me/sfos
1
0
Fork 0
mirror of https://github.com/acaloiaro/sfos synced 2026-07-21 10:12:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Checkpoint with hetzner-only support

Browse source
This commit is contained in:
Adriano Caloiaro 2024-12-15 09:04:05 -07:00
parent 91e96113a9
commit 0773b9fb41
No known key found for this signature in database
GPG key ID: C2BC56DE73CE3F75
16 changed files with 45 additions and 1744 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
bootstrap/compute_providers/hetzner/main.tf
View file

@ -45,7 +45,7 @@ resource "hcloud_server" "nodes" {
data "template_file" "cloud_config" {
template = file("config/cloud_config.tpl")
template = file("config/cloud-config.tpl")
vars = {
tailscale_auth_key = var.tailscale_auth_key
admin_ssh_public_key = var.admin_ssh_public_key

2
bootstrap/compute_providers/linode/outputs.tf
View file

@ -1,3 +1,3 @@
output "ip_addresses" {
value = linode_instance.sfos.*.ipv4
value = flatten(linode_instance.sfos.*.ipv4)
}

6
bootstrap/flake.lock
View file

@ -1253,11 +1253,11 @@
},
"nixpkgs_8": {
"locked": {
"lastModified": 1732824227,
"narHash": "sha256-fYNXgpu1AEeLyd3fQt4Ym0tcVP7cdJ8wRoqJ+CtTRyY=",
"lastModified": 1734083684,
"narHash": "sha256-5fNndbndxSx5d+C/D0p/VF32xDiJCJzyOqorOYW4JEo=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "c71ad5c34d51dcbda4c15f44ea4e4aa6bb6ac1e9",
"rev": "314e12ba369ccdb9b352a4db26ff419f7c49fa84",
"type": "github"
},
"original": {

2
bootstrap/main.tf
View file

@ -23,7 +23,7 @@ terraform {
module "compute_provider" {
source = "./compute_providers/linode"
source = "./compute_providers/hetzner"
compute_provider_access_token = var.compute_provider_access_token
compute_provider_node_type = var.compute_provider_node_type
compute_provider_region = var.compute_provider_region

34
bootstrap/nixos/sfos-host-01/configuration.nix
View file

@ -7,10 +7,10 @@
./hardware-configuration.nix
./disko-config.nix
# ../../modules/common/qemu.nix
# ../common/base-system.nix
../common/base-system.nix
../../common/nix.nix
# ../common/podman.nix
# ../common/incus.nix
../common/podman.nix
../common/incus.nix
];
boot = {
@ -33,22 +33,22 @@
firewall = {
allowedTCPPorts = [22];
allowedUDPPorts = [config.services.tailscale.port];
# interfaces.incusbr0.allowedTCPPorts = [
# 22
# 53
# 67
# ];
# interfaces.incusbr0.allowedUDPPorts = [
# 53
# 67
# ];
interfaces.incusbr0.allowedTCPPorts = [
22
53
67
];
interfaces.incusbr0.allowedUDPPorts = [
53
67
];
};
};
services.openssh.enable = true;
# sfos.incus = {
# enable = true;
# admin-users = ["sfos"];
# };
# services.tailscale.enable = true;
sfos.incus = {
enable = true;
admin-users = ["sfos"];
};
services.tailscale.enable = true;
system.stateVersion = "24.05";
}

4
bootstrap/outputs.tf Normal file
View file

@ -0,0 +1,4 @@
output "cluster_ips" {
description = "the ipv4 addresses of cluster members"
value = module.compute_provider.ip_addresses
}

33
common/nix.nix
View file

@ -1,33 +0,0 @@
{pkgs, ...}: {
nixpkgs = {
config = {
allowUnfree = true;
};
};
nix = {
package = pkgs.nix;
gc = {
automatic = true;
dates = "weekly";
options = "--delete-older-than 14d";
};
settings = {
trusted-users = [
"@wheel"
];
experimental-features = [
"flakes"
"nix-command"
];
trusted-public-keys = [
"cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
"nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs="
];
};
};
}

26
env.sample
View file

@ -1,23 +1,17 @@
# sfos uses opentofu/terraform to provision infrastrucutre. By default, infrastructure state may be stored in any s3-compatible object store.
# Despite the name of this variables, this access key need not be for AWS (Amazon Web Services)
# Despite the name of this variables, this access key may not be for AWS (Amazon Web Services)
#
# AWS_ACCESS_KEY_ID is the access key for reading/writing opentofu/terraform state to/from a s3-compatible object store
AWS_ACCESS_KEY_ID=<AWS_ACCESS_KEY_ID>
export AWS_ACCESS_KEY_ID=<AWS_ACCESS_KEY_ID>
# sfos uses opentofu/terraform to provision infrastrucutre. By default, infrastructure state may be stored in any s3-compatible object store
# Despite the name of this variables, this access key need not be for AWS (Amazon Web Services)
#
# AWS_SECRET_ACCESS_KEY is the secret access key for reading/writing opentofu/terraform to/from a s3-compatible object store
AWS_SECRET_ACCESS_KEY=<AWS_SECRET_ACCESS_KEY>
export AWS_SECRET_ACCESS_KEY=<AWS_SECRET_ACCESS_KEY>
# Tailscale key to join the Tailnet
TF_VAR_tailscale_auth_key=<TF_VAR_tailscale_auth_key>
# Access token for accessing your compute provider's provisioning API
# Below is hetzner
# export TF_VAR_compute_provider_access_token=<TF_VAR_compute_provider_access_token>
# Linode
export TF_VAR_compute_provider_access_token=<TF_VAR_compute_provider_access_token>
export TF_VAR_tailscale_auth_key=<TF_VAR_tailscale_auth_key>
# The SSH public key of the admin user who is able to SSH into created nodes
export TF_VAR_admin_ssh_public_key=<TF_VAR_admin_ssh_public_key>
@ -26,16 +20,22 @@ export TF_VAR_admin_ssh_public_key=<TF_VAR_admin_ssh_public_key>
# Compute provider configuration
#######################################################################################################################
# Access token for accessing your compute provider's provisioning API
# Below is hetzner
export TF_VAR_compute_provider_access_token=<TF_VAR_compute_provider_access_token>
# Linode
# export TF_VAR_compute_provider_access_token=<TF_VAR_compute_provider_access_token>
#
# The name your compute provider uses to refer to the type of compute resource/node you're creating, e.g Hetzner 'cpx21' for CPX21 server
# Linode types can be retrieved with: linode-cli linodes types
# export TF_VAR_compute_provider_node_type=<TF_VAR_compute_provider_node_type>
#Linode
export TF_VAR_compute_provider_node_type=<TF_VAR_compute_provider_node_type>
#Linode
# export TF_VAR_compute_provider_node_type=<TF_VAR_compute_provider_node_type>
# The region in which to create compute nodes
# Hetzner
# export TF_VAR_compute_provider_region=<TF_VAR_compute_provider_region>
export TF_VAR_compute_provider_region=<TF_VAR_compute_provider_region>
# export TF_VAR_compute_provider_region=<TF_VAR_compute_provider_region>
# The location in the region in which to create compute nodes
export TF_VAR_compute_provider_location=<TF_VAR_compute_provider_location>

23
flake.lock
View file

@ -1237,11 +1237,11 @@
},
"nixpkgs_8": {
"locked": {
"lastModified": 1732014248,
"narHash": "sha256-y/MEyuJ5oBWrWAic/14LaIr/u5E0wRVzyYsouYY3W6w=",
"lastModified": 1732837521,
"narHash": "sha256-jNRNr49UiuIwaarqijgdTR2qLPifxsVhlJrKzQ8XUIE=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "23e89b7da85c3640bbc2173fe04f4bd114342367",
"rev": "970e93b9f82e2a0f3675757eb0bfc73297cc6370",
"type": "github"
},
"original": {
@ -1408,7 +1408,6 @@
"microvm": "microvm",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs_8",
"stable": "stable",
"systems": "systems_7"
}
},
@ -1428,22 +1427,6 @@
"url": "https://spectrum-os.org/git/spectrum"
}
},
"stable": {
"locked": {
"lastModified": 1731797254,
"narHash": "sha256-df3dJApLPhd11AlueuoN0Q4fHo/hagP75LlM5K1sz9g=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "e8c38b73aeb218e27163376a2d617e61a2ad9b59",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-24.05",
"repo": "nixpkgs",
"type": "github"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,

6
flake.nix
View file

@ -8,7 +8,6 @@
inputs = {
flake-utils.url = "github:numtide/flake-utils";
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
stable.url = "github:NixOS/nixpkgs/nixos-24.05";
systems.url = "github:nix-systems/default";
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
devenv.url = "github:cachix/devenv";
@ -37,7 +36,6 @@
microvm,
nixpkgs,
self,
stable,
systems,
...
}: let
@ -121,7 +119,7 @@
}:
nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = {inherit inputs outputs stable self;};
specialArgs = {inherit inputs outputs self;};
modules =
modules
++ [
@ -133,7 +131,7 @@
microvm-config = {modules}:
nixpkgs.lib.nixosSystem {
inherit system;
specialArgs = {inherit inputs outputs stable self;};
specialArgs = {inherit inputs outputs self;};
modules =
modules
++ [

78
nixos/common/base-system.nix
View file

@ -1,78 +0,0 @@
{
lib,
pkgs,
self,
...
}: {
imports = [
../../common/nix.nix
];
# boot = {
# initrd.systemd.enable = true;
# tmp = {
# cleanOnBoot = true;
# useTmpfs = true;
# };
# loader = {
# efi.canTouchEfiVariables = true;
# systemd-boot = {
# enable = true;
# configurationLimit = 20;
# };
# };
# };
environment = {
systemPackages = with pkgs; [
lsof
wget
];
};
i18n = let
locale = "en_US.UTF-8";
in {
defaultLocale = locale;
extraLocaleSettings = {
LC_ADDRESS = locale;
LC_IDENTIFICATION = locale;
LC_MEASUREMENT = locale;
LC_MONETARY = locale;
LC_NAME = locale;
LC_NUMERIC = locale;
LC_PAPER = locale;
LC_TELEPHONE = locale;
LC_TIME = locale;
};
};
networking = {
enableIPv6 = false;
};
programs = {};
services = {
fstrim.enable = true;
locate.enable = true;
rsyslogd.enable = true;
openssh = {
enable = true;
settings.PermitRootLogin = "no";
};
};
security = {
rtkit.enable = true;
};
systemd.services.nix-daemon = {
environment.TMPDIR = "/var/tmp";
};
time.timeZone = "America/New_York";
users.mutableUsers = false;
system.configurationRevision = lib.mkIf (self ? rev) self.rev;
}

67
nixos/common/incus.nix
View file

@ -1,67 +0,0 @@
{
config,
lib,
...
}:
with lib; let
cfg = config.sfos.incus;
in {
options.sfos.incus.enable = mkEnableOption "enable incus";
options.sfos.incus.admin-users = mkOption {
type = with types; listOf str;
description = "A list of system users who are incus admins";
default = [];
};
config = mkIf cfg.enable {
virtualisation = {
incus = {
enable = true;
# Setup the incus cluster
preseed = {
networks = [
{
config = {
"ipv4.address" = "10.0.100.1/24";
"ipv4.nat" = "true";
};
name = "incusbr0";
type = "bridge";
}
];
profiles = [
{
devices = {
eth0 = {
name = "eth0";
network = "incusbr0";
type = "nic";
};
root = {
path = "/";
pool = "default";
size = "10GiB";
type = "disk";
};
};
name = "default";
}
];
storage_pools = [
{
config = {
source = "/var/lib/incus/storage-pools/default";
};
driver = "dir";
name = "default";
}
];
};
};
};
# Add users as incus admins
users.groups."incus-admin" = mkIf (cfg.admin-users != []) {members = cfg.admin-users;};
};
}

23
nixos/common/podman.nix
View file

@ -1,23 +0,0 @@
{pkgs, ...}: {
virtualisation = {
podman = {
enable = true;
# Alias all docker commands to podman
dockerCompat = true;
# Required for containers under podman-compose to be able to talk to each other.
defaultNetwork.settings.dns_enabled = true;
autoPrune = {
enable = true;
dates = "weekly";
flags = [
"--filter=until=24h"
# Don't prune containers flagged 'important'
"--filter=label!=important"
];
};
};
};
environment.systemPackages = with pkgs; [
podman-compose
];
}

40
nixos/sfos-host-01/configuration.nix
View file

@ -1,40 +0,0 @@
{config, ...}: {
imports = [
../common/base-system.nix
../common/podman.nix
../common/incus.nix
./hardware-configuration.nix
../../modules/common/qemu.nix
];
users.users.sfos = {
isNormalUser = true;
extraGroups = ["wheel"];
initialPassword = "Test.123";
};
networking = {
hostName = "sfos-host-01";
nftables.enable = true;
firewall = {
allowedTCPPorts = [22];
allowedUDPPorts = [config.services.tailscale.port];
interfaces.incusbr0.allowedTCPPorts = [
22
53
67
];
interfaces.incusbr0.allowedUDPPorts = [
53
67
];
};
};
sfos.incus = {
enable = true;
admin-users = ["sfos"];
};
services.tailscale.enable = true;
system.stateVersion = "24.05";
}

1442
nixos/sfos-host-01/facter.json
View file

File diff suppressed because it is too large Load diff

1
nixos/sfos-host-01/hardware-configuration.nix
View file

@ -1 +0,0 @@
{}