mirror of
https://github.com/acaloiaro/sfos
synced 2026-07-21 10:12:24 +00:00
WIP
This commit is contained in:
Adriano Caloiaro
parent
7c3139f761
commit
ca6bd38a6b
4 changed files with 157 additions and 1 deletions
72
flake.lock
72
flake.lock
|
|
@ -63,6 +63,24 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-utils_2": {
|
||||
"inputs": {
|
||||
"systems": "systems_3"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1726560853,
|
||||
"narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "numtide",
|
||||
"repo": "flake-utils",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"home-manager": {
|
||||
"inputs": {
|
||||
"nixpkgs": [
|
||||
|
|
@ -84,6 +102,28 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"microvm": {
|
||||
"inputs": {
|
||||
"flake-utils": "flake-utils_2",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
],
|
||||
"spectrum": "spectrum"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1732122592,
|
||||
"narHash": "sha256-lF54irx92m8ddNDQDtOUjKsZAnsGyPL3QTO7byjlxNg=",
|
||||
"owner": "astro",
|
||||
"repo": "microvm.nix",
|
||||
"rev": "19650774c23df84d0b8f315d2527274563497cad",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "astro",
|
||||
"repo": "microvm.nix",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-hardware": {
|
||||
"locked": {
|
||||
"lastModified": 1731797098,
|
||||
|
|
@ -120,11 +160,28 @@
|
|||
"inputs": {
|
||||
"agenix": "agenix",
|
||||
"flake-utils": "flake-utils",
|
||||
"microvm": "microvm",
|
||||
"nixos-hardware": "nixos-hardware",
|
||||
"nixpkgs": "nixpkgs",
|
||||
"stable": "stable"
|
||||
}
|
||||
},
|
||||
"spectrum": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1729945407,
|
||||
"narHash": "sha256-iGNMamNOAnVTETnIVqDWd6fl74J8fLEi1ejdZiNjEtY=",
|
||||
"ref": "refs/heads/main",
|
||||
"rev": "f1d94ee7029af18637dbd5fdf4749621533693fa",
|
||||
"revCount": 764,
|
||||
"type": "git",
|
||||
"url": "https://spectrum-os.org/git/spectrum"
|
||||
},
|
||||
"original": {
|
||||
"type": "git",
|
||||
"url": "https://spectrum-os.org/git/spectrum"
|
||||
}
|
||||
},
|
||||
"stable": {
|
||||
"locked": {
|
||||
"lastModified": 1731797254,
|
||||
|
|
@ -170,6 +227,21 @@
|
|||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"systems_3": {
|
||||
"locked": {
|
||||
"lastModified": 1681028828,
|
||||
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "nix-systems",
|
||||
"repo": "default",
|
||||
"type": "github"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
|
|
|
|||
61
flake.nix
61
flake.nix
|
|
@ -1,5 +1,9 @@
|
|||
{
|
||||
description = "sfos (self-host os)";
|
||||
nixConfig = {
|
||||
extra-substituters = ["https://microvm.cachix.org"];
|
||||
extra-trusted-public-keys = ["microvm.cachix.org-1:oXnBc6hRE3eX5rSYdRyMYXnfzcCxC7yKPTbZXALsqys="];
|
||||
};
|
||||
|
||||
inputs = {
|
||||
flake-utils.url = "github:numtide/flake-utils";
|
||||
|
|
@ -7,6 +11,10 @@
|
|||
stable.url = "github:NixOS/nixpkgs/nixos-24.05";
|
||||
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
|
||||
|
||||
microvm = {
|
||||
url = "github:astro/microvm.nix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
agenix = {
|
||||
url = "github:ryantm/agenix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
|
@ -15,6 +23,7 @@
|
|||
|
||||
outputs = inputs @ {
|
||||
agenix,
|
||||
microvm,
|
||||
nixpkgs,
|
||||
self,
|
||||
stable,
|
||||
|
|
@ -22,8 +31,14 @@
|
|||
}: let
|
||||
inherit (self) outputs;
|
||||
lib = nixpkgs.lib;
|
||||
system = "x86_64-linux";
|
||||
in {
|
||||
inherit lib;
|
||||
packages.${system} = {
|
||||
default = self.packages.${system}.my-microvm;
|
||||
my-microvm = self.nixosConfigurations.my-microvm.config.microvm.declaredRunner;
|
||||
};
|
||||
|
||||
nixosModules = import ./modules/nixos;
|
||||
|
||||
nixosConfigurations = let
|
||||
|
|
@ -42,8 +57,54 @@
|
|||
{environment.systemPackages = [agenix.packages.${system}.default];}
|
||||
];
|
||||
};
|
||||
microvm-config = {modules}:
|
||||
nixpkgs.lib.nixosSystem {
|
||||
inherit system;
|
||||
specialArgs = {inherit inputs outputs stable self;};
|
||||
modules =
|
||||
modules
|
||||
++ [
|
||||
microvm.nixosModules.microvm
|
||||
{
|
||||
users.users.root.password = "";
|
||||
microvm = {
|
||||
volumes = [
|
||||
{
|
||||
mountPoint = "/var";
|
||||
image = "var.img";
|
||||
size = 256;
|
||||
}
|
||||
];
|
||||
|
||||
interfaces = [
|
||||
{
|
||||
type = "user";
|
||||
id = "net1";
|
||||
mac = "02:00:00:00:00:01";
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
# use proto = "virtiofs" for MicroVMs that are started by systemd
|
||||
proto = "9p";
|
||||
tag = "ro-store";
|
||||
# a host's /nix/store will be picked up so that no
|
||||
# squashfs/erofs will be built for it.
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
}
|
||||
];
|
||||
|
||||
# "qemu" has 9p built-in!
|
||||
hypervisor = "qemu";
|
||||
socket = "control.socket";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
in {
|
||||
sfos-host-01 = nixos-config {modules = [./nixos/sfos-host-01/configuration.nix];};
|
||||
my-microvm = microvm-config {modules = [./nixos/sfos-host-01/configuration.nix];};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
21
nixos/common/incus.nix
Normal file
21
nixos/common/incus.nix
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
with lib; let
|
||||
cfg = config.sfos.incus;
|
||||
in {
|
||||
options.sfos.incus.enable = mkEnableOption "enable incus";
|
||||
options.sfos.incus.admin-users = mkOption {
|
||||
type = with types; listOf str;
|
||||
description = "A list of system users who are incus admin";
|
||||
default = [];
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
virtualisation = {
|
||||
incus.enable = true;
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -2,6 +2,7 @@
|
|||
imports = [
|
||||
../common/base-system.nix
|
||||
../common/podman.nix
|
||||
../common/incus.nix
|
||||
./hardware-configuration.nix
|
||||
../../modules/common/qemu.nix
|
||||
];
|
||||
|
|
@ -14,14 +15,15 @@
|
|||
|
||||
networking = {
|
||||
hostName = "sfos-host-01";
|
||||
nftables.enable = true;
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [22];
|
||||
trustedInterfaces = ["tailscale0"];
|
||||
allowedUDPPorts = [config.services.tailscale.port];
|
||||
};
|
||||
};
|
||||
|
||||
sfos.incus.enable = true;
|
||||
services.tailscale.enable = true;
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue