fix indentation
This commit is contained in:
392
flake.nix
392
flake.nix
@@ -1,137 +1,273 @@
|
||||
{
|
||||
description = "CODE CRISPIES Workshop Infrastructure";
|
||||
description = "CODE CRISPIES Workshop Infrastructure";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
nixos-generators.url = "github:nix-community/nixos-generators";
|
||||
};
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
nixos-generators.url = "github:nix-community/nixos-generators";
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, nixos-generators }:
|
||||
let
|
||||
system = "x86_64-linux";
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
# You can change the range here for local development (e.g., 1 2)
|
||||
participantRange = nixpkgs.lib.range 1 2;
|
||||
fullParticipantNames = [
|
||||
"hopper" "curie" "lovelace" "noether" "hamilton"
|
||||
"franklin" "johnson" "clarke" "goldberg" "liskov"
|
||||
"wing" "rosen" "shaw" "karp" "rich"
|
||||
];
|
||||
in
|
||||
{
|
||||
packages.${system} = {
|
||||
live-iso = nixos-generators.nixosGenerate {
|
||||
inherit system;
|
||||
format = "iso";
|
||||
modules = [
|
||||
({ pkgs, ... }: {
|
||||
system.stateVersion = "25.05";
|
||||
networking.networkmanager.enable = true;
|
||||
users.users.workshop = {
|
||||
isNormalUser = true;
|
||||
shell = pkgs.zsh;
|
||||
extraGroups = [ "wheel" ];
|
||||
password = "workshop";
|
||||
};
|
||||
# Use generic autologin for the live ISO TTY
|
||||
services.getty.autologinUser = "workshop";
|
||||
programs.zsh.enable = true;
|
||||
environment.systemPackages = with pkgs; [ openssh curl git ];
|
||||
services.xserver = {
|
||||
enable = true;
|
||||
displayManager.lightdm.enable = true;
|
||||
desktopManager.xfce.enable = true;
|
||||
displayManager.sessionCommands = ''
|
||||
${pkgs.xfce.xfce4-terminal}/bin/xfce4-terminal -e "sudo -i" &
|
||||
'';
|
||||
};
|
||||
})
|
||||
];
|
||||
};
|
||||
local-vm = self.nixosConfigurations.workshop-local.config.system.build.vm;
|
||||
};
|
||||
outputs = { self, nixpkgs, nixos-generators }:
|
||||
let
|
||||
system = "x86_64-linux";
|
||||
pkgs = nixpkgs.legacyPackages.${system};
|
||||
participantRange = nixpkgs.lib.range 1 2;
|
||||
fullParticipantNames = [
|
||||
"hopper" "curie" "lovelace" "noether" "hamilton"
|
||||
"franklin" "johnson" "clarke" "goldberg" "liskov"
|
||||
"wing" "rosen" "shaw" "karp" "rich"
|
||||
];
|
||||
in
|
||||
{
|
||||
packages.${system} = {
|
||||
live-iso = nixos-generators.nixosGenerate {
|
||||
inherit system;
|
||||
format = "iso";
|
||||
modules = [
|
||||
({ pkgs, ... }: {
|
||||
system.stateVersion = "25.05";
|
||||
networking.networkmanager.enable = true;
|
||||
users.users.workshop = {
|
||||
isNormalUser = true;
|
||||
shell = pkgs.zsh;
|
||||
extraGroups = [ "wheel" ];
|
||||
password = "workshop";
|
||||
};
|
||||
services.getty.autologinUser = "workshop";
|
||||
programs.zsh.enable = true;
|
||||
environment.systemPackages = with pkgs; [ openssh curl git ];
|
||||
services.xserver = {
|
||||
enable = true;
|
||||
displayManager.lightdm.enable = true;
|
||||
desktopManager.xfce.enable = true;
|
||||
};
|
||||
services.displayManager.autoLogin.enable = true;
|
||||
services.displayManager.autoLogin.user = "workshop";
|
||||
})
|
||||
];
|
||||
};
|
||||
local-vm = self.nixosConfigurations.workshop-local.config.system.build.vm;
|
||||
};
|
||||
|
||||
nixosConfigurations.workshop-local = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
({ config, pkgs, ... }: {
|
||||
system.stateVersion = "25.05";
|
||||
boot.loader.grub.enable = false;
|
||||
boot.loader.generic-extlinux-compatible.enable = true;
|
||||
nixosConfigurations.workshop-local = nixpkgs.lib.nixosSystem {
|
||||
system = "x86_64-linux";
|
||||
modules = [
|
||||
({ config, pkgs, ... }: {
|
||||
system.stateVersion = "25.05";
|
||||
boot.loader.grub.enable = false;
|
||||
boot.loader.generic-extlinux-compatible.enable = true;
|
||||
|
||||
# Enable IP forwarding for NAT
|
||||
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
|
||||
|
||||
# Host VM user setup
|
||||
users.users.workshop = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ];
|
||||
password = "";
|
||||
shell = pkgs.bash;
|
||||
};
|
||||
|
||||
# GUI setup
|
||||
services.xserver = {
|
||||
enable = true;
|
||||
desktopManager.xfce.enable = true;
|
||||
displayManager.lightdm.enable = true;
|
||||
};
|
||||
services.displayManager.autoLogin.enable = true;
|
||||
services.displayManager.autoLogin.user = "workshop";
|
||||
|
||||
# Auto-open root terminal
|
||||
services.xserver.displayManager.sessionCommands = ''
|
||||
${pkgs.xfce.xfce4-terminal}/bin/xfce4-terminal -T "Workshop Root Shell" -e "sudo -i" &
|
||||
'';
|
||||
|
||||
users.users.workshop = {
|
||||
isNormalUser = true;
|
||||
extraGroups = [ "wheel" ]; # for sudo
|
||||
password = "";
|
||||
};
|
||||
|
||||
# --- THIS IS THE CORRECTED SECTION ---
|
||||
services.xserver = {
|
||||
enable = true;
|
||||
desktopManager.xfce.enable = true;
|
||||
displayManager.lightdm.enable = true;
|
||||
};
|
||||
# Use the generic, documented options for graphical autologin
|
||||
services.displayManager.autoLogin.enable = true;
|
||||
services.displayManager.autoLogin.user = "workshop";
|
||||
# Workshop user convenience
|
||||
programs.bash = {
|
||||
shellAliases = {
|
||||
connect = "sudo nixos-container login";
|
||||
containers = "sudo nixos-container list";
|
||||
root = "sudo -i";
|
||||
};
|
||||
};
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
gnumake nano nixos-container firefox git curl jq
|
||||
];
|
||||
security.pam.services.login.allowNullPassword = true;
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
networking.hostName = "workshop-vm";
|
||||
|
||||
environment.systemPackages = with pkgs; [ gnumake nano nixos-container firefox ];
|
||||
security.pam.services.login.allowNullPassword = true;
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
networking.hostName = "workshop-vm";
|
||||
# FIXED: Proper NAT configuration
|
||||
networking = {
|
||||
nat = {
|
||||
enable = true;
|
||||
internalInterfaces = ["ve-+"];
|
||||
externalInterface = "eth0";
|
||||
# Ensure we have masquerading
|
||||
extraCommands = ''
|
||||
iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -o eth0 -j MASQUERADE
|
||||
'';
|
||||
};
|
||||
firewall = {
|
||||
enable = true;
|
||||
trustedInterfaces = [ "ve-+" ];
|
||||
# Allow forwarding from containers
|
||||
extraCommands = ''
|
||||
iptables -A FORWARD -i ve-+ -j ACCEPT
|
||||
iptables -A FORWARD -o ve-+ -j ACCEPT
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
containers = builtins.listToAttrs (map (i:
|
||||
let participant = builtins.elemAt fullParticipantNames (i - 1);
|
||||
in {
|
||||
name = "participant${toString i}";
|
||||
value = {
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = "192.168.100.1";
|
||||
localAddress = "192.168.100.${toString (10 + i)}";
|
||||
config = {
|
||||
system.stateVersion = "25.05";
|
||||
services.openssh.enable = true;
|
||||
networking.hostName = participant;
|
||||
console.enable = true;
|
||||
users.users.root.password = "root";
|
||||
virtualisation.docker.enable = true;
|
||||
environment.systemPackages = with pkgs; [ docker git curl jq ];
|
||||
systemd.services.workshop-setup = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "docker.service" ];
|
||||
script = ''
|
||||
export HOME=/root;
|
||||
${pkgs.docker}/bin/docker swarm init --advertise-addr 192.168.100.${toString (10 + i)} || true;
|
||||
${pkgs.curl}/bin/curl -fsSL https://install.abra.coopcloud.tech | ${pkgs.bash}/bin/bash;
|
||||
/root/.local/bin/abra server add ${participant}.local;
|
||||
'';
|
||||
serviceConfig = { Type = "oneshot"; RemainAfterExit = true; };
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
) participantRange);
|
||||
|
||||
services.dnsmasq = {
|
||||
enable = true;
|
||||
settings.address = builtins.concatMap (i:
|
||||
let participant = builtins.elemAt fullParticipantNames (i - 1);
|
||||
in [ "/${participant}.local/192.168.100.${toString (10 + i)}" ]
|
||||
) participantRange;
|
||||
};
|
||||
})
|
||||
];
|
||||
};
|
||||
|
||||
devShells.${system}.default = pkgs.mkShell {
|
||||
buildInputs = with pkgs; [
|
||||
terraform
|
||||
nixos-rebuild
|
||||
docker
|
||||
openssh
|
||||
];
|
||||
};
|
||||
};
|
||||
# Container configurations
|
||||
containers = builtins.listToAttrs (map (i:
|
||||
let participant = builtins.elemAt fullParticipantNames (i - 1);
|
||||
in {
|
||||
name = participant;
|
||||
value = {
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = "192.168.100.1";
|
||||
localAddress = "192.168.100.${toString (10 + i)}";
|
||||
config = {
|
||||
system.stateVersion = "25.05";
|
||||
|
||||
users.users.root = {
|
||||
password = "root";
|
||||
openssh.authorizedKeys.keys = [];
|
||||
};
|
||||
users.users.workshop = {
|
||||
isNormalUser = true;
|
||||
password = "workshop";
|
||||
extraGroups = [ "wheel" "docker" ];
|
||||
};
|
||||
|
||||
services.openssh = {
|
||||
enable = true;
|
||||
settings = {
|
||||
PasswordAuthentication = true;
|
||||
PermitRootLogin = "yes";
|
||||
};
|
||||
};
|
||||
|
||||
# FIXED: Proper network configuration
|
||||
networking = {
|
||||
hostName = participant;
|
||||
nameservers = [ "8.8.8.8" "1.1.1.1" ];
|
||||
defaultGateway = {
|
||||
address = "192.168.100.1";
|
||||
interface = "eth0";
|
||||
};
|
||||
firewall.enable = false;
|
||||
useHostResolvConf = false;
|
||||
# Ensure eth0 is configured properly
|
||||
interfaces.eth0.ipv4.addresses = [{
|
||||
address = "192.168.100.${toString (10 + i)}";
|
||||
prefixLength = 24;
|
||||
}];
|
||||
};
|
||||
|
||||
console.enable = true;
|
||||
security.sudo.wheelNeedsPassword = false;
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
environment.systemPackages = with pkgs; [
|
||||
docker git curl jq wget gnutar gzip util-linux
|
||||
];
|
||||
|
||||
# FIXED: Better network initialization
|
||||
systemd.services.container-network-setup = {
|
||||
wantedBy = [ "network.target" ];
|
||||
before = [ "network-online.target" ];
|
||||
script = ''
|
||||
# Ensure proper routing
|
||||
${pkgs.iproute2}/bin/ip route add default via 192.168.100.1 dev eth0 || true
|
||||
# Set up DNS
|
||||
echo "nameserver 8.8.8.8" > /etc/resolv.conf
|
||||
echo "nameserver 1.1.1.1" >> /etc/resolv.conf
|
||||
'';
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.workshop-setup = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network-online.target" "docker.service" "container-network-setup.service" ];
|
||||
wants = [ "network-online.target" ];
|
||||
script = ''
|
||||
export HOME=/root
|
||||
export PATH=/run/current-system/sw/bin:$PATH
|
||||
|
||||
# Wait for network with better test
|
||||
echo "Testing network connectivity..."
|
||||
for attempt in {1..30}; do
|
||||
if ${pkgs.curl}/bin/curl -s --max-time 10 --connect-timeout 5 https://install.abra.coopcloud.tech >/dev/null 2>&1; then
|
||||
echo "Network is up!"
|
||||
break
|
||||
fi
|
||||
echo "Attempt $attempt: Waiting for network..."
|
||||
sleep 2
|
||||
done
|
||||
|
||||
# Docker swarm init
|
||||
${pkgs.docker}/bin/docker swarm init --advertise-addr 192.168.100.${toString (10 + i)} || true
|
||||
|
||||
# Install abra
|
||||
if [ ! -f /root/.local/bin/abra ]; then
|
||||
echo "Installing abra..."
|
||||
${pkgs.curl}/bin/curl -fsSL https://install.abra.coopcloud.tech | ${pkgs.bash}/bin/bash
|
||||
fi
|
||||
|
||||
# Make abra globally available
|
||||
if [ -f /root/.local/bin/abra ]; then
|
||||
ln -sf /root/.local/bin/abra /usr/local/bin/abra || true
|
||||
fi
|
||||
|
||||
# Add server
|
||||
if command -v abra >/dev/null 2>&1; then
|
||||
abra server add ${participant}.local || true
|
||||
fi
|
||||
'';
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
StandardOutput = "journal";
|
||||
StandardError = "journal";
|
||||
};
|
||||
};
|
||||
|
||||
environment.sessionVariables = {
|
||||
PATH = [ "/root/.local/bin" "$PATH" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
) participantRange);
|
||||
|
||||
# DNS for .local domains
|
||||
services.dnsmasq = {
|
||||
enable = true;
|
||||
settings = {
|
||||
address = builtins.concatMap (i:
|
||||
let participant = builtins.elemAt fullParticipantNames (i - 1);
|
||||
in [ "/${participant}.local/192.168.100.${toString (10 + i)}" ]
|
||||
) participantRange;
|
||||
server = [ "8.8.8.8" "1.1.1.1" ];
|
||||
};
|
||||
};
|
||||
})
|
||||
];
|
||||
};
|
||||
|
||||
devShells.${system}.default = pkgs.mkShell {
|
||||
buildInputs = with pkgs; [
|
||||
terraform
|
||||
nixos-rebuild
|
||||
docker
|
||||
openssh
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user