diff --git a/hosts/sausebiene/default.nix b/hosts/sausebiene/default.nix new file mode 100644 index 0000000..055ae3b --- /dev/null +++ b/hosts/sausebiene/default.nix @@ -0,0 +1,44 @@ +{ + globals, + inputs, + nodes, + ... +}: +{ + imports = [ + inputs.nixos-hardware.nixosModules.common-cpu-intel + inputs.nixos-hardware.nixosModules.common-pc-ssd + + ../../config + ../../config/hardware/intel.nix + ../../config/hardware/physical.nix + ../../config/optional/zfs.nix + + ./fs.nix + ./net.nix + ]; + + topology.self.hardware.info = "Intel N100, 16GB RAM"; + + nixpkgs.hostPlatform = "x86_64-linux"; + boot.mode = "efi"; + + meta.promtail = { + enable = true; + proxy = "sentinel"; + }; + + # Connect safely via wireguard to skip authentication + networking.hosts.${nodes.ward-web-proxy.config.wireguard.proxy-home.ipv4} = [ + globals.services.influxdb.domain + ]; + meta.telegraf = { + enable = true; + influxdb2 = { + inherit (globals.services.influxdb) domain; + organization = "machines"; + bucket = "telegraf"; + node = "sire-influxdb"; + }; + }; +} diff --git a/hosts/sausebiene/fs.nix b/hosts/sausebiene/fs.nix new file mode 100644 index 0000000..4ca4965 --- /dev/null +++ b/hosts/sausebiene/fs.nix @@ -0,0 +1,33 @@ +{ + config, + lib, + ... +}: +let + inherit (config.repo.secrets.local) disks; +in +{ + disko.devices = { + disk = { + m2-ssd = { + type = "disk"; + device = "/dev/disk/by-id/${disks.m2-ssd}"; + content = { + type = "gpt"; + partitions = { + efi = lib.disko.gpt.partEfi "1G"; + swap = lib.disko.gpt.partSwap "16G"; + rpool = lib.disko.gpt.partLuksZfs disks.m2-ssd "rpool" "100%"; + }; + }; + }; + }; + zpool = { + rpool = lib.disko.zfs.mkZpool { + datasets = lib.disko.zfs.impermanenceZfsDatasets // { + "safe/guests" = lib.disko.zfs.unmountable; + }; + }; + }; + }; +} diff --git a/hosts/sausebiene/net.nix b/hosts/sausebiene/net.nix new file mode 100644 index 0000000..a2548ec --- /dev/null +++ b/hosts/sausebiene/net.nix @@ -0,0 +1,43 @@ +{ + config, + globals, + ... +}: +{ + networking.hostId = config.repo.secrets.local.networking.hostId; + + # FIXME: aaaaaaaaa + # globals.monitoring.ping.sausebiene = { + # hostv4 = lib.net.cidr.ip globals.net.home-lan.vlans.services.hosts.sausebiene.cidrv4; + # hostv6 = lib.net.cidr.ip globals.net.home-lan.vlans.services.hosts.sausebiene.cidrv6; + # network = "home-lan.vlans.services"; + # }; + + boot.initrd.availableKernelModules = [ "8021q" ]; + boot.initrd.systemd.network = { + enable = true; + networks = { + inherit (config.systemd.network.networks) "10-lan"; + }; + }; + + systemd.network.networks = { + "10-lan" = { + address = [ "192.168.1.6/24" ]; + gateway = [ globals.net.home-lan.vlans.services.hosts.ward.ipv4 ]; + matchConfig.MACAddress = config.repo.secrets.local.networking.interfaces.lan.mac; + networkConfig = { + IPv6PrivacyExtensions = "yes"; + MulticastDNS = true; + }; + linkConfig.RequiredForOnline = "routable"; + }; + }; + + networking.nftables.firewall = { + zones.untrusted.interfaces = [ "lan" ]; + }; + + # Allow accessing influx + wireguard.proxy-sentinel.client.via = "sentinel"; +} diff --git a/hosts/sausebiene/secrets/host.pub b/hosts/sausebiene/secrets/host.pub new file mode 100644 index 0000000..e071795 --- /dev/null +++ b/hosts/sausebiene/secrets/host.pub @@ -0,0 +1 @@ +ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDOZ2/shbByexe15RqevukRr/ZYhGvo3H7aWeqwEwbRJ diff --git a/hosts/sausebiene/secrets/local.nix.age b/hosts/sausebiene/secrets/local.nix.age new file mode 100644 index 0000000..7f0ae9e --- /dev/null +++ b/hosts/sausebiene/secrets/local.nix.age @@ -0,0 +1,11 @@ +age-encryption.org/v1 +-> X25519 FHDjxeYsy2SeiUd6qwEjZHeC3Z6usSyN8zJND6E8ig8 +ki3Tg/NopVqXqJlByi6YwnHm/qcrNtx+bPKgJVl6+Wo +-> piv-p256 xqSe8Q A+wwCAkKZpha/eaKJtlWlLsC2R4Jp+Xaj313d0AYTZ1W +hwg+vOJ+8V6lQ401c6QlTIvG+BD8cPVoN8PPT6Xq4c0 +-> 8MAV){6T-grease F()\ +6or/fJD/g3vChdeqgB9MGpzp72S9lbsZbMiSb0Z7p9N+lYFPM0ydobZWfrxr8ptj +628oaPN6SIqgNn4bKCaxInyKQuBEcXz17QbrYrAWYBKF8O96qg +--- xm0ao0zoO8amQMmPcbDm053OZ/KdNNJPXAbcmV93BLM +MY/\\~#<ص +Rמ)DA ws@i5}ĘhALuEm~n/5ՀVK Ja!~&.D \cW g8P. BX. YܥaJau``Hi曳$d^=xkOgA_\V҆J=ԿF'~F sمC$/ \ No newline at end of file diff --git a/secrets/generated/sausebiene/initrd_host_ed25519_key.age b/secrets/generated/sausebiene/initrd_host_ed25519_key.age new file mode 100644 index 0000000..46d6fa7 Binary files /dev/null and b/secrets/generated/sausebiene/initrd_host_ed25519_key.age differ diff --git a/secrets/generated/sausebiene/promtail-loki-basic-auth-password.age b/secrets/generated/sausebiene/promtail-loki-basic-auth-password.age new file mode 100644 index 0000000..36b07df --- /dev/null +++ b/secrets/generated/sausebiene/promtail-loki-basic-auth-password.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> X25519 ZmH6m4AQx8wxaJPMUevkmsLQ35rlKt+a2iSJq81fKQg +WR6GfDdCI+d4mphM8xHwP/UzXPBqfgaoCyt8s+nDpKk +-> piv-p256 xqSe8Q Awqf0ypLzhT/zHHuXkCAfcP3joODqC8AU6RE+uVFwOdK +B4OjmQ99uxqFkNs/MhC06hScORtowu9HaLrkrW6K3Dg +-> +elbHO7-grease +dg +--- G7eHSF0eaQ6nv/U7/KXwNEnY9okbXmKSWDDszVBZnu4 +c+Q2i+C]TcMbk/3B.:t5we:a^XGg&mB(hmao \ No newline at end of file diff --git a/secrets/generated/sausebiene/telegraf-influxdb-token.age b/secrets/generated/sausebiene/telegraf-influxdb-token.age new file mode 100644 index 0000000..a30c557 --- /dev/null +++ b/secrets/generated/sausebiene/telegraf-influxdb-token.age @@ -0,0 +1,9 @@ +age-encryption.org/v1 +-> X25519 OK0YjDoVUwRXX9O/GTE8bNIYA3TLmY7h3an+EHvPnjc +0WwTbnNSflEwzicZcjMzoMt+UZNrRSyb+HUcKiX/Ybc +-> piv-p256 xqSe8Q AoBweILdXCIv16ZQQZiLaEGf93bHE1WW3ZBEGM2mU5s4 +3S1zyoSzyDcoDQZJdvrYhujwPIL8Nsgd20NpKvKi0/g +-> #-grease = +Gh2UGo3dwqJHeHhmNGPYiFVfVZb6Yvo8L7WKU9KvnuSNFw +--- cF1S3wS0iy+zI14BtNP5+llcah1S0cfQSQ9t6XcRD/I +%,e#pΚ" z^*jҩ*Jc<$iRxՈl]۸)j=0AhG^"" l \ No newline at end of file diff --git a/secrets/generated/sentinel/loki-basic-auth-hashes.age b/secrets/generated/sentinel/loki-basic-auth-hashes.age index 3d223aa..724f4f2 100644 Binary files a/secrets/generated/sentinel/loki-basic-auth-hashes.age and b/secrets/generated/sentinel/loki-basic-auth-hashes.age differ diff --git a/secrets/rekeyed/sausebiene/02083da3c2e6819322181878fae7553f-promtail-loki-basic-auth-password.age b/secrets/rekeyed/sausebiene/02083da3c2e6819322181878fae7553f-promtail-loki-basic-auth-password.age new file mode 100644 index 0000000..084e705 --- /dev/null +++ b/secrets/rekeyed/sausebiene/02083da3c2e6819322181878fae7553f-promtail-loki-basic-auth-password.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 iNceIg YmdgTOgrnPGvk90h8pM+OjfowQzhVo9v5lcCcmnZLQ0 +0CHP+GdcH7Eq2Wu9yp4SCn0bgjY7tKgLbTBHN0i2KdU +-> K3s5a#V_-grease @ ==f A9yR{~ +M+nuDvAN9JDn6EJWJBSujNTgtC+fU+wfwBaw098p5gx5m8aTm+iVAXayx3GeTw2J +AUPIG8TiIj6T0L4KyvNO03zuDYc0aYQXCgJ2wHsheWr/kQ +--- x0kUxYcAenQjbH97L4g11cjO6DW3iWhmTez4wQvoW9I + ^e VE7uYsJz2oO,60F@D d2@*iU@0NVnUkhvE \ No newline at end of file diff --git a/secrets/rekeyed/sausebiene/6990ed2f05dd917e79b312efcbf20391-telegraf-influxdb-token.age b/secrets/rekeyed/sausebiene/6990ed2f05dd917e79b312efcbf20391-telegraf-influxdb-token.age new file mode 100644 index 0000000..3450cf2 --- /dev/null +++ b/secrets/rekeyed/sausebiene/6990ed2f05dd917e79b312efcbf20391-telegraf-influxdb-token.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 iNceIg g14O67KT+fiVFUsYTqwJdNPCNbp8qutFuNgJOvIOmnY +z+jDxlC7+nfhPyEgtjeplFN7uLSjkWRaVxyQ2qbC2uU +-> p}-grease M^( +72hYQ0ZXayKtOOIg9m2NUc15Y8d0LeD0wfoCmo6bJ0Xn+A +--- eLXnULfh27jeqWR1XV640jyegcG6NMDJvkXZeiCoTuQ +YÎcHW1ҭ4.Z5>Eޔ=qYi vʁlKĔpj[I=8%Nà \ No newline at end of file diff --git a/secrets/rekeyed/sausebiene/a136cf730d84d1ea12cd0cd00aa130d3-initrd_host_ed25519_key.age b/secrets/rekeyed/sausebiene/a136cf730d84d1ea12cd0cd00aa130d3-initrd_host_ed25519_key.age new file mode 100644 index 0000000..8207f0d Binary files /dev/null and b/secrets/rekeyed/sausebiene/a136cf730d84d1ea12cd0cd00aa130d3-initrd_host_ed25519_key.age differ diff --git a/secrets/rekeyed/sausebiene/a724df7b1d5ca71e006c0d36be3eceb6-wireguard-proxy-sentinel-priv-sausebiene.age b/secrets/rekeyed/sausebiene/a724df7b1d5ca71e006c0d36be3eceb6-wireguard-proxy-sentinel-priv-sausebiene.age new file mode 100644 index 0000000..5509fd1 --- /dev/null +++ b/secrets/rekeyed/sausebiene/a724df7b1d5ca71e006c0d36be3eceb6-wireguard-proxy-sentinel-priv-sausebiene.age @@ -0,0 +1,8 @@ +age-encryption.org/v1 +-> ssh-ed25519 iNceIg yx0E7V8G3fg0xkW85OFIthHYmzSb+UtvIHYuwJY5dlo +9cg6P5noJZgJDSlF+qptsSaundGj/LHxvoKR7a3/EiY +-> Q[f8ce2C-grease Gk.1J~ a~*? [&:FR2xK +XGoWkCzzyoLy39XWXz1avKY +--- fzl38diZoESS+4+Tali0WMZv5vut+PW9qp796IVUW18 +&.u^TP[A&RH fgNۦH]>Q\xǷ tN!@ +P \ No newline at end of file diff --git a/secrets/rekeyed/sausebiene/db0265df112bb3c06ef6a0361b96c96e-wireguard-proxy-sentinel-psks-sausebiene+sentinel.age b/secrets/rekeyed/sausebiene/db0265df112bb3c06ef6a0361b96c96e-wireguard-proxy-sentinel-psks-sausebiene+sentinel.age new file mode 100644 index 0000000..f14300e Binary files /dev/null and b/secrets/rekeyed/sausebiene/db0265df112bb3c06ef6a0361b96c96e-wireguard-proxy-sentinel-psks-sausebiene+sentinel.age differ diff --git a/secrets/rekeyed/sentinel/c9a404b7a1241d00c53daf77274a95c3-loki-basic-auth-hashes.age b/secrets/rekeyed/sentinel/c9a404b7a1241d00c53daf77274a95c3-loki-basic-auth-hashes.age deleted file mode 100644 index 290407d..0000000 Binary files a/secrets/rekeyed/sentinel/c9a404b7a1241d00c53daf77274a95c3-loki-basic-auth-hashes.age and /dev/null differ diff --git a/secrets/rekeyed/sentinel/dcaec2abd18128d1b2a56e0490ecf616-loki-basic-auth-hashes.age b/secrets/rekeyed/sentinel/dcaec2abd18128d1b2a56e0490ecf616-loki-basic-auth-hashes.age new file mode 100644 index 0000000..2218dea Binary files /dev/null and b/secrets/rekeyed/sentinel/dcaec2abd18128d1b2a56e0490ecf616-loki-basic-auth-hashes.age differ diff --git a/secrets/rekeyed/sentinel/f6bf0b7bd3d2c8815cba951e47ead8fc-wireguard-proxy-sentinel-psks-sausebiene+sentinel.age b/secrets/rekeyed/sentinel/f6bf0b7bd3d2c8815cba951e47ead8fc-wireguard-proxy-sentinel-psks-sausebiene+sentinel.age new file mode 100644 index 0000000..0cfa107 --- /dev/null +++ b/secrets/rekeyed/sentinel/f6bf0b7bd3d2c8815cba951e47ead8fc-wireguard-proxy-sentinel-psks-sausebiene+sentinel.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 yV7lcA TbUU7Qe1joDj9Vz7R0dnhBiTE8/D+EcNF/y7p5lEjn0 +A7kwW/AOVy7wB7RYnSP11QIYxhiOrODgEl7AwAM1hqo +-> Pa;1-grease wep< ?nNq sM7#ln+- 4U3*y,6> +9q3AkZ8bOWDiSg +--- vaag5FKw+gm/7ZZs2TtvCcWym2A5glZrHVmcd5OgPNM +k=oCnj99wzφ ?T5柭VMa>9ODE#pgS }-?o^ \ No newline at end of file diff --git a/secrets/rekeyed/sire-influxdb/e2fc49f34c814de46c73fbf3204423e7-telegraf-influxdb-token-sausebiene.age b/secrets/rekeyed/sire-influxdb/e2fc49f34c814de46c73fbf3204423e7-telegraf-influxdb-token-sausebiene.age new file mode 100644 index 0000000..c8cea21 --- /dev/null +++ b/secrets/rekeyed/sire-influxdb/e2fc49f34c814de46c73fbf3204423e7-telegraf-influxdb-token-sausebiene.age @@ -0,0 +1,7 @@ +age-encryption.org/v1 +-> ssh-ed25519 1tdZKQ iBcbMa5vzu/RqfZBKWzZbxnepo8yNT3+rjU9Htoy3i4 +2hencjJton0PIHsHAmYFmhOlNkGx4jI2UXjsR8SUQuU +-> u.4,!W-grease |/$-"Ss ;}G]-O*, b+#6 +8oR1X8KI9U5mgJks35+tMzCZ+tlQ5EKu7XY +--- j8IMlikPntFCmvYEU/CFXzycblXrfFAqqMN3Dw9Ycj8 +X; Gq9`.3}vE-.?ysd4068=wsVbHrzF5K \ No newline at end of file diff --git a/secrets/rekeyed/ward-web-proxy/3026df7d8e7b352d8c5b303169330089-loki-basic-auth-hashes.age b/secrets/rekeyed/ward-web-proxy/3026df7d8e7b352d8c5b303169330089-loki-basic-auth-hashes.age deleted file mode 100644 index d64c8d1..0000000 Binary files a/secrets/rekeyed/ward-web-proxy/3026df7d8e7b352d8c5b303169330089-loki-basic-auth-hashes.age and /dev/null differ diff --git a/secrets/rekeyed/ward-web-proxy/9ac62b3f616089c30725c0b860f1b3ec-loki-basic-auth-hashes.age b/secrets/rekeyed/ward-web-proxy/9ac62b3f616089c30725c0b860f1b3ec-loki-basic-auth-hashes.age new file mode 100644 index 0000000..8459e4c Binary files /dev/null and b/secrets/rekeyed/ward-web-proxy/9ac62b3f616089c30725c0b860f1b3ec-loki-basic-auth-hashes.age differ diff --git a/secrets/wireguard/proxy-sentinel/keys/sausebiene.age b/secrets/wireguard/proxy-sentinel/keys/sausebiene.age new file mode 100644 index 0000000..f687a16 --- /dev/null +++ b/secrets/wireguard/proxy-sentinel/keys/sausebiene.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> X25519 MlhR1dPHJdvcOLPCBqc70K9LuUcMzmOjB6EXLFlmtT8 +kwpynEyGyv0vO1vh9hmSrEVJG4yFm2wAROwr0PkehNA +-> piv-p256 xqSe8Q As3q1+XwqnvPVnrv7kBAvWvPH9lEusBJ4AKpKF6Ctzwy +Lv+dzFT1E/E5WQWD7dLgK6InyyzunMQTcRE4njHeA5A +-> LlHe-grease ~Sw~Jw - R:CL!a ^vUh9K +gSvLyvHf0kky5uWH8o98wL0zLUhlgEmsD+ainAO/fJLtFICTh2uineNZRFOxZxEW +296qg1m/sTQA/izSjMXCwrkU9uNBo4TOfjB28pYfBg +--- Ml2Z0Eejdcqhj6vxIwpF1jCARpknE9ZS+RmlrGcyUqU +b1c.րZ\ޜ,_ l 7 ԬH-<ˮ`~8po8 \ No newline at end of file diff --git a/secrets/wireguard/proxy-sentinel/keys/sausebiene.pub b/secrets/wireguard/proxy-sentinel/keys/sausebiene.pub new file mode 100644 index 0000000..3f20030 --- /dev/null +++ b/secrets/wireguard/proxy-sentinel/keys/sausebiene.pub @@ -0,0 +1 @@ +QodjkDbHjMe5PH+LxRlU/lR5VJGF6vp2QQB5+DzVOE8= diff --git a/secrets/wireguard/proxy-sentinel/psks/sausebiene+sentinel.age b/secrets/wireguard/proxy-sentinel/psks/sausebiene+sentinel.age new file mode 100644 index 0000000..1daa57f --- /dev/null +++ b/secrets/wireguard/proxy-sentinel/psks/sausebiene+sentinel.age @@ -0,0 +1,10 @@ +age-encryption.org/v1 +-> X25519 TMgljbYm7js7lOMpRoBDu/Nr70XDqHXJRYvBU/GcAzU +aW22h5pYU4cBTPnXfhyM7YxC4e1QkWNXLYuLmT8lG0g +-> piv-p256 xqSe8Q Ar41hbT5AjkIrEvm+tvU1Ubn7rdKruuU0k5R15281nyj +2Owm5MoFybFxy988KQnF5w4bk/JgzMEN0VsuHp4rwLM +-> r4&-grease ]K +R5mtPMADcrrZn2N+BTJuESdokdZTCuyJayQitBdteoFz6EYzVxCnOCRU7LJFuKzo +lvC/na+bpRn40W1LHWgUYJcHLUdalk4dB0d7yQ +--- STdabhK6cjx5gqt3ahkxoulJKgdqxaF8ldsSZMaEs4g +M#d' uLA^@KGcvKpmNvLR_A-;̩^fx\oZIODX{fm \ No newline at end of file