add headscale, eth clients to htz
This commit is contained in:
parent
4293324f36
commit
1849fdc496
15 changed files with 289 additions and 417 deletions
|
|
@ -1,37 +1,67 @@
|
|||
{
|
||||
pkgs,
|
||||
addressList,
|
||||
...
|
||||
}: {
|
||||
{pkgs, ...}: {
|
||||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./vms
|
||||
#./eth.nix
|
||||
./eth.nix
|
||||
];
|
||||
environment.systemPackages = with pkgs; [
|
||||
vim
|
||||
git
|
||||
bridge-utils
|
||||
comma
|
||||
];
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
dockerCompat = true;
|
||||
};
|
||||
networking = {
|
||||
hostName = "htz";
|
||||
domain = "";
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [22];
|
||||
allowedTCPPorts = [22 80 443];
|
||||
allowedUDPPorts = [];
|
||||
logRefusedConnections = true;
|
||||
};
|
||||
nat = {
|
||||
};
|
||||
fileSystems."/var/lib/private/nimbus-beacon-mainnet" = {
|
||||
device = "/eth2";
|
||||
options = ["bind"];
|
||||
};
|
||||
fileSystems."/var/lib/private/geth-mainnet" = {
|
||||
device = "/eth1";
|
||||
options = ["bind"];
|
||||
};
|
||||
services = let
|
||||
domain = "ts.10110110.xyz";
|
||||
in {
|
||||
openssh.enable = true;
|
||||
tailscale.enable = true;
|
||||
headscale = {
|
||||
enable = true;
|
||||
forwardPorts = [
|
||||
{
|
||||
proto = "tcp";
|
||||
sourcePort = 80;
|
||||
destination = addressList.vm-test.ipv4;
|
||||
}
|
||||
];
|
||||
address = "0.0.0.0";
|
||||
port = 8080;
|
||||
serverUrl = "https://${domain}";
|
||||
dns = {baseDomain = domain;};
|
||||
settings = {logtail.enabled = false;};
|
||||
};
|
||||
|
||||
nginx = {
|
||||
enable = true;
|
||||
virtualHosts.${domain} = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:8080";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
services.openssh.enable = true;
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "mail@10110110.xyz";
|
||||
};
|
||||
users.users = {
|
||||
root = {
|
||||
openssh.authorizedKeys.keys = [''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''];
|
||||
|
|
|
|||
|
|
@ -1,74 +1,27 @@
|
|||
{
|
||||
system,
|
||||
ethereum-nix,
|
||||
inputs,
|
||||
...
|
||||
}: {
|
||||
services.ethereum.geth.mainnet = {
|
||||
enable = true;
|
||||
package = ethereum-nix.packages.${system}.geth;
|
||||
package = inputs.ethereum-nix.packages.${system}.geth;
|
||||
openFirewall = true;
|
||||
args = {
|
||||
http = {
|
||||
enable = false;
|
||||
api = ["net" "web3" "eth"];
|
||||
};
|
||||
authrpc.jwtsecret = "/etc/nixos/eth_jwt";
|
||||
};
|
||||
};
|
||||
services.nginx.enable = true;
|
||||
services.nginx.virtualHosts."contabo.10110110.xyz" = {
|
||||
addSSL = true;
|
||||
enableACME = true;
|
||||
root = "/var/www/fam";
|
||||
};
|
||||
security.acme = {
|
||||
acceptTerms = true;
|
||||
defaults.email = "cjriddz@protonmail.com";
|
||||
};
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [80 443];
|
||||
allowedUDPPorts = [];
|
||||
logRefusedConnections = true;
|
||||
};
|
||||
services.ethereum.nimbus-beacon.mainnet = {
|
||||
enable = true;
|
||||
package = ethereum-nix.packages.${system}.nimbus;
|
||||
package = inputs.ethereum-nix.packages.${system}.nimbus;
|
||||
openFirewall = true;
