From e10e22df4be8752d87ea3b387a1ed8264e42b4ea Mon Sep 17 00:00:00 2001 From: Lzebulon Date: Tue, 21 Jul 2026 15:40:54 +0200 Subject: [PATCH 01/15] start integration of a info.nix --- flake.nix | 167 ++++++++++++++++++++---------- hosts/physiques/thot/default.nix | 14 --- hosts/physiques/thot/info.nix | 17 +++ hosts/vm/apprentix/default.nix | 15 --- hosts/vm/apprentix/info.nix | 17 +++ hosts/vm/collabora/default.nix | 11 -- hosts/vm/collabora/info.nix | 14 +++ hosts/vm/jitsi/default.nix | 18 ---- hosts/vm/jitsi/info.nix | 26 +++++ hosts/vm/livre/default.nix | 11 -- hosts/vm/livre/info.nix | 14 +++ hosts/vm/neo/default.nix | 19 ---- hosts/vm/neo/info.nix | 20 ++++ hosts/vm/nextcloud/default.nix | 19 ---- hosts/vm/nextcloud/info.nix | 22 ++++ hosts/vm/periodique/default.nix | 11 -- hosts/vm/periodique/info.nix | 14 +++ hosts/vm/redite/default.nix | 11 -- hosts/vm/redite/info.nix | 13 +++ hosts/vm/reverseproxy/default.nix | 17 --- hosts/vm/reverseproxy/info.nix | 20 ++++ hosts/vm/two/default.nix | 13 --- hosts/vm/two/info.nix | 16 +++ hosts/vm/vaultwarden/default.nix | 11 -- hosts/vm/vaultwarden/info.nix | 13 +++ modules/crans/default.nix | 1 + modules/crans/extra.nix | 32 ++++++ modules/crans/networking.nix | 18 ++-- modules/crans/remote_builder.nix | 18 ++++ 29 files changed, 375 insertions(+), 237 deletions(-) create mode 100644 hosts/physiques/thot/info.nix create mode 100644 hosts/vm/apprentix/info.nix create mode 100644 hosts/vm/collabora/info.nix create mode 100644 hosts/vm/jitsi/info.nix create mode 100644 hosts/vm/livre/info.nix create mode 100644 hosts/vm/neo/info.nix create mode 100644 hosts/vm/nextcloud/info.nix create mode 100644 hosts/vm/periodique/info.nix create mode 100644 hosts/vm/redite/info.nix create mode 100644 hosts/vm/reverseproxy/info.nix create mode 100644 hosts/vm/two/info.nix create mode 100644 hosts/vm/vaultwarden/info.nix create mode 100644 modules/crans/extra.nix create mode 100644 modules/crans/remote_builder.nix diff --git a/flake.nix b/flake.nix index 757108a..e15ed12 100644 --- a/flake.nix +++ b/flake.nix @@ -38,75 +38,130 @@ ./modules agenix.nixosModules.default ]; + get_hosts_names = path: + attrNames ( + attrsets.filterAttrs (name: type: type == "directory") + (readDir path) + ) ; + hostVM = get_hosts_names ./hosts/vm; + hostPhysique = get_hosts_names ./hosts/physiques; + get_info = + path: lists: + filter (x: x != null) + (map (name: + let filePath = path + "/${name}/info.nix"; + in + if builtins.pathExists filePath then + # let eval = evalModules { + # modules = [ + # # ./modules/crans + # { + # crans = import filePath; + # } + # agenix.nixosModules.default + # ]; + # }; + # in + # eval.config + { + crans = import filePath; + } + else + warn "${toString filePath} not found" null + ) lists + ); + hosts_vm_info = get_info ./hosts/vm hostVM; + hosts_physique_info = get_info ./hosts/physiques hostPhysique; + + listInfoToAttrs = + path: infos: + listToAttrs ( + map (info: + { + name = info.crans.name; + value = + nixosSystem { + specialArgs = inputs; + modules = [(path + "/${info.crans.name}")] ++ [info] ++ baseModules + ; + }; + } + ) infos) + ; + attrs_vm_info = listInfoToAttrs ./hosts/vm hosts_vm_info; + attrs_physique_info = listInfoToAttrs ./hosts/physiques hosts_physique_info; + attrs_all_info = attrs_physique_info // attrs_vm_info; in + attrs_all_info + // { - apprentix = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/apprentix ] ++ baseModules; - }; + # apprentix = nixosSystem { + # specialArgs = inputs; + # modules = [ ./hosts/vm/apprentix ] ++ baseModules; + # }; - collabora = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/collabora ] ++ baseModules; - }; + # collabora = nixosSystem { + # specialArgs = inputs; + # modules = [ ./hosts/vm/collabora ] ++ baseModules; + # }; - jitsi = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/jitsi ] ++ baseModules; - }; + # jitsi = nixosSystem { + # specialArgs = inputs; + # modules = [ ./hosts/vm/jitsi ] ++ baseModules; + # }; - livre = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/livre ] ++ baseModules; - }; + # livre = nixosSystem { + # specialArgs = inputs; + # modules = [ ./hosts/vm/livre ] ++ baseModules; + # }; - neo = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/neo ] ++ baseModules; - }; + # neo = nixosSystem { + # specialArgs = inputs; + # modules = [ ./hosts/vm/neo ] ++ baseModules; + # }; - nextcloud = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/nextcloud ] ++ baseModules; - }; + # nextcloud = nixosSystem { + # specialArgs = inputs; + # modules = [ ./hosts/vm/nextcloud ] ++ baseModules; + # }; - periodique = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/periodique ] ++ baseModules; - }; + # periodique = nixosSystem { + # specialArgs = inputs; + # modules = [ ./hosts/vm/periodique ] ++ baseModules; + # }; - redite = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/redite ] ++ baseModules; - }; + # redite = nixosSystem { + # specialArgs = inputs; + # modules = [ ./hosts/vm/redite ] ++ baseModules; + # }; - reverseproxy = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/reverseproxy ] ++ baseModules; - }; + # reverseproxy = nixosSystem { + # specialArgs = inputs; + # modules = [ ./hosts/vm/reverseproxy ] ++ baseModules; + # }; - thot = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/physiques/thot ] ++ baseModules; - }; + # thot = nixosSystem { + # specialArgs = inputs; + # modules = [ ./hosts/physiques/thot ] ++ baseModules; + # }; - two = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/two ] ++ baseModules; - }; + # two = nixosSystem { + # specialArgs = inputs; + # modules = [ ./hosts/vm/two ] ++ baseModules; + # }; - vaultwarden = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/vaultwarden ] ++ baseModules; - }; - cransIso = nixosSystem { - system = "x86_64-linux"; - specialArgs = inputs; - modules = [ - ./hosts/iso - ./modules/crans/locale.nix - ]; - }; + # vaultwarden = nixosSystem { + # specialArgs = inputs; + # modules = [ ./hosts/vm/vaultwarden ] ++ baseModules; + # }; + # cransIso = nixosSystem { + # system = "x86_64-linux"; + # specialArgs = inputs; + # modules = [ + # ./hosts/iso + # ./modules/crans/locale.nix + # ]; + # }; }; }; diff --git a/hosts/physiques/thot/default.nix b/hosts/physiques/thot/default.nix index 80d4f99..27f44b4 100644 --- a/hosts/physiques/thot/default.nix +++ b/hosts/physiques/thot/default.nix @@ -38,19 +38,5 @@ restic ]; - crans = { - enable = true; - - networking.adm.enable = false; - resticClient.enable = false; - - services = { - resticServer = { - enable = true; - port = 4242; - }; - }; - }; - system.stateVersion = "24.05"; } diff --git a/hosts/physiques/thot/info.nix b/hosts/physiques/thot/info.nix new file mode 100644 index 0000000..e45b6db --- /dev/null +++ b/hosts/physiques/thot/info.nix @@ -0,0 +1,17 @@ +{ + name = "thot"; + description = "Serveur de backup sous nixos utilisant Restic"; + id = 14; + + enable = true; + + networking.adm.enable = false; + resticClient.enable = false; + + services = { + resticServer = { + enable = true; + port = 4242; + }; + }; +} diff --git a/hosts/vm/apprentix/default.nix b/hosts/vm/apprentix/default.nix index 4e67e57..1525c72 100644 --- a/hosts/vm/apprentix/default.nix +++ b/hosts/vm/apprentix/default.nix @@ -9,21 +9,6 @@ networking.hostName = "apprentix"; - crans = { - enable = true; - - networking = { - id = 150; - srvNat.enable = true; - }; - - resticClient.when = "01:23"; - - homeNounou.enable = false; - - users.root.passwordFile = ../../../secrets/apprentix/root.age; - }; - security.sudo.extraRules = [ { groups = [ "_user" ]; diff --git a/hosts/vm/apprentix/info.nix b/hosts/vm/apprentix/info.nix new file mode 100644 index 0000000..22e47f2 --- /dev/null +++ b/hosts/vm/apprentix/info.nix @@ -0,0 +1,17 @@ +{ + name = "apprentix"; + description = "VM pour les apprenti⋅es"; + id = 150; + + enable = true; + + networking = { + srvNat.enable = true; + }; + + resticClient.when = "01:23"; + + homeNounou.enable = false; + + users.root.passwordFile = ../../../secrets/apprentix/root.age; +} diff --git a/hosts/vm/collabora/default.nix b/hosts/vm/collabora/default.nix index 46fbc66..4d0a67f 100644 --- a/hosts/vm/collabora/default.nix +++ b/hosts/vm/collabora/default.nix @@ -9,16 +9,5 @@ networking.hostName = "collabora"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - - networking = { - id = 149; - srvNat.enable = true; - }; - - resticClient.enable = false; - }; - system.stateVersion = "25.09"; } diff --git a/hosts/vm/collabora/info.nix b/hosts/vm/collabora/info.nix new file mode 100644 index 0000000..85052e9 --- /dev/null +++ b/hosts/vm/collabora/info.nix @@ -0,0 +1,14 @@ +{ + name = "collabora"; + description = "Collabora du Crans"; + id = 149; + + enable = true; + + networking = { + srvNat.enable = true; + }; + + resticClient.enable = false; +} + diff --git a/hosts/vm/jitsi/default.nix b/hosts/vm/jitsi/default.nix index 518a948..120bd48 100644 --- a/hosts/vm/jitsi/default.nix +++ b/hosts/vm/jitsi/default.nix @@ -9,23 +9,5 @@ networking.hostName = "jitsi"; boot.loader.grub.devices = [ "/dev/vda" ]; - crans = { - enable = true; - - networking = { - id = 163; - srv = { - enable = true; - ipv4 = "185.230.79.15"; - }; - }; - - resticClient.when = "02:34"; - - services = { - acme.enable = true; - }; - }; - system.stateVersion = "24.11"; } diff --git a/hosts/vm/jitsi/info.nix b/hosts/vm/jitsi/info.nix new file mode 100644 index 0000000..64e9044 --- /dev/null +++ b/hosts/vm/jitsi/info.nix @@ -0,0 +1,26 @@ +{ + name = "jitsi"; + description = "Machine qui gère Jitsi"; + + id = 163; + + networking = { + srv = { + enable = true; + ipv4 = "185.230.79.15"; + }; + }; + + resticClient.when = "02:34"; + + services = { + acme.enable = true; + }; + + # aliasDNS = [ + # "visio" + # ]; + + public-ssh = ""; + +} diff --git a/hosts/vm/livre/default.nix b/hosts/vm/livre/default.nix index 9b669a9..1a76e79 100644 --- a/hosts/vm/livre/default.nix +++ b/hosts/vm/livre/default.nix @@ -9,16 +9,5 @@ networking.hostName = "livre"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - - networking = { - id = 140; - srvNat.enable = true; - }; - - resticClient.when = "03:45"; - }; - system.stateVersion = "24.11"; } diff --git a/hosts/vm/livre/info.nix b/hosts/vm/livre/info.nix new file mode 100644 index 0000000..7eba0c0 --- /dev/null +++ b/hosts/vm/livre/info.nix @@ -0,0 +1,14 @@ +{ + name = "livre"; + description = "Editeur de PDF en ligne via Stirling-PDF"; + id = 140; + + enable = true; + + networking = { + srvNat.enable = true; + }; + + resticClient.when = "03:45"; +} + diff --git a/hosts/vm/neo/default.nix b/hosts/vm/neo/default.nix index f2f99ae..c5aaf5f 100644 --- a/hosts/vm/neo/default.nix +++ b/hosts/vm/neo/default.nix @@ -12,24 +12,5 @@ networking.hostName = "neo"; - crans = { - enable = true; - - networking = { - id = 141; - srv = { - enable = true; - ipv4 = "185.230.79.5"; - }; - }; - - resticClient.when = "04:56"; - - services = { - acme.enable = true; - coturn.enable = true; - }; - }; - system.stateVersion = "24.11"; } diff --git a/hosts/vm/neo/info.nix b/hosts/vm/neo/info.nix new file mode 100644 index 0000000..e234b09 --- /dev/null +++ b/hosts/vm/neo/info.nix @@ -0,0 +1,20 @@ +{ + name = "neo"; + description = "Matrix du Crans et bridge IRC/Matrix"; + enable = true; + id = 141; + + networking = { + srv = { + enable = true; + ipv4 = "185.230.79.5"; + }; + }; + + resticClient.when = "04:56"; + + services = { + acme.enable = true; + coturn.enable = true; + }; +} diff --git a/hosts/vm/nextcloud/default.nix b/hosts/vm/nextcloud/default.nix index 99c1ae6..4c96991 100644 --- a/hosts/vm/nextcloud/default.nix +++ b/hosts/vm/nextcloud/default.nix @@ -9,25 +9,6 @@ networking.hostName = "nextcloud"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - networking = { - id = 146; - srvNat = { - enable = true; - interface = "ens20"; - }; - san = { - enable = true; - interface = "ens19"; - }; - }; - - homeAdh.enable = true; - - resticClient.enable = false; - }; - services.autofs = { enable = true; diff --git a/hosts/vm/nextcloud/info.nix b/hosts/vm/nextcloud/info.nix new file mode 100644 index 0000000..d23079d --- /dev/null +++ b/hosts/vm/nextcloud/info.nix @@ -0,0 +1,22 @@ +{ + name = "nextcloud"; + description = "Nextcloud du Crans"; + id = 146; + + enable = true; + + networking = { + srvNat = { + enable = true; + interface = "ens20"; + }; + san = { + enable = true; + interface = "ens19"; + }; + }; + + homeAdh.enable = true; + + resticClient.enable = false; +} diff --git a/hosts/vm/periodique/default.nix b/hosts/vm/periodique/default.nix index d66df0b..82cd023 100644 --- a/hosts/vm/periodique/default.nix +++ b/hosts/vm/periodique/default.nix @@ -9,16 +9,5 @@ networking.hostName = "periodique"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - - networking = { - id = 118; - srvNat.enable = true; - }; - - resticClient.when = "02:56"; - }; - system.stateVersion = "24.11"; } diff --git a/hosts/vm/periodique/info.nix b/hosts/vm/periodique/info.nix new file mode 100644 index 0000000..faf99e8 --- /dev/null +++ b/hosts/vm/periodique/info.nix @@ -0,0 +1,14 @@ +{ + name = "periodique"; + description = "Frontend Matrix du Crans (element)"; + id = 118; + + enable = true; + + networking = { + srvNat.enable = true; + }; + + resticClient.when = "02:56"; +} + diff --git a/hosts/vm/redite/default.nix b/hosts/vm/redite/default.nix index 45dea89..e80b4e7 100644 --- a/hosts/vm/redite/default.nix +++ b/hosts/vm/redite/default.nix @@ -9,16 +9,5 @@ networking.hostName = "redite"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - - networking = { - id = 139; - srvNat.enable = true; - }; - - resticClient.when = "06:18"; - }; - system.stateVersion = "23.11"; } diff --git a/hosts/vm/redite/info.nix b/hosts/vm/redite/info.nix new file mode 100644 index 0000000..78094da --- /dev/null +++ b/hosts/vm/redite/info.nix @@ -0,0 +1,13 @@ +{ + name = "redite"; + description = "Frontend reddit libre"; + id = 139; + + enable = true; + + networking = { + srvNat.enable = true; + }; + + resticClient.when = "06:18"; +} diff --git a/hosts/vm/reverseproxy/default.nix b/hosts/vm/reverseproxy/default.nix index 4c56498..c4e0f27 100644 --- a/hosts/vm/reverseproxy/default.nix +++ b/hosts/vm/reverseproxy/default.nix @@ -13,22 +13,5 @@ users.users."nginx".home = "/var/lib/nginx"; users.users."anubis".extraGroups = [ "nginx" ]; - crans = { - enable = true; - - networking = { - id = 151; - srvNat.enable = true; - srv = { - enable = true; - interface = "ens20"; - ipv4 = "185.230.79.42"; - }; - }; - - resticClient.when = "03:42"; - - }; - system.stateVersion = "25.05"; } diff --git a/hosts/vm/reverseproxy/info.nix b/hosts/vm/reverseproxy/info.nix new file mode 100644 index 0000000..4481c49 --- /dev/null +++ b/hosts/vm/reverseproxy/info.nix @@ -0,0 +1,20 @@ +{ + name = "reverseproxy"; + description = "reverse-proxy principale du Crans"; + id = 151; + + enable = true; + + networking = { + srvNat.enable = true; + srv = { + enable = true; + interface = "ens20"; + ipv4 = "185.230.79.42"; + }; + }; + + resticClient.when = "03:42"; + +} + diff --git a/hosts/vm/two/default.nix b/hosts/vm/two/default.nix index a87ebcd..0a71c71 100644 --- a/hosts/vm/two/default.nix +++ b/hosts/vm/two/default.nix @@ -8,19 +8,6 @@ networking.hostName = "two"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - - networking = { - id = 135; - srvNat = { - enable = true; - interface = "ens19"; - }; - }; - - resticClient.when = "07:29"; - }; system.stateVersion = "23.11"; } diff --git a/hosts/vm/two/info.nix b/hosts/vm/two/info.nix new file mode 100644 index 0000000..2b833b5 --- /dev/null +++ b/hosts/vm/two/info.nix @@ -0,0 +1,16 @@ +{ + name = "two"; + description = "VM de test"; + id = 135; + + enable = true; + + networking = { + srvNat = { + enable = true; + interface = "ens19"; + }; + }; + + resticClient.when = "07:29"; +} diff --git a/hosts/vm/vaultwarden/default.nix b/hosts/vm/vaultwarden/default.nix index 523b73d..d98caf8 100644 --- a/hosts/vm/vaultwarden/default.nix +++ b/hosts/vm/vaultwarden/default.nix @@ -9,16 +9,5 @@ networking.hostName = "vaultwarden"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - - networking = { - id = 159; - srvNat.enable = true; - }; - - resticClient.when = "04:44"; - }; - system.stateVersion = "24.05"; } diff --git a/hosts/vm/vaultwarden/info.nix b/hosts/vm/vaultwarden/info.nix new file mode 100644 index 0000000..953a611 --- /dev/null +++ b/hosts/vm/vaultwarden/info.nix @@ -0,0 +1,13 @@ +{ + name = "vaultwarden"; + description = "Vaultarden du crans, gestionnaire de mot de passe"; + id = 159; + + enable = true; + + networking = { + srvNat.enable = true; + }; + + resticClient.when = "04:44"; +} diff --git a/modules/crans/default.nix b/modules/crans/default.nix index cf9f2ea..ff29544 100644 --- a/modules/crans/default.nix +++ b/modules/crans/default.nix @@ -8,6 +8,7 @@ in { imports = [ ./age.nix + ./extra.nix ./grub.nix ./home.nix ./locale.nix diff --git a/modules/crans/extra.nix b/modules/crans/extra.nix new file mode 100644 index 0000000..e782292 --- /dev/null +++ b/modules/crans/extra.nix @@ -0,0 +1,32 @@ +{ lib, ... }: +with lib; +{ + options.crans = { + name = mkOption { + type = types.str; + example = "vm-test"; + description = "Nom de la machine"; + }; + + description = mkOption { + type = types.str; + example = "VM de test"; + description = "Description de la machine"; + }; + + id = mkOption { + type = types.int; + example = 135; + description = """ + ID de la machine : + - < 100 machine physique + - >= 100 VM ( id de la VM dans proxmox ) + """; + }; + + public-ssh = mkOption { + type = types.str; + description = "Clé ssh public de la machine"; + }; + }; +} diff --git a/modules/crans/networking.nix b/modules/crans/networking.nix index 60ac51e..ca220d3 100644 --- a/modules/crans/networking.nix +++ b/modules/crans/networking.nix @@ -1,7 +1,8 @@ { lib, config, ... }: let - cfg = config.crans.networking; + cfg = config.crans; + cfg-net = cfg.networking; inherit (lib) mkEnableOption @@ -20,12 +21,6 @@ in options.crans.networking = { enable = mkEnableOption "Configuration réseaux commune à toutes les machines du Crans."; - id = mkOption { - type = types.int; - example = 135; - description = "Le numéro de la VM dans Proxmox."; - }; - adm = { enable = mkEnableOption "Configuration du VLAN adm."; @@ -76,8 +71,9 @@ in }; }; - config = mkIf cfg.enable { + config = mkIf cfg-net.enable { networking = { + hostName = cfg.name; useDHCP = false; firewall.enable = lib.mkDefault false; nameservers = [ "172.16.10.128" ]; @@ -92,12 +88,12 @@ in # plus bas). lib.attrsets.mapAttrs' (interface: conf: { - name = cfg."${interface}".interface; + name = cfg-net."${interface}".interface; value = conf; }) ( # On filtre sur les interfaces activées - lib.attrsets.filterAttrs (interface: _: cfg."${interface}".enable) { + lib.attrsets.filterAttrs (interface: _: cfg-net."${interface}".enable) { # Configuration du VLAN adm adm = { ipv4.addresses = [ @@ -120,7 +116,7 @@ in ipv4 = { addresses = [ { - address = cfg.srv.ipv4; + address = cfg-net.srv.ipv4; prefixLength = 26; } ]; diff --git a/modules/crans/remote_builder.nix b/modules/crans/remote_builder.nix new file mode 100644 index 0000000..06995d5 --- /dev/null +++ b/modules/crans/remote_builder.nix @@ -0,0 +1,18 @@ +{ config, pkgs, ...}: +{ + nix.buildMachines = [{ + hostName = "cephiroth.adm.crans.org"; + system = "x86_64-linux"; + + maxJobs = 2; + speedFactor = 2; + + supportedFeatures = [ "kvm" "big-parallel" ]; + }]; + + nix.distributedBuilds = true; + + nix.extraOptions = '' + builders-use-substitutes = true + ''; +} From 7a4a151ef4dc577978b7ece911ec3c49a5578cad Mon Sep 17 00:00:00 2001 From: Lzebulon Date: Tue, 21 Jul 2026 16:16:33 +0200 Subject: [PATCH 02/15] clean --- flake.nix | 75 ++++---------------------------- modules/crans/remote_builder.nix | 18 -------- 2 files changed, 8 insertions(+), 85 deletions(-) delete mode 100644 modules/crans/remote_builder.nix diff --git a/flake.nix b/flake.nix index e15ed12..41505be 100644 --- a/flake.nix +++ b/flake.nix @@ -95,73 +95,14 @@ attrs_all_info // { - # apprentix = nixosSystem { - # specialArgs = inputs; - # modules = [ ./hosts/vm/apprentix ] ++ baseModules; - # }; - - # collabora = nixosSystem { - # specialArgs = inputs; - # modules = [ ./hosts/vm/collabora ] ++ baseModules; - # }; - - # jitsi = nixosSystem { - # specialArgs = inputs; - # modules = [ ./hosts/vm/jitsi ] ++ baseModules; - # }; - - # livre = nixosSystem { - # specialArgs = inputs; - # modules = [ ./hosts/vm/livre ] ++ baseModules; - # }; - - # neo = nixosSystem { - # specialArgs = inputs; - # modules = [ ./hosts/vm/neo ] ++ baseModules; - # }; - - # nextcloud = nixosSystem { - # specialArgs = inputs; - # modules = [ ./hosts/vm/nextcloud ] ++ baseModules; - # }; - - # periodique = nixosSystem { - # specialArgs = inputs; - # modules = [ ./hosts/vm/periodique ] ++ baseModules; - # }; - - # redite = nixosSystem { - # specialArgs = inputs; - # modules = [ ./hosts/vm/redite ] ++ baseModules; - # }; - - # reverseproxy = nixosSystem { - # specialArgs = inputs; - # modules = [ ./hosts/vm/reverseproxy ] ++ baseModules; - # }; - - # thot = nixosSystem { - # specialArgs = inputs; - # modules = [ ./hosts/physiques/thot ] ++ baseModules; - # }; - - # two = nixosSystem { - # specialArgs = inputs; - # modules = [ ./hosts/vm/two ] ++ baseModules; - # }; - - # vaultwarden = nixosSystem { - # specialArgs = inputs; - # modules = [ ./hosts/vm/vaultwarden ] ++ baseModules; - # }; - # cransIso = nixosSystem { - # system = "x86_64-linux"; - # specialArgs = inputs; - # modules = [ - # ./hosts/iso - # ./modules/crans/locale.nix - # ]; - # }; + cransIso = nixosSystem { + system = "x86_64-linux"; + specialArgs = inputs; + modules = [ + ./hosts/iso + ./modules/crans/locale.nix + ]; + }; }; }; diff --git a/modules/crans/remote_builder.nix b/modules/crans/remote_builder.nix deleted file mode 100644 index 06995d5..0000000 --- a/modules/crans/remote_builder.nix +++ /dev/null @@ -1,18 +0,0 @@ -{ config, pkgs, ...}: -{ - nix.buildMachines = [{ - hostName = "cephiroth.adm.crans.org"; - system = "x86_64-linux"; - - maxJobs = 2; - speedFactor = 2; - - supportedFeatures = [ "kvm" "big-parallel" ]; - }]; - - nix.distributedBuilds = true; - - nix.extraOptions = '' - builders-use-substitutes = true - ''; -} From 80c51572c26c7f3b3efa4190ae7c313c936b1f63 Mon Sep 17 00:00:00 2001 From: Lzebulon Date: Sat, 25 Jul 2026 17:21:34 +0200 Subject: [PATCH 03/15] add info.nix pour les machines physiques --- flake.nix | 22 ++++++---- hosts/physiques/cameron/info.nix | 22 ++++++++++ hosts/physiques/cephiroth/info.nix | 20 +++++++++ hosts/physiques/daniel/info.nix | 23 ++++++++++ hosts/physiques/ft/info.nix | 17 ++++++++ hosts/physiques/gulp/info.nix | 22 ++++++++++ hosts/physiques/jack/info.nix | 24 +++++++++++ hosts/physiques/odlyd/info.nix | 21 +++++++++ hosts/physiques/sam/info.nix | 23 ++++++++++ hosts/physiques/stitch/info.nix | 22 ++++++++++ hosts/physiques/tealc/info.nix | 22 ++++++++++ hosts/physiques/zamok/info.nix | 23 ++++++++++ hosts/vm/jitsi/info.nix | 1 + modules/crans/networking.nix | 69 ++++++++++++++++++++++++++---- modules/crans/users.nix | 2 +- 15 files changed, 315 insertions(+), 18 deletions(-) create mode 100644 hosts/physiques/cameron/info.nix create mode 100644 hosts/physiques/cephiroth/info.nix create mode 100644 hosts/physiques/daniel/info.nix create mode 100644 hosts/physiques/ft/info.nix create mode 100644 hosts/physiques/gulp/info.nix create mode 100644 hosts/physiques/jack/info.nix create mode 100644 hosts/physiques/odlyd/info.nix create mode 100644 hosts/physiques/sam/info.nix create mode 100644 hosts/physiques/stitch/info.nix create mode 100644 hosts/physiques/tealc/info.nix create mode 100644 hosts/physiques/zamok/info.nix diff --git a/flake.nix b/flake.nix index 41505be..826d504 100644 --- a/flake.nix +++ b/flake.nix @@ -53,12 +53,13 @@ in if builtins.pathExists filePath then # let eval = evalModules { + # specialArgs = inputs; # modules = [ - # # ./modules/crans + # ./modules/crans # { # crans = import filePath; # } - # agenix.nixosModules.default + # # agenix.nixosModules.default # ]; # }; # in @@ -79,20 +80,23 @@ map (info: { name = info.crans.name; - value = - nixosSystem { - specialArgs = inputs; - modules = [(path + "/${info.crans.name}")] ++ [info] ++ baseModules - ; - }; + value = info; } ) infos) ; + attrsToNixosSystem = path: all_hosts: hosts: + mapAttrs (name: info: + nixosSystem { + specialArgs = { hosts = all_hosts; inherit inputs;}; + modules = [(path + "/${name}")] ++ [info] ++ baseModules + ; + } + ) hosts; attrs_vm_info = listInfoToAttrs ./hosts/vm hosts_vm_info; attrs_physique_info = listInfoToAttrs ./hosts/physiques hosts_physique_info; attrs_all_info = attrs_physique_info // attrs_vm_info; in - attrs_all_info + (attrsToNixosSystem ./hosts/vm attrs_all_info attrs_vm_info) // { cransIso = nixosSystem { diff --git a/hosts/physiques/cameron/info.nix b/hosts/physiques/cameron/info.nix new file mode 100644 index 0000000..4164a30 --- /dev/null +++ b/hosts/physiques/cameron/info.nix @@ -0,0 +1,22 @@ +{ + name = "cameron"; + description = "Serveur de stockage adh"; + id = 2; + + isDebian = true; + + networking = { + adm.enable = true; + san.enable = true; + + switch = { + # todo recheck port + salameche = -1; + }; + }; + + ilo = { + id = 52; + switch.salameche = 16; + }; +} diff --git a/hosts/physiques/cephiroth/info.nix b/hosts/physiques/cephiroth/info.nix new file mode 100644 index 0000000..6c3b5c7 --- /dev/null +++ b/hosts/physiques/cephiroth/info.nix @@ -0,0 +1,20 @@ +{ + name = "cephiroth"; + description = "Serveur de stockage ceph"; + id = 3; + + networking = { + adm.enable = true; + san.enable = true; + + switch = { + carapuce = 12; + arceus = 12; + }; + }; + + ilo = { + id = 53; + switch.salameche = 20; + }; +} diff --git a/hosts/physiques/daniel/info.nix b/hosts/physiques/daniel/info.nix new file mode 100644 index 0000000..71ae326 --- /dev/null +++ b/hosts/physiques/daniel/info.nix @@ -0,0 +1,23 @@ +{ + name = "daniel"; + description = "PVE adm"; + id = 12; + + isDebian = true; + + networking = { + adm.enable = true; + san.enable = true; + srv-nat.enable = true; + + switch = { + carapuce = 3; + arceus = 3; + }; + }; + + ilo = { + id = 22; + switch.salameche = 4; + }; +} diff --git a/hosts/physiques/ft/info.nix b/hosts/physiques/ft/info.nix new file mode 100644 index 0000000..35c5a67 --- /dev/null +++ b/hosts/physiques/ft/info.nix @@ -0,0 +1,17 @@ +{ + name = "ft"; + description = "Serveur de backup du Crans, en SQ39"; + id = 15; + + isDebian = true; + + networking = { + adm.enable = true; + + switch = { + carapuce = 13; + arceus = 13; + }; + }; + +} diff --git a/hosts/physiques/gulp/info.nix b/hosts/physiques/gulp/info.nix new file mode 100644 index 0000000..9fbf144 --- /dev/null +++ b/hosts/physiques/gulp/info.nix @@ -0,0 +1,22 @@ +{ + name = "gulp"; + description = "PVE adh"; + id = 18; + + isDebian = true; + + networking = { + adm.enable = true; + adh.enable = true; + + switch = { + carapuce = 11; + arceus = 11; + }; + }; + + ilo = { + id = 28; + switch.salameche = 12; + }; +} diff --git a/hosts/physiques/jack/info.nix b/hosts/physiques/jack/info.nix new file mode 100644 index 0000000..3fbb130 --- /dev/null +++ b/hosts/physiques/jack/info.nix @@ -0,0 +1,24 @@ +{ + name = "jack"; + description = "PVE adm"; + id = 13; + + isDebian = true; + + networking = { + adm.enable = true; + san.enable = true; + srv-nat.enable = true; + + switch = { + carapuce = 5; + arceus = 5; + }; + }; + + ilo = { + id = 23; + switch.salameche = 6; + }; +} + diff --git a/hosts/physiques/odlyd/info.nix b/hosts/physiques/odlyd/info.nix new file mode 100644 index 0000000..90dff8c --- /dev/null +++ b/hosts/physiques/odlyd/info.nix @@ -0,0 +1,21 @@ +{ + name = "odlyd"; + description = "PVE adh"; + id = 16; + + isDebian = true; + + networking = { + adm.enable = true; + adh.enable = true; + + switch = { + # pas branche + }; + }; + + ilo = { + id = 26; + switch.salameche = 8; + }; +} diff --git a/hosts/physiques/sam/info.nix b/hosts/physiques/sam/info.nix new file mode 100644 index 0000000..0dd7f9b --- /dev/null +++ b/hosts/physiques/sam/info.nix @@ -0,0 +1,23 @@ +{ + name = "sam"; + description = "PVE adm"; + id = 11; + + isDebian = true; + + networking = { + adm.enable = true; + san.enable = true; + srv-nat.enable = true; + + switch = { + carapuce = 1; + arceus = 1; + }; + }; + + ilo = { + id = 21; + switch.salameche = 2; + }; +} diff --git a/hosts/physiques/stitch/info.nix b/hosts/physiques/stitch/info.nix new file mode 100644 index 0000000..b10b4cc --- /dev/null +++ b/hosts/physiques/stitch/info.nix @@ -0,0 +1,22 @@ +{ + name = "stitch"; + description = "PVE adh"; + id = 17; + + isDebian = true; + + networking = { + adm.enable = true; + adh.enable = true; + + switch = { + carapuce = 9; + arceus = 9; + }; + }; + + ilo = { + id = 27; + switch.salameche = 10; + }; +} diff --git a/hosts/physiques/tealc/info.nix b/hosts/physiques/tealc/info.nix new file mode 100644 index 0000000..1b8a385 --- /dev/null +++ b/hosts/physiques/tealc/info.nix @@ -0,0 +1,22 @@ +{ + name = "tealc"; + description = "Serveur de stockage adm"; + id = 1; + + isDebian = true; + + networking = { + adm.enable = true; + san.enable = true; + + switch = { + carapuce = 10; + arceus = 10; + }; + }; + + ilo = { + id = 51; + switch.salameche = 18; + }; +} diff --git a/hosts/physiques/zamok/info.nix b/hosts/physiques/zamok/info.nix new file mode 100644 index 0000000..ce45c1b --- /dev/null +++ b/hosts/physiques/zamok/info.nix @@ -0,0 +1,23 @@ +{ + name = "zamok"; + description = "Serveur de calcul adhérent"; + id = 31; + + isDebian = true; + + networking = { + adm.enable = true; + adh.enable = true; + san.enable = true; + + switch = { + carapuce = 7; + arceus = 4; + }; + }; + + ilo = { + id = 54; + switch.salameche = 14; + }; +} diff --git a/hosts/vm/jitsi/info.nix b/hosts/vm/jitsi/info.nix index 64e9044..5818ab2 100644 --- a/hosts/vm/jitsi/info.nix +++ b/hosts/vm/jitsi/info.nix @@ -5,6 +5,7 @@ id = 163; networking = { + adm.enable = true; srv = { enable = true; ipv4 = "185.230.79.15"; diff --git a/modules/crans/networking.nix b/modules/crans/networking.nix index ca220d3..37fcc4f 100644 --- a/modules/crans/networking.nix +++ b/modules/crans/networking.nix @@ -1,4 +1,4 @@ -{ lib, config, ... }: +{ lib, config, hosts, ... }: let cfg = config.crans; @@ -9,6 +9,7 @@ let mkIf mkOption types + mod ; idString = toString cfg.id; @@ -16,6 +17,8 @@ let hostIdString = lib.fixedWidthString 2 "0" (toString hostId); isVm = cfg.id >= 100; isVmString = toString isVm; + get_mac = id: vlan_num: + "02:00:00:0${toString (id >= 100)}:${toString (mod id 100)}:${toString vlan_num}"; in { options.crans.networking = { @@ -30,6 +33,21 @@ in example = "ens20"; description = "Nom de l'interface réseau sur laquelle est située le VLAN adm."; }; + + ipv4 = mkOption { + type = types.str; + example = "176.16.10.102"; + default = "172.16.10.${idString}"; + description = "Adresse IPv4 de la machine sur le VLAN adm"; + }; + + ipv6 = mkOption { + type = types.str; + example = "fd00::10:0:ff:fe01:0210"; + default = "fd00::10:0:ff:fe0${isVmString}:${hostIdString}10"; + description = "Adresse IPv6 de la machine sur le VLAN adm"; + }; + }; srv = { @@ -47,6 +65,13 @@ in example = "185.230.79.1"; description = "Adresse IPv4 de la machine."; }; + + ipv6 = mkOption { + type = types.str; + example = "2a0c:700:2::ff:fe01:0202"; + default = "2a0c:700:2::ff:fe0${isVmString}:${hostIdString}02"; + description = "Adresse IPv6 de la machine sur le VLAN srv."; + }; }; srvNat = { @@ -58,6 +83,20 @@ in example = "ens20"; description = "Nom de l'interface réseau sur laquelle est située le VLAN srv-nat."; }; + + ipv4 = mkOption { + type = types.str; + example = "176.16.3.102"; + default = "172.16.3.${idString}"; + description = "Adresse IPv4 de la machine sur le VLAN srv-nat."; + }; + + ipv6 = mkOption { + type = types.str; + example = "2a0c:700:3::ff:fe01:0203"; + default = "2a0c:700:3::ff:fe0${isVmString}:${hostIdString}03"; + description = "Adresse IPv6 de la machine sur le VLAN srv-nat."; + }; }; san = { @@ -68,6 +107,20 @@ in example = "ens19"; description = "Nom de l'interface réseau sur laquelle est située le VLAN san."; }; + + ipv4 = mkOption { + type = types.str; + example = "176.16.4.102"; + default = "172.16.4.${idString}"; + description = "Adresse IPv4 de la machine sur le VLAN srv-nat."; + }; + + ipv6 = mkOption { + type = types.str; + example = "fd00::4:0:ff:fe01:0204"; + default = "fd00::4:0:ff:fe0${isVmString}:${hostIdString}04"; + description = "Adresse IPv6 de la machine sur le VLAN san."; + }; }; }; @@ -98,14 +151,14 @@ in adm = { ipv4.addresses = [ { - address = "172.16.10.${idString}"; + address = cfg-net.adm.ipv4; prefixLength = 24; } ]; ipv6.addresses = [ { - address = "fd00::10:0:ff:fe0${isVmString}:${hostIdString}10"; + address = cfg-net.adm.ipv6; prefixLength = 64; } ]; @@ -131,7 +184,7 @@ in ipv6 = { addresses = [ { - address = "2a0c:700:2::ff:fe0${isVmString}:${hostIdString}02"; + address = cfg-net.srv.ipv6; prefixLength = 64; } ]; @@ -150,7 +203,7 @@ in ipv4 = { addresses = [ { - address = "172.16.3.${idString}"; + address = cfg-net.srvNat.ipv4; prefixLength = 24; } ]; @@ -166,7 +219,7 @@ in ipv6 = { addresses = [ { - address = "2a0c:700:3::ff:fe0${isVmString}:${hostIdString}03"; + address = cfg-net.srvNat.ipv6; prefixLength = 64; } ]; @@ -184,14 +237,14 @@ in san = { ipv4.addresses = [ { - address = "172.16.4.${idString}"; + address = cfg-net.san.ipv4; prefixLength = 24; } ]; ipv6.addresses = [ { - address = "fd00::4:0:ff:fe0${isVmString}:${hostIdString}04"; + address = cfg-net.san.ipv6; prefixLength = 64; } ]; diff --git a/modules/crans/users.nix b/modules/crans/users.nix index c229bf4..5686447 100644 --- a/modules/crans/users.nix +++ b/modules/crans/users.nix @@ -18,7 +18,7 @@ in root = { passwordFile = mkOption { - type = types.path; + type = types.externalPath; default = ../../secrets/common/root.age; example = ../../secrets/apprentix/root.age; description = "Fichier chiffré par age contenant le mot de passe root."; From da5dc3c21ad51f2798f880c2b490ca5c342f6f8e Mon Sep 17 00:00:00 2001 From: lzebulon Date: Sat, 25 Jul 2026 17:48:45 +0200 Subject: [PATCH 04/15] Apply 1 suggestion(s) to 1 file(s) Co-authored-by: Pyjacpp --- modules/crans/networking.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/crans/networking.nix b/modules/crans/networking.nix index 37fcc4f..0cceae0 100644 --- a/modules/crans/networking.nix +++ b/modules/crans/networking.nix @@ -18,7 +18,7 @@ let isVm = cfg.id >= 100; isVmString = toString isVm; get_mac = id: vlan_num: - "02:00:00:0${toString (id >= 100)}:${toString (mod id 100)}:${toString vlan_num}"; + "02:00:00:0${toString (id >= 100)}:${toString (mod id 100)}:${lib.fixedWidthString 2 "0" (toString vlan_num)}"; in { options.crans.networking = { From 7ba95e86a4b9e1964ff4a0629c852596aa089b2a Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Sun, 6 Sep 2026 11:53:44 +0200 Subject: [PATCH 05/15] Fix inputs --- flake.nix | 21 ++++++--------------- 1 file changed, 6 insertions(+), 15 deletions(-) diff --git a/flake.nix b/flake.nix index 39325e3..e4af1b4 100644 --- a/flake.nix +++ b/flake.nix @@ -51,18 +51,6 @@ filePath = path + "/${name}/info.nix"; in if builtins.pathExists filePath then - # let eval = evalModules { - # specialArgs = inputs; - # modules = [ - # ./modules/crans - # { - # crans = import filePath; - # } - # # agenix.nixosModules.default - # ]; - # }; - # in - # eval.config { crans = import filePath; } @@ -86,11 +74,14 @@ mapAttrs ( name: info: nixosSystem { - specialArgs = { + specialArgs = inputs // { hosts = all_hosts; - inherit inputs; }; - modules = [ (path + "/${name}") ] ++ [ info ] ++ baseModules; + modules = [ + (path + "/${name}") + info + ] + ++ baseModules; } ) hosts; attrs_vm_info = listInfoToAttrs ./hosts/vm hosts_vm_info; From fefefa84eaf909cef4044e91399ecb93c7712d11 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Sun, 6 Sep 2026 14:47:13 +0200 Subject: [PATCH 06/15] cleanup hosts-v2 --- flake.nix | 35 ++++++++++++---------------------- modules/crans/default.nix | 40 +++++++++++++++++++++++++++++++++++++-- modules/crans/extra.nix | 32 ------------------------------- 3 files changed, 50 insertions(+), 57 deletions(-) delete mode 100644 modules/crans/extra.nix diff --git a/flake.nix b/flake.nix index e4af1b4..d928964 100644 --- a/flake.nix +++ b/flake.nix @@ -26,12 +26,15 @@ agenix, ... }: + let + lib = nixpkgs.lib; + in flake-parts.lib.mkFlake { inherit inputs; } { imports = [ inputs.treefmt-nix.flakeModule ]; systems = [ "x86_64-linux" ]; - flake = with nixpkgs.lib; { + flake = with lib; { nixosConfigurations = let baseModules = [ @@ -40,35 +43,20 @@ ]; get_hosts_names = path: attrNames (attrsets.filterAttrs (name: type: type == "directory") (readDir path)); - hostVM = get_hosts_names ./hosts/vm; - hostPhysique = get_hosts_names ./hosts/physiques; get_info = - path: lists: + path: filter (x: x != null) ( map ( name: let filePath = path + "/${name}/info.nix"; in - if builtins.pathExists filePath then - { - crans = import filePath; - } - else - warn "${toString filePath} not found" null - ) lists + if builtins.pathExists filePath then import filePath else warn "${toString filePath} not found" null + ) (get_hosts_names path) ); - hosts_vm_info = get_info ./hosts/vm hostVM; - hosts_physique_info = get_info ./hosts/physiques hostPhysique; listInfoToAttrs = - path: infos: - listToAttrs ( - map (info: { - name = info.crans.name; - value = info; - }) infos - ); + infos: add: listToAttrs (map (info: lib.nameValuePair info.name (info // add)) infos); attrsToNixosSystem = path: all_hosts: hosts: mapAttrs ( @@ -79,16 +67,17 @@ }; modules = [ (path + "/${name}") - info + ({ ... }: { config.crans = info; }) ] ++ baseModules; } ) hosts; - attrs_vm_info = listInfoToAttrs ./hosts/vm hosts_vm_info; - attrs_physique_info = listInfoToAttrs ./hosts/physiques hosts_physique_info; + attrs_vm_info = listInfoToAttrs (get_info ./hosts/vm) { isVm = true; }; + attrs_physique_info = listInfoToAttrs (get_info ./hosts/physiques) { isVm = false; }; attrs_all_info = attrs_physique_info // attrs_vm_info; in (attrsToNixosSystem ./hosts/vm attrs_all_info attrs_vm_info) + // (attrsToNixosSystem ./hosts/physiques attrs_all_info attrs_physique_info) // { cransIso = nixosSystem { system = "x86_64-linux"; diff --git a/modules/crans/default.nix b/modules/crans/default.nix index ff29544..d55cf8a 100644 --- a/modules/crans/default.nix +++ b/modules/crans/default.nix @@ -3,12 +3,16 @@ let cfg = config.crans; - inherit (lib) mkEnableOption mkIf; + inherit (lib) + mkEnableOption + mkOption + types + mkIf + ; in { imports = [ ./age.nix - ./extra.nix ./grub.nix ./home.nix ./locale.nix @@ -26,6 +30,38 @@ in options.crans = { enable = mkEnableOption "Configuration commune à toutes les machines du Crans"; + + name = mkOption { + type = types.str; + example = "vm-test"; + description = "Nom de la machine"; + }; + + isVm = mkOption { + type = types.bool; + description = "Est-ce une machine virtuelle ?"; + }; + + description = mkOption { + type = types.str; + example = "VM de test"; + description = "Description de la machine"; + }; + + id = mkOption { + type = types.int; + example = 135; + description = '' + ID de la machine : + - < 100 machine physique + - >= 100 VM ( id de la VM dans proxmox ) + ''; + }; + + public-ssh = mkOption { + type = types.str; + description = "Clé ssh public de la machine"; + }; }; config = mkIf cfg.enable { diff --git a/modules/crans/extra.nix b/modules/crans/extra.nix deleted file mode 100644 index e782292..0000000 --- a/modules/crans/extra.nix +++ /dev/null @@ -1,32 +0,0 @@ -{ lib, ... }: -with lib; -{ - options.crans = { - name = mkOption { - type = types.str; - example = "vm-test"; - description = "Nom de la machine"; - }; - - description = mkOption { - type = types.str; - example = "VM de test"; - description = "Description de la machine"; - }; - - id = mkOption { - type = types.int; - example = 135; - description = """ - ID de la machine : - - < 100 machine physique - - >= 100 VM ( id de la VM dans proxmox ) - """; - }; - - public-ssh = mkOption { - type = types.str; - description = "Clé ssh public de la machine"; - }; - }; -} From 2641ecf224e355e1e74706e9f390f6977ad736a1 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Sun, 6 Sep 2026 15:11:55 +0200 Subject: [PATCH 07/15] Fix physiques et warning id --- flake.nix | 18 +++++++++--------- hosts/physiques/cephiroth/info.nix | 5 ++++- modules/crans/default.nix | 16 +++++++++++++++- 3 files changed, 28 insertions(+), 11 deletions(-) diff --git a/flake.nix b/flake.nix index d928964..d294c50 100644 --- a/flake.nix +++ b/flake.nix @@ -71,7 +71,7 @@ ] ++ baseModules; } - ) hosts; + ) (attrsets.filterAttrs (name: info: !(info.isDebian or false)) hosts); attrs_vm_info = listInfoToAttrs (get_info ./hosts/vm) { isVm = true; }; attrs_physique_info = listInfoToAttrs (get_info ./hosts/physiques) { isVm = false; }; attrs_all_info = attrs_physique_info // attrs_vm_info; @@ -79,14 +79,14 @@ (attrsToNixosSystem ./hosts/vm attrs_all_info attrs_vm_info) // (attrsToNixosSystem ./hosts/physiques attrs_all_info attrs_physique_info) // { - cransIso = nixosSystem { - system = "x86_64-linux"; - specialArgs = inputs; - modules = [ - ./hosts/iso - ./modules/crans/locale.nix - ]; - }; + # cransIso = nixosSystem { + # system = "x86_64-linux"; + # specialArgs = inputs; + # modules = [ + # ./hosts/iso + # ./modules/crans/locale.nix + # ]; + # }; }; }; diff --git a/hosts/physiques/cephiroth/info.nix b/hosts/physiques/cephiroth/info.nix index 6c3b5c7..e2f7b28 100644 --- a/hosts/physiques/cephiroth/info.nix +++ b/hosts/physiques/cephiroth/info.nix @@ -3,6 +3,9 @@ description = "Serveur de stockage ceph"; id = 3; + # Sous Nix mais dans une autre branche + isDebian = true; + networking = { adm.enable = true; san.enable = true; @@ -12,7 +15,7 @@ arceus = 12; }; }; - + ilo = { id = 53; switch.salameche = 20; diff --git a/modules/crans/default.nix b/modules/crans/default.nix index d55cf8a..333d11a 100644 --- a/modules/crans/default.nix +++ b/modules/crans/default.nix @@ -6,8 +6,9 @@ let inherit (lib) mkEnableOption mkOption - types mkIf + types + optional ; in { @@ -42,6 +43,13 @@ in description = "Est-ce une machine virtuelle ?"; }; + isDebian = mkOption { + type = types.bool; + default = false; + example = "true"; + description = "Est-ce une machine Debian ?"; + }; + description = mkOption { type = types.str; example = "VM de test"; @@ -77,5 +85,11 @@ in ldap.enable = true; }; }; + + warnings = ( + optional ( + cfg.isVm != (cfg.id >= 100) + ) "${cfg.name}: isVm (${toString cfg.isVm}) est incohérent avec son id (${toString cfg.id})" + ); }; } From cc4e66ae5578689b3a6022e5f4861c12fa2c463d Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Sun, 6 Sep 2026 18:19:04 +0200 Subject: [PATCH 08/15] vlan conf --- modules/crans/default.nix | 1 + modules/crans/vlans.nix | 228 ++++++++++++++++++++++++++++++++++++++ 2 files changed, 229 insertions(+) create mode 100644 modules/crans/vlans.nix diff --git a/modules/crans/default.nix b/modules/crans/default.nix index 333d11a..0e077fa 100644 --- a/modules/crans/default.nix +++ b/modules/crans/default.nix @@ -26,6 +26,7 @@ in ./ssh.nix ./store.nix ./users.nix + ./vlans.nix ./virtualisation.nix ]; diff --git a/modules/crans/vlans.nix b/modules/crans/vlans.nix new file mode 100644 index 0000000..468494f --- /dev/null +++ b/modules/crans/vlans.nix @@ -0,0 +1,228 @@ +{ lib, ... }: +let + inherit (lib) + mkOption + types + mkDefault + mkForce + ; + + vlanConf = { + + srv = { + id = 2; + description = "Réseau public"; + interface = "ens19"; + ipv4 = { + address = mkForce "185.230.79.0"; + prefixLength = 26; + routes = [ + { + address = "0.0.0.0"; + via = "185.230.79.62"; + prefixLength = 0; + } + ]; + }; + ipv6 = { + address = mkForce "2a0c:700:10::"; + routes = [ + { + address = "::"; + via = "2a0c:700:2::ff:fe00:9902"; + prefixLength = 0; + } + ]; + }; + }; + + srv-nat = { + id = 3; + description = "Réseau derrière un NAT"; + interface = "ens19"; + ipv4.routes = [ + { + address = "0.0.0.0"; + via = "172.16.3.99"; + prefixLength = 0; + } + ]; + ipv6 = { + address = mkForce "2a0c:700:3::"; + routes = [ + { + address = "0.0.0.0"; + via = "2a0c:700:3::ff:fe00:9903"; + prefixLength = 0; + } + ]; + }; + }; + + san = { + id = 4; + description = "Accès aux baies de stockages"; + interface = "ens19"; + }; + + ceph = { + id = 6; + description = "Réseau interne à ceph"; + interface = "ens20"; + }; + + adm = { + id = 10; + description = "Réseau interne"; + interface = "ens18"; + }; + + adh = { + id = 12; + description = "Réseau adhérent"; + ipv4 = { + address = mkForce "185.230.78.0"; + routes = [ + { + address = "0.0.0.0"; + via = "185.230.78.12"; + prefixLength = 0; + } + ]; + }; + ipv6 = { + address = mkForce "2a0c:700:12::"; + prefixLength = 48; + routes = [ + { + address = "::"; + via = "2a0c:700:12::ff:fe00:9912"; + prefixLength = 0; + } + ]; + }; + }; + + adh-adm = { + id = 13; + description = "Réseau d’administration du réseau adhérent"; + }; + + ens = { + id = 2751; + description = "Interconnexion avec l’ENS."; + ipv4 = { + address = mkForce "138.231.136.0"; + prefixLength = 29; + }; + ipv6 = null; + }; + + ens-clubs = { + id = 2754; + description = "Réseau clubs interconnecté avec l’ENS"; + ipv6 = null; + }; + + ens-lp = { + id = 2756; + description = "Réseau imprimante interconnecté avec l’ENS"; + ipv6 = null; + }; + + }; + + ipOpt = + v: + let + maxPrefix = if v == 4 then 32 else 128; + in + types.submodule { + options = { + address = mkOption { + type = types.str; + description = "Adresses IPv${v} du réseau"; + }; + + prefixLength = mkOption { + type = types.ints.between 0 maxPrefix; + default = if v == 4 then 24 else 64; + description = "Prefixe du réseau"; + }; + + routes = mkOption { + default = [ ]; + description = "Routes par défaut"; + example = [ + { + address = "0.0.0.0"; + via = "172.16.3.99"; + prefixLength = 0; + } + ]; + type = types.listOf ( + types.submodule { + options = { + address = mkOption { type = types.str; }; + via = mkOption { type = types.str; }; + prefixLength = mkOption { type = types.ints.between 0 maxPrefix; }; + }; + } + ); + }; + }; + }; +in +{ + options.crans.vlans = mkOption { + type = types.attrsOf ( + types.submodule { + options = { + id = mkOption { + type = types.int; + example = "10"; + description = "Id du VLAN"; + }; + + description = mkOption { + type = types.str; + description = "Description du VLAN"; + }; + + interface = mkOption { + type = types.nullOr types.str; + default = null; + example = "ens19"; + description = "Interface par défaut du VLAN"; + }; + + ipv4 = mkOption { + type = types.nullOr (ipOpt 4); + description = "Réseau IPv4 du VLAN."; + }; + + ipv6 = mkOption { + type = types.nullOr (ipOpt 6); + description = "Réseau IPv6 du VLAN."; + }; + }; + } + ); + }; + + config.crans.vlans = ( + builtins.mapAttrs ( + vlan: conf: + let + vlan = lib.mod conf.id 100; + in + lib.mkMerge [ + conf + { + ipv4.address = mkDefault "172.16.${toString vlan}.0"; + ipv6.address = mkDefault "fd00:0:0:${toString vlan}::"; + } + ] + ) vlanConf + ); +} From b9d3ed71a59f6aa51403ec501bf182ce4da3bc47 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Tue, 8 Sep 2026 13:33:25 +0200 Subject: [PATCH 09/15] Networking --- hosts/vm/apprentix/info.nix | 22 +-- hosts/vm/collabora/info.nix | 3 +- hosts/vm/jitsi/info.nix | 5 +- hosts/vm/livre/info.nix | 3 +- hosts/vm/mediakiwi/default.nix | 2 +- hosts/vm/neo/info.nix | 3 +- hosts/vm/nextcloud/info.nix | 32 ++-- hosts/vm/periodique/info.nix | 3 +- hosts/vm/redite/info.nix | 2 +- hosts/vm/reverseproxy/info.nix | 3 +- hosts/vm/two/info.nix | 4 +- hosts/vm/vaultwarden/info.nix | 4 +- modules/crans/default.nix | 2 +- modules/crans/networking.nix | 318 ++++++++++----------------------- modules/crans/vlans.nix | 10 +- 15 files changed, 143 insertions(+), 273 deletions(-) diff --git a/hosts/vm/apprentix/info.nix b/hosts/vm/apprentix/info.nix index 22e47f2..f569b99 100644 --- a/hosts/vm/apprentix/info.nix +++ b/hosts/vm/apprentix/info.nix @@ -1,17 +1,17 @@ { - name = "apprentix"; - description = "VM pour les apprenti⋅es"; - id = 150; - - enable = true; + name = "apprentix"; + description = "VM pour les apprenti⋅es"; + id = 150; - networking = { - srvNat.enable = true; - }; + enable = true; - resticClient.when = "01:23"; + networking = { + srv-nat.enable = true; + }; - homeNounou.enable = false; + resticClient.when = "01:23"; - users.root.passwordFile = ../../../secrets/apprentix/root.age; + homeNounou.enable = false; + + users.root.passwordFile = ../../../secrets/apprentix/root.age; } diff --git a/hosts/vm/collabora/info.nix b/hosts/vm/collabora/info.nix index 85052e9..c68b81f 100644 --- a/hosts/vm/collabora/info.nix +++ b/hosts/vm/collabora/info.nix @@ -6,9 +6,8 @@ enable = true; networking = { - srvNat.enable = true; + srv-nat.enable = true; }; resticClient.enable = false; } - diff --git a/hosts/vm/jitsi/info.nix b/hosts/vm/jitsi/info.nix index 5818ab2..d9c3c5c 100644 --- a/hosts/vm/jitsi/info.nix +++ b/hosts/vm/jitsi/info.nix @@ -1,9 +1,10 @@ { name = "jitsi"; description = "Machine qui gère Jitsi"; - id = 163; + enable = true; + networking = { adm.enable = true; srv = { @@ -23,5 +24,5 @@ # ]; public-ssh = ""; - + } diff --git a/hosts/vm/livre/info.nix b/hosts/vm/livre/info.nix index 7eba0c0..1632dd6 100644 --- a/hosts/vm/livre/info.nix +++ b/hosts/vm/livre/info.nix @@ -6,9 +6,8 @@ enable = true; networking = { - srvNat.enable = true; + srv-nat.enable = true; }; resticClient.when = "03:45"; } - diff --git a/hosts/vm/mediakiwi/default.nix b/hosts/vm/mediakiwi/default.nix index e4a80a0..c5318e2 100644 --- a/hosts/vm/mediakiwi/default.nix +++ b/hosts/vm/mediakiwi/default.nix @@ -17,7 +17,7 @@ networking = { id = 144; - srvNat.enable = true; + srv-nat.enable = true; }; # Enable when deploying the real mediakiwi diff --git a/hosts/vm/neo/info.nix b/hosts/vm/neo/info.nix index e234b09..ad068b7 100644 --- a/hosts/vm/neo/info.nix +++ b/hosts/vm/neo/info.nix @@ -1,9 +1,10 @@ { name = "neo"; description = "Matrix du Crans et bridge IRC/Matrix"; - enable = true; id = 141; + enable = true; + networking = { srv = { enable = true; diff --git a/hosts/vm/nextcloud/info.nix b/hosts/vm/nextcloud/info.nix index d23079d..598f79a 100644 --- a/hosts/vm/nextcloud/info.nix +++ b/hosts/vm/nextcloud/info.nix @@ -1,22 +1,22 @@ { - name = "nextcloud"; - description = "Nextcloud du Crans"; - id = 146; - - enable = true; + name = "nextcloud"; + description = "Nextcloud du Crans"; + id = 146; - networking = { - srvNat = { - enable = true; - interface = "ens20"; - }; - san = { - enable = true; - interface = "ens19"; - }; + enable = true; + + networking = { + srv-nat = { + enable = true; + interface = "ens20"; }; + san = { + enable = true; + interface = "ens19"; + }; + }; - homeAdh.enable = true; + homeAdh.enable = true; - resticClient.enable = false; + resticClient.enable = false; } diff --git a/hosts/vm/periodique/info.nix b/hosts/vm/periodique/info.nix index faf99e8..489eaff 100644 --- a/hosts/vm/periodique/info.nix +++ b/hosts/vm/periodique/info.nix @@ -6,9 +6,8 @@ enable = true; networking = { - srvNat.enable = true; + srv-nat.enable = true; }; resticClient.when = "02:56"; } - diff --git a/hosts/vm/redite/info.nix b/hosts/vm/redite/info.nix index 78094da..74298d9 100644 --- a/hosts/vm/redite/info.nix +++ b/hosts/vm/redite/info.nix @@ -6,7 +6,7 @@ enable = true; networking = { - srvNat.enable = true; + srv-nat.enable = true; }; resticClient.when = "06:18"; diff --git a/hosts/vm/reverseproxy/info.nix b/hosts/vm/reverseproxy/info.nix index 4481c49..e2bcf3f 100644 --- a/hosts/vm/reverseproxy/info.nix +++ b/hosts/vm/reverseproxy/info.nix @@ -6,7 +6,7 @@ enable = true; networking = { - srvNat.enable = true; + srv-nat.enable = true; srv = { enable = true; interface = "ens20"; @@ -17,4 +17,3 @@ resticClient.when = "03:42"; } - diff --git a/hosts/vm/two/info.nix b/hosts/vm/two/info.nix index 2b833b5..c345d86 100644 --- a/hosts/vm/two/info.nix +++ b/hosts/vm/two/info.nix @@ -2,11 +2,11 @@ name = "two"; description = "VM de test"; id = 135; - + enable = true; networking = { - srvNat = { + srv-nat = { enable = true; interface = "ens19"; }; diff --git a/hosts/vm/vaultwarden/info.nix b/hosts/vm/vaultwarden/info.nix index 953a611..1cf8489 100644 --- a/hosts/vm/vaultwarden/info.nix +++ b/hosts/vm/vaultwarden/info.nix @@ -2,11 +2,11 @@ name = "vaultwarden"; description = "Vaultarden du crans, gestionnaire de mot de passe"; id = 159; - + enable = true; networking = { - srvNat.enable = true; + srv-nat.enable = true; }; resticClient.when = "04:44"; diff --git a/modules/crans/default.nix b/modules/crans/default.nix index 0e077fa..4f28495 100644 --- a/modules/crans/default.nix +++ b/modules/crans/default.nix @@ -78,7 +78,7 @@ in homeNounou.enable = lib.mkDefault true; monitoring.enable = true; networking = { - enable = true; + enable = lib.mkDefault true; adm.enable = lib.mkDefault true; }; resticClient.enable = lib.mkDefault true; diff --git a/modules/crans/networking.nix b/modules/crans/networking.nix index 0cceae0..99e20b1 100644 --- a/modules/crans/networking.nix +++ b/modules/crans/networking.nix @@ -1,4 +1,9 @@ -{ lib, config, hosts, ... }: +{ + lib, + config, + hosts, + ... +}: let cfg = config.crans; @@ -8,249 +13,114 @@ let mkEnableOption mkIf mkOption + mkDefault types mod + mapAttrs + mapAttrs' + filterAttrs + mergeAttrsList + optional + fixedWidthString + nameValuePair ; - - idString = toString cfg.id; - hostId = lib.mod cfg.id 100; - hostIdString = lib.fixedWidthString 2 "0" (toString hostId); - isVm = cfg.id >= 100; - isVmString = toString isVm; - get_mac = id: vlan_num: - "02:00:00:0${toString (id >= 100)}:${toString (mod id 100)}:${lib.fixedWidthString 2 "0" (toString vlan_num)}"; in { options.crans.networking = { enable = mkEnableOption "Configuration réseaux commune à toutes les machines du Crans."; + } + // mapAttrs ( + vlan: conf: + let + vlanId = mod conf.id 100; + in + mergeAttrsList ( + [ + { + enable = mkEnableOption "Activation du réseau ${vlan}"; - adm = { - enable = mkEnableOption "Configuration du VLAN adm."; + interface = mkOption { + type = types.str; + description = "Interface pour le réseau ${vlan}"; + default = conf.interface; + }; - interface = mkOption { - type = types.str; - default = "ens18"; - example = "ens20"; - description = "Nom de l'interface réseau sur laquelle est située le VLAN adm."; - }; - - ipv4 = mkOption { - type = types.str; - example = "176.16.10.102"; - default = "172.16.10.${idString}"; - description = "Adresse IPv4 de la machine sur le VLAN adm"; - }; - - ipv6 = mkOption { - type = types.str; - example = "fd00::10:0:ff:fe01:0210"; - default = "fd00::10:0:ff:fe0${isVmString}:${hostIdString}10"; - description = "Adresse IPv6 de la machine sur le VLAN adm"; - }; - - }; - - srv = { - enable = mkEnableOption "Configuration du VLAN srv."; - - interface = mkOption { - type = types.str; - default = "ens19"; - example = "ens20"; - description = "Nom de l'interface réseau sur laquelle est située le VLAN srv."; - }; - - ipv4 = mkOption { - type = types.str; - example = "185.230.79.1"; - description = "Adresse IPv4 de la machine."; - }; - - ipv6 = mkOption { - type = types.str; - example = "2a0c:700:2::ff:fe01:0202"; - default = "2a0c:700:2::ff:fe0${isVmString}:${hostIdString}02"; - description = "Adresse IPv6 de la machine sur le VLAN srv."; - }; - }; - - srvNat = { - enable = mkEnableOption "Configuration du VLAN srv-nat."; - - interface = mkOption { - type = types.str; - default = "ens19"; - example = "ens20"; - description = "Nom de l'interface réseau sur laquelle est située le VLAN srv-nat."; - }; - - ipv4 = mkOption { - type = types.str; - example = "176.16.3.102"; - default = "172.16.3.${idString}"; - description = "Adresse IPv4 de la machine sur le VLAN srv-nat."; - }; - - ipv6 = mkOption { - type = types.str; - example = "2a0c:700:3::ff:fe01:0203"; - default = "2a0c:700:3::ff:fe0${isVmString}:${hostIdString}03"; - description = "Adresse IPv6 de la machine sur le VLAN srv-nat."; - }; - }; - - san = { - enable = mkEnableOption "Configuration du VLAN san."; - - interface = mkOption { - type = types.str; - example = "ens19"; - description = "Nom de l'interface réseau sur laquelle est située le VLAN san."; - }; - - ipv4 = mkOption { - type = types.str; - example = "176.16.4.102"; - default = "172.16.4.${idString}"; - description = "Adresse IPv4 de la machine sur le VLAN srv-nat."; - }; - - ipv6 = mkOption { - type = types.str; - example = "fd00::4:0:ff:fe01:0204"; - default = "fd00::4:0:ff:fe0${isVmString}:${hostIdString}04"; - description = "Adresse IPv6 de la machine sur le VLAN san."; - }; - }; - }; + defaultRoutes = mkOption { + type = types.bool; + default = true; + description = "Configuration par défaut des routes de ${vlan}"; + }; + } + ] + ++ optional ((conf.ipv4 or true) != null) { + ipv4 = mkOption { + type = types.str; + description = "Adresse IPv4 de la machine sur le réseau ${vlan}"; + default = "172.16.${toString vlanId}.${toString cfg.id}"; + }; + } + ++ optional ((conf.ipv6 or true) != null) ( + let + # XXX: Utilisation du masque pour le déterminer à la place ? + prefix = + if lib.hasPrefix "2a0c:700" conf.ipv6.address then + "2a0c:700" + else if lib.hasPrefix "fd00:0:0" conf.ipv6.address then + "fd00:0:0" + else + (builtins.warn "Le prefixe de ${conf.ipv6.address} n’est pas reconnu"); + in + { + ipv6 = mkOption { + type = types.str; + description = "Adresse IPv6 de la machine sur le réseau ${vlan}"; + default = "${prefix}:${toString vlanId}::ff:fe0${toString (cfg.id / 100)}:${toString (mod cfg.id 100)}${ + fixedWidthString 2 "0" (toString vlanId) + }"; + }; + } + ) + ) + ) cfg.vlans; config = mkIf cfg-net.enable { networking = { hostName = cfg.name; useDHCP = false; - firewall.enable = lib.mkDefault false; - nameservers = [ "172.16.10.128" ]; + firewall.enable = mkDefault false; + nameservers = [ + # Romanesco via adm + "172.16.10.128" + "fd00::10:0:ff:fe01:2810" + ]; - # La configuration des interfaces se fait de la manière suivante : - # elle est écrite de manière générique pour toutes les machines, puis - # on filtre pour ne garder que les interfaces activées. nix fait de - # l'évaluation paresseuse donc ça fonctionne bien ! - interfaces = - # On change le nom des interfaces de "adm", "srv", ... pour leur vrai - # nom (on ne le met pas directement pour faire fonctionner le filter - # plus bas). - lib.attrsets.mapAttrs' - (interface: conf: { - name = cfg-net."${interface}".interface; - value = conf; - }) - ( - # On filtre sur les interfaces activées - lib.attrsets.filterAttrs (interface: _: cfg-net."${interface}".enable) { - # Configuration du VLAN adm - adm = { - ipv4.addresses = [ + interfaces = mapAttrs' ( + vlan: vconf: + let + conf = cfg-net.${vlan}; + in + nameValuePair conf.interface ( + # On itère ipv4 / ipv6 + builtins.mapAttrs + ( + ipvx: _: + mkIf (vconf.${ipvx} != null) { + addresses = [ { - address = cfg-net.adm.ipv4; - prefixLength = 24; + address = conf.${ipvx}; + prefixLength = vconf.${ipvx}.prefixLength; } ]; - ipv6.addresses = [ - { - address = cfg-net.adm.ipv6; - prefixLength = 64; - } - ]; - }; - - # Configuration du VLAN srv - srv = { - ipv4 = { - addresses = [ - { - address = cfg-net.srv.ipv4; - prefixLength = 26; - } - ]; - routes = [ - { - address = "0.0.0.0"; - via = "185.230.79.62"; - prefixLength = 0; - } - ]; - }; - ipv6 = { - addresses = [ - { - address = cfg-net.srv.ipv6; - prefixLength = 64; - } - ]; - routes = [ - { - address = "::"; - via = "2a0c:700:2::ff:fe00:9902"; - prefixLength = 0; - } - ]; - }; - }; - - # Configuration du VLAN srv-nat - srvNat = { - ipv4 = { - addresses = [ - { - address = cfg-net.srvNat.ipv4; - prefixLength = 24; - } - ]; - routes = [ - { - address = "0.0.0.0"; - via = "172.16.3.99"; - prefixLength = 0; - } - ]; - }; - - ipv6 = { - addresses = [ - { - address = cfg-net.srvNat.ipv6; - prefixLength = 64; - } - ]; - routes = [ - { - address = "::"; - via = "2a0c:700:3::ff:fe00:9903"; - prefixLength = 0; - } - ]; - }; - }; - - # Configuration du VLAN san - san = { - ipv4.addresses = [ - { - address = cfg-net.san.ipv4; - prefixLength = 24; - } - ]; - - ipv6.addresses = [ - { - address = cfg-net.san.ipv6; - prefixLength = 64; - } - ]; - }; + routes = mkIf conf.defaultRoutes vconf.${ipvx}.routes; + } + ) + { + "ipv4" = null; + "ipv6" = null; } - ); + ) + ) (filterAttrs (n: _: cfg-net.${n}.enable) cfg.vlans); # On filtre les interfaces désactivées. }; }; } diff --git a/modules/crans/vlans.nix b/modules/crans/vlans.nix index 468494f..9de7ee6 100644 --- a/modules/crans/vlans.nix +++ b/modules/crans/vlans.nix @@ -216,13 +216,15 @@ in let vlan = lib.mod conf.id 100; in - lib.mkMerge [ - conf - { + lib.mkMerge ( + [ conf ] + ++ lib.optional ((conf.ipv4 or true) != null) { ipv4.address = mkDefault "172.16.${toString vlan}.0"; + } + ++ lib.optional ((conf.ipv6 or true) != null) { ipv6.address = mkDefault "fd00:0:0:${toString vlan}::"; } - ] + ) ) vlanConf ); } From 8670daa0f68a494071144ba395662dd35b8e15e3 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Tue, 8 Sep 2026 13:37:01 +0200 Subject: [PATCH 10/15] info mediawiki --- hosts/vm/mediakiwi/default.nix | 12 ------------ hosts/vm/mediakiwi/info.nix | 13 +++++++++++++ 2 files changed, 13 insertions(+), 12 deletions(-) create mode 100644 hosts/vm/mediakiwi/info.nix diff --git a/hosts/vm/mediakiwi/default.nix b/hosts/vm/mediakiwi/default.nix index c5318e2..b0f5484 100644 --- a/hosts/vm/mediakiwi/default.nix +++ b/hosts/vm/mediakiwi/default.nix @@ -12,17 +12,5 @@ networking.hostName = "mediakiwi"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - - networking = { - id = 144; - srv-nat.enable = true; - }; - - # Enable when deploying the real mediakiwi - resticClient.when = "06:47"; - }; - system.stateVersion = "25.05"; } diff --git a/hosts/vm/mediakiwi/info.nix b/hosts/vm/mediakiwi/info.nix new file mode 100644 index 0000000..3097f89 --- /dev/null +++ b/hosts/vm/mediakiwi/info.nix @@ -0,0 +1,13 @@ +{ + name = "mediakiwi"; + description = "Wiki du Crans"; + id = 144; + + enable = true; + + networking = { + srv-nat.enable = true; + }; + + resticClient.when = "06:47"; +} From 602971a10a774014affae15301129c2da1b0efd5 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Sat, 12 Sep 2026 11:22:37 +0200 Subject: [PATCH 11/15] cransIso and fix networking --- flake.nix | 16 ++++++++-------- modules/crans/vlans.nix | 2 +- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/flake.nix b/flake.nix index d294c50..3371775 100644 --- a/flake.nix +++ b/flake.nix @@ -79,14 +79,14 @@ (attrsToNixosSystem ./hosts/vm attrs_all_info attrs_vm_info) // (attrsToNixosSystem ./hosts/physiques attrs_all_info attrs_physique_info) // { - # cransIso = nixosSystem { - # system = "x86_64-linux"; - # specialArgs = inputs; - # modules = [ - # ./hosts/iso - # ./modules/crans/locale.nix - # ]; - # }; + cransIso = nixosSystem { + system = "x86_64-linux"; + specialArgs = inputs; + modules = [ + ./hosts/iso + ./modules/crans/locale.nix + ]; + }; }; }; diff --git a/modules/crans/vlans.nix b/modules/crans/vlans.nix index 9de7ee6..c535aa8 100644 --- a/modules/crans/vlans.nix +++ b/modules/crans/vlans.nix @@ -51,7 +51,7 @@ let address = mkForce "2a0c:700:3::"; routes = [ { - address = "0.0.0.0"; + address = "::"; via = "2a0c:700:3::ff:fe00:9903"; prefixLength = 0; } From bf2cd34569f388c23e45f17e0d1bd72120af82bc Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Tue, 15 Sep 2026 17:28:51 +0200 Subject: [PATCH 12/15] Verification info.nix --- flake.nix | 34 +++++++++++++++++++++++++++++++++- hosts/physiques/zamok/info.nix | 2 +- 2 files changed, 34 insertions(+), 2 deletions(-) diff --git a/flake.nix b/flake.nix index 3371775..6a3a797 100644 --- a/flake.nix +++ b/flake.nix @@ -41,6 +41,33 @@ ./modules agenix.nixosModules.default ]; + + infoRequired = { + name = lib.isString; + description = lib.isString; + id = lib.isInt; + }; + verifyAttrs = + info: + let + missing = lib.filter (n: !(info ? ${n})) (map (i: i.name) (lib.attrsToList infoRequired)); + wrongType = lib.filter (n: info ? ${n.name} && !(n.value info.${n.name})) ( + lib.attrsToList infoRequired + ); + in + (lib.warnIf ( + lib.length missing > 0 + ) "${info.name}/info.nix : les attributs « ${lib.join ", " missing} » sont manquants") + (lib.warnIf (lib.length wrongType > 0) + "${info.name}/info.nix : les attributs « ${ + lib.join ", " (map (i: i.name) wrongType) + } » sont mal typés" + ) + (lib.warnIfNot ( + (info.isDebian or false) || info ? enable + ) "${info.name}/info.nix : cette machine nix ne définit pas l’attribut enable") + info; + get_hosts_names = path: attrNames (attrsets.filterAttrs (name: type: type == "directory") (readDir path)); get_info = @@ -51,12 +78,16 @@ let filePath = path + "/${name}/info.nix"; in - if builtins.pathExists filePath then import filePath else warn "${toString filePath} not found" null + if builtins.pathExists filePath then + verifyAttrs (import filePath) + else + warn "${toString filePath} not found" null ) (get_hosts_names path) ); listInfoToAttrs = infos: add: listToAttrs (map (info: lib.nameValuePair info.name (info // add)) infos); + attrsToNixosSystem = path: all_hosts: hosts: mapAttrs ( @@ -72,6 +103,7 @@ ++ baseModules; } ) (attrsets.filterAttrs (name: info: !(info.isDebian or false)) hosts); + attrs_vm_info = listInfoToAttrs (get_info ./hosts/vm) { isVm = true; }; attrs_physique_info = listInfoToAttrs (get_info ./hosts/physiques) { isVm = false; }; attrs_all_info = attrs_physique_info // attrs_vm_info; diff --git a/hosts/physiques/zamok/info.nix b/hosts/physiques/zamok/info.nix index ce45c1b..3237c2d 100644 --- a/hosts/physiques/zamok/info.nix +++ b/hosts/physiques/zamok/info.nix @@ -15,7 +15,7 @@ arceus = 4; }; }; - + ilo = { id = 54; switch.salameche = 14; From 6a11260c6296ff68de76453689b4e46bc845ccba Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Wed, 16 Sep 2026 10:43:53 +0200 Subject: [PATCH 13/15] Lib crans --- flake.nix | 78 ++++--------------------- hosts/vm/reverseproxy/reverseproxy.nix | 12 +--- lib/default.nix | 19 ++++++ lib/info.nix | 81 ++++++++++++++++++++++++++ modules/crans/users.nix | 2 +- 5 files changed, 114 insertions(+), 78 deletions(-) create mode 100644 lib/default.nix create mode 100644 lib/info.nix diff --git a/flake.nix b/flake.nix index 6a3a797..7b90db8 100644 --- a/flake.nix +++ b/flake.nix @@ -27,14 +27,20 @@ ... }: let - lib = nixpkgs.lib; + lib = nixpkgs.lib.extend ( + final: prev: + import ./lib { + inherit inputs; + lib = final; + } + ); in flake-parts.lib.mkFlake { inherit inputs; } { imports = [ inputs.treefmt-nix.flakeModule ]; systems = [ "x86_64-linux" ]; - flake = with lib; { + flake = with lib.crans.info; { nixosConfigurations = let baseModules = [ @@ -42,76 +48,14 @@ agenix.nixosModules.default ]; - infoRequired = { - name = lib.isString; - description = lib.isString; - id = lib.isInt; - }; - verifyAttrs = - info: - let - missing = lib.filter (n: !(info ? ${n})) (map (i: i.name) (lib.attrsToList infoRequired)); - wrongType = lib.filter (n: info ? ${n.name} && !(n.value info.${n.name})) ( - lib.attrsToList infoRequired - ); - in - (lib.warnIf ( - lib.length missing > 0 - ) "${info.name}/info.nix : les attributs « ${lib.join ", " missing} » sont manquants") - (lib.warnIf (lib.length wrongType > 0) - "${info.name}/info.nix : les attributs « ${ - lib.join ", " (map (i: i.name) wrongType) - } » sont mal typés" - ) - (lib.warnIfNot ( - (info.isDebian or false) || info ? enable - ) "${info.name}/info.nix : cette machine nix ne définit pas l’attribut enable") - info; - - get_hosts_names = - path: attrNames (attrsets.filterAttrs (name: type: type == "directory") (readDir path)); - get_info = - path: - filter (x: x != null) ( - map ( - name: - let - filePath = path + "/${name}/info.nix"; - in - if builtins.pathExists filePath then - verifyAttrs (import filePath) - else - warn "${toString filePath} not found" null - ) (get_hosts_names path) - ); - - listInfoToAttrs = - infos: add: listToAttrs (map (info: lib.nameValuePair info.name (info // add)) infos); - - attrsToNixosSystem = - path: all_hosts: hosts: - mapAttrs ( - name: info: - nixosSystem { - specialArgs = inputs // { - hosts = all_hosts; - }; - modules = [ - (path + "/${name}") - ({ ... }: { config.crans = info; }) - ] - ++ baseModules; - } - ) (attrsets.filterAttrs (name: info: !(info.isDebian or false)) hosts); - attrs_vm_info = listInfoToAttrs (get_info ./hosts/vm) { isVm = true; }; attrs_physique_info = listInfoToAttrs (get_info ./hosts/physiques) { isVm = false; }; attrs_all_info = attrs_physique_info // attrs_vm_info; in - (attrsToNixosSystem ./hosts/vm attrs_all_info attrs_vm_info) - // (attrsToNixosSystem ./hosts/physiques attrs_all_info attrs_physique_info) + (attrsToNixosSystem ./hosts/vm attrs_all_info attrs_vm_info baseModules) + // (attrsToNixosSystem ./hosts/physiques attrs_all_info attrs_physique_info baseModules) // { - cransIso = nixosSystem { + cransIso = lib.nixosSystem { system = "x86_64-linux"; specialArgs = inputs; modules = [ diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix index f0d5b78..8301373 100644 --- a/hosts/vm/reverseproxy/reverseproxy.nix +++ b/hosts/vm/reverseproxy/reverseproxy.nix @@ -8,6 +8,8 @@ let formatJSON = pkgs.formats.json { }; formatYAML = pkgs.formats.yaml { }; + inherit (lib.crans) fetchFromCrans; + antiBot = formatYAML.generate "antibot.yaml" [ { name = "whitelist-crans"; @@ -160,16 +162,6 @@ let ]; }; - fetchFromCrans = - opts: - pkgs.fetchFromGitLab ( - { - domain = "gitlab.adm.crans.org"; - owner = "nounous"; - } - // opts - ); - installPartySite = pkgs.python3Packages.buildPythonApplication { name = "site-install-party"; pyproject = false; diff --git a/lib/default.nix b/lib/default.nix new file mode 100644 index 0000000..e3ffe47 --- /dev/null +++ b/lib/default.nix @@ -0,0 +1,19 @@ +args@{ inputs, ... }: +let + pkgs = inputs.nixpkgs.legacyPackages.x86_64-linux; +in +{ + crans = { + info = import ./info.nix args; + + fetchFromCrans = + opts: + pkgs.fetchFromGitLab ( + { + domain = "gitlab.adm.crans.org"; + owner = "nounous"; + } + // opts + ); + }; +} diff --git a/lib/info.nix b/lib/info.nix new file mode 100644 index 0000000..b3cd64f --- /dev/null +++ b/lib/info.nix @@ -0,0 +1,81 @@ +{ lib, inputs, ... }: + +let + inherit (lib) + attrNames + attrsToList + isInt + isString + join + length + listToAttrs + filter + filterAttrs + mapAttrs + nameValuePair + nixosSystem + readDir + warn + warnIf + warnIfNot + ; +in +rec { + + infoRequired = { + name = isString; + description = isString; + id = isInt; + }; + verifyAttrs = + info: + let + missing = filter (n: !(info ? ${n})) (attrNames infoRequired); + wrongType = filter (n: info ? ${n.name} && !(n.value info.${n.name})) (attrsToList infoRequired); + in + (warnIf ( + length missing > 0 + ) "${info.name}/info.nix : les attributs « ${join ", " missing} » sont manquants") + (warnIf (length wrongType > 0) + "${info.name}/info.nix : les attributs « ${join ", " (map (i: i.name) wrongType)} » sont mal typés" + ) + (warnIfNot ( + (info.isDebian or false) || info ? enable + ) "${info.name}/info.nix : cette machine nix ne définit pas l’attribut enable") + info; + + get_hosts_names = path: attrNames (filterAttrs (name: type: type == "directory") (readDir path)); + get_info = + path: + filter (x: x != null) ( + map ( + name: + let + filePath = path + "/${name}/info.nix"; + in + if builtins.pathExists filePath then + verifyAttrs (import filePath) + else + warn "${toString filePath} not found" null + ) (get_hosts_names path) + ); + + listInfoToAttrs = infos: add: listToAttrs (map (info: nameValuePair info.name (info // add)) infos); + + attrsToNixosSystem = + path: all_hosts: hosts: baseModules: + mapAttrs ( + name: info: + nixosSystem { + specialArgs = inputs // { + hosts = all_hosts; + }; + modules = [ + (path + "/${name}") + ({ ... }: { config.crans = info; }) + ] + ++ baseModules; + } + ) (filterAttrs (name: info: !(info.isDebian or false)) hosts); + +} diff --git a/modules/crans/users.nix b/modules/crans/users.nix index 892aede..9c14880 100644 --- a/modules/crans/users.nix +++ b/modules/crans/users.nix @@ -23,7 +23,7 @@ in root = { passwordFile = mkOption { - type = types.externalPath; + type = types.path; default = ../../secrets/common/root.age; example = ../../secrets/apprentix/root.age; description = "Fichier chiffré par age contenant le mot de passe root."; From f239a9aada83dd5c5fb97f02e5600a487bc65abe Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Fri, 18 Sep 2026 16:52:59 +0200 Subject: [PATCH 14/15] Encapsulation --- flake.nix | 4 ---- lib/info.nix | 9 +++++---- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/flake.nix b/flake.nix index 7b90db8..46ee8d6 100644 --- a/flake.nix +++ b/flake.nix @@ -47,10 +47,6 @@ ./modules agenix.nixosModules.default ]; - - attrs_vm_info = listInfoToAttrs (get_info ./hosts/vm) { isVm = true; }; - attrs_physique_info = listInfoToAttrs (get_info ./hosts/physiques) { isVm = false; }; - attrs_all_info = attrs_physique_info // attrs_vm_info; in (attrsToNixosSystem ./hosts/vm attrs_all_info attrs_vm_info baseModules) // (attrsToNixosSystem ./hosts/physiques attrs_all_info attrs_physique_info baseModules) diff --git a/lib/info.nix b/lib/info.nix index b3cd64f..b689add 100644 --- a/lib/info.nix +++ b/lib/info.nix @@ -19,9 +19,6 @@ let warnIf warnIfNot ; -in -rec { - infoRequired = { name = isString; description = isString; @@ -61,7 +58,8 @@ rec { ); listInfoToAttrs = infos: add: listToAttrs (map (info: nameValuePair info.name (info // add)) infos); - +in +rec { attrsToNixosSystem = path: all_hosts: hosts: baseModules: mapAttrs ( @@ -78,4 +76,7 @@ rec { } ) (filterAttrs (name: info: !(info.isDebian or false)) hosts); + attrs_vm_info = listInfoToAttrs (get_info ../hosts/vm) { isVm = true; }; + attrs_physique_info = listInfoToAttrs (get_info ../hosts/physiques) { isVm = false; }; + attrs_all_info = attrs_physique_info // attrs_vm_info; } From a33d37b92e66b9832667aa739746fa781b2832e5 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Sun, 27 Sep 2026 10:28:20 +0200 Subject: [PATCH 15/15] Apply 1 suggestion(s) to 1 file(s) Co-authored-by: lzebulon --- hosts/vm/jitsi/info.nix | 3 --- 1 file changed, 3 deletions(-) diff --git a/hosts/vm/jitsi/info.nix b/hosts/vm/jitsi/info.nix index d9c3c5c..f070613 100644 --- a/hosts/vm/jitsi/info.nix +++ b/hosts/vm/jitsi/info.nix @@ -19,9 +19,6 @@ acme.enable = true; }; - # aliasDNS = [ - # "visio" - # ]; public-ssh = "";