Initial config framework

.gitignore

@@ -0,0 +1,2 @@
+result*
+/configuration.nix

README.md

@@ -0,0 +1,17 @@
+# Work In Progress!
+Notice, these things might be missing:
+- Functionality
+- Style
+- Safety
+
+### Build:
+- Build locally on another machine (verify)
+```
+nix --extra-experimental-features "nix-command flakes" build ".#nixosConfigurations.chapel.config.system.build.toplevel"
+```
+(replace "chapel" with the hostname)
+
+- Build, install and switch on the actual target
+```
+nixos-rebuild switch --update-input nixpkgs --update-input unstable --no-write-lock-file --refresh --flake github+felixalbrigtsen/nixos-server-conf.git --upgrade
+```

base.nix

@@ -0,0 +1,60 @@
+{ config, lib, pkgs, inputs, values, ... }:
+
+{
+
+  boot.loader.systemd-boot.enable = true;
+  boot.loader.efi.canTouchEfiVariables = true;
+
+  networking = {
+    domain = "home.feal.no";
+    useDHCP = false;
+  };
+
+  time.timeZone = "Europe/Oslo";
+  i18n.defaultLocale = "en_US.UTF-8";
+
+  console = {
+    font = "Lat2-Terminus16";
+    keyMap = "no";
+  };
+
+  system.autoUpgrade = {
+    enable = true;
+    flake = "github:felixalbrigtsen/nixos-server-conf";
+    flags = [
+      "--update-input" "nixpkgs"
+      "--update-input" "unstable"
+      "--no-write-lock-file"
+    ];
+  };
+
+  nix = {
+    gc = {
+      automatic = true;
+      options = "--delete-older-than 2d";
+    };
+
+    settings.experimental-features = ["nix-command" "flakes"];
+
+    registry= {
+      nixpkgs.flake = inputs.nixpkgs;
+    };
+
+    nixPath = [ "nixpkgs=${inputs.nixpkgs}" ];
+  };
+
+  services.openssh = {
+    enable = true;
+    permitRootLogin = "no";
+    passwordAuthentication = false;
+  };
+
+  users.users.felixalb = {
+    isNormalUser = true;
+    extraGroups = [ "wheel" ];
+    openssh.authorizedKeys.keys = [
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDKzPICGew7uN0cmvRmbwkwTCodTBUgEhkoftQnZuO4Q felixalbrigtsen@gmail.com"
+      "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHkLmJIkBM6AMbYM/hYm27Flgya81UiGqh9/owYWmrbZ home.feal.no"
+    ];
+  };
+}

flake.lock

@@ -0,0 +1,95 @@
+{
+  "nodes": {
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1674091526,
+        "narHash": "sha256-eLhLKOpF1ix5xZeFF9g8uE1stdyxuBLJvWQ20gLbDto=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "fc5b90fd72177d9bcf435b10c12bb943549748c6",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-22.11-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs-stable": {
+      "locked": {
+        "lastModified": 1673740915,
+        "narHash": "sha256-MMH8zONfqahgHly3K8/A++X34800rajA/XgZ2DzNL/M=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "7c65528c3f8462b902e09d1ccca23bb9034665c2",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "release-22.11",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "nixpkgs_2": {
+      "locked": {
+        "lastModified": 1673606088,
+        "narHash": "sha256-wdYD41UwNwPhTdMaG0AIe7fE1bAdyHe6bB4HLUqUvck=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "37b97ae3dd714de9a17923d004a2c5b5543dfa6d",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixpkgs-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "nixpkgs": "nixpkgs",
+        "sops-nix": "sops-nix",
+        "unstable": "unstable"
+      }
+    },
+    "sops-nix": {
+      "inputs": {
+        "nixpkgs": "nixpkgs_2",
+        "nixpkgs-stable": "nixpkgs-stable"
+      },
+      "locked": {
+        "lastModified": 1673752321,
+        "narHash": "sha256-EFfXY1ZHJq4FNaNQA9x0djtu/jiOhBbT0Xi+BT06cJw=",
+        "owner": "Mic92",
+        "repo": "sops-nix",
+        "rev": "e18eefd2b133a58309475298052c341c08470717",
+        "type": "github"
+      },
+      "original": {
+        "id": "sops-nix",
+        "type": "indirect"
+      }
+    },
+    "unstable": {
+      "locked": {
+        "lastModified": 1674101896,
+        "narHash": "sha256-xWLaexT6IHhOJru54wrOMeBbkKeJzOZ4Pqrxctf82q0=",
+        "owner": "NixOS",
+        "repo": "nixpkgs",
+        "rev": "a841e262264e48722dccc8469f066068146e406b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "NixOS",
+        "ref": "nixos-unstable-small",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}

flake.nix

@@ -0,0 +1,29 @@
+{
+  description = "Felixalb System flake";
+
+  inputs = {
+    nixpkgs.url = "github:NixOS/nixpkgs/nixos-22.11-small";
+    unstable.url = "github:NixOS/nixpkgs/nixos-unstable-small";
+
+    # sops-nix.url = "github:Mic92/sops-nix";
+    # sops-nix.inputs.nixpkgs.follows = "nixpkgs";
+  };
+
+  outputs = { self, nixpkgs, unstable, sops-nix, ... }@inputs:
+    let
+      system = "x86_64-linux";
+    in
+    {
+      nixosConfigurations = {
+        chapel = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          specialArgs = {
+            inherit inputs;
+          };
+          modules = [
+            ./hosts/chapel/configuration.nix
+          ];
+        };
+      };
+    };
+}

hosts/chapel/configuration.nix

@@ -0,0 +1,82 @@
+{ config, pkgs, ... }:
+
+{
+  imports =
+    [
+      ../../base.nix
+      ./hardware-configuration.nix
+      ./services/nginx.nix
+      ./services/metrics
+      ./services/cloudflared.nix
+    ];
+
+  networking = {
+    hostName = "chapel";
+    defaultGateway = "192.168.10.1";
+    nameservers = [ "192.168.10.1" ];
+    interfaces.eth0.ipv4 = {
+      addresses = [
+        { address = "192.168.10.100"; prefixLength = 24; }
+      ];
+    };
+  };
+
+  environment.variables = { EDITOR = "vim"; };
+  environment.systemPackages = with pkgs; [
+    ((vim_configurable.override {  }).customize{
+       name = "vim";
+       vimrcConfig.packages.myplugins = with pkgs.vimPlugins; {
+       start = [ vim-nix vim-lastplace ];
+       opt = [];
+     };
+     vimrcConfig.customRC = ''
+     " your custom vimrc
+     set number
+     set relativenumber
+     set nu rnu
+     set signcolumn=number
+
+     set hlsearch
+     set smartcase
+     set incsearch
+
+     set autoindent
+     set expandtab
+     set shiftwidth=2
+     set tabstop=2
+     set smartindent
+     set smarttab
+
+     set ruler
+
+     set undolevels=1000
+
+     set nocompatible
+     set backspace=indent,eol,start
+     " Turn on syntax highlighting by default
+     syntax on
+     " ...
+     '';
+    }
+  )
+    wget
+    git
+    tree
+    rsync
+    bottom
+  ];
+
+  networking.firewall.allowedTCPPorts = [ 80 22 3100 ];
+
+  system.copySystemConfiguration = true;
+
+  # This value determines the NixOS release from which the default
+  # settings for stateful data, like file locations and database versions
+  # on your system were taken. It‘s perfectly fine and recommended to leave
+  # this value at the release version of the first install of this system.
+  # Before changing this value read the documentation for this option
+  # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
+  system.stateVersion = "22.05"; # Did you read the comment?
+
+}
+

hosts/chapel/hardware-configuration.nix

@@ -0,0 +1,36 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/f7086b7c-581e-40d4-90c0-47cb767395c7";
+      fsType = "ext4";
+    };
+
+  fileSystems."/boot" =
+    { device = "/dev/disk/by-uuid/4303-A70F";
+      fsType = "vfat";
+    };
+
+  swapDevices = [ ];
+
+  # Enables DHCP on each ethernet and wireless interface. In case of scripted networking
+  # (the default) this is the recommended approach. When using systemd-networkd it's
+  # still possible to use this option, but it's recommended to use it in conjunction
+  # with explicit per-interface declarations with `networking.interfaces.<interface>.useDHCP`.
+  networking.useDHCP = lib.mkDefault true;
+  # networking.interfaces.ens18.useDHCP = lib.mkDefault true;
+
+  hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;
+}

hosts/chapel/services/cloudflared.nix

@@ -0,0 +1,24 @@
+{ config, pkgs, ... }:
+
+{
+  users.users.cloudflared = {
+    group = "cloudflared";
+    isSystemUser = true;
+  };
+  users.groups.cloudflared = { };
+
+  environment.systemPackages = [
+    pkgs.cloudflared
+  ];
+
+  systemd.services.cloudflared_tunnel = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    serviceConfig = {
+      ExecStart = "${pkgs.cloudflared}/bin/cloudflared tunnel --no-autoupdate run --token=TODO_FIXSECRETS";
+      Restart = "always";
+      User = "cloudflared";
+      Group = "cloudflared";
+    };
+  };
+}

hosts/chapel/services/metrics/default.nix

@@ -0,0 +1,10 @@
+{ config, pkgs, ... }:
+
+{
+  imports = [
+    ./prometheus.nix
+    ./grafana.nix
+    ./loki.nix
+    ./snmp-exporter.nix
+  ];
+}

hosts/chapel/services/metrics/grafana.nix

@@ -0,0 +1,64 @@
+{ config, pkgs, ... }:
+
+let
+  cfg = config.services.grafana;
+in {
+  services.grafana = {
+    enable = true;
+    settings.server = {
+      domain = "grafana.feal.no";
+      http_port = 2342;
+      http_addr = "127.0.0.1";
+    };
+
+    provision = {
+      enable = true;
+      datasources.settings.datasources = [
+        {
+          name = "Prometheus";
+          type = "prometheus";
+          url = ("http://${config.services.prometheus.listenAddress}:${toString config.services.prometheus.port}");
+         isDefault = true;
+        }
+        {
+          name = "Loki";
+          type = "loki";
+          url = ("http://${config.services.loki.configuration.server.http_listen_address}:${toString config.services.loki.configuration.server.http_listen_port}");
+        }
+      ];
+      dashboards.settings.providers = [
+        {
+          name = "Node Exporter Full";
+          type = "file";
+          url = "https://grafana.com/api/dashboards/1860/revisions/29/download";
+          options.path = dashboards/node-exporter-full.json;
+        }
+        {
+          name = "Synology NAS Details";
+          type = "file";
+          url = "https://grafana.com/api/dashboards/14284/revisions/9/download";
+          options.path = dashboards/synology-nas-details.json;
+        }
+        {
+          name = "OpenWRT";
+          type = "file";
+          url = "https://grafana.com/api/dashboards/11147/revisions/1/download";
+          options.path = dashboards/openwrt.json;
+        }
+      ];
+    };
+  };
+
+  services.nginx.virtualHosts.${cfg.settings.server.domain} = {
+    locations = {
+      "/" = {
+        proxyPass = "http://127.0.0.1:${toString cfg.settings.server.http_port}";
+        proxyWebsockets = true;
+        extraConfig = ''
+          proxy_buffers 8 1024k;
+          proxy_buffer_size 1024k;
+        '';
+      };
+    };
+  };
+}

hosts/chapel/services/metrics/loki.nix

@@ -0,0 +1,75 @@
+{ config, pkgs, ... }:
+
+let
+  cfg = config.services.loki;
+in {
+  services.loki = {
+    enable = true;
+    configuration = {
+      auth_enabled = false;
+      server = {
+        http_listen_port = 3100;
+        http_listen_address = "0.0.0.0";
+        grpc_listen_port = 9096;
+      };
+
+      ingester = {
+        wal = {
+          enabled = true;
+          dir = "/var/lib/loki/wal";
+        };
+        lifecycler = {
+          address = "127.0.0.1";
+          ring = {
+            kvstore = {
+              store = "inmemory";
+            };
+            replication_factor = 1;
+          };
+          final_sleep = "0s";
+        };
+        chunk_idle_period = "1h";
+      };
+
+      schema_config = {
+        configs = [
+          {
+            from = "2022-12-01";
+            store = "boltdb-shipper";
+            object_store = "filesystem";
+            schema = "v11";
+            index = {
+              prefix = "index_";
+              period = "24h";
+            };
+          }
+        ];
+      };
+
+      storage_config = {
+        boltdb_shipper = {
+          active_index_directory = "/var/lib/loki/boltdb-shipper-index";
+          cache_location = "/var/lib/loki/boltdb-shipper-cache";
+          shared_store = "filesystem";
+          cache_ttl = "24h";
+        };
+        filesystem = {
+          directory = "/var/lib/loki/chunks";
+        };
+      };
+
+      limits_config = {
+        enforce_metric_name = false;
+        reject_old_samples = true;
+        reject_old_samples_max_age = "72h";
+      };
+
+      compactor = {
+        working_directory = "/var/lib/loki/compactor";
+        shared_store = "filesystem";
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ cfg.configuration.server.http_listen_port ];
+}

hosts/chapel/services/metrics/prometheus.nix

@@ -0,0 +1,60 @@
+{ config, pkgs, ... }:
+
+let
+  cfg = config.services.prometheus;
+in {
+  services.prometheus = {
+    enable = true;
+    listenAddress = "127.0.0.1";
+    port = 9001;
+
+    scrapeConfigs = [
+      {
+        job_name = "node";
+        static_configs = [
+          {
+            targets = [
+              "chapel.home.feal.no:${toString cfg.exporters.node.port}"
+              "sulu.home.feal.no:9100"
+              "mccoy.home.feal.no:9100"
+              "borg.home.feal.no:9100"
+              "troi.home.feal.no:9100"
+              "dlink-feal.home.feal.no:9100"
+            ];
+          }
+        ];
+      }
+      {
+        job_name = "openwrt";
+        static_configs = [
+          { targets = ["dlink-feal.home.feal.no:9100"]; }
+        ];
+      }
+      {
+        job_name = "snmp";
+        static_configs = [{
+          targets = [
+            "feal-syn1.home.feal.no"
+            "feal-syn2.home.feal.no"
+          ];
+        }];
+        metrics_path = "/snmp";
+        params.module = ["synology"];
+        relabel_configs = [
+          {
+            source_labels = ["__address__"];
+            target_label = "__param_target";
+          }
+          {
+            source_labels = ["__param_target"];
+            target_label = "instance";
+          }
+          {
+            target_label = "__address__";
+            replacement = "127.0.0.1:9116";
+          }
+        ];
+      }
+    ];
+  };
+}

hosts/chapel/services/metrics/snmp-exporter.nix

@@ -0,0 +1,20 @@
+{ config, pkgs, ... }:
+
+{
+  environment.systemPackages = [
+    pkgs.prometheus-snmp-exporter
+  ];
+
+  systemd.services.prometheus-snmp-exporter = {
+    enable = true;
+    description = "Gather data from SNMP devices and expose them as Prometheus metrics";
+    unitConfig = {
+      Type = "simple";
+    };
+    serviceConfig = {
+      ExecStart = "${pkgs.prometheus-snmp-exporter}/bin/snmp_exporter --config.file='/var/prometheus/snmp.yml'";
+      # TODO: Fix this conf file!
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+}

hosts/chapel/services/nginx.nix

@@ -0,0 +1,11 @@
+{ config, pkgs, ... }:
+
+{
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+  };
+}