diff --git a/flake.lock b/flake.lock index 58dc309..92c321f 100644 --- a/flake.lock +++ b/flake.lock @@ -35,10 +35,32 @@ "type": "github" } }, - "deploy-rs": { + "colmena": { "inputs": { "flake-compat": "flake-compat", + "flake-utils": "flake-utils", + "nix-github-actions": "nix-github-actions", "nixpkgs": "nixpkgs_2", + "stable": "stable" + }, + "locked": { + "lastModified": 1755272288, + "narHash": "sha256-ypTPb2eKcOBbOoyvPV0j4ZOXs4kayo73/2KI456QnE0=", + "owner": "zhaofengli", + "repo": "colmena", + "rev": "5bf4ce6a24adba74a5184f4a9bef01d545a09473", + "type": "github" + }, + "original": { + "owner": "zhaofengli", + "repo": "colmena", + "type": "github" + } + }, + "deploy-rs": { + "inputs": { + "flake-compat": "flake-compat_2", + "nixpkgs": "nixpkgs_3", "utils": "utils" }, "locked": { @@ -115,11 +137,11 @@ "flake-compat": { "flake": false, "locked": { - "lastModified": 1733328505, - "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=", + "lastModified": 1650374568, + "narHash": "sha256-Z+s0J8/r907g149rllvwhb4pKi8Wam5ij0st8PwAh+E=", "owner": "edolstra", "repo": "flake-compat", - "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec", + "rev": "b4a34015c698c7793d592d66adbab377907a2be8", "type": "github" }, "original": { @@ -131,11 +153,11 @@ "flake-compat_2": { "flake": false, "locked": { - "lastModified": 1747046372, - "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=", + "lastModified": 1733328505, + "narHash": "sha256-NeCCThCEP3eCl2l/+27kNNK7QrwZB1IJCrXfrbv5oqU=", "owner": "edolstra", "repo": "flake-compat", - "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885", + "rev": "ff81ac966bb2cae68946d5ed5fc4994f96d0ffec", "type": "github" }, "original": { @@ -161,6 +183,22 @@ } }, "flake-compat_4": { + "flake": false, + "locked": { + "lastModified": 1747046372, + "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "9100a0f413b0c601e0533d1d94ffd501ce2e7885", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_5": { "flake": false, "locked": { "lastModified": 1696426674, @@ -217,6 +255,21 @@ } }, "flake-utils": { + "locked": { + "lastModified": 1659877975, + "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=", + "owner": "numtide", + "repo": "flake-utils", + "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0", + "type": "github" + }, + "original": { + "owner": "numtide", + "repo": "flake-utils", + "type": "github" + } + }, + "flake-utils_2": { "inputs": { "systems": "systems_2" }, @@ -234,7 +287,7 @@ "type": "github" } }, - "flake-utils_2": { + "flake-utils_3": { "inputs": { "systems": "systems_3" }, @@ -325,7 +378,7 @@ "headplane": { "inputs": { "devshell": "devshell", - "flake-utils": "flake-utils", + "flake-utils": "flake-utils_2", "nixpkgs": [ "nixpkgs" ] @@ -395,10 +448,31 @@ "type": "github" } }, + "nix-github-actions": { + "inputs": { + "nixpkgs": [ + "colmena", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1729742964, + "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=", + "owner": "nix-community", + "repo": "nix-github-actions", + "rev": "e04df33f62cdcf93d73e9a04142464753a16db67", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "nix-github-actions", + "type": "github" + } + }, "nixos-mailserver": { "inputs": { "blobs": "blobs", - "flake-compat": "flake-compat_2", + "flake-compat": "flake-compat_3", "git-hooks": "git-hooks", "nixpkgs": [ "nixpkgs" @@ -422,8 +496,8 @@ }, "nixos-wsl": { "inputs": { - "flake-compat": "flake-compat_3", - "nixpkgs": "nixpkgs_3" + "flake-compat": "flake-compat_4", + "nixpkgs": "nixpkgs_4" }, "locked": { "lastModified": 1758123407, @@ -504,6 +578,22 @@ } }, "nixpkgs_2": { + "locked": { + "lastModified": 1750134718, + "narHash": "sha256-v263g4GbxXv87hMXMCpjkIxd/viIF7p3JpJrwgKdNiI=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "9e83b64f727c88a7711a2c463a7b16eedb69a84c", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-unstable", + "repo": "nixpkgs", + "type": "github" + } + }, + "nixpkgs_3": { "locked": { "lastModified": 1743014863, "narHash": "sha256-jAIUqsiN2r3hCuHji80U7NNEafpIMBXiwKlSrjWMlpg=", @@ -519,7 +609,7 @@ "type": "github" } }, - "nixpkgs_3": { + "nixpkgs_4": { "locked": { "lastModified": 1757745802, "narHash": "sha256-hLEO2TPj55KcUFUU1vgtHE9UEIOjRcH/4QbmfHNF820=", @@ -535,7 +625,7 @@ "type": "github" } }, - "nixpkgs_4": { + "nixpkgs_5": { "locked": { "lastModified": 1758070117, "narHash": "sha256-uLwwHFCZnT1c3N3biVe/0hCkag2GSrf9+M56+Okf+WY=", @@ -551,7 +641,7 @@ "type": "github" } }, - "nixpkgs_5": { + "nixpkgs_6": { "locked": { "lastModified": 1751011381, "narHash": "sha256-krGXKxvkBhnrSC/kGBmg5MyupUUT5R6IBCLEzx9jhMM=", @@ -567,7 +657,7 @@ "type": "github" } }, - "nixpkgs_6": { + "nixpkgs_7": { "locked": { "lastModified": 1750811787, "narHash": "sha256-rD/978c35JXz6JLAzciTIOCMenPumF6zrQOj4rVZeHE=", @@ -583,7 +673,7 @@ "type": "github" } }, - "nixpkgs_7": { + "nixpkgs_8": { "locked": { "lastModified": 1730768919, "narHash": "sha256-8AKquNnnSaJRXZxc5YmF/WfmxiHX6MMZZasRP6RRQkE=", @@ -599,7 +689,7 @@ "type": "github" } }, - "nixpkgs_8": { + "nixpkgs_9": { "locked": { "lastModified": 1722813957, "narHash": "sha256-IAoYyYnED7P8zrBFMnmp7ydaJfwTnwcnqxUElC1I26Y=", @@ -618,7 +708,7 @@ "nixvim": { "inputs": { "flake-parts": "flake-parts", - "nixpkgs": "nixpkgs_5", + "nixpkgs": "nixpkgs_6", "nixvim": "nixvim_2", "pre-commit-hooks": "pre-commit-hooks" }, @@ -639,7 +729,7 @@ "nixvim_2": { "inputs": { "flake-parts": "flake-parts_2", - "nixpkgs": "nixpkgs_6", + "nixpkgs": "nixpkgs_7", "nuschtosSearch": "nuschtosSearch", "systems": "systems_4" }, @@ -659,7 +749,7 @@ }, "nuschtosSearch": { "inputs": { - "flake-utils": "flake-utils_2", + "flake-utils": "flake-utils_3", "ixx": "ixx", "nixpkgs": [ "nixvim", @@ -683,9 +773,9 @@ }, "pre-commit-hooks": { "inputs": { - "flake-compat": "flake-compat_4", + "flake-compat": "flake-compat_5", "gitignore": "gitignore_2", - "nixpkgs": "nixpkgs_7" + "nixpkgs": "nixpkgs_8" }, "locked": { "lastModified": 1750779888, @@ -704,13 +794,14 @@ "root": { "inputs": { "catppuccin": "catppuccin", + "colmena": "colmena", "deploy-rs": "deploy-rs", "disko": "disko", "headplane": "headplane", "home-manager": "home-manager", "nixos-mailserver": "nixos-mailserver", "nixos-wsl": "nixos-wsl", - "nixpkgs": "nixpkgs_4", + "nixpkgs": "nixpkgs_5", "nixpkgs-unstable": "nixpkgs-unstable", "nixvim": "nixvim", "sops-nix": "sops-nix", @@ -737,6 +828,22 @@ "type": "github" } }, + "stable": { + "locked": { + "lastModified": 1750133334, + "narHash": "sha256-urV51uWH7fVnhIvsZIELIYalMYsyr2FCalvlRTzqWRw=", + "owner": "NixOS", + "repo": "nixpkgs", + "rev": "36ab78dab7da2e4e27911007033713bab534187b", + "type": "github" + }, + "original": { + "owner": "NixOS", + "ref": "nixos-25.05", + "repo": "nixpkgs", + "type": "github" + } + }, "superdirt-src": { "flake": false, "locked": { @@ -833,7 +940,7 @@ "tidalcycles": { "inputs": { "dirt-samples-src": "dirt-samples-src", - "nixpkgs": "nixpkgs_8", + "nixpkgs": "nixpkgs_9", "superdirt-src": "superdirt-src", "tidal-src": "tidal-src", "vim-tidal-src": "vim-tidal-src", diff --git a/flake.nix b/flake.nix index 6f87e0b..c451fad 100644 --- a/flake.nix +++ b/flake.nix @@ -26,6 +26,9 @@ # deploy-rs deploy-rs.url = "github:serokell/deploy-rs"; + # colmena + colmena.url = "github:zhaofengli/colmena"; + # nixos-wsl nixos-wsl.url = "github:nix-community/NixOS-WSL/main"; @@ -58,6 +61,7 @@ nixpkgs, tidalcycles, deploy-rs, + colmena, ... }@inputs: let @@ -92,6 +96,20 @@ nixosModules = import ./modules/nixos; homeManagerModules = import ./modules/home-manager; + devShells = forAllSystems ( + system: + let + pkgs = nixpkgs.legacyPackages.${system}; + in + { + default = pkgs.mkShell { + buildInputs = [ + colmena.packages.${system}.colmena + ]; + }; + } + ); + nixosConfigurations = let hetzner = import ./lib/hetzner.nix { inherit inputs nixpkgs; }; @@ -136,7 +154,7 @@ }; # servers - db-01 = hetzner.mkHetznerMachine "db-01" { + db-01 = hetzner.mkMachine "db-01" { ipv6Address = "2a01:4f8:c012:15d4::/64"; }; hosting-01 = nixpkgs.lib.nixosSystem { @@ -146,7 +164,7 @@ ./hosts/hosting-01 ]; }; - hosting-02 = hetzner.mkHetznerMachine "hosting-02" { + hosting-02 = hetzner.mkMachine "hosting-02" { ipv6Address = "2a01:4f8:c013:7fc0::/64"; }; mail-01 = nixpkgs.lib.nixosSystem { @@ -166,6 +184,55 @@ }; }) { inherit (self.nixosConfigurations) db-01 hosting-02; }; + colmenaHive = + let + servers = builtins.map (file: nixpkgs.lib.removeSuffix ".nix" file) ( + builtins.filter (file: file != "common.nix" && nixpkgs.lib.hasSuffix ".nix" file) ( + builtins.attrNames (builtins.readDir ./hosts/servers) + ) + ); + + colmenaConfig = nixpkgs.lib.genAttrs servers ( + name: + { ... }: + let + diskConfig = import ./lib/disk-config.nix { inherit nixpkgs; }; + machineConfig = import ./hosts/servers/${name}.nix; + in + { + imports = [ + inputs.disko.nixosModules.disko + inputs.sops-nix.nixosModules.sops + inputs.self.nixosModules.namespaced-vpn + inputs.self.nixosModules.storagebox + + ./hosts/servers/common.nix + + diskConfig + machineConfig + ]; + + deployment = { + targetHost = "${name}.escapeangle.com"; + targetPort = 22; + targetUser = "root"; + buildOnTarget = true; + }; + } + ); + in + colmena.lib.makeHive ( + { + meta = { + nixpkgs = import nixpkgs { + system = "aarch64-linux"; + overlays = [ ]; + }; + }; + } + // colmenaConfig + ); + checks = builtins.mapAttrs (system: deployLib: deployLib.deployChecks self.deploy) deploy-rs.lib; }; } diff --git a/hosts/servers/common.nix b/hosts/servers/common.nix new file mode 100644 index 0000000..a4cec32 --- /dev/null +++ b/hosts/servers/common.nix @@ -0,0 +1,88 @@ +{ + lib, + modulesPath, + pkgs, + ... +}: +{ + imports = [ + (modulesPath + "/installer/scan/not-detected.nix") + (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot = { + loader.grub = { + devices = [ "/dev/sda" ]; + efiSupport = true; + efiInstallAsRemovable = true; + }; + + initrd.kernelModules = [ "virtio_gpu" ]; + + kernelParams = [ "console=tty" ]; + }; + + time.timeZone = lib.mkDefault "Europe/Berlin"; + + networking = { + useNetworkd = true; + }; + + systemd.network = { + enable = true; + + networks = { + "30-wan" = { + matchConfig.Name = "enp1s0"; + networkConfig.DHCP = "ipv4"; + routes = [ + { Gateway = "fe80::1"; } + ]; + }; + }; + }; + + services.openssh = { + enable = true; + settings.PasswordAuthentication = false; + extraConfig = '' + PrintLastLog no + ''; + }; + + programs.zsh.enable = true; + environment.pathsToLink = [ "/share/zsh" ]; + environment.shells = [ pkgs.zsh ]; + environment.enableAllTerminfo = true; + + users.users.lander = { + isNormalUser = true; + shell = pkgs.zsh; + extraGroups = [ + "wheel" + ]; + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnthKtz0fE4yQ/X10cJgKVCjYCNkRNoqV28xAhD7h2M cardno:22_498_026" + ]; + }; + + users.users.root.openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnthKtz0fE4yQ/X10cJgKVCjYCNkRNoqV28xAhD7h2M cardno:22_498_026" + ]; + + nix = { + settings = { + trusted-users = [ "lander" ]; + accept-flake-config = true; + auto-optimise-store = true; + }; + + package = pkgs.nixVersions.stable; + extraOptions = ''experimental-features = nix-command flakes''; + + gc = { + automatic = true; + options = "--delete-older-than 7d"; + }; + }; +} diff --git a/lib/hetzner.nix b/lib/hetzner.nix index e74f1c3..5b02e35 100644 --- a/lib/hetzner.nix +++ b/lib/hetzner.nix @@ -4,7 +4,7 @@ ... }: { - mkHetznerMachine = + mkMachine = hostname: { system ? "aarch64-linux", @@ -154,4 +154,23 @@ machineConfig ] ++ extraModules; }; + + mkColmena = + { + system ? "aarch64-linux", + user ? "lander", + timeZone ? "Europe/Berlin", + disks ? [ "/dev/sda" ], + ipv6Address, + tailscale ? true, + extraModules ? [ ], + }: + { + deployment = { + targetHost = "hosting-02.escapeangle.com"; + targetPort = 22; + targetUser = "root"; + buildOnTarget = true; + }; + }; }