feat: cloudinit nix cofig

2024-08-25 17:47:41 +02:00 · 2024-08-25 17:47:41 +02:00 · a49d802954
commit a49d802954
parent 207d47ab5e
7 changed files with 142 additions and 112 deletions
--- a/flake.nix
+++ b/flake.nix
@ -1,48 +0,0 @@
-{
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.11";
-    nixos-generators = {
-      url = "github:nix-community/nixos-generators";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-    xc = {
-      url = "github:joerdav/xc";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
-  };
-
-  outputs = { nixpkgs, nixos-generators, xc, ... }:
-    let
-      pkgsForSystem = system: import nixpkgs {
-        inherit system;
-        overlays = [
-          (final: prev: { xc = xc.packages.${system}.xc; })
-        ];
-      };
-      allVMs = [ "x86_64-linux" "aarch64-linux" ];
-      forAllVMs = f: nixpkgs.lib.genAttrs allVMs (system: f {
-        inherit system;
-        pkgs = pkgsForSystem system;
-      });
-    in
-    {
-      packages = forAllVMs ({ system, pkgs }: {
-        vm = nixos-generators.nixosGenerate {
-          format = "qcow-efi";
-          system = system;
-
-          specialArgs = {
-            pkgs = pkgs;
-          };
-
-          modules = [
-            # Pin nixpkgs to the flake input, so that the packages installed
-            # come from the flake inputs.nixpkgs.url.
-            ({ ... }: { nix.registry.nixpkgs.flake = nixpkgs; })
-            # Apply the rest of the config.
-            ./configuration.nix
-          ];
-        };
-      });
-    };
-}
--- a/11
+++ b/11
@ -13,11 +13,11 @@ lint:
  @tflint --recursive

 build:
-  @nix build .#vm
+  @nix build ./proxmox#vm

 push:
  #!/usr/bin/env sh
-  export NIXOS_IMAGE=$(nix path-info --quiet .#vm)/nixos.qcow2
+  export NIXOS_IMAGE=$(nix path-info --quiet ./proxmox#vm)/nixos.qcow2
  export VERSION=$(echo $NIXOS_IMAGE | cut -d'/' -f4 | cut -d'-' -f1)

  echo "Uploading $NIXOS_IMAGE to code.tjo.space"
@ -30,7 +30,7 @@ push:

 deploy: build
  #!/usr/bin/env sh
-  export NIXOS_IMAGE=$(nix path-info --quiet .#vm)/nixos.qcow2
+  export NIXOS_IMAGE=$(nix path-info --quiet ./proxmox#vm)/nixos.qcow2
  export TF_VAR_image_path=$NIXOS_IMAGE

  echo "Deploying $NIXOS_IMAGE"
@ -38,3 +38,8 @@ deploy: build
  cd {{justfile_directory()}}/terraform
  tofu init
  tofu apply
+
+destroy:
+  #!/usr/bin/env sh
+  cd {{justfile_directory()}}/terraform
+  tofu  destroy
--- a/proxmox/configuration.nix
+++ b/proxmox/configuration.nix
@ -0,0 +1,37 @@
+{ lib, pkgs, ... }:
+{
+  system.stateVersion = "24.05";
+
+  boot.loader.systemd-boot.enable = true;
+
+  services.qemuGuest.enable = true;
+
+  services.cloud-init = {
+    enable = true;
+    network.enable = true;
+    settings = lib.mkOptionDefault {
+      datasource = {
+        NoCloud = { };
+        ConfigDrive = { };
+      };
+    };
+  };
+
+  # Needed due to cloud-init.network.enable = true
+  networking.useNetworkd = true;
+
+  # Create default user
+  security.sudo.wheelNeedsPassword = false;
+  nix.settings.trusted-users = [ "nixos" ];
+  users.users.nixos = {
+    isNormalUser = true;
+    password = "hunter2";
+    extraGroups = [ "wheel" ];
+  };
+
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+  environment.systemPackages = [ pkgs.nginx ];
+}
--- a/proxmox/flake.lock
+++ b/proxmox/flake.lock
@ -53,16 +53,16 @@
    },
    "nixpkgs": {
      "locked": {
-        "lastModified": 1720535198,
-        "narHash": "sha256-zwVvxrdIzralnSbcpghA92tWu2DV2lwv89xZc8MTrbg=",
+        "lastModified": 1724316499,
+        "narHash": "sha256-Qb9MhKBUTCfWg/wqqaxt89Xfi6qTD3XpTzQ9eXi3JmE=",
        "owner": "NixOS",
        "repo": "nixpkgs",
-        "rev": "205fd4226592cc83fd4c0885a3e4c9c400efabb5",
+        "rev": "797f7dc49e0bc7fab4b57c021cdf68f595e47841",
        "type": "github"
      },
      "original": {
        "owner": "NixOS",
-        "ref": "nixos-23.11",
+        "ref": "nixos-24.05",
        "repo": "nixpkgs",
        "type": "github"
      }
--- a/proxmox/flake.nix
+++ b/proxmox/flake.nix
@ -0,0 +1,70 @@
+{
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-24.05";
+    nixos-generators = {
+      url = "github:nix-community/nixos-generators";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+    xc = {
+      url = "github:joerdav/xc";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+  };
+
+  outputs =
+    {
+      nixpkgs,
+      nixos-generators,
+      xc,
+      ...
+    }:
+    let
+      pkgsForSystem =
+        system:
+        import nixpkgs {
+          inherit system;
+          overlays = [ (final: prev: { xc = xc.packages.${system}.xc; }) ];
+        };
+      allVMs = [
+        "x86_64-linux"
+        "aarch64-linux"
+      ];
+      forAllVMs =
+        f:
+        nixpkgs.lib.genAttrs allVMs (
+          system:
+          f {
+            inherit system;
+            pkgs = pkgsForSystem system;
+          }
+        );
+    in
+    {
+      packages = forAllVMs (
+        { system, pkgs }:
+        {
+          vm = nixos-generators.nixosGenerate {
+            format = "qcow-efi";
+            system = system;
+
+            specialArgs = {
+              pkgs = pkgs;
+            };
+
+            modules = [
+              # Pin nixpkgs to the flake input, so that the packages installed
+              # come from the flake inputs.nixpkgs.url.
+              (
+                { ... }:
+                {
+                  nix.registry.nixpkgs.flake = nixpkgs;
+                }
+              )
+              # Apply the rest of the config.
+              ./configuration.nix
+            ];
+          };
+        }
+      );
+    };
+}
--- a/terraform/configuration.nix
+++ b/terraform/configuration.nix
@ -19,42 +19,13 @@ let
    '';
    fixupPhase = "";
  };
+  instance = builtins.fromJSON (builtins.readFile "/etc/ingress.tjo.cloud.json");
 in
 {
-  system.stateVersion = "23.11";
+  system.stateVersion = "24.05";

-  # BOOT
-  boot.loader.systemd-boot.enable = true;
-
-  # PROXMOX
-  services.qemuGuest.enable = true;
-  services.cloud-init = {
-    enable = true;
-    network.enable = true;
-    settings = lib.mkOptionDefault {
-      datasource = {
-        NoCloud = { };
-        ConfigDrive = { };
-      };
-      cloud_init_modules = [
-        [
-          "write-files"
-          "always"
-        ]
-      ];
-      cloud_config_modules = [
-        [
-          "runcmd"
-          "always"
-        ]
-      ];
-      system_info = {
-        default_user = {
-          name = "nixos";
-        };
-      };
-    };
-  };
+  networking.hostName = instance.name;
+  networking.domain = instance.domain;

  # USER MANAGEMENT
  security.sudo.wheelNeedsPassword = false;
@ -63,6 +34,7 @@ in
    isNormalUser = true;
    password = "hunter2";
    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keys = instance.ssh_keys;
  };

  # SSH
@ -86,7 +58,6 @@ in
  systemd.services.qemu-guest-agent.requires = [ "tailscaled-autoconnect.service" ];

  # FIREWALL
-  networking.useNetworkd = true;
  networking.firewall = {
    enable = true;

@ -123,6 +94,4 @@ in
      };
    };
  };
-
-  environment.systemPackages = [ pkgs.nginx ];
 }
--- a/terraform/node.tf
+++ b/terraform/node.tf
@ -1,9 +1,12 @@
 locals {
+  domain = "ingress.tjo.cloud"
+
  nodes = {
    for k, v in var.nodes : k => merge(v, {
      id          = 700 + index(keys(var.nodes), k)
      hash        = sha1(v.name)
      mac_address = "AA:BB:07:00:${format("%v:%v", substr(sha1(v.name), 0, 2), substr(sha1(v.name), 2, 2))}"
+      domain      = local.domain
    })
  }

@ -27,6 +30,8 @@ locals {
      public_ipv6   = local.ipv6_addresses[k]["ens18"][0]
      internal_ipv4 = local.ipv4_addresses[k]["tailscale0"][0]
      internal_ipv6 = local.ipv6_addresses[k]["tailscale0"][0]
+      #internal_ipv4 = data.tailscale_device.ingress[k].addresses[0]
+      #internal_ipv6 = data.tailscale_device.ingress[k].addresses[1]
    })
  }
 }
@ -36,7 +41,7 @@ resource "tailscale_tailnet_key" "ingress" {
  ephemeral     = true
  preauthorized = true
  tags          = ["tag:ingress-tjo-cloud"]
-  description   = "tailscale key for ingress-tjo-cloud nodes"
+  description   = "tailscale key for ingress-tjo-cloud instances"
 }

 resource "proxmox_virtual_environment_file" "ingress" {
@ -60,26 +65,20 @@ resource "proxmox_virtual_environment_file" "userdata" {
  source_raw {
    data      = <<-EOF
    #cloud-config
-    ssh_authorized_keys:
-    %{for key in var.ssh_keys~}
-    - ${key}
-    %{endfor}
    write_files:
+    - path: /etc/ingress.tjo.cloud.json
+      encoding: base64
+      content: ${base64encode(jsonencode({ name : each.value.name, domain : each.value.domain, ssh_keys : var.ssh_keys }))}
    - path: /run/secrets/tailscale.com/authkey
+      permissions: '0600'
      content: ${var.tailscale_apikey}
-      permissions: '0400'
-      owner: root:root
    - path: /etc/nixos/configuration.nix
-      content: |
-        { config, pkgs, ... }:
-        {
-          system.stateVersion = "23.11";
-          networking.hostName = "${each.value.name}";
-          networking.domain = "ingress.tjo.cloud";
-        }
+      encoding: base64
+      content: ${base64encode(file("${path.module}/configuration.nix"))}
    runcmd:
-    - systemctl start tailscaled-autoconnect.service
-    - nixos-rebuild switch
+    - source /etc/profile && nixos-rebuild switch
+    power_state:
+      mode: reboot
    EOF
    file_name = "${each.value.name}.ingress.tjo.cloud.userconfig.yaml"
  }
@ -89,13 +88,11 @@ resource "proxmox_virtual_environment_vm" "nodes" {
  for_each = local.nodes

  vm_id     = each.value.id
-  name      = "${each.value.name}.ingress.tjo.cloud"
+  name      = "${each.value.name}.${each.value.domain}"
  node_name = each.value.host

-  description = "Node ${each.value.name} for ingress.tjo.cloud."
-  tags = concat(
-    ["ingress-tjo-cloud"],
-  )
+  description = "Node ${each.value.name} for ${each.value.domain}."
+  tags        = [each.value.domain]

  stop_on_destroy     = true
  timeout_start_vm    = 60