From 36e82ba24b9a2055874cbed67f903475459f1c78 Mon Sep 17 00:00:00 2001 From: Alexander Szczepanski Date: Fri, 22 Nov 2024 09:37:11 +0100 Subject: [PATCH] vps-arm-2024-11-22-09-37-11 --- configs/docker.nix | 2 +- flake.nix | 2 + machine/vps-arm/configuration.nix | 131 ++++++++++++++++++--- machine/vps-arm/hardware-configuration.nix | 39 +++++- services/nextcloud.nix | 2 +- 5 files changed, 154 insertions(+), 22 deletions(-) diff --git a/configs/docker.nix b/configs/docker.nix index 920534d..37d3f4d 100755 --- a/configs/docker.nix +++ b/configs/docker.nix @@ -8,7 +8,7 @@ docker = { enable = true; extraOptions = "--metrics-addr='127.0.0.1:9323' --experimental"; - # storageDriver = "btrfs"; + storageDriver = "btrfs"; }; }; diff --git a/flake.nix b/flake.nix index 910b949..0616971 100644 --- a/flake.nix +++ b/flake.nix @@ -95,6 +95,8 @@ system = "aarch64-linux"; specialArgs = {inherit inputs outputs;}; modules = [ + impermanence.nixosModules.impermanence + inputs.sops-nix.nixosModules.sops ./machine/vps-arm/configuration.nix ]; }; diff --git a/machine/vps-arm/configuration.nix b/machine/vps-arm/configuration.nix index 0a9a1c3..9bd0305 100755 --- a/machine/vps-arm/configuration.nix +++ b/machine/vps-arm/configuration.nix @@ -22,7 +22,6 @@ in { imports = [ ./hardware-configuration.nix - inputs.sops-nix.nixosModules.sops ../../configs/common.nix ../../configs/docker.nix ../../configs/user.nix @@ -31,7 +30,7 @@ in { ../../services/frigate.nix ../../services/gitea.nix ../../services/nextcloud.nix - ../../services/rustdesk-server.nix + # ../../services/rustdesk-server.nix ../../services/uptime-kuma.nix ../../services/headscale.nix ../../services/goaccess.nix @@ -41,8 +40,8 @@ in { defaultSopsFile = ../../secrets-vps-arm.yaml; validateSopsFiles = true; age = { - sshKeyPaths = ["/etc/ssh/ssh_host_ed25519_key"]; - keyFile = "/var/lib/sops-nix/key.txt"; + sshKeyPaths = ["/persist/etc/ssh/ssh_host_ed25519_key"]; + keyFile = "/persist/var/lib/sops-nix/key.txt"; generateKey = true; }; @@ -79,9 +78,82 @@ in { }; }; - boot.loader = { - systemd-boot.enable = true; - efi.canTouchEfiVariables = true; + boot = { + loader = { + efi.canTouchEfiVariables = true; + grub = { + enable = true; + device = "nodev"; + efiSupport = true; + enableCryptodisk = true; + }; + }; + + kernelPackages = pkgs.linuxPackages_latest; + supportedFilesystems = ["btrfs"]; + kernelParams = ["ip=dhcp"]; + initrd = { + availableKernelModules = ["virtio-pci"]; + systemd.users.root.shell = "/bin/cryptsetup-askpass"; + network = { + enable = true; + ssh = { + enable = true; + port = 22; + authorizedKeys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOYEaT0gH9yJM2Al0B+VGXdZB/b2qjZK7n01Weq0TcmQ alex@framework" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN99h5reZdz9+DOyTRh8bPYWO+Dtv7TbkLbMdvi+Beio alex@desktop" + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIkURF5v9vRyEPhsK80kUgYh1vsS0APL4XyH4F3Fpyic alex@macbook" + ]; + hostKeys = ["/persist/pre_boot_ssh_key"]; + }; + }; + luks.devices = { + root = { + device = "/dev/disk/by-uuid/d17f6d8b-aec8-4c48-834d-f88d6308e281"; + preLVM = true; + }; + }; + + postDeviceCommands = pkgs.lib.mkBefore '' + mkdir -p /mnt + + # We first mount the btrfs root to /mnt + # so we can manipulate btrfs subvolumes. + mount -o subvol=/ /dev/mapper/lvm-root /mnt + + # While we're tempted to just delete /root and create + # a new snapshot from /root-blank, /root is already + # populated at this point with a number of subvolumes, + # which makes `btrfs subvolume delete` fail. + # So, we remove them first. + # + # /root contains subvolumes: + # - /root/var/lib/portables + # - /root/var/lib/machines + # + # I suspect these are related to systemd-nspawn, but + # since I don't use it I'm not 100% sure. + # Anyhow, deleting these subvolumes hasn't resulted + # in any issues so far, except for fairly + # benign-looking errors from systemd-tmpfiles. + btrfs subvolume list -o /mnt/root | + cut -f9 -d' ' | + while read subvolume; do + echo "deleting /$subvolume subvolume..." + btrfs subvolume delete "/mnt/$subvolume" + done && + echo "deleting /root subvolume..." && + btrfs subvolume delete /mnt/root + + echo "restoring blank /root subvolume..." + btrfs subvolume snapshot /mnt/root-blank /mnt/root + + # Once we're done rolling back to a blank snapshot, + # we can unmount /mnt and continue on the boot process. + umount /mnt + ''; + }; }; time.timeZone = "Europe/Berlin"; @@ -121,12 +193,41 @@ in { }; }; - environment.systemPackages = with pkgs; [ - goaccess - xd - nyx - headscale - ]; + environment = { + systemPackages = with pkgs; [ + goaccess + xd + nyx + headscale + ]; + persistence."/persist" = { + directories = [ + "/var/lib/acme" + # "/var/lib/docker" + "/var/lib/fail2ban" + "/var/lib/frigate" + "/var/lib/gitea" + "/var/lib/headscale" + "/var/lib/nextcloud" + "/var/lib/nixos" + "/var/lib/postgresql" + "/var/lib/private" + "/var/lib/redis-nextcloud" + "/var/lib/tailscale" + "/var/lib/tuptime" + "/var/lib/vnstat" + "/var/www" + ]; + files = [ + "/etc/machine-id" + "/etc/NIXOS" + "/etc/ssh/ssh_host_ed25519_key" + "/etc/ssh/ssh_host_ed25519_key.pub" + "/etc/ssh/ssh_host_rsa_key" + "/etc/ssh/ssh_host_rsa_key.pub" + ]; + }; + }; programs = { mtr.enable = true; @@ -218,7 +319,7 @@ in { }; extraCreateArgs = "--stats --verbose --checkpoint-interval 600 --exclude-caches"; environment.BORG_RSH = "ssh -i /home/alex/.ssh/id_borg_rsa"; - paths = ["/home/alex" "/var/lib"]; + paths = ["/home/alex" "/persist"]; repo = "ssh://u278697-sub3@u278697.your-storagebox.de:23/./borg-arm"; startAt = "daily"; prune.keep = { @@ -234,5 +335,5 @@ in { }; }; - system.stateVersion = "24.05"; + system.stateVersion = "25.05"; } diff --git a/machine/vps-arm/hardware-configuration.nix b/machine/vps-arm/hardware-configuration.nix index 32989fe..8145906 100644 --- a/machine/vps-arm/hardware-configuration.nix +++ b/machine/vps-arm/hardware-configuration.nix @@ -13,22 +13,51 @@ ]; boot.initrd.availableKernelModules = ["xhci_pci" "virtio_scsi" "sr_mod"]; - boot.initrd.kernelModules = []; + boot.initrd.kernelModules = ["dm-snapshot"]; boot.kernelModules = []; boot.extraModulePackages = []; fileSystems."/" = { - device = "/dev/disk/by-uuid/332b05c2-56cc-4b0b-b906-54b6b87542cd"; - fsType = "ext4"; + device = "/dev/disk/by-uuid/3a21f244-5bf9-4c65-bce7-92c03fb0fd69"; + fsType = "btrfs"; + options = ["subvol=root"]; + }; + + fileSystems."/home" = { + device = "/dev/disk/by-uuid/3a21f244-5bf9-4c65-bce7-92c03fb0fd69"; + fsType = "btrfs"; + options = ["subvol=home"]; + }; + + fileSystems."/nix" = { + device = "/dev/disk/by-uuid/3a21f244-5bf9-4c65-bce7-92c03fb0fd69"; + fsType = "btrfs"; + options = ["subvol=nix"]; + }; + + fileSystems."/persist" = { + device = "/dev/disk/by-uuid/3a21f244-5bf9-4c65-bce7-92c03fb0fd69"; + fsType = "btrfs"; + options = ["subvol=persist"]; + neededForBoot = true; + }; + + fileSystems."/var/log" = { + device = "/dev/disk/by-uuid/3a21f244-5bf9-4c65-bce7-92c03fb0fd69"; + fsType = "btrfs"; + options = ["subvol=log"]; + neededForBoot = true; }; fileSystems."/boot" = { - device = "/dev/disk/by-uuid/3D20-21CC"; + device = "/dev/disk/by-uuid/438B-D3D2"; fsType = "vfat"; options = ["fmask=0022" "dmask=0022"]; }; - swapDevices = []; + swapDevices = [ + {device = "/dev/disk/by-uuid/4608cfa2-da5b-45b1-97f4-8486957e409b";} + ]; # Enables DHCP on each ethernet and wireless interface. In case of scripted networking # (the default) this is the recommended approach. When using systemd-networkd it's diff --git a/services/nextcloud.nix b/services/nextcloud.nix index 154e412..8473805 100644 --- a/services/nextcloud.nix +++ b/services/nextcloud.nix @@ -29,7 +29,7 @@ }; nextcloud = { - enable = true; + enable = false; hostName = "nextcloud.szczepan.ski"; # Need to manually increment with every major upgrade.