add hyprland conf

nixos/htz/configuration.nix

@@ -1,4 +1,9 @@
-{pkgs, ...}: {
+{
+  addressList,
+  lib,
+  pkgs,
+  ...
+}: {
   imports = [
     ./hardware-configuration.nix
     ./vms
@@ -10,9 +15,10 @@
     bridge-utils
     comma
   ];
-  virtualisation.podman = {
-    enable = true;
-    dockerCompat = true;
+  virtualisation = {
+    docker = {
+      enable = true;
+    };
   };
   networking = {
     hostName = "htz";
@@ -22,7 +28,12 @@
       allowedTCPPorts = [22 80 443];
       allowedUDPPorts = [];
       logRefusedConnections = true;
+      trustedInterfaces = ["microvm"];
     };
+    # Map addressList to entries in /etc/hosts
+    extraHosts =
+      builtins.concatStringsSep "\n"
+      (lib.attrsets.mapAttrsToList (k: v: "${v.ipv4} ${k}") addressList);
   };
   fileSystems."/var/lib/private/nimbus-beacon-mainnet" = {
     device = "/eth2";
@@ -35,7 +46,13 @@
   services = let
     domain = "ts.10110110.xyz";
   in {
-    openssh.enable = true;
+    openssh = {
+      enable = true;
+      settings = {
+        PasswordAuthentication = false;
+        PermitRootLogin = "prohibit-password";
+      };
+    };
     tailscale.enable = true;
     headscale = {
       enable = true;
@@ -45,7 +62,6 @@
       dns = {baseDomain = domain;};
       settings = {logtail.enabled = false;};
     };
-
     nginx = {
       enable = true;
       virtualHosts.${domain} = {

nixos/htz/eth.nix

@@ -3,24 +3,39 @@
   inputs,
   ...
 }: {
+  networking = {
+    firewall = {
+      allowedTCPPorts = [9000 30303];
+      allowedUDPPorts = [9000 30303];
+      logRefusedConnections = true;
+      trustedInterfaces = ["microvm"];
+    };
+  };
   services.ethereum.geth.mainnet = {
     enable = true;
     package = inputs.ethereum-nix.packages.${system}.geth;
-    openFirewall = true;
+    openFirewall = false;
     args = {
+      http = {
+        enable = true;
+        addr = "10.0.0.1";
+      };
       authrpc.jwtsecret = "/etc/nixos/eth_jwt";
     };
   };
   services.ethereum.nimbus-beacon.mainnet = {
     enable = true;
     package = inputs.ethereum-nix.packages.${system}.nimbus;
-    openFirewall = true;
+    openFirewall = false;
     args = {
       user = "nimbus";
       jwt-secret = "/etc/nixos/eth_jwt";
       trusted-node-url = "https://sync.invis.tools";
       enr-auto-update = true;
-      rest.enable = true;
+      rest = {
+        enable = true;
+        address = "10.0.0.1";
+      };
       light-client-data.max-periods = "3";
     };
   };

nixos/htz/hardware-configuration.nix

@@ -30,21 +30,22 @@
     device = "/dev/disk/by-uuid/2d5aa5d0-e6c5-4b5d-b295-d5248da994fc";
     fsType = "ext4";
   };
-
   fileSystems."/boot" = {
     device = "/dev/disk/by-uuid/8480-5FBB";
     fsType = "vfat";
   };
-
   fileSystems."/eth1" = {
     device = "/dev/disk/by-uuid/d674ba1d-dde0-4c8d-bdc7-0cb240d6de62";
     fsType = "ext4";
   };
-
   fileSystems."/eth2" = {
     device = "/dev/disk/by-uuid/c2c7cf35-dc97-4ca3-823f-1e892bcba6f5";
     fsType = "ext4";
   };
+  fileSystems."/var/lib/microvms" = {
+    device = "/dev/disk/by-uuid/06af31e6-7ac6-4066-a56b-9feaae14508b";
+    fsType = "ext4";
+  };
   swapDevices = [
     {device = "/dev/disk/by-uuid/d4b0d80e-d570-4d21-bbe4-0f31bd50cbcc";}
   ];
@@ -71,7 +72,12 @@
         matchConfig.Name = "microvm";
         networkConfig = {
           DHCPServer = true;
-          IPv6SendRA = true;
+          IPv6SendRA = false;
+        };
+        dhcpServerConfig = {
+          PoolOffset = 128;
+          PoolSize = 64;
+          EmitDNS = true;
         };
         addresses = [
           {
@@ -83,6 +89,10 @@
         matchConfig.Name = "vm-*";
         networkConfig.Bridge = "microvm";
       };
+      "12-microvm" = {
+        matchConfig.Name = "vnet*";
+        networkConfig.Bridge = "microvm";
+      };
     };
   };
   nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

nixos/htz/vms/default.nix

@@ -1,8 +1,105 @@
-_: {
+{
+  inputs,
+  lib,
+  pkgs,
+  system,
+  addressList,
+  ...
+}: let
+  genVMConfig = {
+    name,
+    config ? {},
+    ...
+  }: {
+    restartIfChanged = true;
+    inherit pkgs;
+    # Merge custom config passed with defaults
+    config =
+      lib.attrsets.recursiveUpdate
+      {
+        microvm = {
+          shares = [
+            {
+              source = "/nix/store";
+              mountPoint = "/nix/.ro-store";
+              tag = "ro-store";
+              proto = "virtiofs";
+            }
+          ];
+          interfaces = [
+            {
+              type = "tap";
+              id = name;
+              inherit (addressList.${name}) mac;
+            }
+          ];
+        };
+        systemd.network = {
+          enable = true;
+          networks."20-lan" = {
+            matchConfig.Type = "ether";
+            networkConfig = {
+              Address = [(addressList.${name}.ipv4 + addressList.${name}.subnet)];
+              Gateway = "10.0.0.1";
+              DNS = ["1.1.1.1"];
+              IPv6AcceptRA = true;
+              DHCP = "no";
+            };
+          };
+          networks."19-docker" = {
+            matchConfig.Name = "veth*";
+            linkConfig = {
+              Unmanaged = true;
+            };
+          };
+        };
+        services.openssh = {
+          enable = true;
+          listenAddresses = [
+            {
+              addr = addressList.${name}.ipv4;
+              port = 22;
+            }
+          ];
+          settings.PasswordAuthentication = false;
+          settings.KbdInteractiveAuthentication = false;
+        };
+        networking.firewall = {
+          enable = true;
+          allowedTCPPorts = [22];
+          allowedUDPPorts = [];
+          logRefusedConnections = true;
+        };
+        users.users = {
+          root = {
+            openssh.authorizedKeys.keys = [
+              ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTJm2iu/5xacOoh4/JAvMtHE62duDlVVXpvVP+uQMR root@htz''
+              ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHM4Zr0PFN7QdOG2aJ+nuzRCK6caulrpY6bphA1Ppl8Y e@t14''
+            ];
+          };
+          e = {
+            isNormalUser = true;
+            extraGroups = ["wheel"];
+            openssh.authorizedKeys.keys = [
+              ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIItTJm2iu/5xacOoh4/JAvMtHE62duDlVVXpvVP+uQMR root@htz''
+              ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILU2TUxKyGKoZ68IG4hw23RmxVf72u5K9W0StkgTr0b2 e@t14''
+            ];
+          };
+        };
+        documentation.enable = false;
+        system.stateVersion = "23.11";
+      }
+      config;
+  };
+in {
   microvm.vms = {
-    # vm-headscale = genVMConfig {
-    #   name = "vm-headscale";
-    #   config = import ./headscale.nix { inherit config; };
-    # };
+    vm-pool = genVMConfig {
+      name = "vm-pool";
+      config = import ./pool.nix {inherit pkgs system inputs;};
+    };
+    vm-k3s = genVMConfig {
+      name = "vm-k3s";
+      config = import ./k3s.nix {inherit pkgs;};
+    };
   };
 }

nixos/htz/vms/k3s.nix

@@ -0,0 +1,28 @@
+{pkgs, ...}: {
+  environment.systemPackages = with pkgs; [
+    k3s
+  ];
+  services.k3s = {
+    enable = true;
+    role = "server";
+    extraFlags = toString [
+      "--disable traefik"
+    ];
+  };
+  networking.firewall = {
+    allowedTCPPorts = [6443];
+  };
+  services.tailscale.enable = true;
+  microvm = {
+    vcpu = 2;
+    mem = 4096;
+    volumes = [
+      {
+        image = "/var/lib/microvms/vm-k3s/vm-k3s-root.img";
+        label = "vm-pool-root";
+        mountPoint = "/";
+        size = 10000;
+      }
+    ];
+  };
+}

nixos/htz/vms/pool.nix

@@ -0,0 +1,34 @@
+{
+  system,
+  inputs,
+  pkgs,
+  ...
+}: {
+  imports = [inputs.ethereum-nix.nixosModules.default];
+
+  environment.systemPackages = with pkgs; [
+    vim
+    inputs.ethereum-nix.packages.${system}.rocketpool
+    docker-compose
+  ];
+  environment.interactiveShellInit = ''
+    alias rp='rocketpool --allow-root'
+  '';
+  virtualisation = {
+    docker = {
+      enable = true;
+    };
+  };
+  microvm = {
+    vcpu = 2;
+    mem = 4096;
+    volumes = [
+      {
+        image = "/var/lib/microvms/vm-pool/vm-pool-root.img";
+        label = "vm-pool-root";
+        mountPoint = "/";
+        size = 40000;
+      }
+    ];
+  };
+}