first version

.gitignore

@@ -0,0 +1 @@
+result

config/arachnide/configuration.nix

@@ -0,0 +1,197 @@
+# Edit this configuration file to define what should be installed on
+# your system.  Help is available in the configuration.nix(5) man page
+# and in the NixOS manual (accessible by running ‘nixos-help’).
+
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  # Bootloader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking = {
+    hostName = "arachnide"; # Define your hostname.
+    # Pick only one of the below networking options.
+    # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+    # networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
+    interfaces.enp1s0.ipv4.addresses = [ {
+      address = "192.168.36.9";
+      prefixLength = 24;
+    } ];
+    interfaces.enp3s0.ipv4.addresses = [ {
+      address = "10.0.0.1";
+      prefixLength = 24;
+    } ];
+    defaultGateway = "192.168.36.1";
+    nameservers = [ "80.67.169.12" "80.67.169.40" "2001:910:800::12" "2001:910:800::40" ];
+    enableIPv6 = true;
+    wg-quick.interfaces = {
+      wg0 = {
+        address = [ "192.168.12.2/32" "2a01:4f9:1a:9a05::2/128" ];
+        dns = [ "80.67.169.12" "80.67.169.40" "2001:910:800::12" "2001:910:800::40" ];
+        privateKeyFile = "/etc/wireguard/private.key";
+
+        peers = [
+          {
+            publicKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w=";
+            allowedIPs = [ "0.0.0.0/0" "::/0" ];
+            endpoint = "vpn.lab12.fr:51812";
+            persistentKeepalive = 15;
+          }
+        ];
+      };
+    };
+  };
+
+  # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Enable networking using networkmanager
+  # networking.networkmanager.enable = true;
+
+
+
+  # Set your time zone.
+  time.timeZone = "Etc/UTC";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "fr_FR.UTF-8";
+
+  i18n.extraLocaleSettings = {
+    LC_ADDRESS = "fr_FR.UTF-8";
+    LC_IDENTIFICATION = "fr_FR.UTF-8";
+    LC_MEASUREMENT = "fr_FR.UTF-8";
+    LC_MONETARY = "fr_FR.UTF-8";
+    LC_NAME = "fr_FR.UTF-8";
+    LC_NUMERIC = "fr_FR.UTF-8";
+    LC_PAPER = "fr_FR.UTF-8";
+    LC_TELEPHONE = "fr_FR.UTF-8";
+    LC_TIME = "fr_FR.UTF-8";
+  };
+
+  # Configure keymap in X11
+  services.xserver.xkb = {
+    layout = "fr";
+    variant = "";
+  };
+
+  # Configure console keymap
+  console.keyMap = "fr";
+
+  # Define a user account. Don't forget to set a password with ‘passwd’.
+  users.users.douzeb = {
+    isNormalUser = true;
+    description = "douze baie";
+    extraGroups = [ "networkmanager" "wheel" ];
+    packages = with pkgs; [];
+  };
+
+  # Passwordless sudo for members of the wheel group
+  security.sudo.wheelNeedsPassword = false;
+
+  # Allow unfree packages
+  nixpkgs.config.allowUnfree = true;
+
+  environment.shellAliases = {
+    tm = "tmux new -A -s shared" ;
+    ll = "ls -al";
+  };
+
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+  #  vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.
+    git
+    wget
+    tmux
+    htop
+    memtester
+    # Useful podman development tools
+    #dive            # look into docker image layers
+    podman-tui      # status of containers in the terminal
+    #aardvark-dns
+    #docker-compose # start group of containers for dev
+    #podman-compose  # start group of containers for dev
+    mosh
+    dig
+    mtr
+  ];
+
+ programs.neovim = {
+    enable = true;
+    viAlias = true;
+    vimAlias = true;
+  };
+
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  services.openssh.ports = [ 144 ];
+  services.openssh.settings = {
+    PermitRootLogin = "no";
+    PasswordAuthentication = false;
+    KbdInteractiveAuthentication = false;
+  };
+
+  boot.kernel.sysctl = {
+    "net.ipv4.ip_forward" = 1;
+    "net.ipv6.conf.all.forwarding" = 1;
+  };
+
+  # Open ports in the firewall.
+  # networking.firewall.allowedTCPPorts = [ ... ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+  networking.firewall.allowedTCPPorts = [ 80 144 443 ];
+  networking.firewall.allowedUDPPorts = [ 53 ];
+  networking.firewall.allowedUDPPortRanges = [
+    { from = 60000; to = 61000; }
+  ];
+	
+  virtualisation.containers.enable = true;
+  virtualisation.podman = {
+    enable = true;
+
+    # Create a `docker` alias for podman, to use it as a drop-in replacement
+    dockerCompat = true;
+
+    # Required for containers under podman-compose to be able to talk to each other.
+    defaultNetwork.settings.dns_enabled = true;
+  };
+  #virtualisation.oci-containers.containers = {
+  #  nixos = {
+  #    image = "nix:latest"
+  #    extraOptions = [ "--network=host" ];
+  #  };
+  #};
+
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "24.05"; # Did you read the comment?
+
+}

config/arachnide/hardware-configuration.nix

@@ -0,0 +1,43 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "usbhid" "uas" "sd_mod" "sdhci_pci" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/cca324f9-16eb-47f3-b568-b83926921e44";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/1483-E7BA";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp4s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp5s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp6s0.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

config/dromadaire/configuration.nix

@@ -0,0 +1,224 @@
+# Edit this configuration file to define what should be installed on
+# your system. Help is available in the configuration.nix(5) man page, on
+# https://search.nixos.org/options and in the NixOS manual (`nixos-help`).
+
+{ config, lib, pkgs, ... }:
+
+{
+  imports =
+    [ # Include the results of the hardware scan.
+      ./hardware-configuration.nix
+    ];
+
+  hardware.sensor.hddtemp.enable = true;
+
+  # Use the systemd-boot EFI boot loader.
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.systemd-boot.configurationLimit = 7;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking = {
+    hostName = "dromadaire"; # Define your hostname.
+    # Pick only one of the below networking options.
+    # networking.wireless.enable = true;  # Enables wireless support via wpa_supplicant.
+    # networking.networkmanager.enable = true;  # Easiest to use and most distros use this by default.
+    interfaces.enp2s0.ipv4.addresses = [ {
+      address = "192.168.36.6";
+      prefixLength = 24;
+    } ];
+    defaultGateway = "192.168.36.1";
+    nameservers = [ "80.67.169.12" "80.67.169.40" "2001:910:800::12" "2001:910:800::40" ];
+    enableIPv6 = true;
+    wg-quick.interfaces = {
+      wg0 = {
+        address = [ "192.168.12.3/32" "2a01:4f9:1a:9a05::3/128" ];
+        dns = [ "80.67.169.12" "80.67.169.40" "2001:910:800::12" "2001:910:800::40" ];
+        privateKeyFile = "/etc/wireguard/private.key";
+
+        peers = [
+          {
+            publicKey = "cUmp55I20JEhxr+RMmOsX+6U9kcDiAq3grnvzjQ642w=";
+            allowedIPs = [ "0.0.0.0/0" "::/0" ];
+            endpoint = "vpn.lab12.fr:51812";
+            persistentKeepalive = 15;
+          }
+        ];
+      };
+    };
+  };
+
+  # Set your time zone.
+  time.timeZone = "Europe/Paris";
+
+  # Configure network proxy if necessary
+  # networking.proxy.default = "http://user:password@proxy:port/";
+  # networking.proxy.noProxy = "127.0.0.1,localhost,internal.domain";
+
+  # Select internationalisation properties.
+  i18n.defaultLocale = "en_US.UTF-8";
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "fr";
+    #useXkbConfig = true; # use xkb.options in tty.
+  };
+
+  # Enable the X11 windowing system.
+  # services.xserver.enable = true;
+
+
+  
+
+  # Configure keymap in X11
+  # services.xserver.xkb.layout = "us";
+  # services.xserver.xkb.options = "eurosign:e,caps:escape";
+
+  # Enable CUPS to print documents.
+  # services.printing.enable = true;
+
+  # Enable sound.
+  # hardware.pulseaudio.enable = true;
+  # OR
+  # services.pipewire = {
+  #   enable = true;
+  #   pulse.enable = true;
+  # };
+
+  # Enable touchpad support (enabled default in most desktopManager).
+  # services.libinput.enable = true;
+
+  # Define a user account. Don't forget to set a password with 'passwd'.
+  users.users.optisseur = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ]; # Enable 'sudo' for the user.
+    initialPassword = "Change Me!";
+  #   packages = with pkgs; [
+  #     firefox
+  #     tree
+  #   ];
+  };
+
+  environment.shellAliases = {
+    tm = "tmux new -A -s shared" ;
+    ll = "ls -al";
+  };
+
+
+  # List packages installed in system profile. To search, run:
+  # $ nix search wget
+  environment.systemPackages = with pkgs; [
+    git
+    wget
+    tmux
+    htop
+    memtester
+    # Useful podman development tools
+    #dive            # look into docker image layers
+    podman-tui      # status of containers in the terminal
+    #aardvark-dns
+    #docker-compose # start group of containers for dev
+    #podman-compose  # start group of containers for dev
+  ];
+
+
+  # Some programs need SUID wrappers, can be configured further or are
+  # started in user sessions.
+  
+  programs.neovim = {
+    enable = true;
+    viAlias = true;
+    vimAlias = true;
+  };
+
+  # programs.mtr.enable = true;
+  # programs.gnupg.agent = {
+  #   enable = true;
+  #   enableSSHSupport = true;
+  # };
+
+  # List services that you want to enable:
+
+  # Enable the OpenSSH daemon.
+  services.openssh.enable = true;
+  services.openssh.ports = [ 144 ];
+  services.openssh.settings = {
+    PermitRootLogin = "no";
+    PasswordAuthentication = false;
+    KbdInteractiveAuthentication = false;
+  };
+
+  virtualisation.containers.enable = true;
+  virtualisation.podman = {
+    enable = true;
+
+    # Create a `docker` alias for podman, to use it as a drop-in replacement
+    dockerCompat = true;
+
+    # Required for containers under podman-compose to be able to talk to each other.
+    defaultNetwork.settings.dns_enabled = true;
+  };
+  #virtualisation.oci-containers.containers = {
+  #  nixos = {
+  #    image = "nix:latest"
+  #    extraOptions = [ "--network=host" ];
+  #  };
+  #};
+    
+
+  services.gitea-actions-runner = {
+    package = pkgs.forgejo-runner;
+    instances.default = {
+      enable = false;
+      name = "dromadaire";
+      url = "https://git.distrilab.fr";
+      # Obtaining the path to the runner token file may differ
+      tokenFile = "/etc/forgejo/runner.token";
+      labels = [
+                 # provide a debian base with nodejs for actions
+                 "debian-latest:docker://node:20-bookworm"
+                 # fake the ubuntu name, because node provides no ubuntu builds
+                 "ubuntu-latest:docker://node:20-bookworm"
+                 # nixos
+                 "nixos:docker://nixos/nix:latest"
+                 # provide native execution on the host
+                 #"native:host"
+      ];
+    };    
+  };
+
+  # Open ports in the firewall.
+  networking.firewall.allowedTCPPorts = [ 80 144 443 ];
+  networking.firewall.interfaces.podman0.allowedUDPPorts = [ 53 ];
+  networking.firewall.interfaces.podman1.allowedUDPPorts = [ 53 ];
+  networking.firewall.interfaces.podman2.allowedUDPPorts = [ 53 ];
+  networking.firewall.interfaces.podman3.allowedUDPPorts = [ 53 ];
+  networking.firewall.interfaces.podman4.allowedUDPPorts = [ 53 ];
+  # networking.firewall.allowedUDPPorts = [ ... ];
+  # Or disable the firewall altogether.
+  # networking.firewall.enable = false;
+
+  # Copy the NixOS configuration file and link it from the resulting system
+  # (/run/current-system/configuration.nix). This is useful in case you
+  # accidentally delete configuration.nix.
+  # system.copySystemConfiguration = true;
+
+  # This option defines the first version of NixOS you have installed on this particular machine,
+  # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions.
+  #
+  # Most users should NEVER change this value after the initial install, for any reason,
+  # even if you've upgraded your system to a new NixOS release.
+  #
+  # This value does NOT affect the Nixpkgs version your packages and OS are pulled from,
+  # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how
+  # to actually do that.
+  #
+  # This value being lower than the current NixOS release does NOT mean your system is
+  # out of date, out of support, or vulnerable.
+  #
+  # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration,
+  # and migrated your data accordingly.
+  #
+  # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion .
+  system.stateVersion = "24.05"; # Did you read the comment?
+
+}
+

config/dromadaire/hardware-configuration.nix

@@ -0,0 +1,40 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/installer/scan/not-detected.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usbhid" "uas" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ "kvm-intel" ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/13091899-b70b-4d2d-904c-8c7a3024b60b";
+      fsType = "btrfs";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/8FFA-85D7";
+      fsType = "vfat";
+      options = [ "fmask=0077" "dmask=0077" ];
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp2s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.enp3s0.useDHCP = lib.mkDefault true;
+  # networking.interfaces.wlo1.useDHCP = lib.mkDefault true;
+
+  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

krops.nix

@@ -0,0 +1,44 @@
+let
+  krops = builtins.fetchGit {
+    url = "https://cgit.krebsco.de/krops/";
+  };
+  lib = import "${krops}/lib";
+  pkgs = import "${krops}/pkgs" {};
+
+  source = name: lib.evalSource [
+    {
+      config.file  = toString ./config/${name};
+      modules.file = toString ./modules;
+      nixos-config.symlink = "config/configuration.nix";
+      secrets.pass = {
+        dir  = toString ~/.password-store/nixin-password-store/krops;
+        name = "${name}";
+      };
+      nixpkgs.git = {
+        ref = "nixos-24.11";
+        url = https://github.com/NixOS/nixpkgs-channels;
+      };
+    }
+  ];
+
+  arachnide = pkgs.krops.writeDeploy "deploy-server-arachnide" {
+    source = source "arachnide";
+    target = lib.mkTarget "douzeb@192.168.36.9" // {
+      port = "144";
+      sudo = true;
+    };
+    # only build the configuration and do not activate it for now (could also use writeTest instead of writeDeploy for doing that)
+    operation = "build";
+  };
+
+  dromadaire = pkgs.krops.writeDeploy "deploy-server-dromadaire" {
+    source = source "dromadaire";
+    target = "root@192.168.36.6";
+  };
+
+in {
+  arachnide = arachnide;
+  dromadaire = dromadaire;
+  all = pkgs.writeScript "deploy-all-servers"
+    (lib.concatStringsSep "\n" [ arachnide dromadaire ]);
+}