts/ncm-2/nomad.nix
View file

@ -59,6 +59,9 @@
"public" = {
interface = "enp0s4";
};
"private" = {
cidr = "10.0.1.2/24";
};
};
artifact = {
# Workaround for landlock issue: https://github.com/hashicorp/nomad/issues/18721

36
operate/templates/default.nix
View file

@ -18,9 +18,12 @@
hostName = name;
nftables.enable = true;
firewall = {
# always allow traffic from the tailnet
trustedInterfaces = ["tailscale0" "eth1"];
allowedTCPPorts = [22 80 443];
logRefusedConnections = true;
logRefusedPackets = true;
checkReversePath = false;
# always allow traffic from the tailnet and internal network
trustedInterfaces = ["tailscale0" "enp0s5" "podman0" "veth0"];
allowedTCPPorts = [22 80 443 24017];
allowedUDPPorts = [config.services.tailscale.port];
};
};
@ -42,11 +45,6 @@
};
};
# age.secrets.docker_auth_json = {
# file = ./secrets/docker_ghcr_auth_config_json.age;
# path = "/run/containers/0/auth.json";
# };
age.secrets.tailscale_auth_key = {
file = ./secrets/tailscale_auth_key;
};
@ -67,28 +65,6 @@
'')
];
#
# TEST: authentication to private repo
#
# environment.variables = {
# XDG_RUNTIME_DIR = "/var/run/user/0";
# };
# Define a systemd service to create files in /var/run/user/0
# systemd.services."create-incus-ghcr-auth-file" = {
# description = "Create ghcr.io auth file for incus to retrieve private images";
# after = ["default.target"];
# wantedBy = ["default.target"];
# serviceConfig = {
# ExecStart = ''${pkgs.bashInteractive}/bin/bash -c 'echo {\\"auths\\":{ \\"ghcr.io\\": {\\"auth\\": \\"YWNhbG9pYXJvOiBnaHBfVnN4dzc4YXZ6N0lBeXQyejVrcGpZQTJXV21XbUZNMzlZdkMxIA==\\"}}} > /var/run/user/0/containers/auth.json' '';
# ExecStartPre = "${pkgs.coreutils}/bin/mkdir -p /var/run/user/0/containers";
# Restart = "no";
# };
# };
#
# /TEST: authentication to private repo
#
users.users = {
root = {
openssh.authorizedKeys.keys = [];

3
operate/templates/nomad.nix
View file

@ -59,6 +59,9 @@
"public" = {
interface = "enp0s4";
};
"private" = {
cidr = "10.0.1.2/24";
};
};
artifact = {
# Workaround for landlock issue: https://github.com/hashicorp/nomad/issues/18721