mirror of
https://gitlab.com/upRootNutrition/dotfiles.git
synced 2025-12-07 13:32:15 -06:00
test: trying to get microVMs to work
This commit is contained in:
Nick
parent
0c4173ceaf
commit
2582d3cec9
9 changed files with 539 additions and 417 deletions
|
|
@ -16,170 +16,191 @@ let
|
|||
dns0Path = "dns/${dns0}";
|
||||
in
|
||||
{
|
||||
microvm.vms.${serviceCfg.name} = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
firefly-iii = {
|
||||
enable = true;
|
||||
dataDir = serviceCfg.varPaths.path0;
|
||||
enableNginx = false;
|
||||
poolConfig = {
|
||||
"listen.owner" = config.services.caddy.user;
|
||||
"pm" = "dynamic";
|
||||
"pm.max_children" = 32;
|
||||
"pm.start_servers" = 2;
|
||||
"pm.min_spare_servers" = 2;
|
||||
"pm.max_spare_servers" = 4;
|
||||
"pm.max_requests" = 500;
|
||||
microvm.vms = {
|
||||
${serviceCfg.name} = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
services = {
|
||||
firefly-iii = {
|
||||
enable = true;
|
||||
# dataDir = serviceCfg.varPaths.path0;
|
||||
enableNginx = false;
|
||||
poolConfig = {
|
||||
"listen.owner" = config.services.caddy.user;
|
||||
"pm" = "dynamic";
|
||||
"pm.max_children" = 32;
|
||||
"pm.start_servers" = 2;
|
||||
"pm.min_spare_servers" = 2;
|
||||
"pm.max_spare_servers" = 4;
|
||||
"pm.max_requests" = 500;
|
||||
};
|
||||
settings = {
|
||||
APP_URL = "https://${host}";
|
||||
APP_KEY_FILE = "/run/secrets/pass";
|
||||
# DB_PASSWORD_FILE = "/run/secrets/data";
|
||||
# DB_CONNECTION = "pgsql";
|
||||
# DB_HOST = "db";
|
||||
# DB_DATABASE = "firefly";
|
||||
# DB_USERNAME = "firefly";
|
||||
MAIL_MAILER = smtpCfg.name;
|
||||
MAIL_HOST = smtpCfg.hostname;
|
||||
MAIL_PORT = smtpCfg.ports.port0;
|
||||
MAIL_FROM = smtpCfg.email.address0;
|
||||
MAIL_USERNAME = smtpCfg.email.address0;
|
||||
MAIL_PASSWORD_FILE = "/run/secrets/smtp";
|
||||
MAIL_ENCRYPTION = "tls";
|
||||
SITE_OWNER = email.address2;
|
||||
};
|
||||
};
|
||||
settings = {
|
||||
APP_URL = "https://${host}";
|
||||
APP_KEY_FILE = "/run/secrets/pass";
|
||||
DB_PASSWORD_FILE = "/run/secrets/data";
|
||||
DB_CONNECTION = "pgsql";
|
||||
DB_HOST = "db";
|
||||
DB_DATABASE = "firefly";
|
||||
DB_USERNAME = "firefly";
|
||||
MAIL_MAILER = smtpCfg.name;
|
||||
MAIL_HOST = smtpCfg.hostname;
|
||||
MAIL_PORT = smtpCfg.ports.port0;
|
||||
MAIL_FROM = smtpCfg.email.address0;
|
||||
MAIL_USERNAME = smtpCfg.email.address0;
|
||||
MAIL_PASSWORD_FILE = "/run/secrets/smtp";
|
||||
MAIL_ENCRYPTION = "tls";
|
||||
SITE_OWNER = email.address2;
|
||||
|
||||
firefly-iii-data-importer = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
caddy = {
|
||||
enable = true;
|
||||
virtualHosts."${serviceCfg.interface.ip}" = {
|
||||
extraConfig = ''
|
||||
root * ${config.services.firefly-iii.package}/public
|
||||
|
||||
file_server
|
||||
|
||||
encode gzip
|
||||
|
||||
php_fastcgi unix//run/phpfpm/firefly-iii.sock
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
# postgresql = {
|
||||
# enable = true;
|
||||
# ensureDatabases = [ "firefly" ];
|
||||
# ensureUsers = [
|
||||
# {
|
||||
# name = "firefly";
|
||||
# ensureDBOwnership = true;
|
||||
# }
|
||||
# ];
|
||||
# };
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
firefly-iii-data-importer = {
|
||||
enable = true;
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
80
|
||||
serviceCfg.ports.port0
|
||||
serviceCfg.ports.port1
|
||||
];
|
||||
|
||||
caddy = {
|
||||
enable = true;
|
||||
virtualHosts."${serviceCfg.interface.ip}" = {
|
||||
extraConfig = ''
|
||||
root * ${config.services.firefly-iii.package}/public
|
||||
|
||||
file_server
|
||||
|
||||
encode gzip
|
||||
|
||||
php_fastcgi unix//run/phpfpm/firefly-iii.sock
|
||||
'';
|
||||
systemd = {
|
||||
services = {
|
||||
fix-secrets-permissions = {
|
||||
description = "Fix secrets permissions for firefly-iii";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
before = [
|
||||
"firefly-iii-setup.service"
|
||||
"phpfpm-firefly-iii.service"
|
||||
];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
chown root:firefly-iii /run/secrets/pass
|
||||
chown root:firefly-iii /run/secrets/smtp
|
||||
chmod 0640 /run/secrets/pass
|
||||
chmod 0640 /run/secrets/smtp
|
||||
'';
|
||||
};
|
||||
systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [
|
||||
{ Address = "${serviceCfg.interface.ip}/24"; }
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Destination = "${hostCfg.localhost.address1}/0";
|
||||
Gateway = serviceCfg.interface.gate;
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
enable = true;
|
||||
ensureDatabases = [ "firefly" ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "firefly";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
tmpfiles.rules = [
|
||||
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
];
|
||||
};
|
||||
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
microvm = {
|
||||
vcpu = 2;
|
||||
mem = 3072;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = serviceCfg.interface.id;
|
||||
mac = serviceCfg.interface.mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = serviceCfg.interface.idUser;
|
||||
mac = serviceCfg.interface.macUser;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = serviceCfg.interface.ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${serviceCfg.mntPaths.path0}";
|
||||
tag = "${serviceCfg.name}_data";
|
||||
}
|
||||
# {
|
||||
# mountPoint = "/var/lib/postgresql";
|
||||
# proto = "virtiofs";
|
||||
# source = "${serviceCfg.mntPaths.path0}/database";
|
||||
# tag = "${serviceCfg.name}_database";
|
||||
# }
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
80
|
||||
serviceCfg.ports.port0
|
||||
serviceCfg.ports.port1
|
||||
];
|
||||
systemd = {
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s5";
|
||||
addresses = [
|
||||
{ Address = "${serviceCfg.interface.ip}/24"; }
|
||||
];
|
||||
routes = [
|
||||
{
|
||||
Destination = "${hostCfg.localhost.address1}/0";
|
||||
Gateway = serviceCfg.interface.gate;
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
tmpfiles.rules = [
|
||||
"Z ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
# "Z ${serviceCfg.secretPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
|
||||
"Z /var/lib/postgresql 755 postgres postgres -"
|
||||
];
|
||||
};
|
||||
|
||||
systemd.services.systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
microvm = {
|
||||
vcpu = 2;
|
||||
mem = 3072;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = serviceCfg.interface.id;
|
||||
mac = serviceCfg.interface.mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = serviceCfg.interface.idUser;
|
||||
mac = serviceCfg.interface.macUser;
|
||||
}
|
||||
];
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = serviceCfg.interface.ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${serviceCfg.mntPaths.path0}/data";
|
||||
tag = "${serviceCfg.name}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/postgresql";
|
||||
proto = "virtiofs";
|
||||
source = "${serviceCfg.mntPaths.path0}/database";
|
||||
tag = "${serviceCfg.name}_database";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -193,6 +214,8 @@ in
|
|||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
|
||||
# "d ${serviceCfg.mntPaths.path0}/data 0751 microvm wheel - -"
|
||||
# "d ${serviceCfg.mntPaths.path0}/database 0751 microvm wheel - -"
|
||||
];
|
||||
|
||||
sops = {
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue