refactor: standardize hetzner machines

Signed-off-by: Lander Van den Bulcke <landervandenbulcke@gmail.com>
2025-09-18 23:20:10 +02:00 · 2025-09-18 23:20:10 +02:00 · b3c5b0c362
commit b3c5b0c362
parent 6289ac038f
7 changed files with 266 additions and 129 deletions
--- a/lib/hetzner.nix
+++ b/lib/hetzner.nix
@ -0,0 +1,149 @@
+{
+  inputs,
+  nixpkgs,
+  ...
+}:
+{
+  mkHetznerMachine =
+    hostname:
+    {
+      system ? "aarch64-linux",
+      user ? "lander",
+      timeZone ? "Europe/Berlin",
+      disks ? [ "/dev/sda" ],
+      ipv6Address,
+      tailscale ? true,
+      extraModules ? [ ],
+    }:
+    let
+      diskConfig = import ./disk-config.nix { inherit disks nixpkgs; };
+      machineConfig = ../hosts/servers/${hostname}.nix;
+    in
+    nixpkgs.lib.nixosSystem {
+      inherit system;
+
+      modules = [
+        inputs.disko.nixosModules.disko
+        inputs.sops-nix.nixosModules.sops
+
+        diskConfig
+
+        (
+          {
+            config,
+            lib,
+            pkgs,
+            ...
+          }:
+          {
+            boot = {
+              loader.grub = {
+                devices = [ "/dev/sda" ];
+                efiSupport = true;
+                efiInstallAsRemovable = true;
+              };
+
+              initrd.kernelModules = [ "virtio_gpu" ];
+
+              kernelParams = [ "console=tty" ];
+            };
+
+            time.timeZone = timeZone;
+
+            networking = {
+              useNetworkd = true;
+              hostName = hostname;
+            };
+
+            systemd.network = {
+              enable = true;
+
+              networks = {
+                "30-wan" = {
+                  matchConfig.Name = "enp1s0";
+                  networkConfig.DHCP = "ipv4";
+                  address = [ ipv6Address ];
+                  routes = [
+                    { Gateway = "fe80::1"; }
+                  ];
+                };
+              };
+            };
+
+            services.openssh = {
+              enable = true;
+              settings.PasswordAuthentication = false;
+              extraConfig = ''
+                PrintLastLog no
+              '';
+            };
+
+            sops.secrets.tailscale-authkey = lib.mkIf tailscale {
+              owner = "root";
+              group = "root";
+              sopsFile = ../hosts/common/servers/secrets.yaml;
+            };
+
+            services.tailscale = lib.mkIf tailscale {
+              enable = tailscale;
+              openFirewall = false;
+              extraUpFlags = [
+                "--login-server=https://headscale.escapeangle.com"
+              ];
+              authKeyFile = config.sops.secrets.tailscale-authkey.path;
+            };
+
+            programs.zsh.enable = true;
+            environment.pathsToLink = [ "/share/zsh" ];
+            environment.shells = [ pkgs.zsh ];
+            environment.enableAllTerminfo = true;
+
+            users.users.${user} = {
+              isNormalUser = true;
+              shell = pkgs.zsh;
+              extraGroups = [
+                "wheel"
+              ];
+              openssh.authorizedKeys.keys = [
+                "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnthKtz0fE4yQ/X10cJgKVCjYCNkRNoqV28xAhD7h2M cardno:22_498_026"
+              ];
+            };
+
+            users.users.root.openssh.authorizedKeys.keys = [
+              "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPnthKtz0fE4yQ/X10cJgKVCjYCNkRNoqV28xAhD7h2M cardno:22_498_026"
+            ];
+
+            nix = {
+              settings = {
+                trusted-users = [ "${user}" ];
+                accept-flake-config = true;
+                auto-optimise-store = true;
+              };
+
+              registry = {
+                nixpkgs = {
+                  flake = nixpkgs;
+                };
+              };
+
+              nixPath = [
+                "nixpkgs=${nixpkgs.outPath}"
+                "nixos-config=/etc/nixos/configuration.nix"
+                "/nix/var/nix/profiles/per-user/root/channels"
+              ];
+
+              package = pkgs.nixVersions.stable;
+              extraOptions = ''experimental-features = nix-command flakes'';
+
+              gc = {
+                automatic = true;
+                options = "--delete-older-than 7d";
+              };
+            };
+          }
+        )
+
+        machineConfig
+      ] ++ extraModules;
+    };
+}