diff --git a/flake.lock b/flake.lock index 2fc079a..f2d628a 100644 --- a/flake.lock +++ b/flake.lock @@ -41,11 +41,11 @@ ] }, "locked": { - "lastModified": 1784368054, - "narHash": "sha256-zF1iJkBQSDWmRO4/LEeHR1SpKY0lqZaxkoQJpPS9K9U=", + "lastModified": 1787400831, + "narHash": "sha256-H3MEkFDZf+UH+QrVgW8TdKrssPFltF8fBg/rh0J1zIc=", "owner": "hyprwm", "repo": "aquamarine", - "rev": "9b5f14d9483445e766294eb8fbe0b8f370269ed0", + "rev": "7ce889cb78b97979b83a4648509fc3ef405c3286", "type": "github" }, "original": { @@ -100,11 +100,11 @@ ] }, "locked": { - "lastModified": 1772408722, - "narHash": "sha256-rHuJtdcOjK7rAHpHphUb1iCvgkU3GpfvicLMwwnfMT0=", + "lastModified": 1782949081, + "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=", "owner": "hercules-ci", "repo": "flake-parts", - "rev": "f20dc5d9b8027381c474144ecabc9034d6a839a3", + "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e", "type": "github" }, "original": { @@ -116,6 +116,7 @@ "hermes-agent": { "inputs": { "flake-parts": "flake-parts", + "home-manager": "home-manager_2", "nixpkgs": "nixpkgs_2", "npm-lockfile-fix": "npm-lockfile-fix", "pyproject-build-systems": "pyproject-build-systems", @@ -123,11 +124,11 @@ "uv2nix": "uv2nix" }, "locked": { - "lastModified": 1784644108, - "narHash": "sha256-WFwNw701EOVHRwEpgifbYQaT68LOxATKDTXaep82yN4=", + "lastModified": 1787852122, + "narHash": "sha256-QFOvSx7laGYIIPq+LNNEyrqxfSmXOrv+4Y80nKbXkjA=", "owner": "NousResearch", "repo": "hermes-agent", - "rev": "d604141d097eec4a49493ad1eaceb9b2ca1e496d", + "rev": "0dfba37b11ff2ca908ae2df85b55f4f4c9b7fd8b", "type": "github" }, "original": { @@ -143,11 +144,11 @@ ] }, "locked": { - "lastModified": 1784601896, - "narHash": "sha256-rkpUOBv9pVG+GxhK90ebCrFpvjnfP4u2y/iGrzA42K4=", + "lastModified": 1787500880, + "narHash": "sha256-UrAlku7KST0DT+j1bdVGYI8tCz23PWL88uGMer3IZ2U=", "owner": "feel-co", "repo": "hjem", - "rev": "35e95ebb9557ac41a72fe00dd55218d1a7f21679", + "rev": "d248f0e4f7abd6e1f0eb9ace778dd7928481943e", "type": "github" }, "original": { @@ -161,17 +162,16 @@ "hjem": [ "hjem" ], - "nix-darwin": "nix-darwin", "nixpkgs": [ "nixpkgs" ] }, "locked": { - "lastModified": 1784361899, - "narHash": "sha256-QIzbnJIwy5cMYvPmLYPA4ar0lhficYLKZ6ytcHK90Uo=", + "lastModified": 1787315974, + "narHash": "sha256-LLToYudTlFqNY0NsG//CnE2I/zF0cpktX44ZhFJ2alY=", "owner": "snugnug", "repo": "hjem-rum", - "rev": "73f6d1c01fe94e3de1cb3a84b9346da52f483c60", + "rev": "217c6e1f445b3973ca8f988f070c9b84cceaa1ca", "type": "github" }, "original": { @@ -201,6 +201,27 @@ "type": "github" } }, + "home-manager_2": { + "inputs": { + "nixpkgs": [ + "hermes-agent", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1786487128, + "narHash": "sha256-ad60hrRVhH/bo3Jl1YLzO+QcS3mUNZr9LNJdzhMO2P4=", + "owner": "nix-community", + "repo": "home-manager", + "rev": "f404edbfa4117810c96b97048299242fc50e5362", + "type": "github" + }, + "original": { + "owner": "nix-community", + "repo": "home-manager", + "type": "github" + } + }, "hyprcursor": { "inputs": { "hyprlang": [ @@ -217,11 +238,11 @@ ] }, "locked": { - "lastModified": 1776511930, - "narHash": "sha256-fCpwFiTW0rT7oKJqr3cqHMnkwypSwQKpbtUEtxdkgrM=", + "lastModified": 1786464181, + "narHash": "sha256-2alOMkLjXANh7unkZnYnCF2K2rApZaOLMoQ3o+VX2CY=", "owner": "hyprwm", "repo": "hyprcursor", - "rev": "39435900785d0c560c6ae8777d29f28617d031ef", + "rev": "e4ed7c08123df5af460a0a70961380cbfb872f76", "type": "github" }, "original": { @@ -246,11 +267,11 @@ ] }, "locked": { - "lastModified": 1782566056, - "narHash": "sha256-haEZcHzYrePnjFOYSWTbxm/Nrla0aPslJfmvdCvqtVc=", + "lastModified": 1786464367, + "narHash": "sha256-k58p4wbzIXWyRWrW84pP8tD+iaZSSYiiM+fr0Auk4oU=", "owner": "hyprwm", "repo": "hyprgraphics", - "rev": "c6e7b9f673f4360bc813d3dc75028f75ee88d3f8", + "rev": "7c895c44e3ca6d28ed68ddd80ec02b02b925e7fc", "type": "github" }, "original": { @@ -276,11 +297,11 @@ "xdph": "xdph" }, "locked": { - "lastModified": 1784641930, - "narHash": "sha256-j1c/65skFvp1WPbHBlAfVWaeCz0Bgwr/WPwIg0H+Ncg=", + "lastModified": 1787842129, + "narHash": "sha256-+C4MYYZsT+JdgZj70g7ERYm4zjJRwRnwy7o1QHPW5eg=", "owner": "hyprwm", "repo": "Hyprland", - "rev": "1a3606234c59842340ad9a42baeeffe44a9d6cda", + "rev": "3b1aa6be7b8d672c7180ea616f9eca1992e227c3", "type": "github" }, "original": { @@ -322,11 +343,11 @@ ] }, "locked": { - "lastModified": 1784196523, - "narHash": "sha256-ahtKMGXFJdlQNhatQm1+BBU/pGfGYnAqQt3vWvq4p8s=", + "lastModified": 1786464504, + "narHash": "sha256-7sHwM86KILQyHDHDuE2SDBlQ2jvZ0EW3hY7sW009/cg=", "owner": "hyprwm", "repo": "hyprland-guiutils", - "rev": "a6ccb6cb112ed5a244c0191fb972347ecfa893e0", + "rev": "4c30cf3097ea963c0e250749ee0c59f8b08816d6", "type": "github" }, "original": { @@ -376,11 +397,11 @@ ] }, "locked": { - "lastModified": 1777320127, - "narHash": "sha256-Qu+Wf2Bp5qUjyn2YpZNq8a7JyzTGowhT1knrwE38a9U=", + "lastModified": 1786464129, + "narHash": "sha256-339AkTlpMYSIvFuG0rnR+8Yg4/AZKeJalshJavlnKfg=", "owner": "hyprwm", "repo": "hyprlang", - "rev": "090117506ddc3d7f26e650ff344d378c2ec329cc", + "rev": "9508458be316a0d70d37ebed1ab725ccd10411ff", "type": "github" }, "original": { @@ -428,11 +449,11 @@ ] }, "locked": { - "lastModified": 1782554491, - "narHash": "sha256-+p3MlyN/nqRefcf2IckPlGRUn9+hielqpS9XClbLleM=", + "lastModified": 1785930473, + "narHash": "sha256-DitTu625BhEYpZjtjxtGpjrEJwPwW+X/+jJvhSZNSJM=", "owner": "hyprwm", "repo": "hyprtoolkit", - "rev": "bdba25ced39ea39ab004a8f31593ba0b0ff1ca35", + "rev": "af515b69dfbe366dc7873aa1475cb2f4db3ebad7", "type": "github" }, "original": { @@ -453,11 +474,11 @@ ] }, "locked": { - "lastModified": 1784323413, - "narHash": "sha256-XnAVV+H4f8Xdv0yZcSwJ5kCjLyE8fHxPeLX6a3HSrAU=", + "lastModified": 1786903207, + "narHash": "sha256-QTwMqLLONRhv9iz6CVeuX6BqQNQCIqI8hL/cPYlR/24=", "owner": "hyprwm", "repo": "hyprutils", - "rev": "5f03477ab3a005ff27c527486f551883535aea2f", + "rev": "6cf50415e06dc6bd9f1252f1b745eac6b4a1cc39", "type": "github" }, "original": { @@ -478,11 +499,11 @@ ] }, "locked": { - "lastModified": 1777159683, - "narHash": "sha256-Jxixw6wZphUp+nHYxOKUYSckL17QMBx2d5Zp0rJHr1g=", + "lastModified": 1786464033, + "narHash": "sha256-QM8Qe4/L8lpdVN4bgwahmi+jyyc4fisseDMe4afcDxA=", "owner": "hyprwm", "repo": "hyprwayland-scanner", - "rev": "b8632713a6beaf28b56f2a7b0ab2fb7088dbb404", + "rev": "62e62c1ca23da17612c6890d4ad2064f575643db", "type": "github" }, "original": { @@ -507,11 +528,11 @@ ] }, "locked": { - "lastModified": 1778410714, - "narHash": "sha256-o6RzFj4nJXaPRY7EM01siuCQeT41RfwwmcmFQqwFJJg=", + "lastModified": 1786464294, + "narHash": "sha256-ZQsZ2WvBdkboCIyh8LStDPdAIARmxzn0XMNxxoOhjPE=", "owner": "hyprwm", "repo": "hyprwire", - "rev": "85148a8e612808cf5ddb25d0b3c5840f3498a7dc", + "rev": "4ce7cd6b6128c1ac41caf23c58a30a26b327f9dd", "type": "github" }, "original": { @@ -520,27 +541,6 @@ "type": "github" } }, - "nix-darwin": { - "inputs": { - "nixpkgs": [ - "hjem-rum", - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1779036909, - "narHash": "sha256-zXcwYQGCT6pzinK+1dBB2ekTVtfxGZAapb3Evdcu4fY=", - "owner": "nix-darwin", - "repo": "nix-darwin", - "rev": "56c666e108467d87d13508936aade6d567f2a501", - "type": "github" - }, - "original": { - "owner": "nix-darwin", - "repo": "nix-darwin", - "type": "github" - } - }, "nixpkgs": { "locked": { "lastModified": 1754028485, @@ -559,11 +559,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1775036866, - "narHash": "sha256-ZojAnPuCdy657PbTq5V0Y+AHKhZAIwSIT2cb8UgAz/U=", + "lastModified": 1785318670, + "narHash": "sha256-dN6Ou5x/+23FZLEpYP3IffO+NyJFzUlGumt1uu3MMaY=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "6201e203d09599479a3b3450ed24fa81537ebc4e", + "rev": "0954f7ee2f6bb3dc7d4e3d0d8bcb8fd4bde4cfc5", "type": "github" }, "original": { @@ -575,11 +575,11 @@ }, "nixpkgs_3": { "locked": { - "lastModified": 1784356753, - "narHash": "sha256-12KrbMiWLcf8m7pCvAtZh1ZrgF85ZXDXvfR/fWTKy84=", + "lastModified": 1787360063, + "narHash": "sha256-dt4WdcvsA8/RCe+VZZwqU0X+XMM3wBbGCWA0/sFWzGo=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "61b7c44c4073f0b827768aff0049561b5110ea5a", + "rev": "2c423e03bbafcff28bfadc6781a4a8257f205cb5", "type": "github" }, "original": { @@ -591,11 +591,11 @@ }, "nixpkgs_4": { "locked": { - "lastModified": 1784497964, - "narHash": "sha256-vlHUuqAcbcH2RKmHbPiuQzbv1pnzzavXnI62RD0bqCU=", + "lastModified": 1787736819, + "narHash": "sha256-cV5xEJJK3BvhU8rEd4mC9UsmDi5qscv/kzGPhBRC5WA=", "owner": "nixos", "repo": "nixpkgs", - "rev": "241313f4e8e508cb9b13278c2b0fa25b9ca27163", + "rev": "9fbb54b33e91ee4ca368e35a78e0613c720600b3", "type": "github" }, "original": { @@ -664,11 +664,11 @@ ] }, "locked": { - "lastModified": 1772555609, - "narHash": "sha256-3BA3HnUvJSbHJAlJj6XSy0Jmu7RyP2gyB/0fL7XuEDo=", + "lastModified": 1785115949, + "narHash": "sha256-8AM37BfyGaL2v/SZyg4PupRxJ01Y4htvM+WrTjWrPpo=", "owner": "pyproject-nix", "repo": "build-system-pkgs", - "rev": "c37f66a953535c394244888598947679af231863", + "rev": "62c0d86027edb1c4f39a5facc09876348144f7c9", "type": "github" }, "original": { @@ -685,11 +685,11 @@ ] }, "locked": { - "lastModified": 1772865871, - "narHash": "sha256-/ZTSg97aouL0SlPHaokA4r3iuH9QzHVuWPACD2CUCFY=", + "lastModified": 1784591072, + "narHash": "sha256-zP/WaDxrRu8GANZM61+V2LT/7ycEEdoyLWn7M6WzU7M=", "owner": "pyproject-nix", "repo": "pyproject.nix", - "rev": "e537db02e72d553cea470976b9733581bcf5b3ed", + "rev": "e3b599ca2e7fcf93d4edf65d7f19bbf6491724f3", "type": "github" }, "original": { @@ -750,11 +750,11 @@ ] }, "locked": { - "lastModified": 1773039484, - "narHash": "sha256-+boo33KYkJDw9KItpeEXXv8+65f7hHv/earxpcyzQ0I=", + "lastModified": 1785277507, + "narHash": "sha256-9Tq3UDX2hD/aveW/HvkBlAmEwJTOlY5HQXJM+L5BGmE=", "owner": "pyproject-nix", "repo": "uv2nix", - "rev": "b68be7cfeacbed9a3fa38a2b5adc0cfb81d9bb1f", + "rev": "5a836d395cbf5fc22670eb98dd4aa4fc4d406977", "type": "github" }, "original": { @@ -791,11 +791,11 @@ ] }, "locked": { - "lastModified": 1784371182, - "narHash": "sha256-S8A1lezEalltWcCp3gAic5lssS0xTSISK6fKODefhOk=", + "lastModified": 1786988229, + "narHash": "sha256-frEFLVRj8xXvBBDs44IRiqHo6R2PxsRpluygL7abjjI=", "owner": "hyprwm", "repo": "xdg-desktop-portal-hyprland", - "rev": "08d99f727944dd15e4740090305e31c5fb92a50a", + "rev": "59d429bf45aed4e2209043c0c36565ad8e2859a5", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 65dd8a0..3109786 100644 --- a/flake.nix +++ b/flake.nix @@ -27,26 +27,40 @@ let system = "x86_64-linux"; username = "poslop"; + lib = nixpkgs.lib; + + # mkHost + # roles resolve to ./roles/.nix; list entries may also be + # inline attrsets or paths, which load after (and override) roles. + # hosts//custom.nix, if present, always loads last. mkHost = - host: modules: + name: roles: nixpkgs.lib.nixosSystem { - modules = [ { nixpkgs.hostPlatform = system; } ] ++ modules; + modules = + [ { nixpkgs.hostPlatform = system; } ] + ++ [ ./hosts/${name}/configuration.nix ] + ++ map ( + role: + if builtins.isString role then ./roles/${role}.nix else role + ) roles + ++ lib.optional (builtins.pathExists ./hosts/${name}/custom.nix) + ./hosts/${name}/custom.nix; specialArgs = { inherit self inputs username - host ; + host = name; }; }; in { nixosConfigurations = { - nixos-vm2 = mkHost "nixos-vm2" [ ./hosts/nixos-vm2/configuration.nix ]; - qemu-vm = mkHost "qemu-vm" [ ./hosts/qemu-vm/configuration.nix ]; - goyplex-vm = mkHost "goyplex-vm" [ ./hosts/goyplex-vm/configuration.nix ]; - hermes-vm = mkHost "hermes-vm" [ ./hosts/hermes-vm/configuration.nix ]; + nixos-vm2 = mkHost "nixos-vm2" [ "core" ]; + qemu-vm = mkHost "qemu-vm" [ "core" ]; + goyplex-vm = mkHost "goyplex-vm" [ "k3s-server" ]; + hermes-vm = mkHost "hermes-vm" [ "hermes" ]; }; }; } diff --git a/hosts/goyplex-vm/configuration.nix b/hosts/goyplex-vm/configuration.nix index ec77758..1f679a6 100644 --- a/hosts/goyplex-vm/configuration.nix +++ b/hosts/goyplex-vm/configuration.nix @@ -1,10 +1,11 @@ -{ pkgs, ... }: +{ + pkgs, + ... +}: { imports = [ ./hardware-configuration.nix - ../../modules - ../../modules/k3s/k3s.nix ]; boot.loader.systemd-boot.enable = true; diff --git a/hosts/hermes-vm/configuration.nix b/hosts/hermes-vm/configuration.nix index 9203c1e..1f679a6 100644 --- a/hosts/hermes-vm/configuration.nix +++ b/hosts/hermes-vm/configuration.nix @@ -1,10 +1,11 @@ -{ pkgs, ... }: +{ + pkgs, + ... +}: { imports = [ ./hardware-configuration.nix - ../../modules - ../../modules/hermes ]; boot.loader.systemd-boot.enable = true; diff --git a/hosts/nixos-vm2/configuration.nix b/hosts/nixos-vm2/configuration.nix index fd54cb1..9b1c8dd 100644 --- a/hosts/nixos-vm2/configuration.nix +++ b/hosts/nixos-vm2/configuration.nix @@ -5,7 +5,6 @@ { imports = [ ./hardware-configuration.nix - ../../modules ]; boot.loader.grub.enable = true; diff --git a/hosts/qemu-vm/configuration.nix b/hosts/qemu-vm/configuration.nix index 866fe4e..62ebaa4 100644 --- a/hosts/qemu-vm/configuration.nix +++ b/hosts/qemu-vm/configuration.nix @@ -5,7 +5,6 @@ { imports = [ ./hardware-configuration.nix - ../../modules ]; boot.loader.grub.enable = true; diff --git a/modules/core/network.nix b/modules/core/network.nix index c102531..6bde584 100644 --- a/modules/core/network.nix +++ b/modules/core/network.nix @@ -3,4 +3,6 @@ { networking.hostName = host; networking.networkmanager.enable = true; + + services.netbird.enable = true; } diff --git a/modules/core/packages/dev.nix b/modules/core/packages/dev.nix index ee70dcc..80cda7d 100644 --- a/modules/core/packages/dev.nix +++ b/modules/core/packages/dev.nix @@ -5,6 +5,7 @@ neovim git tree-sitter + yamlfmt gcc # lua diff --git a/modules/core/zsh/.zshrc b/modules/core/zsh/.zshrc index 3274b22..b05ba80 100644 --- a/modules/core/zsh/.zshrc +++ b/modules/core/zsh/.zshrc @@ -17,7 +17,7 @@ alias gs='git status' alias hermes='docker exec -it -u hermes hermes-agent /data/current-package/bin/hermes' -alias hermes-age='cd /etc/rice-flakes/modules/hermes/secrets && sudo EDITOR=nvim agenix -e ./hermes-env.age -i /etc/ssh/ssh_host_ed25519_key' +alias hermes-age='cd /etc/rice-flakes/modules/hermes/secrets && sudo EDITOR=nvim agenix -e hermes-env.age -i /etc/ssh/ssh_host_ed25519_key' ga() { if [[ -z "$1" ]]; then diff --git a/modules/hermes/hermes.nix b/modules/hermes/hermes.nix index acdb3dc..0ed2df7 100644 --- a/modules/hermes/hermes.nix +++ b/modules/hermes/hermes.nix @@ -1,6 +1,7 @@ { inputs, config, + pkgs, ... }: @@ -14,6 +15,10 @@ config.age.secrets.hermes-env.path ]; + environment = { + BW_SERVERURL = "https://vault.archfox.org"; + }; + container = { image = "debian:bookworm"; backend = "docker"; @@ -24,6 +29,8 @@ "9119:9119" "-p" "8642:8642" + "-p" + "9120:9120" ]; }; @@ -34,7 +41,17 @@ mcp_reload_confirm = "false"; }; + gateway = { + multiplex_profiles = true; + }; + + delegation = { + model = "z-ai/glm-5.3-flash"; + provider = "nous"; + }; + memory = { + provider = "holographic"; memory_enabled = true; user_profile_enabled = true; }; @@ -43,11 +60,6 @@ credits_notices = true; }; - delegation = { - model = "openai/gpt-5.6-luna"; - provider = "nous"; - }; - discord = { group_sessions_per_user = false; reactions = false; @@ -55,9 +67,68 @@ }; }; + systemd.services.hermes-serve = { + description = "Hermes Agent Serve (desktop remote backend)"; + wantedBy = [ "multi-user.target" ]; + after = [ + "hermes-agent.service" + "network-online.target" + ]; + wants = [ "network-online.target" ]; + requires = [ "hermes-agent.service" ]; + + serviceConfig = { + Type = "simple"; + Restart = "always"; + RestartSec = 5; + TimeoutStopSec = 15; + }; + + script = '' + exec ${pkgs.docker}/bin/docker exec -i -u hermes \ + -e HERMES_HOME=/data/.hermes \ + -e HOME=/home/hermes \ + hermes-agent \ + /data/current-package/bin/hermes serve \ + --host 0.0.0.0 \ + --port 9120 + ''; + }; + + systemd.services.hermes-dashboard = { + description = "Hermes Agent Dashboard (web UI)"; + wantedBy = [ "multi-user.target" ]; + after = [ + "hermes-agent.service" + "network-online.target" + ]; + wants = [ "network-online.target" ]; + requires = [ "hermes-agent.service" ]; + + serviceConfig = { + Type = "simple"; + Restart = "always"; + RestartSec = 5; + TimeoutStopSec = 15; + }; + + script = '' + exec ${pkgs.docker}/bin/docker exec -i -u hermes \ + -e HERMES_HOME=/data/.hermes \ + -e HOME=/home/hermes \ + hermes-agent \ + /data/current-package/bin/hermes dashboard \ + --host 0.0.0.0 \ + --port 9121 \ + --no-open + ''; + }; + networking.firewall.allowedTCPPorts = [ 8080 9119 + 9120 + 9121 8642 ]; } diff --git a/modules/hermes/secrets/agenix.nix b/modules/hermes/secrets/agenix.nix index 182b916..02925cd 100644 --- a/modules/hermes/secrets/agenix.nix +++ b/modules/hermes/secrets/agenix.nix @@ -10,6 +10,6 @@ age.secrets."hermes-env".file = ./hermes-env.age; hjem.users.${username}.packages = with pkgs; [ - inputs.agenix.packages."${system}".default + inputs.agenix.packages."${pkgs.stdenv.hostPlatform.system}".default ]; } diff --git a/modules/hermes/secrets/hermes-env.age b/modules/hermes/secrets/hermes-env.age index 1583299..8c8124d 100644 Binary files a/modules/hermes/secrets/hermes-env.age and b/modules/hermes/secrets/hermes-env.age differ diff --git a/modules/k3s/k3s.nix b/modules/k3s/k3s.nix index 8eaa99c..d5310cc 100644 --- a/modules/k3s/k3s.nix +++ b/modules/k3s/k3s.nix @@ -1,22 +1,25 @@ { - networking.firewall.allowedTCPPorts = [ 6443 80 443 33073 ]; + networking.firewall.allowedTCPPorts = [ + 6443 + 80 + 443 + 8969 + 33073 + ]; networking.firewall.allowedUDPPorts = [ 3479 ]; services.k3s = { enable = true; role = "server"; extraFlags = "--write-kubeconfig-mode 644"; - manifests = { - traefik-namespace = { source = ./traefik/namespace.yaml; }; - traefik-rbac = { source = ./traefik/rbac.yaml; }; - traefik-pvc = { source = ./traefik/pvc.yaml; }; - traefik-deployment = { source = ./traefik/deployment.yaml; }; - traefik-service = { source = ./traefik/service.yaml; }; - netbird-namespace = { source = ./netbird/namespace.yaml; }; - netbird-config = { source = ./netbird/config.yaml; }; - netbird-server = { source = ./netbird/server.yaml; }; - netbird-dashboard = { source = ./netbird/dashboard.yaml; }; - netbird-ingress = { source = ./netbird/ingress.yaml; }; - }; + }; + + fileSystems."/var/lib/rancher/k3s/server/manifests/apps" = { + device = "/home/poslop/k3s/apps"; + fsType = "none"; + options = [ + "bind" + "ro" + ]; }; } diff --git a/modules/k3s/netbird/config.yaml b/modules/k3s/netbird/config.yaml deleted file mode 100644 index 285a2b9..0000000 --- a/modules/k3s/netbird/config.yaml +++ /dev/null @@ -1,45 +0,0 @@ -apiVersion: v1 -kind: ConfigMap -metadata: - name: netbird-server-config - namespace: netbird -data: - config.yaml: | - server: - listenAddress: ":80" - exposedAddress: "https://netbird.archfox.org:443" - metricsPort: 9090 - healthcheckAddress: ":9000" - logLevel: "info" - logFile: "console" - stunPorts: - - 3479 - tls: - certFile: "" - keyFile: "" - letsencrypt: - enabled: false - dataDir: "" - domains: [] - email: "" - awsRoute53: false - authSecret: "182c13eec94ba6ef89ce8f3e33b4694b051fe4b0bf6d2c9188f738d1c000b6d7" - dataDir: "/var/lib/netbird/" - disableAnonymousMetrics: false - disableGeoliteUpdate: false - auth: - issuer: "https://netbird.archfox.org/oauth2" - localAuthDisabled: false - signKeyRefreshEnabled: true - dashboardRedirectURIs: - - "https://netbird.archfox.org/nb-auth" - - "https://netbird.archfox.org/nb-silent-auth" - cliRedirectURIs: - - "http://localhost:53000/" - store: - engine: "sqlite" - dsn: "" - encryptionKey: "" - reverseProxy: - trustedHTTPProxies: - - "10.0.1.45/32" diff --git a/modules/k3s/netbird/dashboard.yaml b/modules/k3s/netbird/dashboard.yaml deleted file mode 100644 index 3766dfa..0000000 --- a/modules/k3s/netbird/dashboard.yaml +++ /dev/null @@ -1,56 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: dashboard - namespace: netbird -spec: - replicas: 1 - selector: - matchLabels: - app: dashboard - template: - metadata: - labels: - app: dashboard - spec: - containers: - - name: dashboard - image: netbirdio/dashboard:latest - ports: - - containerPort: 80 - env: - - name: NETBIRD_MGMT_API_ENDPOINT - value: "https://netbird.archfox.org" - - name: NETBIRD_MGMT_GRPC_API_ENDPOINT - value: "https://netbird.archfox.org" - - name: AUTH_AUDIENCE - value: "netbird-dashboard" - - name: AUTH_CLIENT_ID - value: "netbird-dashboard" - - name: AUTH_CLIENT_SECRET - value: "" - - name: AUTH_AUTHORITY - value: "https://netbird.archfox.org/oauth2" - - name: USE_AUTH0 - value: "false" - - name: AUTH_SUPPORTED_SCOPES - value: "openid profile email groups" - - name: AUTH_REDIRECT_URI - value: "/nb-auth" - - name: AUTH_SILENT_REDIRECT_URI - value: "/nb-silent-auth" - - name: LETSENCRYPT_DOMAIN - value: "none" ---- -apiVersion: v1 -kind: Service -metadata: - name: dashboard - namespace: netbird -spec: - selector: - app: dashboard - ports: - - name: http - port: 80 - targetPort: 80 diff --git a/modules/k3s/netbird/ingress.yaml b/modules/k3s/netbird/ingress.yaml deleted file mode 100644 index 0a8c46d..0000000 --- a/modules/k3s/netbird/ingress.yaml +++ /dev/null @@ -1,26 +0,0 @@ -apiVersion: traefik.io/v1alpha1 -kind: IngressRoute -metadata: - name: netbird - namespace: netbird -spec: - entryPoints: - - web - routes: - - match: Host(`netbird.archfox.org`) && (PathPrefix(`/management.ManagementService/`) || PathPrefix(`/signalexchange.SignalExchange/`) || PathPrefix(`/management.ProxyService/`)) - kind: Rule - services: - - name: netbird-server - port: 80 - scheme: h2c - - match: Host(`netbird.archfox.org`) && (PathPrefix(`/relay`) || PathPrefix(`/ws-proxy/`) || PathPrefix(`/api`) || PathPrefix(`/oauth2`)) - kind: Rule - services: - - name: netbird-server - port: 80 - - match: Host(`netbird.archfox.org`) - kind: Rule - priority: 1 - services: - - name: dashboard - port: 80 diff --git a/modules/k3s/netbird/namespace.yaml b/modules/k3s/netbird/namespace.yaml deleted file mode 100644 index db05a13..0000000 --- a/modules/k3s/netbird/namespace.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: netbird diff --git a/modules/k3s/netbird/server.yaml b/modules/k3s/netbird/server.yaml deleted file mode 100644 index 4b954e2..0000000 --- a/modules/k3s/netbird/server.yaml +++ /dev/null @@ -1,74 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: netbird-server - namespace: netbird -spec: - replicas: 1 - selector: - matchLabels: - app: netbird-server - template: - metadata: - labels: - app: netbird-server - spec: - containers: - - name: netbird-server - image: netbirdio/netbird-server:latest - args: ["--config", "/etc/netbird/config.yaml"] - ports: - - containerPort: 80 - - containerPort: 3479 - protocol: UDP - - containerPort: 33073 - env: - - name: NETBIRD_STORE_ENCRYPTION_KEY - valueFrom: - secretKeyRef: - name: netbird-encryption - key: encryptionKey - volumeMounts: - - name: config - mountPath: /etc/netbird - - name: data - mountPath: /var/lib/netbird - volumes: - - name: config - configMap: - name: netbird-server-config - - name: data - persistentVolumeClaim: - claimName: netbird-data ---- -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: netbird-data - namespace: netbird -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 2Gi ---- -apiVersion: v1 -kind: Service -metadata: - name: netbird-server - namespace: netbird -spec: - selector: - app: netbird-server - ports: - - name: http - port: 80 - targetPort: 80 - - name: grpc-compat - port: 33073 - targetPort: 33073 - - name: stun - port: 3479 - targetPort: 3479 - protocol: UDP diff --git a/modules/k3s/traefik/deployment.yaml b/modules/k3s/traefik/deployment.yaml deleted file mode 100644 index 7dcca15..0000000 --- a/modules/k3s/traefik/deployment.yaml +++ /dev/null @@ -1,35 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: traefik - namespace: traefik -spec: - replicas: 1 - selector: - matchLabels: - app: traefik - template: - metadata: - labels: - app: traefik - spec: - serviceAccountName: traefik - containers: - - name: traefik - image: traefik:v3.4 - args: - - --log.level=INFO - - --api.dashboard=true - - --entrypoints.web.address=:80 - - --providers.kubernetescrd=true - - --providers.kubernetesingress=true - ports: - - name: web - containerPort: 80 - volumeMounts: - - name: acme-storage - mountPath: /data - volumes: - - name: acme-storage - persistentVolumeClaim: - claimName: traefik-acme diff --git a/modules/k3s/traefik/namespace.yaml b/modules/k3s/traefik/namespace.yaml deleted file mode 100644 index c088a91..0000000 --- a/modules/k3s/traefik/namespace.yaml +++ /dev/null @@ -1,4 +0,0 @@ -apiVersion: v1 -kind: Namespace -metadata: - name: traefik diff --git a/modules/k3s/traefik/pvc.yaml b/modules/k3s/traefik/pvc.yaml deleted file mode 100644 index 46187de..0000000 --- a/modules/k3s/traefik/pvc.yaml +++ /dev/null @@ -1,11 +0,0 @@ -apiVersion: v1 -kind: PersistentVolumeClaim -metadata: - name: traefik-acme - namespace: traefik -spec: - accessModes: - - ReadWriteOnce - resources: - requests: - storage: 128Mi diff --git a/modules/k3s/traefik/rbac.yaml b/modules/k3s/traefik/rbac.yaml deleted file mode 100644 index a10b9eb..0000000 --- a/modules/k3s/traefik/rbac.yaml +++ /dev/null @@ -1,41 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - name: traefik - namespace: traefik ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRole -metadata: - name: traefik -rules: - - apiGroups: [""] - resources: ["services", "endpoints", "secrets", "configmaps", "nodes", "namespaces", "pods"] - verbs: ["get", "list", "watch"] - - apiGroups: ["discovery.k8s.io"] - resources: ["endpointslices"] - verbs: ["get", "list", "watch"] - - apiGroups: ["extensions", "networking.k8s.io"] - resources: ["ingresses", "ingressclasses"] - verbs: ["get", "list", "watch"] - - apiGroups: ["extensions", "networking.k8s.io"] - resources: ["ingresses/status"] - verbs: ["update"] - - apiGroups: ["traefik.io"] - resources: ["ingressroutes", "ingressroutetcps", "ingressrouteudps", "middlewares", - "middlewaretcps", "tlsoptions", "tlsstores", "traefikservices", - "serverstransports", "serverstransporttcps"] - verbs: ["get", "list", "watch"] ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: ClusterRoleBinding -metadata: - name: traefik -roleRef: - apiGroup: rbac.authorization.k8s.io - kind: ClusterRole - name: traefik -subjects: - - kind: ServiceAccount - name: traefik - namespace: traefik diff --git a/modules/k3s/traefik/service.yaml b/modules/k3s/traefik/service.yaml deleted file mode 100644 index 04377c8..0000000 --- a/modules/k3s/traefik/service.yaml +++ /dev/null @@ -1,16 +0,0 @@ -apiVersion: v1 -kind: Service -metadata: - name: traefik - namespace: traefik -spec: - type: LoadBalancer - selector: - app: traefik - ports: - - name: web - port: 80 - targetPort: 80 - - name: websecure - port: 443 - targetPort: 443 diff --git a/roles/core.nix b/roles/core.nix new file mode 100644 index 0000000..5db7cb9 --- /dev/null +++ b/roles/core.nix @@ -0,0 +1,6 @@ +{ + # shared baseline: core system + home manager config + imports = [ + ../modules + ]; +} diff --git a/roles/hermes.nix b/roles/hermes.nix new file mode 100644 index 0000000..ebe73a8 --- /dev/null +++ b/roles/hermes.nix @@ -0,0 +1,7 @@ +{ + # hermes agent host: core + hermes container + secrets + imports = [ + ./core.nix + ../modules/hermes + ]; +} diff --git a/roles/k3s-server.nix b/roles/k3s-server.nix new file mode 100644 index 0000000..e7331bb --- /dev/null +++ b/roles/k3s-server.nix @@ -0,0 +1,7 @@ +{ + # k3s server node (goyplex-vm): k3s + manifests + firewall + imports = [ + ./core.nix + ../modules/k3s/k3s.nix + ]; +}