reformat
This commit is contained in:
Ingolf Wagner
parent
95d70d5225
commit
973e3b3305
27 changed files with 359 additions and 291 deletions
|
|
@ -1,19 +1,23 @@
|
||||||
{
|
{
|
||||||
# cat ~/.ssh/id_rsa.pub
|
# cat ~/.ssh/id_rsa.pub
|
||||||
publicSshKey ? "",
|
publicSshKey ? ""
|
||||||
# remote-install-get-hiddenReceiver
|
, # remote-install-get-hiddenReceiver
|
||||||
hiddenReceiver ? "", }:
|
hiddenReceiver ? ""
|
||||||
|
,
|
||||||
|
}:
|
||||||
{ config, lib, pkgs, ... }: {
|
{ config, lib, pkgs, ... }: {
|
||||||
|
|
||||||
imports = [
|
imports = [
|
||||||
{ # system setup
|
{
|
||||||
|
# system setup
|
||||||
networking.hostName = "liveos";
|
networking.hostName = "liveos";
|
||||||
|
|
||||||
users.extraUsers = {
|
users.extraUsers = {
|
||||||
root = { openssh.authorizedKeys.keys = [ publicSshKey ]; };
|
root = { openssh.authorizedKeys.keys = [ publicSshKey ]; };
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
{ # installed packages
|
{
|
||||||
|
# installed packages
|
||||||
nixpkgs.config.allowUnfree = true;
|
nixpkgs.config.allowUnfree = true;
|
||||||
environment.systemPackages = with pkgs; [
|
environment.systemPackages = with pkgs; [
|
||||||
#style
|
#style
|
||||||
|
|
@ -50,7 +54,8 @@ hiddenReceiver ? "", }:
|
||||||
dosfstools
|
dosfstools
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
{ # bash configuration
|
{
|
||||||
|
# bash configuration
|
||||||
programs.bash = {
|
programs.bash = {
|
||||||
enableCompletion = true;
|
enableCompletion = true;
|
||||||
interactiveShellInit = ''
|
interactiveShellInit = ''
|
||||||
|
|
@ -81,45 +86,49 @@ hiddenReceiver ? "", }:
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
{ # ssh configuration
|
{
|
||||||
|
# ssh configuration
|
||||||
services.openssh.enable = true;
|
services.openssh.enable = true;
|
||||||
services.openssh.passwordAuthentication = false;
|
services.openssh.passwordAuthentication = false;
|
||||||
systemd.services.sshd.wantedBy = lib.mkForce [ "multi-user.target" ];
|
systemd.services.sshd.wantedBy = lib.mkForce [ "multi-user.target" ];
|
||||||
}
|
}
|
||||||
{ # hidden ssh announce
|
{
|
||||||
config = let
|
# hidden ssh announce
|
||||||
torDirectory = "/var/lib/tor";
|
config =
|
||||||
hiddenServiceDir = torDirectory + "/liveos";
|
let
|
||||||
in {
|
torDirectory = "/var/lib/tor";
|
||||||
services.tor = {
|
hiddenServiceDir = torDirectory + "/liveos";
|
||||||
enable = true;
|
in
|
||||||
client.enable = true;
|
{
|
||||||
extraConfig = ''
|
services.tor = {
|
||||||
HiddenServiceDir ${hiddenServiceDir}
|
enable = true;
|
||||||
HiddenServicePort 22 127.0.0.1:22
|
client.enable = true;
|
||||||
'';
|
extraConfig = ''
|
||||||
};
|
HiddenServiceDir ${hiddenServiceDir}
|
||||||
systemd.services.hidden-ssh-announce = {
|
HiddenServicePort 22 127.0.0.1:22
|
||||||
description = "irc announce hidden ssh";
|
|
||||||
after = [ "tor.service" "network-online.target" ];
|
|
||||||
wants = [ "tor.service" ];
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
serviceConfig = {
|
|
||||||
ExecStart = pkgs.writers.writeDash "irc-announce-ssh" ''
|
|
||||||
set -efu
|
|
||||||
until test -e ${hiddenServiceDir}/hostname; do
|
|
||||||
echo "still waiting for ${hiddenServiceDir}/hostname"
|
|
||||||
sleep 1
|
|
||||||
done
|
|
||||||
until ${pkgs.tor}/bin/torify ${pkgs.netcat-openbsd}/bin/nc -z ${hiddenReceiver} 1337; do sleep 1; done && \
|
|
||||||
echo "torify ssh root@$(cat ${hiddenServiceDir}/hostname) -i ~/.ssh/id_rsa" | ${pkgs.tor}/bin/torify ${pkgs.nmap}/bin/ncat ${hiddenReceiver} 1337
|
|
||||||
'';
|
'';
|
||||||
PrivateTmp = "true";
|
};
|
||||||
User = "tor";
|
systemd.services.hidden-ssh-announce = {
|
||||||
Type = "oneshot";
|
description = "irc announce hidden ssh";
|
||||||
|
after = [ "tor.service" "network-online.target" ];
|
||||||
|
wants = [ "tor.service" ];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
serviceConfig = {
|
||||||
|
ExecStart = pkgs.writers.writeDash "irc-announce-ssh" ''
|
||||||
|
set -efu
|
||||||
|
until test -e ${hiddenServiceDir}/hostname; do
|
||||||
|
echo "still waiting for ${hiddenServiceDir}/hostname"
|
||||||
|
sleep 1
|
||||||
|
done
|
||||||
|
until ${pkgs.tor}/bin/torify ${pkgs.netcat-openbsd}/bin/nc -z ${hiddenReceiver} 1337; do sleep 1; done && \
|
||||||
|
echo "torify ssh root@$(cat ${hiddenServiceDir}/hostname) -i ~/.ssh/id_rsa" | ${pkgs.tor}/bin/torify ${pkgs.nmap}/bin/ncat ${hiddenReceiver} 1337
|
||||||
|
'';
|
||||||
|
PrivateTmp = "true";
|
||||||
|
User = "tor";
|
||||||
|
Type = "oneshot";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -11,7 +11,8 @@ let
|
||||||
hiddenReceiver = "";
|
hiddenReceiver = "";
|
||||||
|
|
||||||
};
|
};
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
|
|
||||||
imports = [ remote-access ];
|
imports = [ remote-access ];
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -12,7 +12,8 @@ let
|
||||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6uza62+Go9sBFs3XZE2OkugBv9PJ7Yv8ebCskE5WYPcahMZIKkQw+zkGI8EGzOPJhQEv2xk+XBf2VOzj0Fto4nh8X5+Llb1nM+YxQPk1SVlwbNAlhh24L1w2vKtBtMy277MF4EP+caGceYP6gki5+DzlPUSdFSAEFFWgN1WPkiyUii15Xi3QuCMR8F18dbwVUYbT11vwNhdiAXWphrQG+yPguALBGR+21JM6fffOln3BhoDUp2poVc5Qe2EBuUbRUV3/fOU4HwWVKZ7KCFvLZBSVFutXCj5HuNWJ5T3RuuxJSmY5lYuFZx9gD+n+DAEJt30iXWcaJlmUqQB5awcB1S2d9pJ141V4vjiCMKUJHIdspFrI23rFNYD9k2ZXDA8VOnQE33BzmgF9xOVh6qr4G0oEpsNqJoKybVTUeSyl4+ifzdQANouvySgLJV/pcqaxX1srSDIUlcM2vDMWAs3ryCa0aAlmAVZIHgRhh6wa+IXW8gIYt+5biPWUuihJ4zGBEwkyVXXf2xsecMWCAGPWPDL0/fBfY9krNfC5M2sqxey2ShFIq+R/wMdaI7yVjUCF2QIUNiIdFbJL6bDrDyHnEXJJN+rAo23jUoTZZRv7Jq3DB/A5H7a73VCcblZyUmwMSlpg3wos7pdw5Ctta3zQPoxoAKGS1uZ+yTeZbPMmdbw==";
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC6uza62+Go9sBFs3XZE2OkugBv9PJ7Yv8ebCskE5WYPcahMZIKkQw+zkGI8EGzOPJhQEv2xk+XBf2VOzj0Fto4nh8X5+Llb1nM+YxQPk1SVlwbNAlhh24L1w2vKtBtMy277MF4EP+caGceYP6gki5+DzlPUSdFSAEFFWgN1WPkiyUii15Xi3QuCMR8F18dbwVUYbT11vwNhdiAXWphrQG+yPguALBGR+21JM6fffOln3BhoDUp2poVc5Qe2EBuUbRUV3/fOU4HwWVKZ7KCFvLZBSVFutXCj5HuNWJ5T3RuuxJSmY5lYuFZx9gD+n+DAEJt30iXWcaJlmUqQB5awcB1S2d9pJ141V4vjiCMKUJHIdspFrI23rFNYD9k2ZXDA8VOnQE33BzmgF9xOVh6qr4G0oEpsNqJoKybVTUeSyl4+ifzdQANouvySgLJV/pcqaxX1srSDIUlcM2vDMWAs3ryCa0aAlmAVZIHgRhh6wa+IXW8gIYt+5biPWUuihJ4zGBEwkyVXXf2xsecMWCAGPWPDL0/fBfY9krNfC5M2sqxey2ShFIq+R/wMdaI7yVjUCF2QIUNiIdFbJL6bDrDyHnEXJJN+rAo23jUoTZZRv7Jq3DB/A5H7a73VCcblZyUmwMSlpg3wos7pdw5Ctta3zQPoxoAKGS1uZ+yTeZbPMmdbw==";
|
||||||
hiddenReceiver = "";
|
hiddenReceiver = "";
|
||||||
};
|
};
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
|
|
||||||
imports = [ remote-access ];
|
imports = [ remote-access ];
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -41,27 +41,29 @@
|
||||||
enable = true;
|
enable = true;
|
||||||
displayManager.auto.enable = true;
|
displayManager.auto.enable = true;
|
||||||
|
|
||||||
desktopManager = let
|
desktopManager =
|
||||||
guide = pkgs.stdenv.mkDerivation {
|
let
|
||||||
name = "yubikey-guide-2019-01-21.html";
|
guide = pkgs.stdenv.mkDerivation {
|
||||||
src = pkgs.fetchFromGitHub {
|
name = "yubikey-guide-2019-01-21.html";
|
||||||
owner = "drduh";
|
src = pkgs.fetchFromGitHub {
|
||||||
repo = "YubiKey-Guide";
|
owner = "drduh";
|
||||||
rev = "035d98ebbed54a0218ccbf23905054d32f97508e";
|
repo = "YubiKey-Guide";
|
||||||
sha256 = "0rzy06a5xgfjpaklxdgrxml24d0vhk78lb577l3z4x7a2p32dbyq";
|
rev = "035d98ebbed54a0218ccbf23905054d32f97508e";
|
||||||
|
sha256 = "0rzy06a5xgfjpaklxdgrxml24d0vhk78lb577l3z4x7a2p32dbyq";
|
||||||
|
};
|
||||||
|
buildInputs = [ pkgs.pandoc ];
|
||||||
|
installPhase =
|
||||||
|
"pandoc --highlight-style pygments -s --toc README.md -o $out";
|
||||||
};
|
};
|
||||||
buildInputs = [ pkgs.pandoc ];
|
in
|
||||||
installPhase =
|
{
|
||||||
"pandoc --highlight-style pygments -s --toc README.md -o $out";
|
default = "xfce";
|
||||||
|
xterm.enable = false;
|
||||||
|
xfce.enable = true;
|
||||||
|
xfce.extraSessionCommands = ''
|
||||||
|
${pkgs.midori}/bin/midori ${guide} &
|
||||||
|
${pkgs.xfce.terminal}/bin/xfce4-terminal &
|
||||||
|
'';
|
||||||
};
|
};
|
||||||
in {
|
|
||||||
default = "xfce";
|
|
||||||
xterm.enable = false;
|
|
||||||
xfce.enable = true;
|
|
||||||
xfce.extraSessionCommands = ''
|
|
||||||
${pkgs.midori}/bin/midori ${guide} &
|
|
||||||
${pkgs.xfce.terminal}/bin/xfce4-terminal &
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -12,7 +12,8 @@ let
|
||||||
${pkgs.black}/bin/black --exclude venv ${toString ./.}
|
${pkgs.black}/bin/black --exclude venv ${toString ./.}
|
||||||
'';
|
'';
|
||||||
|
|
||||||
in pkgs.mkShell {
|
in
|
||||||
|
pkgs.mkShell {
|
||||||
|
|
||||||
buildInputs = with pkgs; [ myPython startServer reformat ];
|
buildInputs = with pkgs; [ myPython startServer reformat ];
|
||||||
|
|
||||||
|
|
|
||||||
102
shell.nix
102
shell.nix
|
|
@ -45,7 +45,8 @@ let
|
||||||
property.file = toString ./submodules/property;
|
property.file = toString ./submodules/property;
|
||||||
} else
|
} else
|
||||||
{ };
|
{ };
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
system.file = toString ./system;
|
system.file = toString ./system;
|
||||||
configs.file = toString ./configs;
|
configs.file = toString ./configs;
|
||||||
nixos-config.symlink = "configs/${name}/configuration.nix";
|
nixos-config.symlink = "configs/${name}/configuration.nix";
|
||||||
|
|
@ -144,44 +145,55 @@ let
|
||||||
|
|
||||||
deployment = { secrets, content }:
|
deployment = { secrets, content }:
|
||||||
name:
|
name:
|
||||||
{ host ? (hostPattern name), target ? "/var/src/", user ? "root"
|
{ host ? (hostPattern name)
|
||||||
, commandPrefix ? "deploy", enableSwitch ? true, enableSecrets ? true }:
|
, target ? "/var/src/"
|
||||||
with ops;
|
, user ? "root"
|
||||||
let
|
, commandPrefix ? "deploy"
|
||||||
commandName = if enableSecrets then
|
, enableSwitch ? true
|
||||||
"${commandPrefix}-${name}-with-secrets"
|
, enableSecrets ? true
|
||||||
else
|
}:
|
||||||
"${commandPrefix}-${name}-without-secrets";
|
with ops;
|
||||||
populateCommands = with lib;
|
let
|
||||||
flatten [
|
commandName =
|
||||||
content
|
if enableSecrets then
|
||||||
(optionals enableSecrets secrets)
|
"${commandPrefix}-${name}-with-secrets"
|
||||||
(optionals enableSwitch [ switch ])
|
else
|
||||||
];
|
"${commandPrefix}-${name}-without-secrets";
|
||||||
in jobs commandName "${user}@${host}${target}" populateCommands;
|
populateCommands = with lib;
|
||||||
|
flatten [
|
||||||
|
content
|
||||||
|
(optionals enableSecrets secrets)
|
||||||
|
(optionals enableSwitch [ switch ])
|
||||||
|
];
|
||||||
|
in
|
||||||
|
jobs commandName "${user}@${host}${target}" populateCommands;
|
||||||
|
|
||||||
serverDeployment = name:
|
serverDeployment = name:
|
||||||
with ops;
|
with ops;
|
||||||
deployment {
|
deployment
|
||||||
content = [
|
{
|
||||||
(populate source.nixPkgs)
|
content = [
|
||||||
(populate source.modules)
|
(populate source.nixPkgs)
|
||||||
(populate (source.system name))
|
(populate source.modules)
|
||||||
];
|
(populate (source.system name))
|
||||||
secrets = [ (populate (source.secrets name)) ];
|
];
|
||||||
} name;
|
secrets = [ (populate (source.secrets name)) ];
|
||||||
|
}
|
||||||
|
name;
|
||||||
|
|
||||||
desktopDeployment = name:
|
desktopDeployment = name:
|
||||||
with ops;
|
with ops;
|
||||||
deployment {
|
deployment
|
||||||
content = [
|
{
|
||||||
(populate source.nixPkgs)
|
content = [
|
||||||
(populate source.modules)
|
(populate source.nixPkgs)
|
||||||
(populate (source.system name))
|
(populate source.modules)
|
||||||
];
|
(populate (source.system name))
|
||||||
secrets =
|
];
|
||||||
[ (populate (source.secrets name)) (populate source.desktopSecrets) ];
|
secrets =
|
||||||
} name;
|
[ (populate (source.secrets name)) (populate source.desktopSecrets) ];
|
||||||
|
}
|
||||||
|
name;
|
||||||
|
|
||||||
cleanupNix = name:
|
cleanupNix = name:
|
||||||
{ ... }:
|
{ ... }:
|
||||||
|
|
@ -191,13 +203,14 @@ let
|
||||||
user = "root";
|
user = "root";
|
||||||
port = "22";
|
port = "22";
|
||||||
};
|
};
|
||||||
in pkgs.writers.writeDashBin "clean-${name}" # sh
|
in
|
||||||
''
|
pkgs.writers.writeDashBin "clean-${name}" # sh
|
||||||
set -eu
|
''
|
||||||
${pkgs.openssh}/bin/ssh \
|
set -eu
|
||||||
${target.user}@${target.host} -p ${target.port} \
|
${pkgs.openssh}/bin/ssh \
|
||||||
nix-collect-garbage -d
|
${target.user}@${target.host} -p ${target.port} \
|
||||||
'';
|
nix-collect-garbage -d
|
||||||
|
'';
|
||||||
|
|
||||||
# helper function to make stuff more readable
|
# helper function to make stuff more readable
|
||||||
runForAll = serverList: command: arguments:
|
runForAll = serverList: command: arguments:
|
||||||
|
|
@ -217,7 +230,8 @@ let
|
||||||
target = "/mnt/var/src";
|
target = "/mnt/var/src";
|
||||||
enableSwitch = false;
|
enableSwitch = false;
|
||||||
};
|
};
|
||||||
in deployments ++ cleanup ++ install;
|
in
|
||||||
|
deployments ++ cleanup ++ install;
|
||||||
|
|
||||||
desktops = desktopList:
|
desktops = desktopList:
|
||||||
with lib;
|
with lib;
|
||||||
|
|
@ -231,9 +245,11 @@ let
|
||||||
target = "/mnt/var/src";
|
target = "/mnt/var/src";
|
||||||
enableSwitch = false;
|
enableSwitch = false;
|
||||||
};
|
};
|
||||||
in deployments ++ cleanup ++ install;
|
in
|
||||||
|
deployments ++ cleanup ++ install;
|
||||||
|
|
||||||
in pkgs.mkShell {
|
in
|
||||||
|
pkgs.mkShell {
|
||||||
|
|
||||||
buildInputs = with pkgs;
|
buildInputs = with pkgs;
|
||||||
(servers [ "workhorse" "sputnik" "porani" "dummy" ])
|
(servers [ "workhorse" "sputnik" "porani" "dummy" ])
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1 @@
|
||||||
|
|
||||||
|
|
@ -11,7 +11,8 @@ let
|
||||||
# rev = "928f9e5e1d63e77a91f2ca57ffa2be1fef3078ec";
|
# rev = "928f9e5e1d63e77a91f2ca57ffa2be1fef3078ec";
|
||||||
#sha256 = "0rs84c549l863vbnnqgnx7v6m2zlq0wz46jbhm4v1l1a25d966s1";
|
#sha256 = "0rs84c549l863vbnnqgnx7v6m2zlq0wz46jbhm4v1l1a25d966s1";
|
||||||
#};
|
#};
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
imports = [ (toString hcloud-modules) ];
|
imports = [ (toString hcloud-modules) ];
|
||||||
|
|
||||||
# configure admin ssh keys
|
# configure admin ssh keys
|
||||||
|
|
|
||||||
|
|
@ -1,17 +1,20 @@
|
||||||
{ pkgs ? import <nixpkgs> { } }:
|
{ pkgs ? import <nixpkgs> { } }:
|
||||||
let
|
let
|
||||||
terranix = pkgs.callPackage (pkgs.fetchgit {
|
terranix = pkgs.callPackage
|
||||||
url = "https://github.com/mrVanDalo/terranix.git";
|
(pkgs.fetchgit {
|
||||||
rev = "2.3.0";
|
url = "https://github.com/mrVanDalo/terranix.git";
|
||||||
sha256 = "030067h3gjc02llaa7rx5iml0ikvw6szadm0nrss2sqzshsfimm4";
|
rev = "2.3.0";
|
||||||
}) { };
|
sha256 = "030067h3gjc02llaa7rx5iml0ikvw6szadm0nrss2sqzshsfimm4";
|
||||||
|
})
|
||||||
|
{ };
|
||||||
|
|
||||||
terraform = pkgs.writers.writeBashBin "terraform" ''
|
terraform = pkgs.writers.writeBashBin "terraform" ''
|
||||||
export TF_VAR_hcloud_api_token=`${pkgs.pass}/bin/pass development/hetzner.com/api-token`
|
export TF_VAR_hcloud_api_token=`${pkgs.pass}/bin/pass development/hetzner.com/api-token`
|
||||||
${pkgs.terraform_0_12}/bin/terraform "$@"
|
${pkgs.terraform_0_12}/bin/terraform "$@"
|
||||||
'';
|
'';
|
||||||
|
|
||||||
in pkgs.mkShell {
|
in
|
||||||
|
pkgs.mkShell {
|
||||||
|
|
||||||
buildInputs = [
|
buildInputs = [
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -3,43 +3,45 @@ with builtins; {
|
||||||
imports = [ ./provider.nix ./nginx.nix ./journald.nix ];
|
imports = [ ./provider.nix ./nginx.nix ./journald.nix ];
|
||||||
|
|
||||||
# create default index
|
# create default index
|
||||||
resource.graylog_index_set.default = let
|
resource.graylog_index_set.default =
|
||||||
maxIndexSize = 200;
|
let
|
||||||
maxIndexCount = 20;
|
maxIndexSize = 200;
|
||||||
isDefault = true;
|
maxIndexCount = 20;
|
||||||
in {
|
isDefault = true;
|
||||||
title = "default";
|
in
|
||||||
description = ''
|
{
|
||||||
This is the default index set, where everything ends up which is
|
title = "default";
|
||||||
not specifically send to another index.
|
description = ''
|
||||||
|
This is the default index set, where everything ends up which is
|
||||||
|
not specifically send to another index.
|
||||||
|
|
||||||
Be aware this index can only hold ${
|
Be aware this index can only hold ${
|
||||||
toString (maxIndexCount * maxIndexSize)
|
toString (maxIndexCount * maxIndexSize)
|
||||||
}MB of logs!
|
}MB of logs!
|
||||||
'';
|
'';
|
||||||
default = isDefault;
|
default = isDefault;
|
||||||
index_prefix = "graylog";
|
index_prefix = "graylog";
|
||||||
rotation_strategy_class =
|
rotation_strategy_class =
|
||||||
"org.graylog2.indexer.rotation.strategies.SizeBasedRotationStrategy";
|
"org.graylog2.indexer.rotation.strategies.SizeBasedRotationStrategy";
|
||||||
retention_strategy_class =
|
retention_strategy_class =
|
||||||
"org.graylog2.indexer.retention.strategies.DeletionRetentionStrategy";
|
"org.graylog2.indexer.retention.strategies.DeletionRetentionStrategy";
|
||||||
index_analyzer = "standard";
|
index_analyzer = "standard";
|
||||||
index_optimization_disabled = false;
|
index_optimization_disabled = false;
|
||||||
writable = true;
|
writable = true;
|
||||||
shards = 1;
|
shards = 1;
|
||||||
replicas = 0;
|
replicas = 0;
|
||||||
index_optimization_max_num_segments = 1;
|
index_optimization_max_num_segments = 1;
|
||||||
field_type_refresh_interval = 5000;
|
field_type_refresh_interval = 5000;
|
||||||
retention_strategy = toJSON ({
|
retention_strategy = toJSON ({
|
||||||
max_number_of_indices = maxIndexCount;
|
max_number_of_indices = maxIndexCount;
|
||||||
type =
|
type =
|
||||||
"org.graylog2.indexer.retention.strategies.DeletionRetentionStrategyConfig";
|
"org.graylog2.indexer.retention.strategies.DeletionRetentionStrategyConfig";
|
||||||
});
|
});
|
||||||
rotation_strategy = toJSON ({
|
rotation_strategy = toJSON ({
|
||||||
#max_docs_per_index = 30000000;
|
#max_docs_per_index = 30000000;
|
||||||
max_size = maxIndexSize * 1024 * 1024;
|
max_size = maxIndexSize * 1024 * 1024;
|
||||||
type =
|
type =
|
||||||
"org.graylog2.indexer.rotation.strategies.SizeBasedRotationStrategyConfig";
|
"org.graylog2.indexer.rotation.strategies.SizeBasedRotationStrategyConfig";
|
||||||
});
|
});
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -2,19 +2,19 @@
|
||||||
# to send data to these inputs
|
# to send data to these inputs
|
||||||
|
|
||||||
log_format graylog2_json escape=json '{ "timestamp": "$time_iso8601", '
|
log_format graylog2_json escape=json '{ "timestamp": "$time_iso8601", '
|
||||||
'"facility": "nginx", '
|
'"facility": "nginx", '
|
||||||
'"src_addr": "$remote_addr", '
|
'"src_addr": "$remote_addr", '
|
||||||
'"body_bytes_sent": $body_bytes_sent, '
|
'"body_bytes_sent": $body_bytes_sent, '
|
||||||
'"request_time": $request_time, '
|
'"request_time": $request_time, '
|
||||||
'"response_status": $status, '
|
'"response_status": $status, '
|
||||||
'"request": "$request", '
|
'"request": "$request", '
|
||||||
'"request_method": "$request_method", '
|
'"request_method": "$request_method", '
|
||||||
'"host": "$host",'
|
'"host": "$host",'
|
||||||
'"upstream_cache_status": "$upstream_cache_status",'
|
'"upstream_cache_status": "$upstream_cache_status",'
|
||||||
'"upstream_addr": "$upstream_addr",'
|
'"upstream_addr": "$upstream_addr",'
|
||||||
'"http_x_forwarded_for": "$http_x_forwarded_for",'
|
'"http_x_forwarded_for": "$http_x_forwarded_for",'
|
||||||
'"http_referrer": "$http_referer", '
|
'"http_referrer": "$http_referer", '
|
||||||
'"http_user_agent": "$http_user_agent" }';
|
'"http_user_agent": "$http_user_agent" }';
|
||||||
|
|
||||||
access_log syslog:server=${access_log_input} graylog2_json;
|
access_log syslog:server=${access_log_input} graylog2_json;
|
||||||
error_log syslog:server=${error_log_input};
|
error_log syslog:server=${error_log_input};
|
||||||
|
|
@ -269,41 +269,43 @@ with builtins; {
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
graylog_stream_rule = let
|
graylog_stream_rule =
|
||||||
nq_stream_rule = field: value: stream_id: {
|
let
|
||||||
inherit field value stream_id;
|
nq_stream_rule = field: value: stream_id: {
|
||||||
type = 1;
|
inherit field value stream_id;
|
||||||
inverted = true;
|
type = 1;
|
||||||
|
inverted = true;
|
||||||
|
};
|
||||||
|
eq_stream_rule = field: value: stream_id: {
|
||||||
|
inherit field value stream_id;
|
||||||
|
type = 1;
|
||||||
|
inverted = false;
|
||||||
|
};
|
||||||
|
gt_stream_rule = field: value: stream_id: {
|
||||||
|
inherit field value stream_id;
|
||||||
|
type = 3;
|
||||||
|
inverted = false;
|
||||||
|
};
|
||||||
|
lt_stream_rule = field: value: stream_id: {
|
||||||
|
inherit field value stream_id;
|
||||||
|
type = 4;
|
||||||
|
inverted = false;
|
||||||
|
};
|
||||||
|
between = min: max: stream_id: {
|
||||||
|
"is_nginx_access_${min}_${max}" =
|
||||||
|
(eq_stream_rule "nginx_access" true stream_id);
|
||||||
|
"nginx_above${min}" = (gt_stream_rule "response_status" min stream_id);
|
||||||
|
"nginx_below${max}" = (lt_stream_rule "response_status" max stream_id);
|
||||||
|
};
|
||||||
|
in
|
||||||
|
(between "499" "600" "\${graylog_stream.nginx5xx.id}")
|
||||||
|
// (between "399" "500" "\${graylog_stream.nginx4xx.id}")
|
||||||
|
// (between "199" "300" "\${graylog_stream.nginx2xx.id}") // {
|
||||||
|
is_nginx_access = (eq_stream_rule "nginx_access" true
|
||||||
|
"\${graylog_stream.nginx_access.id}");
|
||||||
|
is_nginx_error =
|
||||||
|
(eq_stream_rule "nginx_error" true "\${graylog_stream.nginx_error.id}");
|
||||||
};
|
};
|
||||||
eq_stream_rule = field: value: stream_id: {
|
|
||||||
inherit field value stream_id;
|
|
||||||
type = 1;
|
|
||||||
inverted = false;
|
|
||||||
};
|
|
||||||
gt_stream_rule = field: value: stream_id: {
|
|
||||||
inherit field value stream_id;
|
|
||||||
type = 3;
|
|
||||||
inverted = false;
|
|
||||||
};
|
|
||||||
lt_stream_rule = field: value: stream_id: {
|
|
||||||
inherit field value stream_id;
|
|
||||||
type = 4;
|
|
||||||
inverted = false;
|
|
||||||
};
|
|
||||||
between = min: max: stream_id: {
|
|
||||||
"is_nginx_access_${min}_${max}" =
|
|
||||||
(eq_stream_rule "nginx_access" true stream_id);
|
|
||||||
"nginx_above${min}" = (gt_stream_rule "response_status" min stream_id);
|
|
||||||
"nginx_below${max}" = (lt_stream_rule "response_status" max stream_id);
|
|
||||||
};
|
|
||||||
in (between "499" "600" "\${graylog_stream.nginx5xx.id}")
|
|
||||||
// (between "399" "500" "\${graylog_stream.nginx4xx.id}")
|
|
||||||
// (between "199" "300" "\${graylog_stream.nginx2xx.id}") // {
|
|
||||||
is_nginx_access = (eq_stream_rule "nginx_access" true
|
|
||||||
"\${graylog_stream.nginx_access.id}");
|
|
||||||
is_nginx_error =
|
|
||||||
(eq_stream_rule "nginx_error" true "\${graylog_stream.nginx_error.id}");
|
|
||||||
};
|
|
||||||
|
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -5,7 +5,8 @@ let
|
||||||
|
|
||||||
getVariable = name: "\${ var.${name} }";
|
getVariable = name: "\${ var.${name} }";
|
||||||
|
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
|
|
||||||
hcloud = {
|
hcloud = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
|
||||||
|
|
@ -6,7 +6,8 @@ let
|
||||||
|
|
||||||
cfg = config.hcloud.nixserver;
|
cfg = config.hcloud.nixserver;
|
||||||
|
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
|
|
||||||
options.hcloud.nixserver = {
|
options.hcloud.nixserver = {
|
||||||
enable = mkEnableOption ''
|
enable = mkEnableOption ''
|
||||||
|
|
|
||||||
|
|
@ -14,7 +14,8 @@ let
|
||||||
};
|
};
|
||||||
});
|
});
|
||||||
|
|
||||||
in pkgs.mkShell {
|
in
|
||||||
|
pkgs.mkShell {
|
||||||
|
|
||||||
# needed pkgs
|
# needed pkgs
|
||||||
# -----------
|
# -----------
|
||||||
|
|
|
||||||
|
|
@ -5,7 +5,8 @@ let
|
||||||
rev = "5fa359a482892cd973dcc6ecfc607f4709f24495";
|
rev = "5fa359a482892cd973dcc6ecfc607f4709f24495";
|
||||||
sha256 = "0smgmdiklj98y71fmcdjsqjq8l41i66hs8msc7k4m9dpkphqk86p";
|
sha256 = "0smgmdiklj98y71fmcdjsqjq8l41i66hs8msc7k4m9dpkphqk86p";
|
||||||
};
|
};
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
|
|
||||||
imports = [ "${hcloud-modules}/default.nix" ];
|
imports = [ "${hcloud-modules}/default.nix" ];
|
||||||
|
|
||||||
|
|
@ -43,8 +44,9 @@ in {
|
||||||
ServerAliveInterval 60
|
ServerAliveInterval 60
|
||||||
ServerAliveCountMax 3
|
ServerAliveCountMax 3
|
||||||
'';
|
'';
|
||||||
in concatStringsSep "\n"
|
in
|
||||||
(map configPart (attrNames config.hcloud.nixserver));
|
concatStringsSep "\n"
|
||||||
|
(map configPart (attrNames config.hcloud.nixserver));
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -34,7 +34,8 @@ let
|
||||||
apiImage = "thecodingmachine/workadventure-back:develop";
|
apiImage = "thecodingmachine/workadventure-back:develop";
|
||||||
uploaderImage = "thecodingmachine/workadventure-uploader:develop";
|
uploaderImage = "thecodingmachine/workadventure-uploader:develop";
|
||||||
|
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
|
|
||||||
virtualisation.docker.enable = true;
|
virtualisation.docker.enable = true;
|
||||||
boot.kernel.sysctl."net.ipv4.ip_forward" = true;
|
boot.kernel.sysctl."net.ipv4.ip_forward" = true;
|
||||||
|
|
|
||||||
|
|
@ -7,16 +7,18 @@ let
|
||||||
sha256 = "193pajq1gcd9jyd12nii06q1sf49xdhbjbfqk3lcq83s0miqfs63";
|
sha256 = "193pajq1gcd9jyd12nii06q1sf49xdhbjbfqk3lcq83s0miqfs63";
|
||||||
});
|
});
|
||||||
|
|
||||||
ops = let
|
ops =
|
||||||
overlay = self: super: {
|
let
|
||||||
# overwrite ssh to use the generated ssh configuration
|
overlay = self: super: {
|
||||||
openssh = super.writeShellScriptBin "ssh" ''
|
# overwrite ssh to use the generated ssh configuration
|
||||||
${super.openssh}/bin/ssh -F ${
|
openssh = super.writeShellScriptBin "ssh" ''
|
||||||
toString ./generated/ssh-configuration
|
${super.openssh}/bin/ssh -F ${
|
||||||
} "$@"
|
toString ./generated/ssh-configuration
|
||||||
'';
|
} "$@"
|
||||||
};
|
'';
|
||||||
in opsImport { overlays = [ overlay ]; };
|
};
|
||||||
|
in
|
||||||
|
opsImport { overlays = [ overlay ]; };
|
||||||
|
|
||||||
lib = ops.lib;
|
lib = ops.lib;
|
||||||
pkgs = ops.pkgs;
|
pkgs = ops.pkgs;
|
||||||
|
|
@ -49,18 +51,19 @@ let
|
||||||
|
|
||||||
deployServer = name:
|
deployServer = name:
|
||||||
{ user ? "root", host, ... }:
|
{ user ? "root", host, ... }:
|
||||||
with ops;
|
with ops;
|
||||||
jobs "deploy-${name}" "${user}@${host.ipv4}" [
|
jobs "deploy-${name}" "${user}@${host.ipv4}" [
|
||||||
# deploy secrets to /run/plops-secrets/secrets
|
# deploy secrets to /run/plops-secrets/secrets
|
||||||
# (populateTmpfs (source.secrets name))
|
# (populateTmpfs (source.secrets name))
|
||||||
# deploy system to /var/src/system
|
# deploy system to /var/src/system
|
||||||
(populate (source.system name))
|
(populate (source.system name))
|
||||||
# deploy nixpkgs to /var/src/nixpkgs
|
# deploy nixpkgs to /var/src/nixpkgs
|
||||||
(populate source.nixPkgs)
|
(populate source.nixPkgs)
|
||||||
switch
|
switch
|
||||||
];
|
];
|
||||||
|
|
||||||
in pkgs.mkShell {
|
in
|
||||||
|
pkgs.mkShell {
|
||||||
|
|
||||||
buildInputs = lib.mapAttrsToList deployServer servers;
|
buildInputs = lib.mapAttrsToList deployServer servers;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -13,7 +13,8 @@ let
|
||||||
${pkgs.terraform_0_12}/bin/terraform "$@"
|
${pkgs.terraform_0_12}/bin/terraform "$@"
|
||||||
'';
|
'';
|
||||||
|
|
||||||
in pkgs.mkShell {
|
in
|
||||||
|
pkgs.mkShell {
|
||||||
|
|
||||||
buildInputs = [
|
buildInputs = [
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -10,7 +10,8 @@ let
|
||||||
|
|
||||||
hcloud-modules = /home/palo/dev/terranix-hcloud/terraform-0.11;
|
hcloud-modules = /home/palo/dev/terranix-hcloud/terraform-0.11;
|
||||||
|
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
|
|
||||||
imports = [ (toString hcloud-modules) ./config/ssh-setup.nix ];
|
imports = [ (toString hcloud-modules) ./config/ssh-setup.nix ];
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -19,7 +19,8 @@
|
||||||
};
|
};
|
||||||
'';
|
'';
|
||||||
allServerParts = map serverPart (attrNames config.hcloud.server);
|
allServerParts = map serverPart (attrNames config.hcloud.server);
|
||||||
in ''
|
in
|
||||||
|
''
|
||||||
{
|
{
|
||||||
${concatStringsSep "\n" allServerParts}
|
${concatStringsSep "\n" allServerParts}
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -11,7 +11,8 @@ let
|
||||||
publicKeyFile = ../../sshkey.pub;
|
publicKeyFile = ../../sshkey.pub;
|
||||||
};
|
};
|
||||||
target = file: "${toString ../../02-build/generated}/${file}";
|
target = file: "${toString ../../02-build/generated}/${file}";
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
# configure admin ssh keys
|
# configure admin ssh keys
|
||||||
users.admins.palo.publicKey = lib.fileContents ssh.publicKeyFile;
|
users.admins.palo.publicKey = lib.fileContents ssh.publicKeyFile;
|
||||||
|
|
||||||
|
|
@ -36,8 +37,9 @@ in {
|
||||||
ServerAliveInterval 60
|
ServerAliveInterval 60
|
||||||
ServerAliveCountMax 3
|
ServerAliveCountMax 3
|
||||||
'';
|
'';
|
||||||
in concatStringsSep "\n"
|
in
|
||||||
(map configPart (attrNames config.hcloud.server));
|
concatStringsSep "\n"
|
||||||
|
(map configPart (attrNames config.hcloud.server));
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -2,11 +2,13 @@
|
||||||
|
|
||||||
let
|
let
|
||||||
|
|
||||||
terranix = pkgs.callPackage (pkgs.fetchgit {
|
terranix = pkgs.callPackage
|
||||||
url = "https://github.com/mrVanDalo/terranix.git";
|
(pkgs.fetchgit {
|
||||||
rev = "6097722f3a94972a92d810f3a707351cd425a4be";
|
url = "https://github.com/mrVanDalo/terranix.git";
|
||||||
sha256 = "1d8w82mvgflmscvq133pz9ynr79cgd5qjggng85byk8axj6fg6jw";
|
rev = "6097722f3a94972a92d810f3a707351cd425a4be";
|
||||||
}) { };
|
sha256 = "1d8w82mvgflmscvq133pz9ynr79cgd5qjggng85byk8axj6fg6jw";
|
||||||
|
})
|
||||||
|
{ };
|
||||||
|
|
||||||
terraform = pkgs.writers.writeDashBin "terraform" ''
|
terraform = pkgs.writers.writeDashBin "terraform" ''
|
||||||
export TF_VAR_hcloud_api_token=`${pkgs.pass}/bin/pass development/hetzner.com/api-token`
|
export TF_VAR_hcloud_api_token=`${pkgs.pass}/bin/pass development/hetzner.com/api-token`
|
||||||
|
|
@ -27,7 +29,8 @@ let
|
||||||
rm ${toString ./.}/terraform.tfstate*
|
rm ${toString ./.}/terraform.tfstate*
|
||||||
'';
|
'';
|
||||||
|
|
||||||
in pkgs.mkShell {
|
in
|
||||||
|
pkgs.mkShell {
|
||||||
|
|
||||||
buildInputs = with pkgs; [ terranix terraform create destroy ];
|
buildInputs = with pkgs; [ terranix terraform create destroy ];
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -4,21 +4,23 @@ with pkgs.lib;
|
||||||
|
|
||||||
let
|
let
|
||||||
|
|
||||||
ops = let
|
ops =
|
||||||
opsImport = import ((import <nixpkgs> { }).fetchgit {
|
let
|
||||||
url = "https://github.com/mrVanDalo/plops.git";
|
opsImport = import ((import <nixpkgs> { }).fetchgit {
|
||||||
rev = "9fabba016a3553ae6e13d5d17d279c4de2eb00ad";
|
url = "https://github.com/mrVanDalo/plops.git";
|
||||||
sha256 = "193pajq1gcd9jyd12nii06q1sf49xdhbjbfqk3lcq83s0miqfs63";
|
rev = "9fabba016a3553ae6e13d5d17d279c4de2eb00ad";
|
||||||
});
|
sha256 = "193pajq1gcd9jyd12nii06q1sf49xdhbjbfqk3lcq83s0miqfs63";
|
||||||
overlay = self: super: {
|
});
|
||||||
# overwrite ssh to use the generated ssh configuration
|
overlay = self: super: {
|
||||||
openssh = super.writers.writeBashBin "ssh" ''
|
# overwrite ssh to use the generated ssh configuration
|
||||||
${super.openssh}/bin/ssh -F ${
|
openssh = super.writers.writeBashBin "ssh" ''
|
||||||
toString ./generated/ssh-configuration
|
${super.openssh}/bin/ssh -F ${
|
||||||
} "$@"
|
toString ./generated/ssh-configuration
|
||||||
'';
|
} "$@"
|
||||||
};
|
'';
|
||||||
in opsImport { overlays = [ overlay ]; };
|
};
|
||||||
|
in
|
||||||
|
opsImport { overlays = [ overlay ]; };
|
||||||
|
|
||||||
lib = ops.lib;
|
lib = ops.lib;
|
||||||
pkgs = ops.pkgs;
|
pkgs = ops.pkgs;
|
||||||
|
|
@ -48,13 +50,13 @@ let
|
||||||
|
|
||||||
deployServer = name:
|
deployServer = name:
|
||||||
{ user ? "root", host, ... }:
|
{ user ? "root", host, ... }:
|
||||||
with ops;
|
with ops;
|
||||||
jobs "deploy-${name}" "${user}@${host.ipv4}" [
|
jobs "deploy-${name}" "${user}@${host.ipv4}" [
|
||||||
(populate (source.system name))
|
(populate (source.system name))
|
||||||
(populate source.nixPkgs)
|
(populate source.nixPkgs)
|
||||||
(populate source.modules)
|
(populate source.modules)
|
||||||
switch
|
switch
|
||||||
];
|
];
|
||||||
|
|
||||||
moshServer = name:
|
moshServer = name:
|
||||||
{ user ? "root", host, ... }:
|
{ user ? "root", host, ... }:
|
||||||
|
|
@ -66,7 +68,8 @@ let
|
||||||
"${user}@${host.ipv4}"
|
"${user}@${host.ipv4}"
|
||||||
'';
|
'';
|
||||||
|
|
||||||
in pkgs.mkShell {
|
in
|
||||||
|
pkgs.mkShell {
|
||||||
buildInputs = lib.mapAttrsToList deployServer servers
|
buildInputs = lib.mapAttrsToList deployServer servers
|
||||||
++ mapAttrsToList moshServer servers;
|
++ mapAttrsToList moshServer servers;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -5,7 +5,8 @@ let
|
||||||
rev = "5fa359a482892cd973dcc6ecfc607f4709f24495";
|
rev = "5fa359a482892cd973dcc6ecfc607f4709f24495";
|
||||||
sha256 = "0smgmdiklj98y71fmcdjsqjq8l41i66hs8msc7k4m9dpkphqk86p";
|
sha256 = "0smgmdiklj98y71fmcdjsqjq8l41i66hs8msc7k4m9dpkphqk86p";
|
||||||
};
|
};
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
|
|
||||||
imports = [ "${hcloud-modules}/default.nix" ];
|
imports = [ "${hcloud-modules}/default.nix" ];
|
||||||
|
|
||||||
|
|
@ -40,8 +41,9 @@ in {
|
||||||
ServerAliveInterval 60
|
ServerAliveInterval 60
|
||||||
ServerAliveCountMax 3
|
ServerAliveCountMax 3
|
||||||
'';
|
'';
|
||||||
in concatStringsSep "\n"
|
in
|
||||||
(map configPart (attrNames config.hcloud.nixserver));
|
concatStringsSep "\n"
|
||||||
|
(map configPart (attrNames config.hcloud.nixserver));
|
||||||
};
|
};
|
||||||
|
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -35,7 +35,8 @@ let
|
||||||
apiImage = "thecodingmachine/workadventure-back:${version}";
|
apiImage = "thecodingmachine/workadventure-back:${version}";
|
||||||
uploaderImage = "thecodingmachine/workadventure-uploader:${version}";
|
uploaderImage = "thecodingmachine/workadventure-uploader:${version}";
|
||||||
|
|
||||||
in {
|
in
|
||||||
|
{
|
||||||
|
|
||||||
virtualisation.docker.enable = true;
|
virtualisation.docker.enable = true;
|
||||||
boot.kernel.sysctl."net.ipv4.ip_forward" = true;
|
boot.kernel.sysctl."net.ipv4.ip_forward" = true;
|
||||||
|
|
|
||||||
|
|
@ -7,16 +7,18 @@ let
|
||||||
sha256 = "193pajq1gcd9jyd12nii06q1sf49xdhbjbfqk3lcq83s0miqfs63";
|
sha256 = "193pajq1gcd9jyd12nii06q1sf49xdhbjbfqk3lcq83s0miqfs63";
|
||||||
});
|
});
|
||||||
|
|
||||||
ops = let
|
ops =
|
||||||
overlay = self: super: {
|
let
|
||||||
# overwrite ssh to use the generated ssh configuration
|
overlay = self: super: {
|
||||||
openssh = super.writeShellScriptBin "ssh" ''
|
# overwrite ssh to use the generated ssh configuration
|
||||||
${super.openssh}/bin/ssh -F ${
|
openssh = super.writeShellScriptBin "ssh" ''
|
||||||
toString ./generated/ssh-configuration
|
${super.openssh}/bin/ssh -F ${
|
||||||
} "$@"
|
toString ./generated/ssh-configuration
|
||||||
'';
|
} "$@"
|
||||||
};
|
'';
|
||||||
in opsImport { overlays = [ overlay ]; };
|
};
|
||||||
|
in
|
||||||
|
opsImport { overlays = [ overlay ]; };
|
||||||
|
|
||||||
lib = ops.lib;
|
lib = ops.lib;
|
||||||
pkgs = ops.pkgs;
|
pkgs = ops.pkgs;
|
||||||
|
|
@ -49,18 +51,19 @@ let
|
||||||
|
|
||||||
deployServer = name:
|
deployServer = name:
|
||||||
{ user ? "root", host, ... }:
|
{ user ? "root", host, ... }:
|
||||||
with ops;
|
with ops;
|
||||||
jobs "deploy-${name}" "${user}@${host.ipv4}" [
|
jobs "deploy-${name}" "${user}@${host.ipv4}" [
|
||||||
# deploy secrets to /run/plops-secrets/secrets
|
# deploy secrets to /run/plops-secrets/secrets
|
||||||
# (populateTmpfs (source.secrets name))
|
# (populateTmpfs (source.secrets name))
|
||||||
# deploy system to /var/src/system
|
# deploy system to /var/src/system
|
||||||
(populate (source.system name))
|
(populate (source.system name))
|
||||||
# deploy nixpkgs to /var/src/nixpkgs
|
# deploy nixpkgs to /var/src/nixpkgs
|
||||||
(populate source.nixPkgs)
|
(populate source.nixPkgs)
|
||||||
switch
|
switch
|
||||||
];
|
];
|
||||||
|
|
||||||
in pkgs.mkShell {
|
in
|
||||||
|
pkgs.mkShell {
|
||||||
|
|
||||||
buildInputs = lib.mapAttrsToList deployServer servers;
|
buildInputs = lib.mapAttrsToList deployServer servers;
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,18 +1,21 @@
|
||||||
{ pkgs ? import <nixpkgs> { } }:
|
{ pkgs ? import <nixpkgs> { } }:
|
||||||
let
|
let
|
||||||
|
|
||||||
terranix = pkgs.callPackage (pkgs.fetchgit {
|
terranix = pkgs.callPackage
|
||||||
url = "https://github.com/mrVanDalo/terranix.git";
|
(pkgs.fetchgit {
|
||||||
rev = "2.3.0";
|
url = "https://github.com/mrVanDalo/terranix.git";
|
||||||
sha256 = "030067h3gjc02llaa7rx5iml0ikvw6szadm0nrss2sqzshsfimm4";
|
rev = "2.3.0";
|
||||||
}) { };
|
sha256 = "030067h3gjc02llaa7rx5iml0ikvw6szadm0nrss2sqzshsfimm4";
|
||||||
|
})
|
||||||
|
{ };
|
||||||
|
|
||||||
terraform = pkgs.writers.writeBashBin "terraform" ''
|
terraform = pkgs.writers.writeBashBin "terraform" ''
|
||||||
export TF_VAR_hcloud_api_token=`${pkgs.pass}/bin/pass development/hetzner.com/api-token`
|
export TF_VAR_hcloud_api_token=`${pkgs.pass}/bin/pass development/hetzner.com/api-token`
|
||||||
${pkgs.terraform_0_12}/bin/terraform "$@"
|
${pkgs.terraform_0_12}/bin/terraform "$@"
|
||||||
'';
|
'';
|
||||||
|
|
||||||
in pkgs.mkShell {
|
in
|
||||||
|
pkgs.mkShell {
|
||||||
|
|
||||||
buildInputs = [
|
buildInputs = [
|
||||||
|
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue