diff --git a/flake.nix b/flake.nix index 757108a..826d504 100644 --- a/flake.nix +++ b/flake.nix @@ -38,68 +38,68 @@ ./modules agenix.nixosModules.default ]; + get_hosts_names = path: + attrNames ( + attrsets.filterAttrs (name: type: type == "directory") + (readDir path) + ) ; + hostVM = get_hosts_names ./hosts/vm; + hostPhysique = get_hosts_names ./hosts/physiques; + get_info = + path: lists: + filter (x: x != null) + (map (name: + let filePath = path + "/${name}/info.nix"; + in + if builtins.pathExists filePath then + # let eval = evalModules { + # specialArgs = inputs; + # modules = [ + # ./modules/crans + # { + # crans = import filePath; + # } + # # agenix.nixosModules.default + # ]; + # }; + # in + # eval.config + { + crans = import filePath; + } + else + warn "${toString filePath} not found" null + ) lists + ); + hosts_vm_info = get_info ./hosts/vm hostVM; + hosts_physique_info = get_info ./hosts/physiques hostPhysique; + + listInfoToAttrs = + path: infos: + listToAttrs ( + map (info: + { + name = info.crans.name; + value = info; + } + ) infos) + ; + attrsToNixosSystem = path: all_hosts: hosts: + mapAttrs (name: info: + nixosSystem { + specialArgs = { hosts = all_hosts; inherit inputs;}; + modules = [(path + "/${name}")] ++ [info] ++ baseModules + ; + } + ) hosts; + attrs_vm_info = listInfoToAttrs ./hosts/vm hosts_vm_info; + attrs_physique_info = listInfoToAttrs ./hosts/physiques hosts_physique_info; + attrs_all_info = attrs_physique_info // attrs_vm_info; in + (attrsToNixosSystem ./hosts/vm attrs_all_info attrs_vm_info) + // { - apprentix = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/apprentix ] ++ baseModules; - }; - - collabora = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/collabora ] ++ baseModules; - }; - - jitsi = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/jitsi ] ++ baseModules; - }; - - livre = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/livre ] ++ baseModules; - }; - - neo = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/neo ] ++ baseModules; - }; - - nextcloud = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/nextcloud ] ++ baseModules; - }; - - periodique = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/periodique ] ++ baseModules; - }; - - redite = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/redite ] ++ baseModules; - }; - - reverseproxy = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/reverseproxy ] ++ baseModules; - }; - - thot = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/physiques/thot ] ++ baseModules; - }; - - two = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/two ] ++ baseModules; - }; - - vaultwarden = nixosSystem { - specialArgs = inputs; - modules = [ ./hosts/vm/vaultwarden ] ++ baseModules; - }; - cransIso = nixosSystem { + cransIso = nixosSystem { system = "x86_64-linux"; specialArgs = inputs; modules = [ diff --git a/hosts/physiques/cameron/info.nix b/hosts/physiques/cameron/info.nix new file mode 100644 index 0000000..4164a30 --- /dev/null +++ b/hosts/physiques/cameron/info.nix @@ -0,0 +1,22 @@ +{ + name = "cameron"; + description = "Serveur de stockage adh"; + id = 2; + + isDebian = true; + + networking = { + adm.enable = true; + san.enable = true; + + switch = { + # todo recheck port + salameche = -1; + }; + }; + + ilo = { + id = 52; + switch.salameche = 16; + }; +} diff --git a/hosts/physiques/cephiroth/info.nix b/hosts/physiques/cephiroth/info.nix new file mode 100644 index 0000000..6c3b5c7 --- /dev/null +++ b/hosts/physiques/cephiroth/info.nix @@ -0,0 +1,20 @@ +{ + name = "cephiroth"; + description = "Serveur de stockage ceph"; + id = 3; + + networking = { + adm.enable = true; + san.enable = true; + + switch = { + carapuce = 12; + arceus = 12; + }; + }; + + ilo = { + id = 53; + switch.salameche = 20; + }; +} diff --git a/hosts/physiques/daniel/info.nix b/hosts/physiques/daniel/info.nix new file mode 100644 index 0000000..71ae326 --- /dev/null +++ b/hosts/physiques/daniel/info.nix @@ -0,0 +1,23 @@ +{ + name = "daniel"; + description = "PVE adm"; + id = 12; + + isDebian = true; + + networking = { + adm.enable = true; + san.enable = true; + srv-nat.enable = true; + + switch = { + carapuce = 3; + arceus = 3; + }; + }; + + ilo = { + id = 22; + switch.salameche = 4; + }; +} diff --git a/hosts/physiques/ft/info.nix b/hosts/physiques/ft/info.nix new file mode 100644 index 0000000..35c5a67 --- /dev/null +++ b/hosts/physiques/ft/info.nix @@ -0,0 +1,17 @@ +{ + name = "ft"; + description = "Serveur de backup du Crans, en SQ39"; + id = 15; + + isDebian = true; + + networking = { + adm.enable = true; + + switch = { + carapuce = 13; + arceus = 13; + }; + }; + +} diff --git a/hosts/physiques/gulp/info.nix b/hosts/physiques/gulp/info.nix new file mode 100644 index 0000000..9fbf144 --- /dev/null +++ b/hosts/physiques/gulp/info.nix @@ -0,0 +1,22 @@ +{ + name = "gulp"; + description = "PVE adh"; + id = 18; + + isDebian = true; + + networking = { + adm.enable = true; + adh.enable = true; + + switch = { + carapuce = 11; + arceus = 11; + }; + }; + + ilo = { + id = 28; + switch.salameche = 12; + }; +} diff --git a/hosts/physiques/jack/info.nix b/hosts/physiques/jack/info.nix new file mode 100644 index 0000000..3fbb130 --- /dev/null +++ b/hosts/physiques/jack/info.nix @@ -0,0 +1,24 @@ +{ + name = "jack"; + description = "PVE adm"; + id = 13; + + isDebian = true; + + networking = { + adm.enable = true; + san.enable = true; + srv-nat.enable = true; + + switch = { + carapuce = 5; + arceus = 5; + }; + }; + + ilo = { + id = 23; + switch.salameche = 6; + }; +} + diff --git a/hosts/physiques/odlyd/info.nix b/hosts/physiques/odlyd/info.nix new file mode 100644 index 0000000..90dff8c --- /dev/null +++ b/hosts/physiques/odlyd/info.nix @@ -0,0 +1,21 @@ +{ + name = "odlyd"; + description = "PVE adh"; + id = 16; + + isDebian = true; + + networking = { + adm.enable = true; + adh.enable = true; + + switch = { + # pas branche + }; + }; + + ilo = { + id = 26; + switch.salameche = 8; + }; +} diff --git a/hosts/physiques/sam/info.nix b/hosts/physiques/sam/info.nix new file mode 100644 index 0000000..0dd7f9b --- /dev/null +++ b/hosts/physiques/sam/info.nix @@ -0,0 +1,23 @@ +{ + name = "sam"; + description = "PVE adm"; + id = 11; + + isDebian = true; + + networking = { + adm.enable = true; + san.enable = true; + srv-nat.enable = true; + + switch = { + carapuce = 1; + arceus = 1; + }; + }; + + ilo = { + id = 21; + switch.salameche = 2; + }; +} diff --git a/hosts/physiques/stitch/info.nix b/hosts/physiques/stitch/info.nix new file mode 100644 index 0000000..b10b4cc --- /dev/null +++ b/hosts/physiques/stitch/info.nix @@ -0,0 +1,22 @@ +{ + name = "stitch"; + description = "PVE adh"; + id = 17; + + isDebian = true; + + networking = { + adm.enable = true; + adh.enable = true; + + switch = { + carapuce = 9; + arceus = 9; + }; + }; + + ilo = { + id = 27; + switch.salameche = 10; + }; +} diff --git a/hosts/physiques/tealc/info.nix b/hosts/physiques/tealc/info.nix new file mode 100644 index 0000000..1b8a385 --- /dev/null +++ b/hosts/physiques/tealc/info.nix @@ -0,0 +1,22 @@ +{ + name = "tealc"; + description = "Serveur de stockage adm"; + id = 1; + + isDebian = true; + + networking = { + adm.enable = true; + san.enable = true; + + switch = { + carapuce = 10; + arceus = 10; + }; + }; + + ilo = { + id = 51; + switch.salameche = 18; + }; +} diff --git a/hosts/physiques/thot/default.nix b/hosts/physiques/thot/default.nix index 80d4f99..27f44b4 100644 --- a/hosts/physiques/thot/default.nix +++ b/hosts/physiques/thot/default.nix @@ -38,19 +38,5 @@ restic ]; - crans = { - enable = true; - - networking.adm.enable = false; - resticClient.enable = false; - - services = { - resticServer = { - enable = true; - port = 4242; - }; - }; - }; - system.stateVersion = "24.05"; } diff --git a/hosts/physiques/thot/info.nix b/hosts/physiques/thot/info.nix new file mode 100644 index 0000000..e45b6db --- /dev/null +++ b/hosts/physiques/thot/info.nix @@ -0,0 +1,17 @@ +{ + name = "thot"; + description = "Serveur de backup sous nixos utilisant Restic"; + id = 14; + + enable = true; + + networking.adm.enable = false; + resticClient.enable = false; + + services = { + resticServer = { + enable = true; + port = 4242; + }; + }; +} diff --git a/hosts/physiques/zamok/info.nix b/hosts/physiques/zamok/info.nix new file mode 100644 index 0000000..ce45c1b --- /dev/null +++ b/hosts/physiques/zamok/info.nix @@ -0,0 +1,23 @@ +{ + name = "zamok"; + description = "Serveur de calcul adhérent"; + id = 31; + + isDebian = true; + + networking = { + adm.enable = true; + adh.enable = true; + san.enable = true; + + switch = { + carapuce = 7; + arceus = 4; + }; + }; + + ilo = { + id = 54; + switch.salameche = 14; + }; +} diff --git a/hosts/vm/apprentix/default.nix b/hosts/vm/apprentix/default.nix index 4e67e57..1525c72 100644 --- a/hosts/vm/apprentix/default.nix +++ b/hosts/vm/apprentix/default.nix @@ -9,21 +9,6 @@ networking.hostName = "apprentix"; - crans = { - enable = true; - - networking = { - id = 150; - srvNat.enable = true; - }; - - resticClient.when = "01:23"; - - homeNounou.enable = false; - - users.root.passwordFile = ../../../secrets/apprentix/root.age; - }; - security.sudo.extraRules = [ { groups = [ "_user" ]; diff --git a/hosts/vm/apprentix/info.nix b/hosts/vm/apprentix/info.nix new file mode 100644 index 0000000..22e47f2 --- /dev/null +++ b/hosts/vm/apprentix/info.nix @@ -0,0 +1,17 @@ +{ + name = "apprentix"; + description = "VM pour les apprenti⋅es"; + id = 150; + + enable = true; + + networking = { + srvNat.enable = true; + }; + + resticClient.when = "01:23"; + + homeNounou.enable = false; + + users.root.passwordFile = ../../../secrets/apprentix/root.age; +} diff --git a/hosts/vm/collabora/default.nix b/hosts/vm/collabora/default.nix index 46fbc66..4d0a67f 100644 --- a/hosts/vm/collabora/default.nix +++ b/hosts/vm/collabora/default.nix @@ -9,16 +9,5 @@ networking.hostName = "collabora"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - - networking = { - id = 149; - srvNat.enable = true; - }; - - resticClient.enable = false; - }; - system.stateVersion = "25.09"; } diff --git a/hosts/vm/collabora/info.nix b/hosts/vm/collabora/info.nix new file mode 100644 index 0000000..85052e9 --- /dev/null +++ b/hosts/vm/collabora/info.nix @@ -0,0 +1,14 @@ +{ + name = "collabora"; + description = "Collabora du Crans"; + id = 149; + + enable = true; + + networking = { + srvNat.enable = true; + }; + + resticClient.enable = false; +} + diff --git a/hosts/vm/jitsi/default.nix b/hosts/vm/jitsi/default.nix index 518a948..120bd48 100644 --- a/hosts/vm/jitsi/default.nix +++ b/hosts/vm/jitsi/default.nix @@ -9,23 +9,5 @@ networking.hostName = "jitsi"; boot.loader.grub.devices = [ "/dev/vda" ]; - crans = { - enable = true; - - networking = { - id = 163; - srv = { - enable = true; - ipv4 = "185.230.79.15"; - }; - }; - - resticClient.when = "02:34"; - - services = { - acme.enable = true; - }; - }; - system.stateVersion = "24.11"; } diff --git a/hosts/vm/jitsi/info.nix b/hosts/vm/jitsi/info.nix new file mode 100644 index 0000000..5818ab2 --- /dev/null +++ b/hosts/vm/jitsi/info.nix @@ -0,0 +1,27 @@ +{ + name = "jitsi"; + description = "Machine qui gère Jitsi"; + + id = 163; + + networking = { + adm.enable = true; + srv = { + enable = true; + ipv4 = "185.230.79.15"; + }; + }; + + resticClient.when = "02:34"; + + services = { + acme.enable = true; + }; + + # aliasDNS = [ + # "visio" + # ]; + + public-ssh = ""; + +} diff --git a/hosts/vm/livre/default.nix b/hosts/vm/livre/default.nix index 9b669a9..1a76e79 100644 --- a/hosts/vm/livre/default.nix +++ b/hosts/vm/livre/default.nix @@ -9,16 +9,5 @@ networking.hostName = "livre"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - - networking = { - id = 140; - srvNat.enable = true; - }; - - resticClient.when = "03:45"; - }; - system.stateVersion = "24.11"; } diff --git a/hosts/vm/livre/info.nix b/hosts/vm/livre/info.nix new file mode 100644 index 0000000..7eba0c0 --- /dev/null +++ b/hosts/vm/livre/info.nix @@ -0,0 +1,14 @@ +{ + name = "livre"; + description = "Editeur de PDF en ligne via Stirling-PDF"; + id = 140; + + enable = true; + + networking = { + srvNat.enable = true; + }; + + resticClient.when = "03:45"; +} + diff --git a/hosts/vm/neo/default.nix b/hosts/vm/neo/default.nix index f2f99ae..c5aaf5f 100644 --- a/hosts/vm/neo/default.nix +++ b/hosts/vm/neo/default.nix @@ -12,24 +12,5 @@ networking.hostName = "neo"; - crans = { - enable = true; - - networking = { - id = 141; - srv = { - enable = true; - ipv4 = "185.230.79.5"; - }; - }; - - resticClient.when = "04:56"; - - services = { - acme.enable = true; - coturn.enable = true; - }; - }; - system.stateVersion = "24.11"; } diff --git a/hosts/vm/neo/info.nix b/hosts/vm/neo/info.nix new file mode 100644 index 0000000..e234b09 --- /dev/null +++ b/hosts/vm/neo/info.nix @@ -0,0 +1,20 @@ +{ + name = "neo"; + description = "Matrix du Crans et bridge IRC/Matrix"; + enable = true; + id = 141; + + networking = { + srv = { + enable = true; + ipv4 = "185.230.79.5"; + }; + }; + + resticClient.when = "04:56"; + + services = { + acme.enable = true; + coturn.enable = true; + }; +} diff --git a/hosts/vm/nextcloud/default.nix b/hosts/vm/nextcloud/default.nix index 99c1ae6..4c96991 100644 --- a/hosts/vm/nextcloud/default.nix +++ b/hosts/vm/nextcloud/default.nix @@ -9,25 +9,6 @@ networking.hostName = "nextcloud"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - networking = { - id = 146; - srvNat = { - enable = true; - interface = "ens20"; - }; - san = { - enable = true; - interface = "ens19"; - }; - }; - - homeAdh.enable = true; - - resticClient.enable = false; - }; - services.autofs = { enable = true; diff --git a/hosts/vm/nextcloud/info.nix b/hosts/vm/nextcloud/info.nix new file mode 100644 index 0000000..d23079d --- /dev/null +++ b/hosts/vm/nextcloud/info.nix @@ -0,0 +1,22 @@ +{ + name = "nextcloud"; + description = "Nextcloud du Crans"; + id = 146; + + enable = true; + + networking = { + srvNat = { + enable = true; + interface = "ens20"; + }; + san = { + enable = true; + interface = "ens19"; + }; + }; + + homeAdh.enable = true; + + resticClient.enable = false; +} diff --git a/hosts/vm/periodique/default.nix b/hosts/vm/periodique/default.nix index d66df0b..82cd023 100644 --- a/hosts/vm/periodique/default.nix +++ b/hosts/vm/periodique/default.nix @@ -9,16 +9,5 @@ networking.hostName = "periodique"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - - networking = { - id = 118; - srvNat.enable = true; - }; - - resticClient.when = "02:56"; - }; - system.stateVersion = "24.11"; } diff --git a/hosts/vm/periodique/info.nix b/hosts/vm/periodique/info.nix new file mode 100644 index 0000000..faf99e8 --- /dev/null +++ b/hosts/vm/periodique/info.nix @@ -0,0 +1,14 @@ +{ + name = "periodique"; + description = "Frontend Matrix du Crans (element)"; + id = 118; + + enable = true; + + networking = { + srvNat.enable = true; + }; + + resticClient.when = "02:56"; +} + diff --git a/hosts/vm/redite/default.nix b/hosts/vm/redite/default.nix index 45dea89..e80b4e7 100644 --- a/hosts/vm/redite/default.nix +++ b/hosts/vm/redite/default.nix @@ -9,16 +9,5 @@ networking.hostName = "redite"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - - networking = { - id = 139; - srvNat.enable = true; - }; - - resticClient.when = "06:18"; - }; - system.stateVersion = "23.11"; } diff --git a/hosts/vm/redite/info.nix b/hosts/vm/redite/info.nix new file mode 100644 index 0000000..78094da --- /dev/null +++ b/hosts/vm/redite/info.nix @@ -0,0 +1,13 @@ +{ + name = "redite"; + description = "Frontend reddit libre"; + id = 139; + + enable = true; + + networking = { + srvNat.enable = true; + }; + + resticClient.when = "06:18"; +} diff --git a/hosts/vm/reverseproxy/default.nix b/hosts/vm/reverseproxy/default.nix index 4c56498..c4e0f27 100644 --- a/hosts/vm/reverseproxy/default.nix +++ b/hosts/vm/reverseproxy/default.nix @@ -13,22 +13,5 @@ users.users."nginx".home = "/var/lib/nginx"; users.users."anubis".extraGroups = [ "nginx" ]; - crans = { - enable = true; - - networking = { - id = 151; - srvNat.enable = true; - srv = { - enable = true; - interface = "ens20"; - ipv4 = "185.230.79.42"; - }; - }; - - resticClient.when = "03:42"; - - }; - system.stateVersion = "25.05"; } diff --git a/hosts/vm/reverseproxy/info.nix b/hosts/vm/reverseproxy/info.nix new file mode 100644 index 0000000..4481c49 --- /dev/null +++ b/hosts/vm/reverseproxy/info.nix @@ -0,0 +1,20 @@ +{ + name = "reverseproxy"; + description = "reverse-proxy principale du Crans"; + id = 151; + + enable = true; + + networking = { + srvNat.enable = true; + srv = { + enable = true; + interface = "ens20"; + ipv4 = "185.230.79.42"; + }; + }; + + resticClient.when = "03:42"; + +} + diff --git a/hosts/vm/two/default.nix b/hosts/vm/two/default.nix index a87ebcd..0a71c71 100644 --- a/hosts/vm/two/default.nix +++ b/hosts/vm/two/default.nix @@ -8,19 +8,6 @@ networking.hostName = "two"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - - networking = { - id = 135; - srvNat = { - enable = true; - interface = "ens19"; - }; - }; - - resticClient.when = "07:29"; - }; system.stateVersion = "23.11"; } diff --git a/hosts/vm/two/info.nix b/hosts/vm/two/info.nix new file mode 100644 index 0000000..2b833b5 --- /dev/null +++ b/hosts/vm/two/info.nix @@ -0,0 +1,16 @@ +{ + name = "two"; + description = "VM de test"; + id = 135; + + enable = true; + + networking = { + srvNat = { + enable = true; + interface = "ens19"; + }; + }; + + resticClient.when = "07:29"; +} diff --git a/hosts/vm/vaultwarden/default.nix b/hosts/vm/vaultwarden/default.nix index 523b73d..d98caf8 100644 --- a/hosts/vm/vaultwarden/default.nix +++ b/hosts/vm/vaultwarden/default.nix @@ -9,16 +9,5 @@ networking.hostName = "vaultwarden"; boot.loader.grub.devices = [ "/dev/sda" ]; - crans = { - enable = true; - - networking = { - id = 159; - srvNat.enable = true; - }; - - resticClient.when = "04:44"; - }; - system.stateVersion = "24.05"; } diff --git a/hosts/vm/vaultwarden/info.nix b/hosts/vm/vaultwarden/info.nix new file mode 100644 index 0000000..953a611 --- /dev/null +++ b/hosts/vm/vaultwarden/info.nix @@ -0,0 +1,13 @@ +{ + name = "vaultwarden"; + description = "Vaultarden du crans, gestionnaire de mot de passe"; + id = 159; + + enable = true; + + networking = { + srvNat.enable = true; + }; + + resticClient.when = "04:44"; +} diff --git a/modules/crans/default.nix b/modules/crans/default.nix index cf9f2ea..ff29544 100644 --- a/modules/crans/default.nix +++ b/modules/crans/default.nix @@ -8,6 +8,7 @@ in { imports = [ ./age.nix + ./extra.nix ./grub.nix ./home.nix ./locale.nix diff --git a/modules/crans/extra.nix b/modules/crans/extra.nix new file mode 100644 index 0000000..e782292 --- /dev/null +++ b/modules/crans/extra.nix @@ -0,0 +1,32 @@ +{ lib, ... }: +with lib; +{ + options.crans = { + name = mkOption { + type = types.str; + example = "vm-test"; + description = "Nom de la machine"; + }; + + description = mkOption { + type = types.str; + example = "VM de test"; + description = "Description de la machine"; + }; + + id = mkOption { + type = types.int; + example = 135; + description = """ + ID de la machine : + - < 100 machine physique + - >= 100 VM ( id de la VM dans proxmox ) + """; + }; + + public-ssh = mkOption { + type = types.str; + description = "Clé ssh public de la machine"; + }; + }; +} diff --git a/modules/crans/networking.nix b/modules/crans/networking.nix index 60ac51e..0cceae0 100644 --- a/modules/crans/networking.nix +++ b/modules/crans/networking.nix @@ -1,13 +1,15 @@ -{ lib, config, ... }: +{ lib, config, hosts, ... }: let - cfg = config.crans.networking; + cfg = config.crans; + cfg-net = cfg.networking; inherit (lib) mkEnableOption mkIf mkOption types + mod ; idString = toString cfg.id; @@ -15,17 +17,13 @@ let hostIdString = lib.fixedWidthString 2 "0" (toString hostId); isVm = cfg.id >= 100; isVmString = toString isVm; + get_mac = id: vlan_num: + "02:00:00:0${toString (id >= 100)}:${toString (mod id 100)}:${lib.fixedWidthString 2 "0" (toString vlan_num)}"; in { options.crans.networking = { enable = mkEnableOption "Configuration réseaux commune à toutes les machines du Crans."; - id = mkOption { - type = types.int; - example = 135; - description = "Le numéro de la VM dans Proxmox."; - }; - adm = { enable = mkEnableOption "Configuration du VLAN adm."; @@ -35,6 +33,21 @@ in example = "ens20"; description = "Nom de l'interface réseau sur laquelle est située le VLAN adm."; }; + + ipv4 = mkOption { + type = types.str; + example = "176.16.10.102"; + default = "172.16.10.${idString}"; + description = "Adresse IPv4 de la machine sur le VLAN adm"; + }; + + ipv6 = mkOption { + type = types.str; + example = "fd00::10:0:ff:fe01:0210"; + default = "fd00::10:0:ff:fe0${isVmString}:${hostIdString}10"; + description = "Adresse IPv6 de la machine sur le VLAN adm"; + }; + }; srv = { @@ -52,6 +65,13 @@ in example = "185.230.79.1"; description = "Adresse IPv4 de la machine."; }; + + ipv6 = mkOption { + type = types.str; + example = "2a0c:700:2::ff:fe01:0202"; + default = "2a0c:700:2::ff:fe0${isVmString}:${hostIdString}02"; + description = "Adresse IPv6 de la machine sur le VLAN srv."; + }; }; srvNat = { @@ -63,6 +83,20 @@ in example = "ens20"; description = "Nom de l'interface réseau sur laquelle est située le VLAN srv-nat."; }; + + ipv4 = mkOption { + type = types.str; + example = "176.16.3.102"; + default = "172.16.3.${idString}"; + description = "Adresse IPv4 de la machine sur le VLAN srv-nat."; + }; + + ipv6 = mkOption { + type = types.str; + example = "2a0c:700:3::ff:fe01:0203"; + default = "2a0c:700:3::ff:fe0${isVmString}:${hostIdString}03"; + description = "Adresse IPv6 de la machine sur le VLAN srv-nat."; + }; }; san = { @@ -73,11 +107,26 @@ in example = "ens19"; description = "Nom de l'interface réseau sur laquelle est située le VLAN san."; }; + + ipv4 = mkOption { + type = types.str; + example = "176.16.4.102"; + default = "172.16.4.${idString}"; + description = "Adresse IPv4 de la machine sur le VLAN srv-nat."; + }; + + ipv6 = mkOption { + type = types.str; + example = "fd00::4:0:ff:fe01:0204"; + default = "fd00::4:0:ff:fe0${isVmString}:${hostIdString}04"; + description = "Adresse IPv6 de la machine sur le VLAN san."; + }; }; }; - config = mkIf cfg.enable { + config = mkIf cfg-net.enable { networking = { + hostName = cfg.name; useDHCP = false; firewall.enable = lib.mkDefault false; nameservers = [ "172.16.10.128" ]; @@ -92,24 +141,24 @@ in # plus bas). lib.attrsets.mapAttrs' (interface: conf: { - name = cfg."${interface}".interface; + name = cfg-net."${interface}".interface; value = conf; }) ( # On filtre sur les interfaces activées - lib.attrsets.filterAttrs (interface: _: cfg."${interface}".enable) { + lib.attrsets.filterAttrs (interface: _: cfg-net."${interface}".enable) { # Configuration du VLAN adm adm = { ipv4.addresses = [ { - address = "172.16.10.${idString}"; + address = cfg-net.adm.ipv4; prefixLength = 24; } ]; ipv6.addresses = [ { - address = "fd00::10:0:ff:fe0${isVmString}:${hostIdString}10"; + address = cfg-net.adm.ipv6; prefixLength = 64; } ]; @@ -120,7 +169,7 @@ in ipv4 = { addresses = [ { - address = cfg.srv.ipv4; + address = cfg-net.srv.ipv4; prefixLength = 26; } ]; @@ -135,7 +184,7 @@ in ipv6 = { addresses = [ { - address = "2a0c:700:2::ff:fe0${isVmString}:${hostIdString}02"; + address = cfg-net.srv.ipv6; prefixLength = 64; } ]; @@ -154,7 +203,7 @@ in ipv4 = { addresses = [ { - address = "172.16.3.${idString}"; + address = cfg-net.srvNat.ipv4; prefixLength = 24; } ]; @@ -170,7 +219,7 @@ in ipv6 = { addresses = [ { - address = "2a0c:700:3::ff:fe0${isVmString}:${hostIdString}03"; + address = cfg-net.srvNat.ipv6; prefixLength = 64; } ]; @@ -188,14 +237,14 @@ in san = { ipv4.addresses = [ { - address = "172.16.4.${idString}"; + address = cfg-net.san.ipv4; prefixLength = 24; } ]; ipv6.addresses = [ { - address = "fd00::4:0:ff:fe0${isVmString}:${hostIdString}04"; + address = cfg-net.san.ipv6; prefixLength = 64; } ]; diff --git a/modules/crans/users.nix b/modules/crans/users.nix index c229bf4..5686447 100644 --- a/modules/crans/users.nix +++ b/modules/crans/users.nix @@ -18,7 +18,7 @@ in root = { passwordFile = mkOption { - type = types.path; + type = types.externalPath; default = ../../secrets/common/root.age; example = ../../secrets/apprentix/root.age; description = "Fichier chiffré par age contenant le mot de passe root.";