tbarnouin/nixos-hypervisor
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Separate minimal configs

Browse source
This commit is contained in:
Théo Barnouin 2024-12-12 17:19:28 +01:00
parent d48bfa332c
commit 8aab61936f
5 changed files with 447 additions and 84 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
systems/default.nix
View file

@ -1,6 +0,0 @@
{ inputs, ... }:
{
imports = [
./microvm.nix
];
}

78
systems/microvm.nix
View file

@ -1,78 +0,0 @@
{ inputs, lib, config, microvm, ... }:
let
cfg = config.services.micro_vm;
in
{
options.services.micro_vm = {
enable = lib.mkEnableOption "Enable NixOS microvm config";
hostname = lib.mkOption {
type = lib.types.str;
description = "The VM hostname";
};
vm_ip = lib.mkOption {
type = lib.types.str;
description = "The VM IP address";
};
macAddr = lib.mkOption {
type = lib.types.str;
description = "The VM MAC Address";
};
vm_mem = lib.mkOption {
type = lib.types.int;
description = "The VM memory count";
default = 0;
};
vm_cpu = lib.mkOption {
type = lib.types.int;
description = "The VM CPU count";
default = 1;
};
};
config = lib.mkIf cfg.enable {
microvm = {
vcpu = cfg.vm_cpu;
balloonMem = cfg.vm_mem;
volumes = [
{
mountPoint = "/var";
image = "/var/lib/microvms/${cfg.hostname}/var.img";
size = 8192;
}
];
shares = [
{
proto = "virtiofs";
tag = "ro-store";
source = "/nix/store";
mountPoint = "/nix/.ro-store";
}
{
proto = "virtiofs";
tag = "${cfg.hostname}-env";
source = "/var/lib/microvms/${cfg.hostname}/env";
mountPoint = "/run/secrets/${cfg.hostname}";
}
];
interfaces = [ {
type = "tap";
id = "vm-${cfg.hostname}";
mac = "${cfg.macAddr}";
} ];
hypervisor = "qemu";
socket = "control.socket";
};
systemd.network.enable = true;
systemd.network.networks."20-lan" = {
matchConfig.Type = "ether";
networkConfig = {
Address = ["${cfg.vm_ip}/24"];
Gateway = "192.168.1.254";
DNS = ["192.168.1.254"];
IPv6AcceptRA = true;
DHCP = "no";
};
};
};
}

132
systems/minimalLXCConfig.nix Normal file
View file

@ -0,0 +1,132 @@
{ config, pkgs, lib, inputs, modulesPath, ... }:
{
nix = {
settings.experimental-features = [ "nix-command" "flakes" ];
settings.trusted-users = [ "root" "@wheel" ];
};
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 22 9002 ];
};
};
boot.isContainer = true;
proxmoxLXC = {
enable = true;
privileged = false;
manageNetwork = false;
manageHostName = false;
};
systemd.suppressedSystemUnits = [
"dev-mqueue.mount"
"sys-kernel-debug.mount"
"sys-fs-fuse-connections.mount"
];
time.timeZone = "Europe/Paris";
console.keyMap = "fr";
i18n.defaultLocale = "fr_FR.UTF-8";
environment.sessionVariables = rec {
TERM = "xterm-256color";
};
nix.gc = {
automatic = true;
dates = "daily";
options = "--delete-old";
};
security.sudo.wheelNeedsPassword = false;
users = {
users.tbarnouin = {
isNormalUser = true;
extraGroups = [ "wheel" ];
shell = pkgs.zsh;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxccGxdfOFXeEClqz3ULl94ubzaJnk4pUus+ek18G0B tbarnouin@nixos"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICf1B0nxNMvPWSR9pStdtx2x6Iw+JUeCCt1CKWoD8dsr"
];
};
users.root = {
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxccGxdfOFXeEClqz3ULl94ubzaJnk4pUus+ek18G0B tbarnouin@nixos"
];
};
};
programs = {
zsh = {
enable = true;
shellAliases = {
ll = "ls -l";
lla = "ls -lah";
};
ohMyZsh = {
enable = true;
plugins = [ "git" ];
theme = "bira";
};
};
tmux = {
enable = true;
};
};
nixpkgs.config.allowUnfree = true;
environment = {
localBinInPath = true;
systemPackages = with pkgs; [
vim
bash
wget
curl
git
htop
tree
dig
ncdu
nmap
iperf3
netcat-openbsd
];
};
services = {
openssh = {
enable = true;
settings.PasswordAuthentication = false;
settings.KbdInteractiveAuthentication = false;
settings.PermitRootLogin = "prohibit-password";
hostKeys = [
{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
];
};
fail2ban = {
enable = true;
};
rsyslogd = {
enable = true;
extraConfig = "*.*@192.168.1.27:514;RSYSLOG_SyslogProtocol23Format";
};
prometheus = {
exporters = {
node = {
enable = true;
enabledCollectors = [ "systemd" ];
port = 9002;
};
};
};
};
system = {
stateVersion = "24.05";
activationScripts.ensure-ssh-key-dir.text = "mkdir -p /etc/ssh";
};
}

195
systems/minimalMicrovmConfig.nix Normal file
View file

@ -0,0 +1,195 @@
{ config, pkgs, lib, inputs, modulesPath, microvm, ... }:
let
cfg = config.services.micro_vm;
in
{
options.services.micro_vm = {
enable = lib.mkEnableOption "Enable NixOS microvm config";
hostname = lib.mkOption {
type = lib.types.str;
description = "The VM hostname";
};
vm_ip = lib.mkOption {
type = lib.types.str;
description = "The VM IP address";
};
macAddr = lib.mkOption {
type = lib.types.str;
description = "The VM MAC Address";
};
vm_mem = lib.mkOption {
type = lib.types.int;
description = "The VM memory count";
default = 0;
};
vm_cpu = lib.mkOption {
type = lib.types.int;
description = "The VM CPU count";
default = 1;
};
};
config = lib.mkIf cfg.enable {
microvm = {
vcpu = cfg.vm_cpu;
balloonMem = cfg.vm_mem;
volumes = [
{
mountPoint = "/var";
image = "/var/lib/microvms/${cfg.hostname}/var.img";
size = 8192;
}
];
shares = [
{
proto = "virtiofs";
tag = "ro-store";
source = "/nix/store";
mountPoint = "/nix/.ro-store";
}
{
proto = "virtiofs";
tag = "${cfg.hostname}-env";
source = "/var/lib/microvms/${cfg.hostname}/env";
mountPoint = "/run/secrets/${cfg.hostname}";
}
];
interfaces = [ {
type = "tap";
id = "vm-${cfg.hostname}";
mac = "${cfg.macAddr}";
} ];
hypervisor = "qemu";
socket = "control.socket";
};
systemd.network.enable = true;
systemd.network.networks."20-lan" = {
matchConfig.Type = "ether";
networkConfig = {
Address = ["${cfg.vm_ip}/24"];
Gateway = "192.168.1.254";
DNS = ["192.168.1.254"];
IPv6AcceptRA = true;
DHCP = "no";
};
};
nix = {
settings.experimental-features = [ "nix-command" "flakes" ];
settings.trusted-users = [ "root" "@wheel" ];
};
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 22 9002 ];
};
};
time.timeZone = "Europe/Paris";
console.keyMap = "fr";
i18n.defaultLocale = "fr_FR.UTF-8";
environment.sessionVariables = rec {
TERM = "xterm-256color";
};
nix.gc = {
automatic = true;
dates = "daily";
options = "--delete-old";
};
security.sudo.wheelNeedsPassword = false;
users = {
users.tbarnouin = {
isNormalUser = true;
extraGroups = [ "wheel" ];
shell = pkgs.zsh;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxccGxdfOFXeEClqz3ULl94ubzaJnk4pUus+ek18G0B tbarnouin@nixos"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICf1B0nxNMvPWSR9pStdtx2x6Iw+JUeCCt1CKWoD8dsr"
];
};
users.root = {
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxccGxdfOFXeEClqz3ULl94ubzaJnk4pUus+ek18G0B tbarnouin@nixos"
];
};
};
programs = {
zsh = {
enable = true;
shellAliases = {
ll = "ls -l";
lla = "ls -lah";
};
ohMyZsh = {
enable = true;
plugins = [ "git" ];
theme = "bira";
};
};
tmux = {
enable = true;
};
};
nixpkgs.config.allowUnfree = true;
environment = {
localBinInPath = true;
systemPackages = with pkgs; [
vim
bash
wget
curl
git
htop
tree
dig
ncdu
nmap
iperf3
netcat-openbsd
];
};
services = {
openssh = {
enable = true;
settings.PasswordAuthentication = false;
settings.KbdInteractiveAuthentication = false;
settings.PermitRootLogin = "prohibit-password";
hostKeys = [
{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
];
};
fail2ban = {
enable = true;
};
rsyslogd = {
enable = true;
extraConfig = "*.*@192.168.1.27:514;RSYSLOG_SyslogProtocol23Format";
};
prometheus = {
exporters = {
node = {
enable = true;
enabledCollectors = [ "systemd" ];
port = 9002;
};
};
};
};
system = {
stateVersion = "24.05";
activationScripts.ensure-ssh-key-dir.text = "mkdir -p /etc/ssh";
};
};
}

120
systems/minimalVMConfig.nix Normal file
View file

@ -0,0 +1,120 @@
{ config, pkgs, lib, inputs, modulesPath, ... }:
{
nix = {
settings.experimental-features = [ "nix-command" "flakes" ];
settings.trusted-users = [ "root" "@wheel" ];
};
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 22 9002 ];
};
};
time.timeZone = "Europe/Paris";
console.keyMap = "fr";
i18n.defaultLocale = "fr_FR.UTF-8";
environment.sessionVariables = rec {
TERM = "xterm-256color";
};
nix.gc = {
automatic = true;
dates = "daily";
options = "--delete-old";
};
security.sudo.wheelNeedsPassword = false;
users = {
users.tbarnouin = {
isNormalUser = true;
extraGroups = [ "wheel" ];
shell = pkgs.zsh;
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxccGxdfOFXeEClqz3ULl94ubzaJnk4pUus+ek18G0B tbarnouin@nixos"
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICf1B0nxNMvPWSR9pStdtx2x6Iw+JUeCCt1CKWoD8dsr"
];
};
users.root = {
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAxccGxdfOFXeEClqz3ULl94ubzaJnk4pUus+ek18G0B tbarnouin@nixos"
];
};
};
programs = {
zsh = {
enable = true;
shellAliases = {
ll = "ls -l";
lla = "ls -lah";
};
ohMyZsh = {
enable = true;
plugins = [ "git" ];
theme = "bira";
};
};
tmux = {
enable = true;
};
};
nixpkgs.config.allowUnfree = true;
environment = {
localBinInPath = true;
systemPackages = with pkgs; [
vim
bash
wget
curl
git
htop
tree
dig
ncdu
nmap
iperf3
netcat-openbsd
];
};
services = {
cloud-init.network.enable = true;
openssh = {
enable = true;
settings.PasswordAuthentication = false;
settings.KbdInteractiveAuthentication = false;
settings.PermitRootLogin = "prohibit-password";
hostKeys = [
{
path = "/etc/ssh/ssh_host_ed25519_key";
type = "ed25519";
}
];
};
fail2ban = {
enable = true;
};
rsyslogd = {
enable = true;
extraConfig = "*.*@192.168.1.27:514;RSYSLOG_SyslogProtocol23Format";
};
prometheus = {
exporters = {
node = {
enable = true;
enabledCollectors = [ "systemd" ];
port = 9002;
};
};
};
};
system = {
stateVersion = "24.05";
activationScripts.ensure-ssh-key-dir.text = "mkdir -p /etc/ssh";
};
}