Compare commits
No commits in common. "d482fd06945b6c3422b998552472cff21e6dde0e" and "29f7621d4275f6460629306df176836f90f92d38" have entirely different histories.
d482fd0694
...
29f7621d42
30 changed files with 836 additions and 860 deletions
|
|
@ -1,8 +1,6 @@
|
|||
{ ... }:
|
||||
{
|
||||
flake.modules.nixos.common-programs =
|
||||
{ lib, pkgs, ... }:
|
||||
{
|
||||
flake.modules.nixos.common-programs = { lib, pkgs, ... }: {
|
||||
environment = {
|
||||
systemPackages = with pkgs; [
|
||||
### Dev Tools ###
|
||||
|
|
@ -20,7 +18,7 @@
|
|||
];
|
||||
shellAliases = {
|
||||
cat = "${lib.getExe pkgs.bat} --paging=never --style=plain";
|
||||
ls = "${lib.getExe pkgs.eza} --git --icons --group-directories-first";
|
||||
ls = "${lib.getExe pkgs.eza} --icons --group-directories-first";
|
||||
tree = "ls --tree";
|
||||
};
|
||||
};
|
||||
|
|
|
|||
|
|
@ -1,13 +1,14 @@
|
|||
{ ... }:
|
||||
{
|
||||
flake.modules.nixos.common-security =
|
||||
{ ... }:
|
||||
{
|
||||
security.sudo = {
|
||||
flake.modules.nixos.common-security = { ... }: {
|
||||
security = {
|
||||
unprivilegedUsernsClone = true; # Needed for rootless podman
|
||||
sudo = {
|
||||
wheelNeedsPassword = false;
|
||||
extraConfig = ''
|
||||
Defaults lecture = never
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
25
aspects/common/users.nix
Normal file
25
aspects/common/users.nix
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
{ ... }:
|
||||
{
|
||||
flake.modules.nixos.common-users = { pkgs, ... }: {
|
||||
users.users = {
|
||||
user = {
|
||||
isNormalUser = true;
|
||||
shell = pkgs.fish;
|
||||
extraGroups = [
|
||||
"networkmanager"
|
||||
"wheel"
|
||||
];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQPkAyy+Du9Omc2WtnUF2TV8jFAF4H6mJi2D4IZ1nzg user@himalia"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO3Y0PVpGfJHonqDS7qoCFhqzUvqGq9I9sax+F9e/5cs user@io"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA1v3+q3EaruiiStWjubEJWvtejam/r41uoOpCdwJtLL user@rotterdam"
|
||||
];
|
||||
hashedPassword = "$6$Pj7v/CpstyuWQQV0$cNujVDhfMBdwlGVEnnd8t71.kZPixbo0u25cd.874iaqLTH4V5fa1f98V5zGapjQCz5JyZmsR94xi00sUrntT0";
|
||||
};
|
||||
root = {
|
||||
shell = pkgs.fish;
|
||||
hashedPassword = "!";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -6,12 +6,7 @@
|
|||
modules = [
|
||||
inputs.agenix.nixosModules.default
|
||||
{ networking.hostName = "alexandria"; }
|
||||
{
|
||||
nixpkgs.overlays = [
|
||||
inputs.agenix.overlays.default
|
||||
inputs.self.overlays.default
|
||||
];
|
||||
}
|
||||
{ nixpkgs.overlays = [ inputs.agenix.overlays.default inputs.self.overlays.default ]; }
|
||||
|
||||
# Common aspects (always included)
|
||||
inputs.self.modules.nixos.common-boot
|
||||
|
|
@ -24,10 +19,7 @@
|
|||
inputs.self.modules.nixos.common-security
|
||||
inputs.self.modules.nixos.common-services
|
||||
inputs.self.modules.nixos.common-tailscale
|
||||
|
||||
# User aspects
|
||||
inputs.self.modules.nixos.user
|
||||
inputs.self.modules.nixos.root
|
||||
inputs.self.modules.nixos.common-users
|
||||
|
||||
# Server aspects
|
||||
inputs.self.modules.nixos.server-boot
|
||||
|
|
|
|||
|
|
@ -6,12 +6,7 @@
|
|||
modules = [
|
||||
inputs.agenix.nixosModules.default
|
||||
{ networking.hostName = "io"; }
|
||||
{
|
||||
nixpkgs.overlays = [
|
||||
inputs.agenix.overlays.default
|
||||
inputs.self.overlays.default
|
||||
];
|
||||
}
|
||||
{ nixpkgs.overlays = [ inputs.agenix.overlays.default inputs.self.overlays.default ]; }
|
||||
|
||||
# Common aspects (always included)
|
||||
inputs.self.modules.nixos.common-boot
|
||||
|
|
@ -24,10 +19,7 @@
|
|||
inputs.self.modules.nixos.common-security
|
||||
inputs.self.modules.nixos.common-services
|
||||
inputs.self.modules.nixos.common-tailscale
|
||||
|
||||
# User aspects
|
||||
inputs.self.modules.nixos.user
|
||||
inputs.self.modules.nixos.root
|
||||
inputs.self.modules.nixos.common-users
|
||||
|
||||
# Desktop aspects
|
||||
inputs.self.modules.nixos.desktop-boot
|
||||
|
|
|
|||
|
|
@ -6,12 +6,7 @@
|
|||
modules = [
|
||||
inputs.agenix.nixosModules.default
|
||||
{ networking.hostName = "rotterdam"; }
|
||||
{
|
||||
nixpkgs.overlays = [
|
||||
inputs.agenix.overlays.default
|
||||
inputs.self.overlays.default
|
||||
];
|
||||
}
|
||||
{ nixpkgs.overlays = [ inputs.agenix.overlays.default inputs.self.overlays.default ]; }
|
||||
|
||||
# Common aspects (always included)
|
||||
inputs.self.modules.nixos.common-boot
|
||||
|
|
@ -24,10 +19,7 @@
|
|||
inputs.self.modules.nixos.common-security
|
||||
inputs.self.modules.nixos.common-services
|
||||
inputs.self.modules.nixos.common-tailscale
|
||||
|
||||
# User aspects
|
||||
inputs.self.modules.nixos.user
|
||||
inputs.self.modules.nixos.root
|
||||
inputs.self.modules.nixos.common-users
|
||||
|
||||
# Desktop aspects
|
||||
inputs.self.modules.nixos.desktop-boot
|
||||
|
|
|
|||
|
|
@ -6,12 +6,7 @@
|
|||
modules = [
|
||||
inputs.agenix.nixosModules.default
|
||||
{ networking.hostName = "trantor"; }
|
||||
{
|
||||
nixpkgs.overlays = [
|
||||
inputs.agenix.overlays.default
|
||||
inputs.self.overlays.default
|
||||
];
|
||||
}
|
||||
{ nixpkgs.overlays = [ inputs.agenix.overlays.default inputs.self.overlays.default ]; }
|
||||
|
||||
# Common aspects (always included)
|
||||
inputs.self.modules.nixos.common-boot
|
||||
|
|
@ -24,10 +19,7 @@
|
|||
inputs.self.modules.nixos.common-security
|
||||
inputs.self.modules.nixos.common-services
|
||||
inputs.self.modules.nixos.common-tailscale
|
||||
|
||||
# User aspects
|
||||
inputs.self.modules.nixos.user
|
||||
inputs.self.modules.nixos.root
|
||||
inputs.self.modules.nixos.common-users
|
||||
|
||||
# Server aspects
|
||||
inputs.self.modules.nixos.server-boot
|
||||
|
|
|
|||
|
|
@ -1,21 +1,12 @@
|
|||
{ ... }:
|
||||
{
|
||||
flake.modules.nixos.podman =
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
{
|
||||
flake.modules.nixos.podman = { config, lib, pkgs, ... }: {
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
autoPrune.enable = true;
|
||||
extraPackages = [ pkgs.podman-compose ];
|
||||
};
|
||||
|
||||
security.unprivilegedUsernsClone = true; # Needed for rootless podman
|
||||
|
||||
systemd = {
|
||||
services.podman-auto-update.enable = true;
|
||||
timers.podman-auto-update.enable = true;
|
||||
|
|
|
|||
|
|
@ -1,17 +1,19 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
flake.modules.nixos.programs-graphics =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
flake.modules.nixos.programs-graphics = { pkgs, ... }: {
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Image Editing
|
||||
gimp
|
||||
inkscape
|
||||
# CAD & 3D Modeling
|
||||
plasticity
|
||||
];
|
||||
|
||||
services.flatpak.packages = [
|
||||
# Vector Graphics
|
||||
"com.boxy_svg.BoxySVG"
|
||||
# 3D Printing / Slicing
|
||||
rec {
|
||||
appId = "io.github.softfever.OrcaSlicer";
|
||||
sha256 = "0hdx5sg6fknj1pfnfxvlfwb5h6y1vjr6fyajbsnjph5gkp97c6p1";
|
||||
|
|
|
|||
|
|
@ -2,20 +2,20 @@
|
|||
|
||||
{
|
||||
flake.modules = {
|
||||
nixos.programs-media =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
nixos.programs-media = { pkgs, ... }: {
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Audio
|
||||
decibels
|
||||
loupe
|
||||
obs-studio
|
||||
# Video
|
||||
showtime
|
||||
# Image Viewer
|
||||
loupe
|
||||
# Recording & Streaming
|
||||
obs-studio
|
||||
];
|
||||
};
|
||||
|
||||
homeManager.programs-media =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
homeManager.programs-media = { pkgs, ... }: {
|
||||
programs.obs-studio = {
|
||||
enable = true;
|
||||
plugins = with pkgs.obs-studio-plugins; [
|
||||
|
|
|
|||
|
|
@ -1,21 +1,24 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
flake.modules.nixos.programs-office =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
flake.modules.nixos.programs-office = { pkgs, ... }: {
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Spelling
|
||||
aspell
|
||||
aspellDicts.de
|
||||
aspellDicts.en
|
||||
aspellDicts.en-computers
|
||||
aspellDicts.pt_BR
|
||||
# Document Viewing
|
||||
papers
|
||||
# Presentations
|
||||
presenterm
|
||||
# Note Taking & Drawing
|
||||
rnote
|
||||
];
|
||||
|
||||
services.flatpak.packages = [
|
||||
# Office Suite
|
||||
"com.collabora.Office"
|
||||
];
|
||||
};
|
||||
|
|
|
|||
|
|
@ -2,17 +2,20 @@
|
|||
|
||||
{
|
||||
flake.modules = {
|
||||
nixos.programs-utilities =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
nixos.programs-utilities = { pkgs, ... }: {
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Terminal
|
||||
ghostty
|
||||
gnome-disk-utility
|
||||
mission-center
|
||||
# File Management
|
||||
nautilus
|
||||
gnome-disk-utility
|
||||
# Archive Tools
|
||||
p7zip
|
||||
rclone
|
||||
unrar
|
||||
# Cloud & Remote
|
||||
rclone
|
||||
# System Monitoring
|
||||
mission-center
|
||||
# Desktop Integration
|
||||
adwaita-icon-theme
|
||||
junction
|
||||
|
|
@ -23,14 +26,14 @@
|
|||
];
|
||||
|
||||
services.flatpak.packages = [
|
||||
# Flatpak Management
|
||||
"com.github.tchx84.Flatseal"
|
||||
# Remote Desktop
|
||||
"com.rustdesk.RustDesk"
|
||||
];
|
||||
};
|
||||
|
||||
homeManager.programs-utilities =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
homeManager.programs-utilities = { pkgs, ... }: {
|
||||
programs = {
|
||||
ghostty = {
|
||||
enable = true;
|
||||
|
|
|
|||
|
|
@ -1,21 +1,18 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
flake.modules.nixos.programs-web =
|
||||
{
|
||||
inputs,
|
||||
pkgs,
|
||||
system,
|
||||
...
|
||||
}:
|
||||
{
|
||||
flake.modules.nixos.programs-web = { inputs, pkgs, system, ... }: {
|
||||
environment.systemPackages = with pkgs; [
|
||||
# Browsers
|
||||
inputs.zen-browser.packages."${system}".default
|
||||
bitwarden-desktop
|
||||
fragments
|
||||
nextcloud-client
|
||||
tor-browser
|
||||
# Communication
|
||||
vesktop
|
||||
# Cloud & Sync
|
||||
bitwarden-desktop
|
||||
nextcloud-client
|
||||
# Downloads
|
||||
fragments
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,12 +0,0 @@
|
|||
{ ... }:
|
||||
|
||||
{
|
||||
flake.modules.nixos.root =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
users.root = {
|
||||
shell = pkgs.fish;
|
||||
hashedPassword = "!";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,33 +1,10 @@
|
|||
# aspects/users/user.nix
|
||||
{ inputs, ... }:
|
||||
|
||||
{
|
||||
flake = {
|
||||
modules.nixos.user =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
users.users.user = {
|
||||
isNormalUser = true;
|
||||
shell = pkgs.fish;
|
||||
extraGroups = [
|
||||
"networkmanager"
|
||||
"wheel"
|
||||
];
|
||||
openssh.authorizedKeys.keys = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQPkAyy+Du9Omc2WtnUF2TV8jFAF4H6mJi2D4IZ1nzg user@himalia"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO3Y0PVpGfJHonqDS7qoCFhqzUvqGq9I9sax+F9e/5cs user@io"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA1v3+q3EaruiiStWjubEJWvtejam/r41uoOpCdwJtLL user@rotterdam"
|
||||
];
|
||||
hashedPassword = "$6$Pj7v/CpstyuWQQV0$cNujVDhfMBdwlGVEnnd8t71.kZPixbo0u25cd.874iaqLTH4V5fa1f98V5zGapjQCz5JyZmsR94xi00sUrntT0";
|
||||
};
|
||||
};
|
||||
|
||||
homeConfigurations = {
|
||||
flake.homeConfigurations = {
|
||||
"user@rotterdam" = inputs.home-manager.lib.homeManagerConfiguration {
|
||||
pkgs = inputs.nixpkgs.legacyPackages.x86_64-linux;
|
||||
extraSpecialArgs = {
|
||||
inherit inputs;
|
||||
hostname = "rotterdam";
|
||||
};
|
||||
extraSpecialArgs = { inherit inputs; hostname = "rotterdam"; };
|
||||
modules = [
|
||||
{ nixpkgs.overlays = [ inputs.self.overlays.default ]; }
|
||||
|
||||
|
|
@ -73,10 +50,7 @@
|
|||
|
||||
"user@io" = inputs.home-manager.lib.homeManagerConfiguration {
|
||||
pkgs = inputs.nixpkgs.legacyPackages.x86_64-linux;
|
||||
extraSpecialArgs = {
|
||||
inherit inputs;
|
||||
hostname = "io";
|
||||
};
|
||||
extraSpecialArgs = { inherit inputs; hostname = "io"; };
|
||||
modules = [
|
||||
{ nixpkgs.overlays = [ inputs.self.overlays.default ]; }
|
||||
|
||||
|
|
@ -114,5 +88,4 @@
|
|||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
54
flake.nix
54
flake.nix
|
|
@ -2,52 +2,58 @@
|
|||
description = "My nix hosts";
|
||||
|
||||
inputs = {
|
||||
# nix tools
|
||||
flake-parts.url = "github:hercules-ci/flake-parts";
|
||||
import-tree.url = "github:vic/import-tree";
|
||||
|
||||
# nixos/hm
|
||||
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
|
||||
nixpkgs-stable.url = "github:nixos/nixpkgs/nixos-25.11";
|
||||
|
||||
home-manager = {
|
||||
url = "github:nix-community/home-manager/master";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
# nixos/hm functionality modules
|
||||
agenix = {
|
||||
url = "github:ryantm/agenix";
|
||||
inputs.nixpkgs.follows = "nixpkgs-stable";
|
||||
};
|
||||
disko.url = "github:nix-community/disko";
|
||||
impermanence.url = "github:nix-community/impermanence";
|
||||
nixos-cli.url = "github:nix-community/nixos-cli";
|
||||
nix-flatpak.url = "github:gmodena/nix-flatpak/main";
|
||||
stylix.url = "github:danth/stylix";
|
||||
|
||||
# nixos/hm program modules
|
||||
niri-flake.url = "github:sodiboo/niri-flake";
|
||||
nix-ai-tools.url = "github:numtide/llm-agents.nix";
|
||||
nix-index-database = {
|
||||
url = "github:nix-community/nix-index-database";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
disko.url = "github:nix-community/disko";
|
||||
|
||||
noctalia = {
|
||||
url = "github:noctalia-dev/noctalia-shell";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
vicinae.url = "github:vicinaehq/vicinae";
|
||||
|
||||
stylix.url = "github:danth/stylix";
|
||||
|
||||
nixos-cli.url = "github:nix-community/nixos-cli";
|
||||
|
||||
nix-flatpak.url = "github:gmodena/nix-flatpak/main";
|
||||
|
||||
zen-browser.url = "github:0xc000022070/zen-browser-flake";
|
||||
|
||||
# stand-alone tools
|
||||
impermanence.url = "github:nix-community/impermanence";
|
||||
|
||||
deploy-rs.url = "github:serokell/deploy-rs";
|
||||
|
||||
niri-flake.url = "github:sodiboo/niri-flake";
|
||||
|
||||
niri.url = "github:baduhai/niri/auto-center-when-space-available";
|
||||
|
||||
nix-index-database = {
|
||||
url = "github:nix-community/nix-index-database";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
terranix = {
|
||||
url = "github:terranix/terranix";
|
||||
inputs.nixpkgs.follows = "nixpkgs";
|
||||
};
|
||||
|
||||
# others
|
||||
niri.url = "github:baduhai/niri/auto-center-when-space-available";
|
||||
nix-ai-tools.url = "github:numtide/llm-agents.nix";
|
||||
|
||||
vicinae.url = "github:vicinaehq/vicinae";
|
||||
};
|
||||
|
||||
outputs =
|
||||
|
|
@ -55,8 +61,6 @@
|
|||
let
|
||||
aspectsModule = import-tree ./aspects;
|
||||
packagesModule = import-tree ./packages;
|
||||
shellsModule = import-tree ./shells;
|
||||
terranixModule = import-tree ./terranix;
|
||||
in
|
||||
flake-parts.lib.mkFlake { inherit inputs; } {
|
||||
systems = [
|
||||
|
|
@ -66,14 +70,12 @@
|
|||
|
||||
imports = [
|
||||
flake-parts.flakeModules.modules
|
||||
inputs.terranix.flakeModule
|
||||
]
|
||||
++ aspectsModule.imports
|
||||
] ++ aspectsModule.imports
|
||||
++ packagesModule.imports
|
||||
++ shellsModule.imports
|
||||
++ terranixModule.imports
|
||||
++ [
|
||||
./deploy.nix
|
||||
./devShells.nix
|
||||
./terranixConfigurations.nix
|
||||
];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,22 +1,12 @@
|
|||
{ inputs, ... }:
|
||||
|
||||
let
|
||||
packageDir = builtins.readDir ./.;
|
||||
|
||||
# Filter to .nix files, excluding overlays.nix
|
||||
isPackageFile = name:
|
||||
name != "overlays.nix" && builtins.match ".*\\.nix$" name != null;
|
||||
|
||||
# Extract package name from filename (e.g., "foo-bar.nix" -> "foo-bar")
|
||||
toPackageName = filename:
|
||||
builtins.head (builtins.match "(.+)\\.nix$" filename);
|
||||
|
||||
packageNames = map toPackageName (builtins.filter isPackageFile (builtins.attrNames packageDir));
|
||||
in
|
||||
{
|
||||
flake.overlays.default = final: prev:
|
||||
builtins.listToAttrs (map (name: {
|
||||
inherit name;
|
||||
value = inputs.self.packages.${final.system}.${name};
|
||||
}) packageNames);
|
||||
flake.overlays.default = final: prev: {
|
||||
base16-schemes = inputs.self.packages.${final.system}.base16-schemes;
|
||||
claude-desktop = inputs.self.packages.${final.system}.claude-desktop;
|
||||
fastfetch = inputs.self.packages.${final.system}.fastfetch;
|
||||
hm-cli = inputs.self.packages.${final.system}.hm-cli;
|
||||
kwrite = inputs.self.packages.${final.system}.kwrite;
|
||||
toggleaudiosink = inputs.self.packages.${final.system}.toggleaudiosink;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
89
plan.md
Normal file
89
plan.md
Normal file
|
|
@ -0,0 +1,89 @@
|
|||
# Current structure:
|
||||
|
||||
```
|
||||
hosts
|
||||
├── alexandria
|
||||
│ ├── hardware-configuration.nix
|
||||
│ ├── jellyfin.nix
|
||||
│ ├── kanidm.nix
|
||||
│ ├── nextcloud.nix
|
||||
│ ├── nginx.nix
|
||||
│ ├── unbound.nix
|
||||
│ └── vaultwarden.nix
|
||||
├── io
|
||||
│ ├── boot.nix
|
||||
│ ├── disko.nix
|
||||
│ ├── hardware-configuration.nix
|
||||
│ ├── programs.nix
|
||||
│ └── services.nix
|
||||
├── modules
|
||||
│ ├── common
|
||||
│ │ ├── boot.nix
|
||||
│ │ ├── console.nix
|
||||
│ │ ├── firewall.nix
|
||||
│ │ ├── locale.nix
|
||||
│ │ ├── nix.nix
|
||||
│ │ ├── openssh.nix
|
