From 00fbb12d5c1fa6da1742c18e83cc25bef6bde343 Mon Sep 17 00:00:00 2001 From: Jake Hillion Date: Sat, 22 Oct 2022 22:18:32 +0100 Subject: [PATCH] add vm.strangervm host --- .../default.nix | 26 +++++++++ .../hardware-configuration.nix | 32 +++++++++++ modules/common/authorized_keys | 6 +++ modules/common/default.nix | 53 +++++++++++++++++++ modules/common/shell.nix | 12 +++++ modules/common/ssh.nix | 14 +++++ modules/common/tailscale.nix | 50 +++++++++++++++++ modules/secrets | 2 +- 8 files changed, 194 insertions(+), 1 deletion(-) create mode 100644 hosts/vm.strangervm.ts.hillion.co.uk/default.nix create mode 100644 hosts/vm.strangervm.ts.hillion.co.uk/hardware-configuration.nix create mode 100644 modules/common/authorized_keys create mode 100644 modules/common/default.nix create mode 100644 modules/common/shell.nix create mode 100644 modules/common/ssh.nix create mode 100644 modules/common/tailscale.nix diff --git a/hosts/vm.strangervm.ts.hillion.co.uk/default.nix b/hosts/vm.strangervm.ts.hillion.co.uk/default.nix new file mode 100644 index 0000000..b18407b --- /dev/null +++ b/hosts/vm.strangervm.ts.hillion.co.uk/default.nix @@ -0,0 +1,26 @@ +{ config, pkgs, lib, ... }: + +{ + system.stateVersion = "22.05"; + + networking.hostName = "vm"; + networking.domain = "strangervm.ts.hillion.co.uk"; + + imports = [ + ./hardware-configuration.nix + ../../modules/common/default.nix + ../../modules/secrets/tailscale/vm.strangervm.ts.hillion.co.uk.nix + ]; + + boot.loader.grub = { + enable = true; + device = "/dev/sda"; + }; + + networking.interfaces.ens18.ipv4.addresses = [{ + address = "10.72.164.3"; + prefixLength = 24; + }]; + networking.defaultGateway = "10.72.164.1"; +} + diff --git a/hosts/vm.strangervm.ts.hillion.co.uk/hardware-configuration.nix b/hosts/vm.strangervm.ts.hillion.co.uk/hardware-configuration.nix new file mode 100644 index 0000000..eb1c88d --- /dev/null +++ b/hosts/vm.strangervm.ts.hillion.co.uk/hardware-configuration.nix @@ -0,0 +1,32 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + fileSystems."/" = + { device = "/dev/disk/by-uuid/6d59bd4b-439d-4480-897c-4480ea6fbe56"; + fsType = "ext4"; + }; + + swapDevices = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.ens18.useDHCP = lib.mkDefault true; + + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} + diff --git a/modules/common/authorized_keys b/modules/common/authorized_keys new file mode 100644 index 0000000..8e40e18 --- /dev/null +++ b/modules/common/authorized_keys @@ -0,0 +1,6 @@ +ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOt74U+rL+BMtAEjfu/Optg1D7Ly7U+TupRxd5u9kfN7oJnW4dJA25WRSr4dgQNq7MiMveoduBY/ky2s0c9gvIA= jake@jake-gentoo +ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBC0uKIvvvkzrOcS7AcamsQRFId+bqPwUC9IiUIsiH5oWX1ReiITOuEo+TL9YMII5RyyfJFeu2ZP9moNuZYlE7Bs= jake@jake-mbp + +ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEAyFsYYjLZ/wyw8XUbcmkk6OKt2IqLOnWpRE5gEvm3X0V4IeTOL9F4IL79h7FTsPvi2t9zGBL1hxeTMZHSGfrdWaMJkQp94gA1W30MKXvJ47nEVt0HUIOufGqgTTaAn4BHxlFUBUuS7UxaA4igFpFVoPJed7ZMhMqxg+RWUmBAkcgTWDMgzUx44TiNpzkYlG8cYuqcIzpV2dhGn79qsfUzBMpGJgkxjkGdDEHRk66JXgD/EtVasZvqp5/KLNnOpisKjR88UJKJ6/buV7FLVra4/0hA9JtH9e1ecCfxMPbOeluaxlieEuSXV2oJMbQoPP87+/QriNdi/6QuCHkMDEhyGw== jake@jake-mbp +ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCw4lgH20nfuchDqvVf0YciqN0GnBw5hfh8KIun5z0P7wlNgVYnCyvPvdIlGf2Nt1z5EGfsMzMLhKDOZkcTMlhupd+j2Er/ZB764uVBGe1n3CoPeasmbIlnamZ12EusYDvQGm2hVJTGQPPp9nKaRxr6ljvTMTNl0KWlWvKP4kec74d28MGgULOPLT3HlAyvUymSULK4lSxFK0l97IVXLa8YwuL5TNFGHUmjoSsi/Q7/CKaqvNh+ib1BYHzHYsuEzaaApnCnfjDBNexHm/AfbI7s+g3XZDcZOORZn6r44dOBNFfwvppsWj3CszwJQYIFeJFuMRtzlC8+kyYxci0+FXHn jake@jake-gentoo + diff --git a/modules/common/default.nix b/modules/common/default.nix new file mode 100644 index 0000000..a4bf427 --- /dev/null +++ b/modules/common/default.nix @@ -0,0 +1,53 @@ +{ pkgs, lib, config, ... }: + +{ + imports = [ + ./shell.nix + ./ssh.nix + ./tailscale.nix + ]; + + nix = { + settings.experimental-features = [ "nix-command" "flakes" ]; + settings = { + auto-optimise-store = true; + }; + gc = { + automatic = true; + dates = "weekly"; + options = "--delete-older-than 90d"; + }; + }; + + time.timeZone = "Europe/London"; + i18n.defaultLocale = "en_GB.UTF-8"; + + users = { + mutableUsers = false; + users."jake" = { + isNormalUser = true; + extraGroups = [ "wheel" ]; # enable sudo + shell = pkgs.zsh; + }; + }; + + security.sudo.wheelNeedsPassword = false; + + environment = { + systemPackages = with pkgs; [ + git + htop + nix + vim + ]; + variables.EDITOR = "vim"; + shellAliases = { + ls = "ls -p --color=auto"; + }; + }; + + networking = rec { + nameservers = [ "1.1.1.1" "8.8.8.8" "100.100.100.100" ]; + networkmanager.dns = "none"; + }; +} diff --git a/modules/common/shell.nix b/modules/common/shell.nix new file mode 100644 index 0000000..9f91951 --- /dev/null +++ b/modules/common/shell.nix @@ -0,0 +1,12 @@ +{ lib, config, ... }: + +{ + config.programs.zsh = { + enable = true; + histSize = 100000; + syntaxHighlighting = { + enable = true; + }; + }; +} + diff --git a/modules/common/ssh.nix b/modules/common/ssh.nix new file mode 100644 index 0000000..e4be8a5 --- /dev/null +++ b/modules/common/ssh.nix @@ -0,0 +1,14 @@ +{ pkgs, lib, config, ... }: + +{ + users.mutableUsers = false; + users.users."jake".openssh.authorizedKeys.keyFiles = [ ./authorized_keys ]; + + programs.mosh.enable = true; + services.openssh = { + enable = true; + permitRootLogin = "no"; + passwordAuthentication = false; + }; +} + diff --git a/modules/common/tailscale.nix b/modules/common/tailscale.nix new file mode 100644 index 0000000..cd2dae8 --- /dev/null +++ b/modules/common/tailscale.nix @@ -0,0 +1,50 @@ +{ pkgs, lib, config, ... }: + +{ + options.tailscalePreAuth = lib.mkOption { + type = lib.types.str; + }; + options.tailscaleAdvertiseRoutes = lib.mkOption { + type = lib.types.str; + default = ""; + }; + + # make the tailscale command usable to users + config.environment.systemPackages = [ pkgs.tailscale ]; + + # enable the tailscale service + config.services.tailscale.enable = true; + + config.systemd.services.tailscale-autoconnect = { + description = "Automatic connection to Tailscale"; + + # make sure tailscale is running before trying to connect to tailscale + after = [ "network-pre.target" "tailscale.service" ]; + wants = [ "network-pre.target" "tailscale.service" ]; + wantedBy = [ "multi-user.target" ]; + + # set this service as a oneshot job + serviceConfig.Type = "oneshot"; + + # have the job run this shell script + script = with pkgs; '' + # wait for tailscaled to settle + sleep 2 + + # check if we are already authenticated to tailscale + status="$(${tailscale}/bin/tailscale status -json | ${jq}/bin/jq -r .BackendState)" + if [ $status = "Running" ]; then # if so, then do nothing + exit 0 + fi + + # otherwise authenticate with tailscale + ${tailscale}/bin/tailscale up \ + --login-server https://ts.hillion.co.uk/ \ + --authkey ${config.tailscalePreAuth} \ + --advertise-routes "${config.tailscaleAdvertiseRoutes}" + ''; + }; + +} + + diff --git a/modules/secrets b/modules/secrets index 921cd5a..1f411f0 160000 --- a/modules/secrets +++ b/modules/secrets @@ -1 +1 @@ -Subproject commit 921cd5a26fded8bdeacf47c464d7c06622920315 +Subproject commit 1f411f096e6b0059c4d31fb14dc6f4f2e91659c7