fix indentation
This commit is contained in:
386
flake.nix
386
flake.nix
@@ -1,137 +1,273 @@
|
|||||||
{
|
{
|
||||||
description = "CODE CRISPIES Workshop Infrastructure";
|
description = "CODE CRISPIES Workshop Infrastructure";
|
||||||
|
|
||||||
inputs = {
|
inputs = {
|
||||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||||
nixos-generators.url = "github:nix-community/nixos-generators";
|
nixos-generators.url = "github:nix-community/nixos-generators";
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = { self, nixpkgs, nixos-generators }:
|
outputs = { self, nixpkgs, nixos-generators }:
|
||||||
let
|
let
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
pkgs = nixpkgs.legacyPackages.${system};
|
pkgs = nixpkgs.legacyPackages.${system};
|
||||||
# You can change the range here for local development (e.g., 1 2)
|
participantRange = nixpkgs.lib.range 1 2;
|
||||||
participantRange = nixpkgs.lib.range 1 2;
|
fullParticipantNames = [
|
||||||
fullParticipantNames = [
|
"hopper" "curie" "lovelace" "noether" "hamilton"
|
||||||
"hopper" "curie" "lovelace" "noether" "hamilton"
|
"franklin" "johnson" "clarke" "goldberg" "liskov"
|
||||||
"franklin" "johnson" "clarke" "goldberg" "liskov"
|
"wing" "rosen" "shaw" "karp" "rich"
|
||||||
"wing" "rosen" "shaw" "karp" "rich"
|
];
|
||||||
];
|
in
|
||||||
in
|
{
|
||||||
{
|
packages.${system} = {
|
||||||
packages.${system} = {
|
live-iso = nixos-generators.nixosGenerate {
|
||||||
live-iso = nixos-generators.nixosGenerate {
|
inherit system;
|
||||||
inherit system;
|
format = "iso";
|
||||||
format = "iso";
|
modules = [
|
||||||
modules = [
|
({ pkgs, ... }: {
|
||||||
({ pkgs, ... }: {
|
system.stateVersion = "25.05";
|
||||||
system.stateVersion = "25.05";
|
networking.networkmanager.enable = true;
|
||||||
networking.networkmanager.enable = true;
|
users.users.workshop = {
|
||||||
users.users.workshop = {
|
isNormalUser = true;
|
||||||
isNormalUser = true;
|
shell = pkgs.zsh;
|
||||||
shell = pkgs.zsh;
|
extraGroups = [ "wheel" ];
|
||||||
extraGroups = [ "wheel" ];
|
password = "workshop";
|
||||||
password = "workshop";
|
};
|
||||||
};
|
services.getty.autologinUser = "workshop";
|
||||||
# Use generic autologin for the live ISO TTY
|
programs.zsh.enable = true;
|
||||||
services.getty.autologinUser = "workshop";
|
environment.systemPackages = with pkgs; [ openssh curl git ];
|
||||||
programs.zsh.enable = true;
|
services.xserver = {
|
||||||
environment.systemPackages = with pkgs; [ openssh curl git ];
|
enable = true;
|
||||||
services.xserver = {
|
displayManager.lightdm.enable = true;
|
||||||
enable = true;
|
desktopManager.xfce.enable = true;
|
||||||
displayManager.lightdm.enable = true;
|
};
|
||||||
desktopManager.xfce.enable = true;
|
services.displayManager.autoLogin.enable = true;
|
||||||
displayManager.sessionCommands = ''
|
services.displayManager.autoLogin.user = "workshop";
|
||||||
${pkgs.xfce.xfce4-terminal}/bin/xfce4-terminal -e "sudo -i" &
|
})
|
||||||
'';
|
];
|
||||||
};
|
};
|
||||||
})
|
local-vm = self.nixosConfigurations.workshop-local.config.system.build.vm;
|
||||||
];
|
};
|
||||||
};
|
|
||||||
local-vm = self.nixosConfigurations.workshop-local.config.system.build.vm;
|
|
||||||
};
|
|
||||||
|
|
||||||
nixosConfigurations.workshop-local = nixpkgs.lib.nixosSystem {
|
nixosConfigurations.workshop-local = nixpkgs.lib.nixosSystem {
|
||||||
system = "x86_64-linux";
|
system = "x86_64-linux";
|
||||||
modules = [
|
modules = [
|
||||||
({ config, pkgs, ... }: {
|
({ config, pkgs, ... }: {
|
||||||
system.stateVersion = "25.05";
|
system.stateVersion = "25.05";
|
||||||
boot.loader.grub.enable = false;
|
boot.loader.grub.enable = false;
|
||||||
boot.loader.generic-extlinux-compatible.enable = true;
|
boot.loader.generic-extlinux-compatible.enable = true;
|
||||||
|
|
||||||
users.users.workshop = {
|
# Enable IP forwarding for NAT
|
||||||
isNormalUser = true;
|
boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
|
||||||
extraGroups = [ "wheel" ]; # for sudo
|
|
||||||
password = "";
|
|
||||||
};
|
|
||||||
|
|
||||||
# --- THIS IS THE CORRECTED SECTION ---
|
# Host VM user setup
|
||||||
services.xserver = {
|
users.users.workshop = {
|
||||||
enable = true;
|
isNormalUser = true;
|
||||||
desktopManager.xfce.enable = true;
|
extraGroups = [ "wheel" ];
|
||||||
displayManager.lightdm.enable = true;
|
password = "";
|
||||||
};
|
shell = pkgs.bash;
|
||||||
# Use the generic, documented options for graphical autologin
|
};
|
||||||
services.displayManager.autoLogin.enable = true;
|
|
||||||
services.displayManager.autoLogin.user = "workshop";
|
|
||||||
|
|
||||||
|
# GUI setup
|
||||||
|
services.xserver = {
|
||||||
|
enable = true;
|
||||||
|
desktopManager.xfce.enable = true;
|
||||||
|
displayManager.lightdm.enable = true;
|
||||||
|
};
|
||||||
|
services.displayManager.autoLogin.enable = true;
|
||||||
|
services.displayManager.autoLogin.user = "workshop";
|
||||||
|
|
||||||
environment.systemPackages = with pkgs; [ gnumake nano nixos-container firefox ];
|
# Auto-open root terminal
|
||||||
security.pam.services.login.allowNullPassword = true;
|
services.xserver.displayManager.sessionCommands = ''
|
||||||
security.sudo.wheelNeedsPassword = false;
|
${pkgs.xfce.xfce4-terminal}/bin/xfce4-terminal -T "Workshop Root Shell" -e "sudo -i" &
|
||||||
networking.hostName = "workshop-vm";
|
'';
|
||||||
|
|
||||||
containers = builtins.listToAttrs (map (i:
|
# Workshop user convenience
|
||||||
let participant = builtins.elemAt fullParticipantNames (i - 1);
|
programs.bash = {
|
||||||
in {
|
shellAliases = {
|
||||||
name = "participant${toString i}";
|
connect = "sudo nixos-container login";
|
||||||
value = {
|
containers = "sudo nixos-container list";
|
||||||
autoStart = true;
|
root = "sudo -i";
|
||||||
privateNetwork = true;
|
};
|
||||||
hostAddress = "192.168.100.1";
|
};
|
||||||
localAddress = "192.168.100.${toString (10 + i)}";
|
|
||||||
config = {
|
|
||||||
system.stateVersion = "25.05";
|
|
||||||
services.openssh.enable = true;
|
|
||||||
networking.hostName = participant;
|
|
||||||
console.enable = true;
|
|
||||||
users.users.root.password = "root";
|
|
||||||
virtualisation.docker.enable = true;
|
|
||||||
environment.systemPackages = with pkgs; [ docker git curl jq ];
|
|
||||||
systemd.services.workshop-setup = {
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
after = [ "docker.service" ];
|
|
||||||
script = ''
|
|
||||||
export HOME=/root;
|
|
||||||
${pkgs.docker}/bin/docker swarm init --advertise-addr 192.168.100.${toString (10 + i)} || true;
|
|
||||||
${pkgs.curl}/bin/curl -fsSL https://install.abra.coopcloud.tech | ${pkgs.bash}/bin/bash;
|
|
||||||
/root/.local/bin/abra server add ${participant}.local;
|
|
||||||
'';
|
|
||||||
serviceConfig = { Type = "oneshot"; RemainAfterExit = true; };
|
|
||||||
};
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
) participantRange);
|
|
||||||
|
|
||||||
services.dnsmasq = {
|
environment.systemPackages = with pkgs; [
|
||||||
enable = true;
|
gnumake nano nixos-container firefox git curl jq
|
||||||
settings.address = builtins.concatMap (i:
|
];
|
||||||
let participant = builtins.elemAt fullParticipantNames (i - 1);
|
security.pam.services.login.allowNullPassword = true;
|
||||||
in [ "/${participant}.local/192.168.100.${toString (10 + i)}" ]
|
security.sudo.wheelNeedsPassword = false;
|
||||||
) participantRange;
|
networking.hostName = "workshop-vm";
|
||||||
};
|
|
||||||
})
|
|
||||||
];
|
|
||||||
};
|
|
||||||
|
|
||||||
devShells.${system}.default = pkgs.mkShell {
|
# FIXED: Proper NAT configuration
|
||||||
buildInputs = with pkgs; [
|
networking = {
|
||||||
terraform
|
nat = {
|
||||||
nixos-rebuild
|
enable = true;
|
||||||
docker
|
internalInterfaces = ["ve-+"];
|
||||||
openssh
|
externalInterface = "eth0";
|
||||||
];
|
# Ensure we have masquerading
|
||||||
};
|
extraCommands = ''
|
||||||
};
|
iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -o eth0 -j MASQUERADE
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
firewall = {
|
||||||
|
enable = true;
|
||||||
|
trustedInterfaces = [ "ve-+" ];
|
||||||
|
# Allow forwarding from containers
|
||||||
|
extraCommands = ''
|
||||||
|
iptables -A FORWARD -i ve-+ -j ACCEPT
|
||||||
|
iptables -A FORWARD -o ve-+ -j ACCEPT
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# Container configurations
|
||||||
|
containers = builtins.listToAttrs (map (i:
|
||||||
|
let participant = builtins.elemAt fullParticipantNames (i - 1);
|
||||||
|
in {
|
||||||
|
name = participant;
|
||||||
|
value = {
|
||||||
|
autoStart = true;
|
||||||
|
privateNetwork = true;
|
||||||
|
hostAddress = "192.168.100.1";
|
||||||
|
localAddress = "192.168.100.${toString (10 + i)}";
|
||||||
|
config = {
|
||||||
|
system.stateVersion = "25.05";
|
||||||
|
|
||||||
|
users.users.root = {
|
||||||
|
password = "root";
|
||||||
|
openssh.authorizedKeys.keys = [];
|
||||||
|
};
|
||||||
|
users.users.workshop = {
|
||||||
|
isNormalUser = true;
|
||||||
|
password = "workshop";
|
||||||
|
extraGroups = [ "wheel" "docker" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
services.openssh = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
PasswordAuthentication = true;
|
||||||
|
PermitRootLogin = "yes";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# FIXED: Proper network configuration
|
||||||
|
networking = {
|
||||||
|
hostName = participant;
|
||||||
|
nameservers = [ "8.8.8.8" "1.1.1.1" ];
|
||||||
|
defaultGateway = {
|
||||||
|
address = "192.168.100.1";
|
||||||
|
interface = "eth0";
|
||||||
|
};
|
||||||
|
firewall.enable = false;
|
||||||
|
useHostResolvConf = false;
|
||||||
|
# Ensure eth0 is configured properly
|
||||||
|
interfaces.eth0.ipv4.addresses = [{
|
||||||
|
address = "192.168.100.${toString (10 + i)}";
|
||||||
|
prefixLength = 24;
|
||||||
|
}];
|
||||||
|
};
|
||||||
|
|
||||||
|
console.enable = true;
|
||||||
|
security.sudo.wheelNeedsPassword = false;
|
||||||
|
|
||||||
|
virtualisation.docker.enable = true;
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
docker git curl jq wget gnutar gzip util-linux
|
||||||
|
];
|
||||||
|
|
||||||
|
# FIXED: Better network initialization
|
||||||
|
systemd.services.container-network-setup = {
|
||||||
|
wantedBy = [ "network.target" ];
|
||||||
|
before = [ "network-online.target" ];
|
||||||
|
script = ''
|
||||||
|
# Ensure proper routing
|
||||||
|
${pkgs.iproute2}/bin/ip route add default via 192.168.100.1 dev eth0 || true
|
||||||
|
# Set up DNS
|
||||||
|
echo "nameserver 8.8.8.8" > /etc/resolv.conf
|
||||||
|
echo "nameserver 1.1.1.1" >> /etc/resolv.conf
|
||||||
|
'';
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.workshop-setup = {
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
after = [ "network-online.target" "docker.service" "container-network-setup.service" ];
|
||||||
|
wants = [ "network-online.target" ];
|
||||||
|
script = ''
|
||||||
|
export HOME=/root
|
||||||
|
export PATH=/run/current-system/sw/bin:$PATH
|
||||||
|
|
||||||
|
# Wait for network with better test
|
||||||
|
echo "Testing network connectivity..."
|
||||||
|
for attempt in {1..30}; do
|
||||||
|
if ${pkgs.curl}/bin/curl -s --max-time 10 --connect-timeout 5 https://install.abra.coopcloud.tech >/dev/null 2>&1; then
|
||||||
|
echo "Network is up!"
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
echo "Attempt $attempt: Waiting for network..."
|
||||||
|
sleep 2
|
||||||
|
done
|
||||||
|
|
||||||
|
# Docker swarm init
|
||||||
|
${pkgs.docker}/bin/docker swarm init --advertise-addr 192.168.100.${toString (10 + i)} || true
|
||||||
|
|
||||||
|
# Install abra
|
||||||
|
if [ ! -f /root/.local/bin/abra ]; then
|
||||||
|
echo "Installing abra..."
|
||||||
|
${pkgs.curl}/bin/curl -fsSL https://install.abra.coopcloud.tech | ${pkgs.bash}/bin/bash
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Make abra globally available
|
||||||
|
if [ -f /root/.local/bin/abra ]; then
|
||||||
|
ln -sf /root/.local/bin/abra /usr/local/bin/abra || true
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Add server
|
||||||
|
if command -v abra >/dev/null 2>&1; then
|
||||||
|
abra server add ${participant}.local || true
|
||||||
|
fi
|
||||||
|
'';
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = true;
|
||||||
|
StandardOutput = "journal";
|
||||||
|
StandardError = "journal";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
environment.sessionVariables = {
|
||||||
|
PATH = [ "/root/.local/bin" "$PATH" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
}
|
||||||
|
) participantRange);
|
||||||
|
|
||||||
|
# DNS for .local domains
|
||||||
|
services.dnsmasq = {
|
||||||
|
enable = true;
|
||||||
|
settings = {
|
||||||
|
address = builtins.concatMap (i:
|
||||||
|
let participant = builtins.elemAt fullParticipantNames (i - 1);
|
||||||
|
in [ "/${participant}.local/192.168.100.${toString (10 + i)}" ]
|
||||||
|
) participantRange;
|
||||||
|
server = [ "8.8.8.8" "1.1.1.1" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
})
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
devShells.${system}.default = pkgs.mkShell {
|
||||||
|
buildInputs = with pkgs; [
|
||||||
|
terraform
|
||||||
|
nixos-rebuild
|
||||||
|
docker
|
||||||
|
openssh
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
}
|
}
|
||||||
|
|||||||
Reference in New Issue
Block a user