Skip to content

Commit c6294dc

Browse files
badelebadele
authored
feat: add hypervisor(hype16) host (#5)
1 parent 7254f34 commit c6294dc

File tree

9 files changed

+497
-0
lines changed

9 files changed

+497
-0
lines changed

‎hosts/hype16/default.nix‎

Lines changed: 233 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,233 @@
1+
# #########################################################
2+
# NIXOS (hosts)
3+
##########################################################
4+
{ inputs, config, pkgs, lib, ... }: {
5+
imports = [
6+
# Host and hardware configuration
7+
./hardware-configuration.nix
8+
./disks.nix
9+
../../nix/modules/nixos/host.nix
10+
11+
# Users
12+
../root.nix
13+
../badele.nix
14+
15+
# Commons
16+
../../nix/nixos/features/commons
17+
../../nix/nixos/features/homelab
18+
../../nix/nixos/features/system/containers.nix
19+
20+
# Roles
21+
../../nix/nixos/roles # Automatically load service from <host.modules> sectionn from `homelab.json` file
22+
];
23+
24+
####################################
25+
# Boot
26+
####################################
27+
28+
boot = {
29+
kernelParams = [ "mem_sleep_default=deep" ];
30+
blacklistedKernelModules = [ ];
31+
kernelModules = [ "kvm-intel" ];
32+
supportedFilesystems = [ "btrfs" ];
33+
34+
# Grub EFI boot loader
35+
loader = {
36+
grub = {
37+
enable = true;
38+
devices = [ "nodev" ];
39+
efiInstallAsRemovable = true;
40+
efiSupport = true;
41+
useOSProber = true;
42+
};
43+
};
44+
45+
# Network
46+
kernel = {
47+
sysctl = {
48+
# Forward on all ipv4 interfaces.
49+
"net.ipv4.conf.all.forwarding" = true;
50+
};
51+
};
52+
};
53+
54+
# xorg
55+
# videoDrivers = [ "intel" "i965" "nvidia" ];
56+
57+
####################################
58+
# host profile
59+
####################################
60+
hostprofile = { nproc = 8; };
61+
62+
virtualisation.docker.storageDriver = "btrfs";
63+
64+
####################################
65+
# Hardware
66+
####################################
67+
68+
# Pulseaudio
69+
hardware.pulseaudio = {
70+
enable = true;
71+
support32Bit =
72+
true; # # If compatibility with 32-bit applications is desired
73+
#extraConfig = "load-module module-combine-sink";
74+
};
75+
76+
####################################
77+
# Networking
78+
####################################
79+
80+
networking = {
81+
enableIPv6 = false;
82+
hostName = "hype16";
83+
useDHCP = false;
84+
85+
# Define VLANs
86+
vlans = {
87+
vlandmz = {
88+
id = 32;
89+
interface = "enp1s0"; # tagged
90+
};
91+
vlanadm = {
92+
id = 240;
93+
interface = "enp1s0"; # tagged
94+
};
95+
};
96+
97+
# Create interfaces
98+
interfaces = {
99+
brlan = {
100+
ipv4.addresses = [{
101+
address = "192.168.254.16";
102+
prefixLength = 24;
103+
}];
104+
};
105+
106+
bradm = {
107+
ipv4.addresses = [{
108+
address = "192.168.240.16";
109+
prefixLength = 24;
110+
}];
111+
};
112+
113+
brdmz = {
114+
ipv4.addresses = [{
115+
address = "192.168.32.16";
116+
prefixLength = 24;
117+
}];
118+
};
119+
};
120+
121+
# Create bridges
122+
bridges = {
123+
# untagged
124+
"brlan" = { interfaces = [ "enp1s0" ]; };
125+
"bradm" = { interfaces = [ "vlanadm" ]; };
126+
"brdmz" = { interfaces = [ "vlandmz" ]; };
127+
};
128+
129+
# Define default gateway and nameservers
130+
defaultGateway = "192.168.254.254";
131+
nameservers = [ "89.2.0.1" "89.2.0.2" ];
132+
};
133+
134+
####################################
135+
# Incus hypervisor
136+
####################################
137+
138+
networking.nftables.enable = true;
139+
140+
networking.firewall = {
141+
# logReversePathDrops = true;
142+
# logRefusedPackets = true;
143+
# logRefusedConnections = true;
144+
# logRefusedUnicastsOnly = true;
145+
146+
interfaces = {
147+
brdmz = {
148+
allowedTCPPorts = [ 53 67 ];
149+
allowedUDPPorts = [ 53 67 ];
150+
};
151+
152+
};
153+
154+
# Forward
155+
# filterForward = true;
156+
# extraForwardRules = "iifname brdmz oifname brdmz accept";
157+
extraInputRules = "iifname brdmz accept";
158+
# "iifname brdmz ip saddr 192.168.254.0/24 ip daddr 192.168.253.0/24 accept";
159+
};
160+
161+
virtualisation.incus = {
162+
enable = true;
163+
ui.enable = true;
164+
preseed = {
165+
profiles = [
166+
{
167+
name = "default";
168+
description = "Default profile";
169+
devices = {
170+
eth0 = {
171+
name = "eth0";
172+
type = "nic";
173+
nictype = "bridged";
174+
parent = "brlan";
175+
};
176+
root = {
177+
path = "/";
178+
pool = "default";
179+
size = "35GiB";
180+
type = "disk";
181+
};
182+
};
183+
}
184+
{
185+
name = "lan";
186+
description = "LAN profile";
187+
devices = {
188+
eth0 = {
189+
name = "eth0";
190+
type = "nic";
191+
nictype = "bridged";
192+
parent = "brlan";
193+
};
194+
};
195+
}
196+
{
197+
name = "dmz";
198+
description = "DMZ profile";
199+
devices = {
200+
eth1 = {
201+
name = "eth1";
202+
type = "nic";
203+
nictype = "bridged";
204+
parent = "brdmz";
205+
};
206+
};
207+
}
208+
];
209+
storage_pools = [{
210+
config = { source = "/var/lib/incus/storage-pools/default"; };
211+
driver = "dir";
212+
name = "default";
213+
}];
214+
};
215+
};
216+
217+
####################################
218+
# Storage
219+
####################################
220+
systemd.tmpfiles.rules = [
221+
# trilium app
222+
"d /data/incus/trilium/var_lib_trilium 0750 root root -"
223+
];
224+
225+
####################################
226+
# Programs
227+
####################################
228+
powerManagement.powertop.enable = true;
229+
programs = { };
230+
231+
nixpkgs.hostPlatform.system = "x86_64-linux";
232+
system.stateVersion = "24.05";
233+
}

‎hosts/hype16/disks.nix‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
{ inputs, lib, ... }: {
2+
3+
imports = [ inputs.disko.nixosModules.disko ];
4+
5+
disko.devices = {
6+
disk = {
7+
disk1 = {
8+
type = "disk";
9+
device = lib.mkDefault
10+
"/dev/disk/by-id/ata-CYX-SSD-S1000_230324000201S5121504";
11+
content = {
12+
type = "gpt";
13+
partitions = {
14+
ESP = {
15+
priority = 1;
16+
name = "ESP";
17+
start = "1M";
18+
end = "1024M";
19+
type = "EF00";
20+
content = {
21+
type = "filesystem";
22+
format = "vfat";
23+
mountpoint = "/boot";
24+
};
25+
};
26+
root = {
27+
size = "100%";
28+
content = {
29+
type = "btrfs";
30+
extraArgs = [ "-f" ]; # Override existing partition
31+
# Subvolumes must set a mountpoint in order to be mounted,
32+
# unless their parent is mounted
33+
subvolumes = {
34+
# Subvolume name is different from mountpoint
35+
"/rootfs" = { mountpoint = "/"; };
36+
# Subvolume name is the same as the mountpoint
37+
"/home" = {
38+
mountOptions = [ "compress=zstd" ];
39+
mountpoint = "/home";
40+
};
41+
# Sub(sub)volume doesn't need a mountpoint as its parent is mounted
42+
"/home/user" = { };
43+
# Parent is not mounted so the mountpoint must be set
44+
"/nix" = {
45+
mountOptions = [ "compress=zstd" "noatime" ];
46+
mountpoint = "/nix";
47+
};
48+
# This subvolume will be created but not mounted
49+
"/test" = { };
50+
# Subvolume for the swapfile
51+
"/swap" = {
52+
mountpoint = "/.swapvol";
53+
swap = {
54+
swapfile.size = "1024M";
55+
swapfile2.size = "1024M";
56+
swapfile2.path = "rel-path";
57+
};
58+
};
59+
};
60+
61+
mountpoint = "/partition-root";
62+
swap = {
63+
swapfile = { size = "20M"; };
64+
swapfile1 = { size = "20M"; };
65+
};
66+
};
67+
};
68+
};
69+
};
70+
};
71+
};
72+
};
73+
}

‎hosts/hype16/hardware-configuration.nix‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
# Do not modify this file! It was generated by ‘nixos-generate-config’
2+
# and may be overwritten by future invocations. Please make changes
3+
# to /etc/nixos/configuration.nix instead.
4+
{ config, lib, pkgs, modulesPath, ... }:
5+
6+
{
7+
imports = [
8+
(modulesPath + "/installer/scan/not-detected.nix")
9+
];
10+
11+
powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
12+
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
13+
}

‎hosts/hype16/secrets.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
system:
2+
user:
3+
root-hash: ENC[AES256_GCM,data:PScvPSDvRaHUXTr5dMBcUoZ2GaJcbb44030WMTvQ2cooKrL/eevf5a5apbRpFSRXu0HsOKpOwrXqauKD3coMY2HTyiYDGEgidrJlij9CjMOKVvHJl4P7hD1aszTuvEgBkwEj8BGAAtG+CA==,iv:AuM7cdeIXuptmRbcS0HcP5ZB7+VcbQuDlECQppCR8lo=,tag:4Te9jkG8yHijyICZlEKiuw==,type:str]
4+
badele-hash: ENC[AES256_GCM,data:vsQy1euMz0qiHiN1Mm4Ab3+y1bvuAJ4QBh60jzLU9RN9JNkpXcsZMVyZ4K5aMFYPVDQ1146T6j+S9UlE9oR3QvenmcrjFWEORXZg+M3ZigHtubKOdbL66FR3lyXGsUgtLFiF7MXuCriubw==,iv:SZChyIKjR2P3/pU2dVxch/7IH86XnPFJGye3x4WKQNQ=,tag:WaEI+35ilONoBEibfpSNkg==,type:str]
5+
test: ENC[AES256_GCM,data:UdDXow==,iv:jlKL5OkN/hS2iNpWIm989kHswyJcBikpWCvUpXNnAgs=,tag:z+gQyR4NnQjEKWBjv4O/Ow==,type:str]
6+
sops:
7+
kms: []
8+
gcp_kms: []
9+
azure_kv: []
10+
hc_vault: []
11+
age:
12+
- recipient: age15js628ku59g94njn0vup20r4xx34guesgsj5dqsken5hma2zqg2szjed66
13+
enc: |
14+
-----BEGIN AGE ENCRYPTED FILE-----
15+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnaEJ0S0FXZ2hXNkw3dW9V
16+
UzI4eVQrb3dmZ0ZXaElnRjZwUmFsSzBmeVdNCnNrTmlwOUt5cE5MNnJtMU9NVktp
17+
NTdnSkZqZXJabU1UNDE1STdLQ2NVMm8KLS0tIG9tL01SMTJNYWFsVVJmSGlUWHVk
18+
c1VGT1RCc1RYZVNIMEZ3cCs1NU0wOTgKeru9fVg8LbfA6FpM4ko7hFO7ydo6lJfP
19+
4C+BJzVBEacPJPUENa71iM5SPF1vD6DzX7Pw7afrph6HpaPXygiNDg==
20+
-----END AGE ENCRYPTED FILE-----
21+
- recipient: age1atc7mzjz8k58l7wh5na8d9k5y5fl5qf75m5dtl53l6wvwmrr7pvqxchgtf
22+
enc: |
23+
-----BEGIN AGE ENCRYPTED FILE-----
24+
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB4VlNTYVZzWFc3TXB5UTUz
25+
cXVoS0twaE93NGk3UlYxZ1d4aElqd21VREc4Cis1TUJNZUZyRE9rR2haT1NRWFc5
26+
dFZoSTgrTVZZQnBJcEtvdWFwUEFvZm8KLS0tIGdwQ0Vwd1Urb3FsajY3c2phVExD
27+
N0dtbTFRUk1lUGluTEtoWEpZSUNjVzAKpmtEkpZ9cw/uKSxObA7FIqG6wKWX7kK4
28+
Vy9yYRYSaJfCW46//3qwuYLqzGqa2+xGjyvPqRPohvFOhVn3pp7FFw==
29+
-----END AGE ENCRYPTED FILE-----
30+
lastmodified: "2024-10-27T07:35:19Z"
31+
mac: ENC[AES256_GCM,data:QJ3WSWPmBAazKz2YJS10mP4BAw5Il+L0FgPVRGHy1wOpv6zpdvj+jHy239d0QuZ3kKVjHeSgaYf2wdzkOLNDCtKKUklBIgKHeRsgbhBOkMouFfnBwWlU65INM72eqW5rDxJ5xL2ieV5UOicomDYnM75SgMHibTBviXW5mLpLMEY=,iv:ch7wdE5bfeK5+VSk8bif6uErhneD3f97UIhnD6/aDNI=,tag:4O8LfwdBbVn3hSTSSd1FOQ==,type:str]
32+
pgp: []
33+
unencrypted_suffix: _unencrypted
34+
version: 3.9.1

‎hosts/hype16/ssh-to-age.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
age1atc7mzjz8k58l7wh5na8d9k5y5fl5qf75m5dtl53l6wvwmrr7pvqxchgtf

‎hosts/hype16/ssh_host_ed25519_key.pub‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAZhjzZnBhiMUFi8l9MwyIo4dq0/7u9vaVWpsZDGQU64 badele@badxps

‎hosts/hype16/ssh_host_rsa_key.pub‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCgKR1Dk3NUCh4hKwSQK9vn2VUZqCvrQCZ61PTAhXXA1kBPX/FiQ4YuqUTGBPz99ygBOv8KCDuACySOZWgKBxlVeyhO8tmiChOrC95YBwHh1Ee8LFgCe1nsg6pZMYXADpk/HnvJlJg88SA3LsvYM6EyJ16fSowX/e4XDnrTWNBaNt4uxufIexVDr7DwgB1FdQdmxpssIyKWoKYQtNGsVPoghQgnBkb8Qh0nmfe6J+jE/JRUV0NTceIUxVpI5/p2OIvEAN4U6EcL7kvJdWzgpc1KtyinB8Aea8xN5oPQsRe2fVNe1uEDkFORXXIspA5qSZkU7o7ni9Vk3FIythWGVVZAUMaBA9RLlgitVDg4tBlb1MwDzL6cmYf05doOXIAL3Qwyb4ZbpLDYEGFHYHi+kgL7yZqo4BmtvTLZ7jqc7XMTZmvLXU8oPX99pre4EuldAtAvWyGYnnMk7EyBT+dE2UA3YiwtxOElAZpUTm7gkdrehZNT9VZw87Txz0xloeQa0qC7XWzFPPru0D1aAp/WEC7qAT3QGUokKzIpzclCs3jDzveV3tV72ouYva3TgCO/5r+qUGp6ebMU1IINPdb60bnFkUl98fPuKISzNAZDrRz7iBTVtPUlFIEZ8hYpXL9gIOF9NhH1hGo3qAyHs8ONY8GtFQ3x96SvI3T+iv8odoXxAw== badele@badxps

0 commit comments

Comments
 (0)