mirror of
https://gitlab.com/upRootNutrition/dotfiles.git
synced 2025-12-17 11:58:00 -06:00
test: added gel but haven't tested
This commit is contained in:
Nick
parent
8eb9ed31fc
commit
9a1707fb2d
11 changed files with 536 additions and 9 deletions
|
|
@ -73,6 +73,7 @@ let
|
|||
ip = stringType;
|
||||
subdomain = stringType;
|
||||
wireguard = stringType;
|
||||
instance = stringType;
|
||||
microvm = lib.mkOption {
|
||||
type = lib.types.submodule {
|
||||
options = {
|
||||
|
|
|
|||
41
modules/config/instances/config/gel.nix
Normal file
41
modules/config/instances/config/gel.nix
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
{ moduleFunctions }:
|
||||
let
|
||||
inherit (moduleFunctions.instancesFunctions) dummy;
|
||||
label = "Gel";
|
||||
name = "gel";
|
||||
in
|
||||
{
|
||||
label = label;
|
||||
name = name;
|
||||
tags = [
|
||||
dummy
|
||||
];
|
||||
ports = {
|
||||
};
|
||||
interfaces = {
|
||||
interface0 = {
|
||||
instance = "private";
|
||||
microvm = {
|
||||
id = "vm-gelpri";
|
||||
mac = "02:00:00:00:81:81";
|
||||
idUser = "vmuser-gelpri";
|
||||
macUser = "02:00:00:00:00:81";
|
||||
ip = "192.168.50.181";
|
||||
gate = "192.168.50.1";
|
||||
ssh = 2801;
|
||||
};
|
||||
};
|
||||
interface1 = {
|
||||
instance = "public";
|
||||
microvm = {
|
||||
id = "vm-gelpub";
|
||||
mac = "02:00:00:00:81:82";
|
||||
idUser = "vmuser-gelpub";
|
||||
macUser = "02:00:00:00:00:82";
|
||||
ip = "192.168.50.182";
|
||||
gate = "192.168.50.1";
|
||||
ssh = 2802;
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
287
modules/nixos/homelab/guests/gel/config/default.nix
Normal file
287
modules/nixos/homelab/guests/gel/config/default.nix
Normal file
|
|
@ -0,0 +1,287 @@
|
|||
{
|
||||
flake,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services.instances) gel;
|
||||
inherit (flake.inputs.gel.packages."x86_64-linux") gel-cli gel-server;
|
||||
inherit (flake.self.packages."x86_64-linux") tome;
|
||||
serviceCfg = gel;
|
||||
in
|
||||
{
|
||||
gelVM =
|
||||
{
|
||||
user,
|
||||
ip,
|
||||
mac,
|
||||
userMac,
|
||||
host,
|
||||
ssh,
|
||||
mnt,
|
||||
instance,
|
||||
}:
|
||||
{
|
||||
microvm.vms = {
|
||||
"${serviceCfg.name}-${user}" = {
|
||||
autostart = true;
|
||||
restartIfChanged = true;
|
||||
config = {
|
||||
system.stateVersion = "24.05";
|
||||
time.timeZone = "America/Winnipeg";
|
||||
users.users.root.openssh.authorizedKeys.keys = flake.config.people.users.${user0}.sshKeys;
|
||||
|
||||
environment.systemPackages = [
|
||||
gel-cli
|
||||
tome
|
||||
];
|
||||
|
||||
services = {
|
||||
openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = false;
|
||||
PermitRootLogin = "prohibit-password";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
users.users.gel = {
|
||||
isSystemUser = true;
|
||||
group = "gel";
|
||||
};
|
||||
users.groups.gel = { };
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
22
|
||||
serviceCfg.ports.port0
|
||||
];
|
||||
|
||||
systemd = {
|
||||
services = {
|
||||
gel-setup = {
|
||||
description = "Setup gel directories and schema";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
before = [ "gel.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
# copy bootstrap script
|
||||
mkdir -p /etc/gel
|
||||
cp /run/secrets/bootstrap.edgesql /etc/gel/bootstrap.edgesql
|
||||
chown gel:gel /etc/gel/bootstrap.edgesql
|
||||
chmod 400 /etc/gel/bootstrap.edgesql
|
||||
|
||||
# update schema files
|
||||
if [ -z "$(ls -A /var/lib/gel-schema)" ]; then
|
||||
# first boot: copy everything
|
||||
cp -r ${tome}/* /var/lib/gel-schema/
|
||||
else
|
||||
# subsequent boots: update config and schema files
|
||||
rm -f /var/lib/gel-schema/gel.toml
|
||||
cp ${tome}/gel.toml /var/lib/gel-schema/
|
||||
rm -f /var/lib/gel-schema/dbschema/*.gel
|
||||
cp ${tome}/dbschema/*.gel /var/lib/gel-schema/dbschema/
|
||||
fi
|
||||
|
||||
chmod -R u+w /var/lib/gel-schema
|
||||
chown -R gel:gel /var/lib/gel-schema
|
||||
'';
|
||||
};
|
||||
|
||||
gel = {
|
||||
description = "Gel database server";
|
||||
after = [
|
||||
"network.target"
|
||||
"run-secrets.mount"
|
||||
];
|
||||
requires = [
|
||||
"gel-setup.service"
|
||||
"run-secrets.mount"
|
||||
];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
ExecStartPre = ''
|
||||
${lib.getExe' gel-server "gel-server"} \
|
||||
--bootstrap-command-file=/etc/gel/bootstrap.edgesql \
|
||||
--bootstrap-only \
|
||||
--data-dir=/var/lib/${serviceCfg.name} \
|
||||
--instance-name=${instance}
|
||||
'';
|
||||
ExecStart = ''
|
||||
${lib.getExe' gel-server "gel-server"} \
|
||||
--admin-ui=enabled \
|
||||
--bind-address=${ip} \
|
||||
--data-dir=/var/lib/${serviceCfg.name} \
|
||||
--instance-name=${instance} \
|
||||
--security=insecure_dev_mode
|
||||
'';
|
||||
User = "gel";
|
||||
Group = "gel";
|
||||
Restart = "always";
|
||||
RestartSec = 5;
|
||||
TimeoutStartSec = 300;
|
||||
};
|
||||
};
|
||||
|
||||
gel-password-sync = {
|
||||
description = "Sync gel admin password";
|
||||
after = [ "gel.service" ];
|
||||
requires = [ "gel.service" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "gel";
|
||||
ExecStartPre =
|
||||
"+"
|
||||
+ pkgs.writeShellScript "copy-password" ''
|
||||
# copy password file to a location gel user can read
|
||||
cp /run/secrets/${user}-pass /etc/gel/admin_password
|
||||
chown gel:gel /etc/gel/admin_password
|
||||
chmod 400 /etc/gel/admin_password
|
||||
'';
|
||||
ExecStart = pkgs.writeShellScript "gel-password-sync" ''
|
||||
# wait for admin socket to be ready
|
||||
for i in {1..30}; do
|
||||
if [ -S /var/lib/${serviceCfg.name}/.s.GEL.admin.5656 ]; then
|
||||
break
|
||||
fi
|
||||
sleep 1
|
||||
done
|
||||
|
||||
${lib.getExe' gel-cli "gel"} \
|
||||
--admin \
|
||||
--unix-path /var/lib/${serviceCfg.name} \
|
||||
query "ALTER ROLE admin SET password := '$(cat /etc/gel/admin_password)'"
|
||||
'';
|
||||
ExecStartPost =
|
||||
"+"
|
||||
+ pkgs.writeShellScript "cleanup-password" ''
|
||||
rm -f /etc/gel/admin_password
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
gel-migrate = {
|
||||
description = "Run gel migrations";
|
||||
after = [ "gel-password-sync.service" ];
|
||||
requires = [ "gel-password-sync.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = pkgs.writeShellScript "gel-migrate" ''
|
||||
cd /var/lib/gel-schema
|
||||
cat /run/secrets/${user}-pass | ${lib.getExe' gel-cli "gel"} \
|
||||
--host ${ip} \
|
||||
--password-from-stdin \
|
||||
--tls-security insecure \
|
||||
--user admin \
|
||||
migration create --non-interactive
|
||||
cat /run/secrets/${user}-pass | ${lib.getExe' gel-cli "gel"} \
|
||||
--host ${ip} \
|
||||
--password-from-stdin \
|
||||
--tls-security insecure \
|
||||
--user admin \
|
||||
migrate
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
systemd-networkd.wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
|
||||
network = {
|
||||
enable = true;
|
||||
networks."20-lan" = {
|
||||
matchConfig.Name = "enp0s6";
|
||||
addresses = [ { Address = "${ip}/24"; } ];
|
||||
routes = [
|
||||
{
|
||||
Destination = "0.0.0.0/0";
|
||||
Gateway = "192.168.50.1";
|
||||
}
|
||||
];
|
||||
dns = [
|
||||
"1.1.1.1"
|
||||
"8.8.8.8"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
microvm = {
|
||||
vcpu = 2;
|
||||
mem = 1024 * 4;
|
||||
hypervisor = "qemu";
|
||||
interfaces = [
|
||||
{
|
||||
type = "tap";
|
||||
id = "vm-gel-${user}";
|
||||
mac = mac;
|
||||
}
|
||||
{
|
||||
type = "user";
|
||||
id = "vmuser-gel";
|
||||
mac = userMac;
|
||||
}
|
||||
];
|
||||
|
||||
forwardPorts = [
|
||||
{
|
||||
from = "host";
|
||||
host.port = ssh;
|
||||
guest.port = 22;
|
||||
}
|
||||
];
|
||||
|
||||
shares = [
|
||||
{
|
||||
mountPoint = "/nix/.ro-store";
|
||||
proto = "virtiofs";
|
||||
source = "/nix/store";
|
||||
tag = "read_only_nix_store";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/${serviceCfg.name}";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/${serviceCfg.name}";
|
||||
tag = "${serviceCfg.name}_${user}_data";
|
||||
}
|
||||
{
|
||||
mountPoint = "/var/lib/gel-schema";
|
||||
proto = "virtiofs";
|
||||
source = "${mnt}/gel-schema";
|
||||
tag = "${serviceCfg.name}_${user}_schema";
|
||||
}
|
||||
{
|
||||
mountPoint = "/run/secrets";
|
||||
proto = "virtiofs";
|
||||
source = "/run/secrets/${serviceCfg.name}";
|
||||
tag = "host_secrets";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${mnt}/${serviceCfg.name} 0751 microvm wheel - -"
|
||||
"d ${mnt}/gel-schema 0751 microvm wheel - -"
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
"${serviceCfg.name}/${user}-pass" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
"${serviceCfg.name}/bootstrap.edgesql" = {
|
||||
owner = "root";
|
||||
mode = "0600";
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
28
modules/nixos/homelab/guests/gel/gelPrivate/default.nix
Normal file
28
modules/nixos/homelab/guests/gel/gelPrivate/default.nix
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
{
|
||||
flake,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ../../../helpers.nix { inherit flake; }) labHelpers;
|
||||
inherit (labHelpers) mntPath;
|
||||
inherit (import ../config { inherit flake lib pkgs; }) gelVM;
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
|
||||
interfaceCfg = instances.gel.interfaces.interface0;
|
||||
|
||||
gelPrivate = gelVM {
|
||||
user = user0;
|
||||
ip = interfaceCfg.microvm.ip;
|
||||
mac = interfaceCfg.microvm.mac;
|
||||
userMac = interfaceCfg.microvm.macUser;
|
||||
ssh = interfaceCfg.microvm.ssh;
|
||||
mnt = mntPath;
|
||||
host = interfaceCfg.domain;
|
||||
instance = interfaceCfg.instance;
|
||||
};
|
||||
|
||||
in
|
||||
gelPrivate
|
||||
28
modules/nixos/homelab/guests/gel/gelPublic/default.nix
Normal file
28
modules/nixos/homelab/guests/gel/gelPublic/default.nix
Normal file
|
|
@ -0,0 +1,28 @@
|
|||
{
|
||||
flake,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (import ../../../helpers.nix { inherit flake; }) labHelpers;
|
||||
inherit (labHelpers) mntPath;
|
||||
inherit (import ../config { inherit flake lib pkgs; }) gelVM;
|
||||
inherit (flake.config.people) user0;
|
||||
inherit (flake.config.services) instances;
|
||||
|
||||
interfaceCfg = instances.gel.interfaces.interface1;
|
||||
|
||||
gelPublic = gelVM {
|
||||
user = user0;
|
||||
ip = interfaceCfg.microvm.ip;
|
||||
mac = interfaceCfg.microvm.mac;
|
||||
userMac = interfaceCfg.microvm.macUser;
|
||||
ssh = interfaceCfg.microvm.ssh;
|
||||
mnt = mntPath;
|
||||
host = interfaceCfg.domain;
|
||||
instance = interfaceCfg.istance;
|
||||
};
|
||||
|
||||
in
|
||||
gelPublic
|
||||
Loading…
Add table
Add a link
Reference in a new issue