||||
│ │ ├── programs.nix
|
||||
│ │ ├── security.nix
|
||||
│ │ ├── services.nix
|
||||
│ │ ├── tailscale.nix
|
||||
│ │ └── users.nix
|
||||
│ ├── desktop
|
||||
│ │ ├── boot.nix
|
||||
│ │ ├── desktop.nix
|
||||
│ │ ├── nix.nix
|
||||
│ │ └── services.nix
|
||||
│ ├── server
|
||||
│ │ ├── boot.nix
|
||||
│ │ ├── nix.nix
|
||||
│ │ └── tailscale.nix
|
||||
│ ├── ai.nix
|
||||
│ ├── bluetooth.nix
|
||||
│ ├── dev.nix
|
||||
│ ├── ephemeral.nix
|
||||
│ ├── fwupd.nix
|
||||
│ ├── gaming.nix
|
||||
│ ├── libvirtd.nix
|
||||
│ ├── networkmanager.nix
|
||||
│ └── podman.nix
|
||||
├── rotterdam
|
||||
│ ├── boot.nix
|
||||
│ ├── hardware-configuration.nix
|
||||
│ ├── hardware.nix
|
||||
│ ├── programs.nix
|
||||
│ └── services.nix
|
||||
└── trantor
|
||||
├── boot.nix
|
||||
├── disko.nix
|
||||
├── fail2ban.nix
|
||||
├── forgejo.nix
|
||||
├── hardware-configuration.nix
|
||||
├── networking.nix
|
||||
├── nginx.nix
|
||||
├── openssh.nix
|
||||
└── unbound.nix
|
||||
modules
|
||||
└── ephemeral.nix
|
||||
users
|
||||
├── modules
|
||||
│ ├── common
|
||||
│ │ ├── bash.nix
|
||||
│ │ ├── fish.nix
|
||||
│ │ └── hm-cli.nix
|
||||
│ ├── desktop
|
||||
│ │ ├── desktop.nix
|
||||
│ │ └── niri.nix
|
||||
│ ├── btop.nix
|
||||
│ ├── comma.nix
|
||||
│ ├── direnv.nix
|
||||
│ ├── gaming.nix
|
||||
│ ├── helix.nix
|
||||
│ ├── obs-studio.nix
|
||||
│ ├── starship.nix
|
||||
│ ├── stylix.nix
|
||||
│ └── tmux.nix
|
||||
└── user
|
||||
└── git.nix
|
||||
```
|
||||
|
||||
|
|
@ -1,113 +0,0 @@
|
|||
# Required environment variables:
|
||||
# CLOUDFLARE_API_TOKEN - API token with "Edit zone DNS" permissions
|
||||
# AWS_ACCESS_KEY_ID - Cloudflare R2 access key for state storage
|
||||
# AWS_SECRET_ACCESS_KEY - Cloudflare R2 secret key for state storage
|
||||
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
perSystem =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
terranix.terranixConfigurations.cloudflare-baduhaidev = {
|
||||
terraformWrapper.package = pkgs.opentofu;
|
||||
modules = [
|
||||
(
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
sharedData = import ../data/services.nix;
|
||||
# Enrich services with host IPs
|
||||
services = map (
|
||||
svc:
|
||||
let
|
||||
hostInfo = sharedData.hosts.${svc.host} or { };
|
||||
in
|
||||
svc
|
||||
// {
|
||||
lanIP = hostInfo.lanIP or null;
|
||||
tailscaleIP = hostInfo.tailscaleIP or null;
|
||||
}
|
||||
) sharedData.services;
|
||||
|
||||
# Helper to extract subdomain from full domain (e.g., "git.baduhai.dev" -> "git")
|
||||
getSubdomain = domain: lib.head (lib.splitString "." domain);
|
||||
|
||||
# Generate DNS records for services
|
||||
# Public services point to trantor's public IP
|
||||
# Private services point to their tailscale IP
|
||||
mkServiceRecords = lib.listToAttrs (
|
||||
lib.imap0 (
|
||||
i: svc:
|
||||
let
|
||||
subdomain = getSubdomain svc.domain;
|
||||
targetIP =
|
||||
if svc.public or false then
|
||||
config.data.terraform_remote_state.trantor "outputs.instance_public_ip"
|
||||
else
|
||||
svc.tailscaleIP;
|
||||
in
|
||||
{
|
||||
name = "service_${toString i}";
|
||||
value = {
|
||||
zone_id = config.variable.zone_id.default;
|
||||
name = subdomain;
|
||||
type = "A";
|
||||
content = targetIP;
|
||||
proxied = false;
|
||||
ttl = 3600;
|
||||
};
|
||||
}
|
||||
) services
|
||||
);
|
||||
in
|
||||
|
||||
{
|
||||
terraform.required_providers.cloudflare = {
|
||||
source = "cloudflare/cloudflare";
|
||||
version = "~> 5.0";
|
||||
};
|
||||
|
||||
terraform.backend.s3 = {
|
||||
bucket = "terraform-state";
|
||||
key = "cloudflare/baduhai.dev.tfstate";
|
||||
region = "auto";
|
||||
endpoint = "https://fcdf920bde00c3d013ee541f984da70e.r2.cloudflarestorage.com";
|
||||
skip_credentials_validation = true;
|
||||
skip_metadata_api_check = true;
|
||||
skip_region_validation = true;
|
||||
skip_requesting_account_id = true;
|
||||
use_path_style = true;
|
||||
};
|
||||
|
||||
variable = {
|
||||
zone_id = {
|
||||
default = "c63a8332fdddc4a8e5612ddc54557044";
|
||||
type = "string";
|
||||
};
|
||||
};
|
||||
|
||||
data = {
|
||||
terraform_remote_state.trantor = {
|
||||
backend = "s3";
|
||||
config = {
|
||||
bucket = "terraform-state";
|
||||
key = "oci/trantor.tfstate";
|
||||
region = "auto";
|
||||
endpoint = "https://fcdf920bde00c3d013ee541f984da70e.r2.cloudflarestorage.com";
|
||||
skip_credentials_validation = true;
|
||||
skip_metadata_api_check = true;
|
||||
skip_region_validation = true;
|
||||
skip_requesting_account_id = true;
|
||||
use_path_style = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
resource.cloudflare_dns_record = mkServiceRecords;
|
||||
}
|
||||
)
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
94
terranix/cloudflare/baduhai.dev.nix
Normal file
94
terranix/cloudflare/baduhai.dev.nix
Normal file
|
|
@ -0,0 +1,94 @@
|
|||
# Required environment variables:
|
||||
# CLOUDFLARE_API_TOKEN - API token with "Edit zone DNS" permissions
|
||||
# AWS_ACCESS_KEY_ID - Cloudflare R2 access key for state storage
|
||||
# AWS_SECRET_ACCESS_KEY - Cloudflare R2 secret key for state storage
|
||||
|
||||
{ config, lib, ... }:
|
||||
|
||||
let
|
||||
sharedData = import ../../data/services.nix;
|
||||
# Enrich services with host IPs
|
||||
services = map (svc:
|
||||
let hostInfo = sharedData.hosts.${svc.host} or {};
|
||||
in svc // {
|
||||
lanIP = hostInfo.lanIP or null;
|
||||
tailscaleIP = hostInfo.tailscaleIP or null;
|
||||
}
|
||||
) sharedData.services;
|
||||
|
||||
# Helper to extract subdomain from full domain (e.g., "git.baduhai.dev" -> "git")
|
||||
getSubdomain = domain: lib.head (lib.splitString "." domain);
|
||||
|
||||
# Generate DNS records for services
|
||||
# Public services point to trantor's public IP
|
||||
# Private services point to their tailscale IP
|
||||
mkServiceRecords = lib.listToAttrs (
|
||||
lib.imap0 (
|
||||
i: svc:
|
||||
let
|
||||
subdomain = getSubdomain svc.domain;
|
||||
targetIP =
|
||||
if svc.public or false then
|
||||
config.data.terraform_remote_state.trantor "outputs.instance_public_ip"
|
||||
else
|
||||
svc.tailscaleIP;
|
||||
in
|
||||
{
|
||||
name = "service_${toString i}";
|
||||
value = {
|
||||
zone_id = config.variable.zone_id.default;
|
||||
name = subdomain;
|
||||
type = "A";
|
||||
content = targetIP;
|
||||
proxied = false;
|
||||
ttl = 3600;
|
||||
};
|
||||
}
|
||||
) services
|
||||
);
|
||||
in
|
||||
|
||||
{
|
||||
terraform.required_providers.cloudflare = {
|
||||
source = "cloudflare/cloudflare";
|
||||
version = "~> 5.0";
|
||||
};
|
||||
|
||||
terraform.backend.s3 = {
|
||||
bucket = "terraform-state";
|
||||
key = "cloudflare/baduhai.dev.tfstate";
|
||||
region = "auto";
|
||||
endpoint = "https://fcdf920bde00c3d013ee541f984da70e.r2.cloudflarestorage.com";
|
||||
skip_credentials_validation = true;
|
||||
skip_metadata_api_check = true;
|
||||
skip_region_validation = true;
|
||||
skip_requesting_account_id = true;
|
||||
use_path_style = true;
|
||||
};
|
||||
|
||||
variable = {
|
||||
zone_id = {
|
||||
default = "c63a8332fdddc4a8e5612ddc54557044";
|
||||
type = "string";
|
||||
};
|
||||
};
|
||||
|
||||
data = {
|
||||
terraform_remote_state.trantor = {
|
||||
backend = "s3";
|
||||
config = {
|
||||
bucket = "terraform-state";
|
||||
key = "oci/trantor.tfstate";
|
||||
region = "auto";
|
||||
endpoint = "https://fcdf920bde00c3d013ee541f984da70e.r2.cloudflarestorage.com";
|
||||
skip_credentials_validation = true;
|
||||
skip_metadata_api_check = true;
|
||||
skip_region_validation = true;
|
||||
skip_requesting_account_id = true;
|
||||
use_path_style = true;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
resource.cloudflare_dns_record = mkServiceRecords;
|
||||
}
|
||||
0
terranix/cloudflare/kernelpanic.space.nix
Normal file
0
terranix/cloudflare/kernelpanic.space.nix
Normal file
|
|
@ -1,17 +0,0 @@
|
|||
# Cloudflare kernelpanic.space configuration placeholder
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
perSystem =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
terranix.terranixConfigurations.cloudflare-kernelpanicspace = {
|
||||
terraformWrapper.package = pkgs.opentofu;
|
||||
modules = [
|
||||
({ config, ... }: {
|
||||
# Terraform config goes here
|
||||
})
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
0
terranix/oci/terminus.nix
Normal file
0
terranix/oci/terminus.nix
Normal file
258
terranix/oci/trantor.nix
Normal file
258
terranix/oci/trantor.nix
Normal file
|
|
@ -0,0 +1,258 @@
|
|||
# Required environment variables:
|
||||
# instead of OCI variables, ~/.oci/config may also be used
|
||||
# OCI_TENANCY_OCID - Oracle tenancy OCID (or use TF_VAR_* to override variables)
|
||||
# OCI_USER_OCID - Oracle user OCID
|
||||
# OCI_FINGERPRINT - API key fingerprint
|
||||
# OCI_PRIVATE_KEY_PATH - Path to OCI API private key
|
||||
# AWS variables are required
|
||||
# AWS_ACCESS_KEY_ID - Cloudflare R2 access key for state storage
|
||||
# AWS_SECRET_ACCESS_KEY - Cloudflare R2 secret key for state storage
|
||||
|
||||
{ config, ... }:
|
||||
|
||||
{
|
||||
terraform.required_providers.oci = {
|
||||
source = "oracle/oci";
|
||||
version = "~> 7.0";
|
||||
};
|
||||
|
||||
provider.oci.region = "sa-saopaulo-1";
|
||||
|
||||
terraform.backend.s3 = {
|
||||
bucket = "terraform-state";
|
||||
key = "oci/trantor.tfstate";
|
||||
region = "auto";
|
||||
endpoint = "https://fcdf920bde00c3d013ee541f984da70e.r2.cloudflarestorage.com";
|
||||
skip_credentials_validation = true;
|
||||
skip_metadata_api_check = true;
|
||||
skip_region_validation = true;
|
||||
skip_requesting_account_id = true;
|
||||
use_path_style = true;
|
||||
};
|
||||
|
||||
variable = {
|
||||
tenancy_ocid = {
|
||||
default = "ocid1.tenancy.oc1..aaaaaaaap3vfdz4piygqza6e6zqunbcuso43ddqfo3ydmpmnomidyghh7rvq";
|
||||
type = "string";
|
||||
};
|
||||
|
||||
compartment_name = {
|
||||
default = "trantor";
|
||||
type = "string";
|
||||
};
|
||||
|
||||
vcn_cidr = {
|
||||
default = "10.0.0.0/24";
|
||||
type = "string";
|
||||
};
|
||||
|
||||
instance_name = {
|
||||
default = "trantor";
|
||||
type = "string";
|
||||
};
|
||||
|
||||
ssh_public_keys = {
|
||||
default = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQPkAyy+Du9Omc2WtnUF2TV8jFAF4H6mJi2D4IZ1nzg user@himalia"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO3Y0PVpGfJHonqDS7qoCFhqzUvqGq9I9sax+F9e/5cs user@io"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA1v3+q3EaruiiStWjubEJWvtejam/r41uoOpCdwJtLL user@rotterdam"
|
||||
];
|
||||
type = "list(string)";
|
||||
};
|
||||
};
|
||||
|
||||
data = {
|
||||
oci_identity_availability_domains.ads = {
|
||||
compartment_id = config.variable.tenancy_ocid.default;
|
||||
};
|
||||
|
||||
oci_core_images.ubuntu_arm = {
|
||||
compartment_id = config.variable.tenancy_ocid.default;
|
||||
operating_system = "Canonical Ubuntu";
|
||||
operating_system_version = "24.04";
|
||||
shape = "VM.Standard.A1.Flex";
|
||||
sort_by = "TIMECREATED";
|
||||
sort_order = "DESC";
|
||||
};
|
||||
};
|
||||
|
||||
resource = {
|
||||
oci_identity_compartment.trantor = {
|
||||
compartment_id = config.variable.tenancy_ocid.default;
|
||||
description = "trantor infrastructure compartment";
|
||||
name = config.variable.compartment_name.default;
|
||||
};
|
||||
|
||||
oci_core_vcn.vcn = {
|
||||
compartment_id = config.resource.oci_identity_compartment.trantor "id";
|
||||
cidr_blocks = [ config.variable.vcn_cidr.default ];
|
||||
display_name = "trantor-vcn";
|
||||
dns_label = "trantor";
|
||||
};
|
||||
|
||||
oci_core_internet_gateway.ig = {
|
||||
compartment_id = config.resource.oci_identity_compartment.trantor "id";
|
||||
vcn_id = config.resource.oci_core_vcn.vcn "id";
|
||||
display_name = "trantor-ig";
|
||||
enabled = true;
|
||||
};
|
||||
|
||||
oci_core_route_table.rt = {
|
||||
compartment_id = config.resource.oci_identity_compartment.trantor "id";
|
||||
vcn_id = config.resource.oci_core_vcn.vcn "id";
|
||||
display_name = "trantor-rt";
|
||||
|
||||
route_rules = [
|
||||
{
|
||||
network_entity_id = config.resource.oci_core_internet_gateway.ig "id";
|
||||
destination = "0.0.0.0/0";
|
||||
destination_type = "CIDR_BLOCK";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
oci_core_security_list.sl = {
|
||||
compartment_id = config.resource.oci_identity_compartment.trantor "id";
|
||||
vcn_id = config.resource.oci_core_vcn.vcn "id";
|
||||
display_name = "trantor-sl";
|
||||
|
||||
egress_security_rules = [
|
||||
{
|
||||
destination = "0.0.0.0/0";
|
||||
protocol = "all";
|
||||
stateless = false;
|
||||
}
|
||||
];
|
||||
|
||||
ingress_security_rules = [
|
||||
{
|
||||
protocol = "6"; # TCP
|
||||
source = "0.0.0.0/0";
|
||||
stateless = false;
|
||||
tcp_options = {
|
||||
min = 22;
|
||||
max = 22;
|
||||
};
|
||||
}
|
||||
{
|
||||
protocol = "6"; # TCP
|
||||
source = "0.0.0.0/0";
|
||||
stateless = false;
|
||||
tcp_options = {
|
||||
min = 80;
|
||||
max = 80;
|
||||
};
|
||||
}
|
||||
{
|
||||
protocol = "6"; # TCP
|
||||
source = "0.0.0.0/0";
|
||||
stateless = false;
|
||||
tcp_options = {
|
||||
min = 443;
|
||||
max = 443;
|
||||
};
|
||||
}
|
||||
{
|
||||
protocol = "6"; # TCP
|
||||
source = "0.0.0.0/0";
|
||||
stateless = false;
|
||||
tcp_options = {
|
||||
min = 25565;
|
||||
max = 25565;
|
||||
};
|
||||
}
|
||||
{
|
||||
protocol = "6"; # TCP
|
||||
source = "0.0.0.0/0";
|
||||
stateless = false;
|
||||
tcp_options = {
|
||||
min = 19132;
|
||||
max = 19133;
|
||||
};
|
||||
}
|
||||
{
|
||||
protocol = "17"; # UDP
|
||||
source = "0.0.0.0/0";
|
||||
stateless = false;
|
||||
udp_options = {
|
||||
min = 19132;
|
||||
max = 19133;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
oci_core_subnet.subnet = {
|
||||
compartment_id = config.resource.oci_identity_compartment.trantor "id";
|
||||
vcn_id = config.resource.oci_core_vcn.vcn "id";
|
||||
cidr_block = config.variable.vcn_cidr.default;
|
||||
display_name = "trantor-subnet";
|
||||
dns_label = "subnet";
|
||||
route_table_id = config.resource.oci_core_route_table.rt "id";
|
||||
security_list_ids = [ (config.resource.oci_core_security_list.sl "id") ];
|
||||
prohibit_public_ip_on_vnic = false;
|
||||
};
|
||||
|
||||
oci_core_instance.trantor = {
|
||||
availability_domain = config.data.oci_identity_availability_domains.ads "availability_domains[0].name";
|
||||
compartment_id = config.resource.oci_identity_compartment.trantor "id";
|
||||
display_name = config.variable.instance_name.default;
|
||||
shape = "VM.Standard.A1.Flex";
|
||||
|
||||
shape_config = {
|
||||
ocpus = 2;
|
||||
memory_in_gbs = 12;
|
||||
};
|
||||
|
||||
source_details = {
|
||||
source_type = "image";
|
||||
source_id = config.data.oci_core_images.ubuntu_arm "images[0].id";
|
||||
boot_volume_size_in_gbs = 100;
|
||||
};
|
||||
|
||||
create_vnic_details = {
|
||||
subnet_id = config.resource.oci_core_subnet.subnet "id";
|
||||
display_name = "trantor-vnic";
|
||||
assign_public_ip = true;
|
||||
hostname_label = config.variable.instance_name.default;
|
||||
};
|
||||
|
||||
metadata = {
|
||||
ssh_authorized_keys = builtins.concatStringsSep "\n" config.variable.ssh_public_keys.default;
|
||||
};
|
||||
|
||||
preserve_boot_volume = false;
|
||||
};
|
||||
|
||||
oci_budget_budget.trantor_budget = {
|
||||
compartment_id = config.variable.tenancy_ocid.default;
|
||||
targets = [ (config.resource.oci_identity_compartment.trantor "id") ];
|
||||
amount = 1;
|
||||
reset_period = "MONTHLY";
|
||||
display_name = "trantor-budget";
|
||||
description = "Monthly budget for trantor compartment";
|
||||
target_type = "COMPARTMENT";
|
||||
};
|
||||
|
||||
oci_budget_alert_rule.daily_spend_alert = {
|
||||
budget_id = config.resource.oci_budget_budget.trantor_budget "id";
|
||||
type = "ACTUAL";
|
||||
threshold = 5;
|
||||
threshold_type = "PERCENTAGE";
|
||||
display_name = "daily-spend-alert";
|
||||
recipients = "baduhai@proton.me";
|
||||
description = "Alert when daily spending exceeds $0.05";
|
||||
message = "Daily spending has exceeded $0.05 in the trantor compartment";
|
||||
};
|
||||
};
|
||||
|
||||
output = {
|
||||
compartment_id = {
|
||||
value = config.resource.oci_identity_compartment.trantor "id";
|
||||
};
|
||||
|
||||
instance_public_ip = {
|
||||
value = config.resource.oci_core_instance.trantor "public_ip";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,57 +0,0 @@
|
|||
# Required environment variables:
|
||||
# TAILSCALE_API_KEY - Tailscale API key with appropriate permissions
|
||||
# TAILSCALE_TAILNET - Your tailnet name (e.g., "user@example.com" or "example.org.github")
|
||||
# AWS_ACCESS_KEY_ID - Cloudflare R2 access key for state storage
|
||||
# AWS_SECRET_ACCESS_KEY - Cloudflare R2 secret key for state storage
|
||||
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
perSystem =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
terranix.terranixConfigurations.tailscale-tailnet = {
|
||||
terraformWrapper.package = pkgs.opentofu;
|
||||
modules = [
|
||||
(
|
||||
{ config, ... }:
|
||||
{
|
||||
terraform.required_providers.tailscale = {
|
||||
source = "tailscale/tailscale";
|
||||
version = "~> 0.17";
|
||||
};
|
||||
|
||||
terraform.backend.s3 = {
|
||||
bucket = "terraform-state";
|
||||
key = "tailscale/tailnet.tfstate";
|
||||
region = "auto";
|
||||
endpoint = "https://fcdf920bde00c3d013ee541f984da70e.r2.cloudflarestorage.com";
|
||||
skip_credentials_validation = true;
|
||||
skip_metadata_api_check = true;
|
||||
skip_region_validation = true;
|
||||
skip_requesting_account_id = true;
|
||||
use_path_style = true;
|
||||
};
|
||||
|
||||
variable = {
|
||||
trantor_tailscale_ip = {
|
||||
default = "100.108.5.90";
|
||||
type = "string";
|
||||
};
|
||||
};
|
||||
|
||||
resource = {
|
||||
tailscale_dns_nameservers.global = {
|
||||
nameservers = [
|
||||
config.variable.trantor_tailscale_ip.default
|
||||
"1.1.1.1"
|
||||
"1.0.0.1"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
)
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
43
terranix/tailscale/tailnet.nix
Normal file
43
terranix/tailscale/tailnet.nix
Normal file
|
|
@ -0,0 +1,43 @@
|
|||
# Required environment variables:
|
||||
# TAILSCALE_API_KEY - Tailscale API key with appropriate permissions
|
||||
# TAILSCALE_TAILNET - Your tailnet name (e.g., "user@example.com" or "example.org.github")
|
||||
# AWS_ACCESS_KEY_ID - Cloudflare R2 access key for state storage
|
||||
# AWS_SECRET_ACCESS_KEY - Cloudflare R2 secret key for state storage
|
||||
|
||||
{ config, ... }:
|
||||
|
||||
{
|
||||
terraform.required_providers.tailscale = {
|
||||
source = "tailscale/tailscale";
|
||||
version = "~> 0.17";
|
||||
};
|
||||
|
||||
terraform.backend.s3 = {
|
||||
bucket = "terraform-state";
|
||||
key = "tailscale/tailnet.tfstate";
|
||||
region = "auto";
|
||||
endpoint = "https://fcdf920bde00c3d013ee541f984da70e.r2.cloudflarestorage.com";
|
||||
skip_credentials_validation = true;
|
||||
skip_metadata_api_check = true;
|
||||
skip_region_validation = true;
|
||||
skip_requesting_account_id = true;
|
||||
use_path_style = true;
|
||||
};
|
||||
|
||||
variable = {
|
||||
trantor_tailscale_ip = {
|
||||
default = "100.108.5.90";
|
||||
type = "string";
|
||||
};
|
||||
};
|
||||
|
||||
resource = {
|
||||
tailscale_dns_nameservers.global = {
|
||||
nameservers = [
|
||||
config.variable.trantor_tailscale_ip.default
|
||||
"1.1.1.1"
|
||||
"1.0.0.1"
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,17 +0,0 @@
|
|||
# OCI Terminus configuration placeholder
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
perSystem =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
terranix.terranixConfigurations.oci-terminus = {
|
||||
terraformWrapper.package = pkgs.opentofu;
|
||||
modules = [
|
||||
({ config, ... }: {
|
||||
# Terraform config goes here
|
||||
})
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,272 +0,0 @@
|
|||
# Required environment variables:
|
||||
# instead of OCI variables, ~/.oci/config may also be used
|
||||
# OCI_TENANCY_OCID - Oracle tenancy OCID (or use TF_VAR_* to override variables)
|
||||
# OCI_USER_OCID - Oracle user OCID
|
||||
# OCI_FINGERPRINT - API key fingerprint
|
||||
# OCI_PRIVATE_KEY_PATH - Path to OCI API private key
|
||||
# AWS variables are required
|
||||
# AWS_ACCESS_KEY_ID - Cloudflare R2 access key for state storage
|
||||
# AWS_SECRET_ACCESS_KEY - Cloudflare R2 secret key for state storage
|
||||
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
perSystem =
|
||||
{ pkgs, ... }:
|
||||
{
|
||||
terranix.terranixConfigurations.oci-trantor = {
|
||||
terraformWrapper.package = pkgs.opentofu;
|
||||
modules = [
|
||||
(
|
||||
{ config, ... }:
|
||||
{
|
||||
terraform.required_providers.oci = {
|
||||
source = "oracle/oci";
|
||||
version = "~> 7.0";
|
||||
};
|
||||
|
||||
provider.oci.region = "sa-saopaulo-1";
|
||||
|
||||
terraform.backend.s3 = {
|
||||
bucket = "terraform-state";
|
||||
key = "oci/trantor.tfstate";
|
||||
region = "auto";
|
||||
endpoint = "https://fcdf920bde00c3d013ee541f984da70e.r2.cloudflarestorage.com";
|
||||
skip_credentials_validation = true;
|
||||
skip_metadata_api_check = true;
|
||||
skip_region_validation = true;
|
||||
skip_requesting_account_id = true;
|
||||
use_path_style = true;
|
||||
};
|
||||
|
||||
variable = {
|
||||
tenancy_ocid = {
|
||||
default = "ocid1.tenancy.oc1..aaaaaaaap3vfdz4piygqza6e6zqunbcuso43ddqfo3ydmpmnomidyghh7rvq";
|
||||
type = "string";
|
||||
};
|
||||
|
||||
compartment_name = {
|
||||
default = "trantor";
|
||||
type = "string";
|
||||
};
|
||||
|
||||
vcn_cidr = {
|
||||
default = "10.0.0.0/24";
|
||||
type = "string";
|
||||
};
|
||||
|
||||
instance_name = {
|
||||
default = "trantor";
|
||||
type = "string";
|
||||
};
|
||||
|
||||
ssh_public_keys = {
|
||||
default = [
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICQPkAyy+Du9Omc2WtnUF2TV8jFAF4H6mJi2D4IZ1nzg user@himalia"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO3Y0PVpGfJHonqDS7qoCFhqzUvqGq9I9sax+F9e/5cs user@io"
|
||||
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA1v3+q3EaruiiStWjubEJWvtejam/r41uoOpCdwJtLL user@rotterdam"
|
||||
];
|
||||
type = "list(string)";
|
||||
};
|
||||
};
|
||||
|
||||
data = {
|
||||
oci_identity_availability_domains.ads = {
|
||||
compartment_id = config.variable.tenancy_ocid.default;
|
||||
};
|
||||
|
||||
oci_core_images.ubuntu_arm = {
|
||||
compartment_id = config.variable.tenancy_ocid.default;
|
||||
operating_system = "Canonical Ubuntu";
|
||||
operating_system_version = "24.04";
|
||||
shape = "VM.Standard.A1.Flex";
|
||||
sort_by = "TIMECREATED";
|
||||
sort_order = "DESC";
|
||||
};
|
||||
};
|
||||
|
||||
resource = {
|
||||
oci_identity_compartment.trantor = {
|
||||
compartment_id = config.variable.tenancy_ocid.default;
|
||||
description = "trantor infrastructure compartment";
|
||||
name = config.variable.compartment_name.default;
|
||||
};
|
||||
|
||||
oci_core_vcn.vcn = {
|
||||
compartment_id = config.resource.oci_identity_compartment.trantor "id";
|
||||
cidr_blocks = [ config.variable.vcn_cidr.default ];
|
||||
display_name = "trantor-vcn";
|
||||
dns_label = "trantor";
|
||||
};
|
||||
|
||||
oci_core_internet_gateway.ig = {
|
||||
compartment_id = config.resource.oci_identity_compartment.trantor "id";
|
||||
vcn_id = config.resource.oci_core_vcn.vcn "id";
|
||||
display_name = "trantor-ig";
|
||||
enabled = true;
|
||||
};
|
||||
|
||||
oci_core_route_table.rt = {
|
||||
compartment_id = config.resource.oci_identity_compartment.trantor "id";
|
||||
vcn_id = config.resource.oci_core_vcn.vcn "id";
|
||||
display_name = "trantor-rt";
|
||||
|
||||
route_rules = [
|
||||
{
|
||||
network_entity_id = config.resource.oci_core_internet_gateway.ig "id";
|
||||
destination = "0.0.0.0/0";
|
||||
destination_type = "CIDR_BLOCK";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
oci_core_security_list.sl = {
|
||||
compartment_id = config.resource.oci_identity_compartment.trantor "id";
|
||||
vcn_id = config.resource.oci_core_vcn.vcn "id";
|
||||
display_name = "trantor-sl";
|
||||
|
||||
egress_security_rules = [
|
||||
{
|
||||
destination = "0.0.0.0/0";
|
||||
protocol = "all";
|
||||
stateless = false;
|
||||
}
|
||||
];
|
||||
|
||||
ingress_security_rules = [
|
||||
{
|
||||
protocol = "6"; # TCP
|
||||
source = "0.0.0.0/0";
|
||||
stateless = false;
|
||||
tcp_options = {
|
||||
min = 22;
|
||||
max = 22;
|
||||
};
|
||||
}
|
||||
{
|
||||
protocol = "6"; # TCP
|
||||
source = "0.0.0.0/0";
|
||||
stateless = false;
|
||||
tcp_options = {
|
||||
min = 80;
|
||||
max = 80;
|
||||
};
|
||||
}
|
||||
{
|
||||
protocol = "6"; # TCP
|
||||
source = "0.0.0.0/0";
|
||||
stateless = false;
|
||||
tcp_options = {
|
||||
min = 443;
|
||||
max = 443;
|
||||
};
|
||||
}
|
||||
{
|
||||
protocol = "6"; # TCP
|
||||
source = "0.0.0.0/0";
|
||||
stateless = false;
|
||||
tcp_options = {
|
||||
min = 25565;
|
||||
max = 25565;
|
||||
};
|
||||
}
|
||||
{
|
||||
protocol = "6"; # TCP
|
||||
source = "0.0.0.0/0";
|
||||
stateless = false;
|
||||
tcp_options = {
|
||||
min = 19132;
|
||||
max = 19133;
|
||||
};
|
||||
}
|
||||
{
|
||||
protocol = "17"; # UDP
|
||||
source = "0.0.0.0/0";
|
||||
stateless = false;
|
||||
udp_options = {
|
||||
min = 19132;
|
||||
max = 19133;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
oci_core_subnet.subnet = {
|
||||
compartment_id = config.resource.oci_identity_compartment.trantor "id";
|
||||
vcn_id = config.resource.oci_core_vcn.vcn "id";
|
||||
cidr_block = config.variable.vcn_cidr.default;
|
||||
display_name = "trantor-subnet";
|
||||
dns_label = "subnet";
|
||||
route_table_id = config.resource.oci_core_route_table.rt "id";
|
||||
security_list_ids = [ (config.resource.oci_core_security_list.sl "id") ];
|
||||
prohibit_public_ip_on_vnic = false;
|
||||
};
|
||||
|
||||
oci_core_instance.trantor = {
|
||||
availability_domain = config.data.oci_identity_availability_domains.ads "availability_domains[0].name";
|
||||
compartment_id = config.resource.oci_identity_compartment.trantor "id";
|
||||
display_name = config.variable.instance_name.default;
|
||||
shape = "VM.Standard.A1.Flex";
|
||||
|
||||
shape_config = {
|
||||
ocpus = 2;
|
||||
memory_in_gbs = 12;
|
||||
};
|
||||
|
||||
source_details = {
|
||||
source_type = "image";
|
||||
source_id = config.data.oci_core_images.ubuntu_arm "images[0].id";
|
||||
boot_volume_size_in_gbs = 100;
|
||||
};
|
||||
|
||||
create_vnic_details = {
|
||||
subnet_id = config.resource.oci_core_subnet.subnet "id";
|
||||
display_name = "trantor-vnic";
|
||||
assign_public_ip = true;
|
||||
hostname_label = config.variable.instance_name.default;
|
||||
};
|
||||
|
||||
metadata = {
|
||||
ssh_authorized_keys = builtins.concatStringsSep "\n" config.variable.ssh_public_keys.default;
|
||||
};
|
||||
|
||||
preserve_boot_volume = false;
|
||||
};
|
||||
|
||||
oci_budget_budget.trantor_budget = {
|
||||
compartment_id = config.variable.tenancy_ocid.default;
|
||||
targets = [ (config.resource.oci_identity_compartment.trantor "id") ];
|
||||
amount = 1;
|
||||
reset_period = "MONTHLY";
|
||||
display_name = "trantor-budget";
|
||||
description = "Monthly budget for trantor compartment";
|
||||
target_type = "COMPARTMENT";
|
||||
};
|
||||
|
||||
oci_budget_alert_rule.daily_spend_alert = {
|
||||
budget_id = config.resource.oci_budget_budget.trantor_budget "id";
|
||||
type = "ACTUAL";
|
||||
threshold = 5;
|
||||
threshold_type = "PERCENTAGE";
|
||||
display_name = "daily-spend-alert";
|
||||
recipients = "baduhai@proton.me";
|
||||
description = "Alert when daily spending exceeds $0.05";
|
||||
message = "Daily spending has exceeded $0.05 in the trantor compartment";
|
||||
};
|
||||
};
|
||||
|
||||
output = {
|
||||
compartment_id = {
|
||||
value = config.resource.oci_identity_compartment.trantor "id";
|
||||
};
|
||||
|
||||
instance_public_ip = {
|
||||
value = config.resource.oci_core_instance.trantor "public_ip";
|
||||
};
|
||||
};
|
||||
}
|
||||
)
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
27
terranixConfigurations.nix
Normal file
27
terranixConfigurations.nix
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
{ inputs, ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
inputs.terranix.flakeModule
|
||||
];
|
||||
|
||||
perSystem =
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
terranix.terranixConfigurations = {
|
||||
oci-trantor = {
|
||||
modules = [ ./terranix/oci/trantor.nix ];
|
||||
terraformWrapper.package = pkgs.opentofu;
|
||||
};
|
||||
cloudflare-baduhaidev = {
|
||||
modules = [ ./terranix/cloudflare/baduhai.dev.nix ];
|
||||
terraformWrapper.package = pkgs.opentofu;
|
||||
};
|
||||
tailscale-tailnet = {
|
||||
modules = [ ./terranix/tailscale/tailnet.nix ];
|
||||
terraformWrapper.package = pkgs.opentofu;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue