refactor: standardize hetzner machines

Signed-off-by: Lander Van den Bulcke <landervandenbulcke@gmail.com>
2025-09-18 23:20:10 +02:00 · 2025-09-18 23:20:10 +02:00 · b3c5b0c362
commit b3c5b0c362
parent 6289ac038f
7 changed files with 266 additions and 129 deletions
--- a/hosts/hosting-02/disk-config.nix
+++ b/hosts/hosting-02/disk-config.nix
@ -1,52 +0,0 @@
-{
-  lib,
-  disks ? [ "/dev/sda" ],
-  ...
-}:
-{
-  disko.devices = {
-    disk = lib.genAttrs disks (disk: {
-      device = disk;
-      type = "disk";
-      content = {
-        type = "gpt";
-        partitions = {
-          boot = {
-            name = "boot";
-            size = "256M";
-            type = "EF00";
-            content = {
-              type = "filesystem";
-              format = "vfat";
-              mountpoint = "/boot";
-            };
-          };
-          main = {
-            size = "100%";
-            content = {
-              type = "btrfs";
-              extraArgs = [ "-f" ]; # override existing partition
-              subvolumes = {
-                "/" = {
-                  mountOptions = [ "compress=zstd" ];
-                  mountpoint = "/";
-                };
-                "/home" = {
-                  mountOptions = [ "compress=zstd" ];
-                  mountpoint = "/home";
-                };
-                "/nix" = {
-                  mountOptions = [
-                    "compress=zstd"
-                    "noatime"
-                  ];
-                  mountpoint = "/nix";
-                };
-              };
-            };
-          };
-        };
-      };
-    });
-  };
-}
--- a/hosts/hosting-02/secrets.yaml
+++ b/hosts/hosting-02/secrets.yaml
@ -1,30 +0,0 @@
-wireguardKey: ENC[AES256_GCM,data:0xzdESyIvaMzDe1W7GOddxCmDeQf246m8mfcPVxNRX6jPu222GXSwSywPgU=,iv:5GvluPofwd4SkQWJo7KKen7x0ZkAu5idl6xcyVxdbvQ=,tag:HtzLtergC3wrYFXIeA37PQ==,type:str]
-storageboxKey: ENC[AES256_GCM,data:iPqksX0X1FrRgjNkgXiAJjsjEXdOxItHOxCBINsb2+d86INm/KOEyAulXudrnw8s9HF8wxrcLAqxQt1XHzoPYif9sM9jw5lo5f5qKx0QoYQNgxD935eww+WpBJ8HtcgwWYYAN2dbcbUFI6id7QNEaJr4bHjTZ03FkZ0nLRZokoln7nKV9+GeEUbfhlLYwicUY/V1pSLvBrX/htc9jtVJWpLS+mOlDY88oyqvSd4+UFgYT9FjXOU6g/5iIiS2p9FrbRFmrPs3lTlFbLwMb/l6qv4X3ApTjYUNV8C5wnBwQM1i2X8Hixe+raGTcwr+ivkYP5I3MBnvYDSmXtrc63/Lfd4zdBj50r1qus8Z50jXNJD3LkbFtkYuIFNcBZKl6dnnHi7L4u9rmLMhDeFV6dcuHsqethwx5x6kfUkXDNjfavTgGsYMFf6W4pt28EjepzP7vwA6BYMI4mseRO4uszwBJXmc2HDOs5tGRiGfcfzn6JsCe+ipDcsubBk7xWbi20sBF5Fsbje22s6Oss99SoEm,iv:toi832UgHmdoEUTowb/2oAxbioLVxNjBAyC1KcsBPI8=,tag:siNnRQyKeXBcC6Ln8P30Dg==,type:str]
-storageboxCryptKey: ENC[AES256_GCM,data:48M3TXFgBnR82K67xfmOk/3CierDXo4WNg==,iv:S+LRyixH/Uaurr51j3UnFPMWAwR2S5dI7Ei+NcmSOeI=,tag:Rv/shtQ9zsp7tCs6f4jBAg==,type:str]
-sops:
-    age:
-        - recipient: age1hvrssz7k9akz66evj4kja53zvdtrss8k2ljxsh5myh2mru62sggqznlzrt
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTdUhmVTFkY2xsVi9uK3Vl
-            eGRKa1RZMnVpQ21JMnFZRHRPL3I1OGFwTlNBCmxWeHFBdmJ4dmszOFZVTXpjSEt0
-            THUvQ3NNTWlZRTZMNVloaEpzQk9YU0UKLS0tIFM3WWtsWERvbkxqb2RDZ01VVStt
-            eFdmOHNGSlNFckg2emltYU5yWHB2UVkKs5B0CG13bfsJL1mVCUcm8JlFVw4pfqMT
-            QGl5LOw06WBIOSrmYn5s98scIkiKvLsqQ+OjbyM0RwB0sGYaz3D0Rg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-09-11T20:17:19Z"
-    mac: ENC[AES256_GCM,data:wY7twUe+K84BbGGdYf30Zt4lR9FHBjtwHVhebvpdjVw2qL0g3uEOv0ntfZ3oqiibcsBTJWa7MvIDYYTJq6OUhTNH2DiGOaOI2tC4wck0aaQiJJQ19ZmiPqMSLlY0UpFvHJfAcfgcZiZnBWg+QhWA+CeDeKSAb74GHthdqWFOOTg=,iv:WbkD7PqSqnkCawdoF85XzB82jsRv02QGHb+7AjUTBxI=,tag:eEOvjEPRR5nfzrL3+PsTAg==,type:str]
-    pgp:
-        - created_at: "2025-09-09T22:56:42Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hF4DARdpY4woM6wSAQdASvzhCErbMVzIY6FCb0HXSKmgpFRO4VbdCphwY0lhxWMw
-            e0pavui/x399qCaqKNgJ+Nidtw8fQ3CEr4Ddb/qUMCZQS8EpE9IrIvUehebBhorz
-            0l4BLBlf2HHgjD2TL2Z9jtehN/UFGnEReM5fKXO8JkWhb9j9jPyswV6tZfyc0Wuy
-            BKTazZTTZ1kgbFRzPqFiqKMnHBBvMcXQ0El2MT7xJCkAzqNRR4H6R6wIyUyfr93n
-            =VeKw
-            -----END PGP MESSAGE-----
-          fp: 4BE1257015580BAB9F4B9D5FCA5B1C34E649BF92
-    unencrypted_suffix: _unencrypted
-    version: 3.10.2
--- a/hosts/servers/hosting-02.nix
+++ b/hosts/servers/hosting-02.nix
@ -1,17 +1,5 @@
 { config, pkgs, ... }:
 {
-  imports = [
-    ./disk-config.nix
-    {
-      _module.args.disks = [ "/dev/sda" ];
-    }
-
-    ../common/servers
-  ];
-
-  time.timeZone = "Europe/Berlin";
-
-  networking.hostName = "hosting-02";
  networking.firewall = {
    enable = true;
    allowedTCPPorts = [
@ -31,12 +19,6 @@
    addRouteTablesToIPRoute2 = true;
  };

-  systemd.network.networks."30-wan" = {
-    address = [
-      "2a01:4f8:c013:7fc0::/64"
-    ];
-  };
-
  systemd.services."netns@" = {
    description = "Network namespace %i";
    serviceConfig = {
@ -149,18 +131,18 @@
    ];
  };

-  sops.secrets = {
-    wireguardKey = {
-      owner = "root";
-      sopsFile = ./secrets.yaml;
-    };
-    storageboxKey = {
-      owner = "root";
-      sopsFile = ./secrets.yaml;
-    };
-    storageboxCryptKey = {
-      owner = "root";
-      sopsFile = ./secrets.yaml;
+  sops = {
+    defaultSopsFile = ./hosting-02.yaml;
+    secrets = {
+      wireguardKey = {
+        owner = "root";
+      };
+      storageboxKey = {
+        owner = "root";
+      };
+      storageboxCryptKey = {
+        owner = "root";
+      };
    };
  };

--- a/hosts/servers/hosting-02.yaml
+++ b/hosts/servers/hosting-02.yaml
@ -0,0 +1,30 @@
+wireguardKey: ENC[AES256_GCM,data:Z239oQMzOp4C33pBePuANX3aPkmjTcrT+Z/UY0dnUCmMOs2Oy3iktS6Fgsw=,iv:21XLXpgsoYpvz887ZlLJW/A6IOJwEX5YwJrnO725M5U=,tag:VDGjOiYqFN8tMhf8s2YV6g==,type:str]
+storageboxKey: ENC[AES256_GCM,data:uWDkiWIk3OePRfoaqjllVlRVzW5+ryE4sIOs8qm6cS8JN/+YFbnkCsT5sdFeXSpJyQ7ymgD6uJJ75RWH6Y/iIARbmZN/x/9hnB3LORHSl/C0F3xMHUf6prXtYyPNLWe+ghCMygaLyvBuCBiEhleevRQANXLUJCysiODepSkXwyasAHKTKuKQUPU/T+1R7eXaQPDMehzD4/0o8SdLkqcZXBQzs3VRp+CbQyl7dx6znwoPWckmFH2W+9fZCE+AxFxBP3jPVjBPuOC3BviTYFSvZPEkmtH+lxYv+PXFAPpgYwmAEjCwWyDMDRy6bNVQIG6TKHn60TJv+GCfRwPJ46mVtbruyil23d7g/V7dhu8btPbgtvcBx/8EexJ0PHAVWcIZ1FJwr7inMCAghbSDD3CkGpOV8btaYgUZtosqfg9r5cd75jB+7RZPwyb8/1mrLWE3eL9Za2lZ6bC7a9AeIn1q3Cn6+aoMKqXp8q/sVwozNpUJj73yhjR146MGjCGpqoKJqK453qc3VCC50OZTOULV,iv:sEwA6zrK6FFqTmVJOMD77g0OuDjCHDLRBlirjhZBx/0=,tag:z1fX+7goXk4U6Di+4EK6Fw==,type:str]
+storageboxCryptKey: ENC[AES256_GCM,data:ryYOzFvdPaVkOHmypYbqw+KU6aB2OQutLw==,iv:FL4c7P36qxYR1KJlg7t0dvFHlKGMIrTlQG+CDkeJu9U=,tag:Ia4mhV9Ed/m1rRMCNnHqXw==,type:str]
+sops:
+    age:
+        - recipient: age1hvrssz7k9akz66evj4kja53zvdtrss8k2ljxsh5myh2mru62sggqznlzrt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVSlA1Z3Q0ZzNlSmVtZmhn
+            dmxZWHplaEJXWFY3UjVSVDhaRkovb0srRkJvClpENmkzK3YrYysvVTJJQ1JVTDA0
+            VG5ySFJYQTlqbkJVZ2pwYjhXeHNsQXcKLS0tIEZDdTRYUzJFdUdUeVpOd3gybkxs
+            b1ZqUzZLUkFwNHJyVlhmK0FOZ1JFYUEKDU4NmBCHRY+ZK+RFK/LioGzjJTaOE1ky
+            MC6jxt7Y5RkCk0BBqeoEVLaNXNViPjwakbvyfH0w0P6l0KDJ4mNlYQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-09-18T21:32:51Z"
+    mac: ENC[AES256_GCM,data:y3iMxGNyJfkmJZebiJ/iW/fhX3758Bz8/z8GfzvBiosjHOE6Awka70uQ7rFvHrLIFATDCrWW09ERD16/EIGL7bZMBKeXmjpkTe9WrmqYu4aS9qj1A/UzcW9zkxj6kKSZlgbdh2RaPXj9VcVfdYs/WDp8cxAuNmFLLEpY9Ar0SSY=,iv:rSGm4Y9XWrYmA2rL3t63NfSgHd6wBPWbtvfGivj6Qq0=,tag:gdHWOS0NO5piFK3fQiCSrw==,type:str]
+    pgp:
+        - created_at: "2025-09-18T21:32:42Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hF4DARdpY4woM6wSAQdA3//4oqX5uJuZHRzZ4TYvZ4rvbh1RLXKKwzmKkZ1wYBMw
+            kXxBjyp9624BQvC0P/aXgr1dWnAqkqNG7/y6Zfg0CLK8qcCkDiur20EH35XOy2gv
+            0l4BbPW04HWvJKU3y6WvVucG87gRi83kJbT6AHXfuw2mAw77pJNZY0g645fV9wBc
+            tSkkum0EpC8P+4aiqcKyFy0KfsmOlouT6QqmlH1VZvCfRPZ1hysWG2bIzV0BDDOo
+            =nKA3
+            -----END PGP MESSAGE-----
+          fp: 4BE1257015580BAB9F4B9D5FCA5B1C34E649BF92
+    unencrypted_suffix: _unencrypted
+    version: 3.10.2