|
||||
args = {
|
||||
nat = "any";
|
||||
network = "mainnet";
|
||||
user = "nimbus";
|
||||
jwt-secret = "/etc/nixos/eth_jwt";
|
||||
trusted-node-url = "https://sync.invis.tools";
|
||||
el = ["http://127.0.0.1:8551"];
|
||||
listen-address = "0.0.0.0";
|
||||
tcp-port = 9000;
|
||||
udp-port = 9000;
|
||||
enr-auto-update = true;
|
||||
max-peers = "160";
|
||||
doppelganger-detection = true;
|
||||
history = "prune";
|
||||
graffiti = "yo";
|
||||
metrics = {
|
||||
enable = true;
|
||||
port = 5054;
|
||||
address = "127.0.0.1";
|
||||
};
|
||||
rest = {
|
||||
enable = true;
|
||||
port = 5052;
|
||||
address = "0.0.0.0";
|
||||
allow-origin = "*";
|
||||
};
|
||||
payload-builder = {
|
||||
enable = true;
|
||||
url = "http://localhost";
|
||||
};
|
||||
light-client-data = {
|
||||
serve = true;
|
||||
import-mode = "only-new";
|
||||
max-periods = "3";
|
||||
};
|
||||
rest.enable = true;
|
||||
light-client-data.max-periods = "3";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,40 +1,54 @@
|
|||
{
|
||||
modulesPath,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
}: {
|
||||
imports = [(modulesPath + "/profiles/qemu-guest.nix")];
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
imports = [(modulesPath + "/installer/scan/not-detected.nix")];
|
||||
boot = {
|
||||
kernelModules = ["kvm-intel"];
|
||||
tmp.cleanOnBoot = true;
|
||||
loader.grub = {
|
||||
efiSupport = true;
|
||||
efiInstallAsRemovable = true;
|
||||
device = "nodev";
|
||||
};
|
||||
initrd.availableKernelModules = [
|
||||
"ata_piix"
|
||||
"uhci_hcd"
|
||||
"xen_blkfront"
|
||||
"vmw_pvscsi"
|
||||
];
|
||||
initrd.kernelModules = ["nvme"];
|
||||
initrd = {
|
||||
kernelModules = ["nvme" "dm-snapshot"];
|
||||
availableKernelModules = [
|
||||
"ahci"
|
||||
"ata_piix"
|
||||
"sd_mod"
|
||||
"uhci_hcd"
|
||||
"vmw_pvscsi"
|
||||
"xen_blkfront"
|
||||
"xhci_pci"
|
||||
];
|
||||
};
|
||||
};
|
||||
fileSystems = {
|
||||
"/boot" = {
|
||||
device = "/dev/disk/by-uuid/8480-5FBB";
|
||||
fsType = "vfat";
|
||||
};
|
||||
"/" = {
|
||||
device = "/dev/mapper/ssd1-root";
|
||||
fsType = "ext4";
|
||||
};
|
||||
fileSystems."/" = {
|
||||
device = "/dev/disk/by-uuid/2d5aa5d0-e6c5-4b5d-b295-d5248da994fc";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/boot" = {
|
||||
device = "/dev/disk/by-uuid/8480-5FBB";
|
||||
fsType = "vfat";
|
||||
};
|
||||
|
||||
fileSystems."/eth1" = {
|
||||
device = "/dev/disk/by-uuid/d674ba1d-dde0-4c8d-bdc7-0cb240d6de62";
|
||||
fsType = "ext4";
|
||||
};
|
||||
|
||||
fileSystems."/eth2" = {
|
||||
device = "/dev/disk/by-uuid/c2c7cf35-dc97-4ca3-823f-1e892bcba6f5";
|
||||
fsType = "ext4";
|
||||
};
|
||||
swapDevices = [
|
||||
{
|
||||
device = "/dev/dm-1";
|
||||
}
|
||||
{device = "/dev/disk/by-uuid/d4b0d80e-d570-4d21-bbe4-0f31bd50cbcc";}
|
||||
];
|
||||
|
||||
zramSwap.enable = false;
|
||||
networking = {
|
||||
useNetworkd = true;
|
||||
|
|
@ -71,4 +85,6 @@
|
|||
};
|
||||
};
|
||||
};
|
||||
nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
|
||||
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,44 +1,8 @@
|
|||
{
|
||||
lib,
|
||||
pkgs,
|
||||
addressList,
|
||||
...
|
||||
}: let
|
||||
genVMConfig = {
|
||||
name,
|
||||
config ? {},
|
||||
ro-store ? true,
|
||||
}: {
|
||||
restartIfChanged = true;
|
||||
inherit pkgs;
|
||||
config =
|
||||
config
|
||||
// {
|
||||
microvm = {
|
||||
shares = lib.mkIf ro-store [
|
||||
{
|
||||
source = "/nix/store";
|
||||
mountPoint = "/nix/.ro-store";
|
||||
tag = "ro-store";
|
||||
proto = "virtiofs";
|
||||
}
|
||||
];
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = name;
|
||||
inherit (addressList.${name}) mac;
|
||||
}
|
||||
];
|
||||
};
|
||||
}
|
||||
// import ./vmDefaults.nix {inherit name addressList;};
|
||||
};
|
||||
in {
|
||||
_: {
|
||||
microvm.vms = {
|
||||
vm-test = genVMConfig {
|
||||
name = "vm-test";
|
||||
config = import ./vm-test.nix {inherit pkgs addressList;};
|
||||
};
|
||||
# vm-headscale = genVMConfig {
|
||||
# name = "vm-headscale";
|
||||
# config = import ./headscale.nix { inherit config; };
|
||||
# };
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,27 +0,0 @@
|
|||
{config, ...}: let
|
||||
domain = "ts.10110110.xyz";
|
||||
in {
|
||||
services = {
|
||||
headscale = {
|
||||
enable = true;
|
||||
address = "0.0.0.0";
|
||||
port = 8080;
|
||||
serverUrl = "https://${domain}";
|
||||
dns = {baseDomain = "10110110.xyz";};
|
||||
settings = {logtail.enabled = false;};
|
||||
};
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
virtualHosts.${domain} = {
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:${toString config.services.headscale.port}";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
system.stateVersion = "23.11";
|
||||
}
|
||||
|
|
@ -1,14 +0,0 @@
|
|||
_: {
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [80];
|
||||
allowedUDPPorts = [];
|
||||
logRefusedConnections = true;
|
||||
};
|
||||
services.nginx.enable = true;
|
||||
services.nginx.virtualHosts."default_server" = {
|
||||
addSSL = false;
|
||||
enableACME = false;
|
||||
};
|
||||
system.stateVersion = "23.11";
|
||||
}
|
||||
|
|
@ -1,46 +0,0 @@
|
|||
{
|
||||
name,
|
||||
addressList,
|
||||
...
|
||||
}: {
|
||||
systemd.network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Type = "ether";
|
||||
networkConfig = {
|
||||
Address = [(addressList.${name}.ipv4 + addressList.${name}.subnet)];
|
||||
Gateway = "10.0.0.1";
|
||||
DNS = ["1.1.1.1"];
|
||||
IPv6AcceptRA = true;
|
||||
DHCP = "no";
|
||||
};
|
||||
};
|
||||
};
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings.PasswordAuthentication = false;
|
||||
settings.KbdInteractiveAuthentication = false;
|
||||
};
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [22];
|
||||
allowedUDPPorts = [];
|
||||
logRefusedConnections = true;
|
||||
};
|
||||
users.users = {
|
||||
root = {
|
||||
openssh.authorizedKeys.keys = [
|
||||
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTJm2iu/5xacOoh4/JAvMtHE62duDlVVXpvVP+uQMR root@htz''
|
||||
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU2TUxKyGKoZ68IG4hw23RmxVf72u5K9W0StkgTr0b2 e@t14''
|
||||
];
|
||||
};
|
||||
e = {
|
||||
isNormalUser = true;
|
||||
extraGroups = ["wheel"];
|
||||
openssh.authorizedKeys.keys = [
|
||||
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTJm2iu/5xacOoh4/JAvMtHE62duDlVVXpvVP+uQMR root@htz''
|
||||
''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU2TUxKyGKoZ68IG4hw23RmxVf72u5K9W0StkgTr0b2 e@t14''
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue