refactor: full repo sweep — variables, docs, and comment cleanup

- variables.nix: switch to rec {}, extract giteaDomain/giteaRepoPath, extraAdminSshKeys, haLanNfsFqdn, tailscaleResolverIp, ports.dhcp, ports.dns; ipaServer now derives from homeDomain ref; section headers - modules: use new vars throughout (pxe-boot, ts-dns-forwarder, cluster-config, configuration.nix, mount-pxe-images) — eval unchanged - docs: delete ephemeral planning docs (AUDIT_REPORT, ha-network-audit, network-cutover); add docs/ha.md; drop migration reference table from ip-addressing.md; remove stale server example from beszel.md - CLAUDE.md/README.md/AGENTS.md: fix build types (tailscale-router, ha-server, drop server); document scripts/ha/, scripts/ipa/, and all previously undocumented top-level and lib scripts Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-07-30 06:28:52 +10:00
parent 71381ad990
commit cded77919d
15 changed files with 502 additions and 1162 deletions
@@ -6,6 +6,10 @@ let
  tftpRoot = "${pxeRoot}/tftp";
  pxeBaseUrl = "http://${vars.pxeServerIp}";

+  # Base network address extracted from lanCidr (e.g. "192.168.2.0" from
+  # "192.168.2.0/24") — used by dnsmasq's proxy DHCP range directive.
+  lanBaseAddr = lib.head (lib.splitString "/" vars.lanCidr);
+
  bootIpxe = pkgs.writeText "boot.ipxe" ''
    #!ipxe

@@ -73,16 +77,16 @@ let
    boot
  '';

-  # Kickstart file for domain-controller.sweet.home.
-  # Installs Rocky Linux 9, sets a static IP, creates wayne with the
-  # admin SSH key, then on first reboot runs ipa-server-install via a
-  # systemd oneshot service.  Passwords are generated at %post time,
-  # written to /root/ipa-credentials.txt (chmod 600), and read back by
-  # the first-boot script — never hardcoded here or in the repo.
+  # Kickstart file for ${vars.ipaServer}.
+  # Installs Rocky Linux 9, sets a static IP, creates ${vars.ipaUser} with
+  # the admin SSH key, then on first reboot runs ipa-server-install via a
+  # systemd oneshot service. Passwords are generated at %post time, written
+  # to /root/ipa-credentials.txt (chmod 600), and read back by the
+  # first-boot script — never hardcoded here or in the repo.
  rockyFreeIpaKs = pkgs.writeText "rocky-freeipa.ks" ''
    #version=RHEL9
    # Unattended Rocky Linux 9 + FreeIPA install
-    # Target: domain-controller.${vars.homeDomain}  ${vars.domainControllerIp}
+    # Target: ${vars.ipaServer}  ${vars.domainControllerIp}

    url --url=${rockyMirror}/BaseOS/${rockyArch}/os/
    repo --name=appstream --baseurl=${rockyMirror}/AppStream/${rockyArch}/os/
@@ -93,14 +97,14 @@ let

    # DHCP during install; static IP configured in %post via NM config file
    network --bootproto=dhcp --device=link --activate
-    network --hostname=domain-controller.sweet.home
+    network --hostname=${vars.ipaServer}

    selinux --enforcing
    firewall --enabled --service=ssh

    rootpw --lock
-    user --name=wayne --groups=wheel --shell=/bin/bash
-    sshkey --username=wayne "${vars.adminSshKey}"
+    user --name=${vars.ipaUser} --groups=wheel --shell=/bin/bash
+    sshkey --username=${vars.ipaUser} "${vars.adminSshKey}"

    zerombr
    clearpart --all --initlabel --drives=sda
@@ -148,7 +152,7 @@ let

    # -- /etc/hosts: FQDN must resolve to the real IP (not loopback) for IPA --
    sed -i '/domain-controller/d' /etc/hosts
-    echo '${vars.domainControllerIp} domain-controller.${vars.homeDomain} domain-controller' >> /etc/hosts
+    echo '${vars.domainControllerIp} ${vars.ipaServer} domain-controller' >> /etc/hosts

    # -- Generate IPA passwords and store securely --
    DM_PASS=$(openssl rand -base64 24 | tr -dc 'A-Za-z0-9' | head -c 24)
@@ -168,13 +172,13 @@ let
    ADMIN_PASS=$(grep '^IPA Admin:' /root/ipa-credentials.txt | awk '{print $NF}')

    ipa-server-install \
-      --realm=SWEET.HOME \
-      --domain=sweet.home \
-      --hostname=domain-controller.sweet.home \
+      --realm=${lib.strings.toUpper vars.homeDomain} \
+      --domain=${vars.homeDomain} \
+      --hostname=${vars.ipaServer} \
      --ds-password="$DM_PASS" \
      --admin-password="$ADMIN_PASS" \
      --setup-dns \
-      --forwarder=192.168.2.253 \
+      --forwarder=${vars.domainControllerIp} \
      --no-dnssec-validation \
      --no-ntp \
      --unattended
@@ -341,9 +345,7 @@ in
    atftpd = {
      enable = true;
      root = tftpRoot;
-      extraOptions = [
-        "--verbose=5"
-      ];
+      extraOptions = [ "--verbose=5" ];
    };

    openssh.settings.PermitRootLogin = "yes";
@@ -428,7 +430,7 @@ in
      # Without this dnsmasq tries to bind port 53 which systemd-resolved
      # already owns, causing startup failure.
      port = 0;
-      dhcp-range = [ "192.168.2.0,proxy" ];
+      dhcp-range = [ "${lanBaseAddr},proxy" ];
      dhcp-match = [
        "set:ipxe,175"
        "set:efi64,option:client-arch,7"
@@ -445,5 +447,5 @@ in
  };

  networking.firewall.allowedTCPPorts = [ vars.ports.pxeBootHttp ];
-  networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp 67 ];
+  networking.firewall.allowedUDPPorts = [ vars.ports.pxeBootTftp vars.ports.dhcp ];
 }
@@ -5,13 +5,13 @@ let
    sudo nixos-rebuild switch \
      --no-write-lock-file \
      --refresh \
-      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+      --flake git+https://${vars.giteaDomain}/${vars.giteaRepoPath}.git#$(cat /etc/flake-target)
  '';
  testCmd = ''
    sudo nixos-rebuild test \
      --no-write-lock-file \
      --refresh \
-      --flake git+https://${vars.lanDomain}/beatzaplenty/nixos.git#$(cat /etc/flake-target)
+      --flake git+https://${vars.giteaDomain}/${vars.giteaRepoPath}.git#$(cat /etc/flake-target)
  '';
  buildImageFn = ''
    buildImage() {
@@ -39,21 +39,18 @@ in
    };
    interactiveShellInit = buildImageFn;
  };
+
  networking.networkmanager.enable = true;

  # Recommended over the true default (bypasses ZFS's own import safeguards)
  # per the option's own docs; matches hosts/docker/host.nix and
-  # modules/services/zfs/enable-service.nix, which already set this
-  # explicitly. Harmless no-op on hosts that don't use ZFS at all.
+  # modules/services/zfs/enable-service.nix. Harmless no-op on hosts without ZFS.
  boot.zfs.forceImportRoot = false;

-  # Set your time zone.
  time.timeZone = vars.timeZone;

-  # Enable QEMU agent
  services.qemuGuest.enable = true;

-  # Enable docker-compose
  environment.systemPackages = with pkgs; [
    vim
    btop
@@ -63,11 +60,10 @@ in
  ];

  # Secrets shared by every host, decrypted at activation via each host's
-  # existing SSH host key (sops-nix derives the age key from
-  # /etc/ssh/ssh_host_ed25519_key automatically — see modules/common/README
-  # or docs/ for the sops workflow). hashedPassword/hashedPasswordFile need
+  # SSH host key (sops-nix derives the age key from
+  # /etc/ssh/ssh_host_ed25519_key automatically). hashedPassword secrets need
  # neededForUsers so they're available before the normal secret-activation
-  # step, since user creation happens very early in boot.
+  # step — user creation happens very early in boot.
  sops = {
    defaultSopsFile = ../../secrets/common.yaml;

@@ -77,9 +73,9 @@ in
      "nix-github-token" = { };
    };

-    # nix.conf doesn't support a *File-style option for access-tokens, so the
-    # token is rendered into a runtime-only file (never touches the Nix store)
-    # and pulled in via nix.conf's native !include directive.
+    # nix.conf has no *File-style option for access-tokens, so the token is
+    # rendered into a runtime-only file (never touches the Nix store) and
+    # pulled in via nix.conf's native !include directive.
    templates."nix-github-token.conf".content = ''
      access-tokens = github.com=${config.sops.placeholder."nix-github-token"}
    '';
@@ -90,12 +86,11 @@ in
  '';

  users = {
-    # With mutableUsers = false, update-users-groups.pl enforces hashedPasswordFile
-    # on every activation regardless of whether the account already exists in
-    # /etc/shadow. The default (true) only applies hashedPasswordFile to newly-
-    # created accounts — which means a freshly-built proxmox disk image (where
-    # activation runs without a usable sops key, so both accounts land in shadow
-    # with ‘!’) will never have its passwords fixed by subsequent boots.
+    # mutableUsers = false makes update-users-groups.pl enforce hashedPasswordFile
+    # on every activation, not just on newly-created accounts. Without this, a
+    # freshly-built proxmox disk image (activation runs without a usable sops key,
+    # so both accounts land in shadow with '!') will never have its passwords fixed
+    # by subsequent boots.
    mutableUsers = false;

    users.root = {
@@ -104,39 +99,23 @@ in

    users.${vars.primaryUser} = {
      isNormalUser = true;
-      extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
-      packages = with pkgs; [
-        tree
-      ];
+      extraGroups = [ "wheel" ];
+      packages = with pkgs; [ tree ];
      hashedPasswordFile = config.sops.secrets."nixos-hashedPassword".path;
-      openssh.authorizedKeys.keys = [
-        vars.adminSshKey
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
-        "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
-      ];
+      openssh.authorizedKeys.keys = [ vars.adminSshKey ] ++ vars.extraAdminSshKeys;
    };
  };

-
-  # Enable the OpenSSH daemon.
  services.openssh.enable = true;

-  #Enable flakes
-
  nix.settings = {
    experimental-features = [ "nix-command" "flakes" ];
    auto-optimise-store = true;
  };

-
  programs.git = {
    enable = true;
    package = pkgs.git;
-    config = {
-      credential.helper = "store";
-    };
+    config.credential.helper = "store";
  };
-
-
-
 }
@@ -42,12 +42,8 @@ let
  '';
 in
 {
-  # Root SSH access — same key set as nixos user so all admin keys can reach root.
-  users.users.root.openssh.authorizedKeys.keys = [
-    vars.adminSshKey
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICMJhrfFayLBG+gWtO6oAvgambw5nWWgztiTFEaaaVRH debian@surface"
-    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGygkCljN6uKpdJbHTOQtn8ZnH+wKXDLAwrDFbLrE/65 nixos@nixos"
-  ];
+  # Root SSH access — same key set as the nixos user so all admin keys can reach root.
+  users.users.root.openssh.authorizedKeys.keys = [ vars.adminSshKey ] ++ vars.extraAdminSshKeys;

  # Passwordless sudo for wheel — operator SSHes as nixos and uses sudo for
  # cluster management commands (drbdadm, crm*, pcs, etc.)
@@ -1,10 +1,10 @@
 { config, lib, vars, ... }:

 let
-  # FQDN of the LAN NFS VIP (Pacemaker vip-lan, 192.168.2.229). Using the
-  # FQDN rather than a raw IP or bare hostname avoids systemd-resolved LLMNR
-  # quirks and survives a future VIP renumber via a DNS-only update.
-  nfsServer = "ha-vip-lan.${vars.homeDomain}";
+  # FQDN of the LAN NFS VIP (Pacemaker vip-lan, 192.168.2.229). Defined in
+  # variables.nix as haLanNfsFqdn; using the FQDN avoids systemd-resolved
+  # LLMNR quirks and survives a future VIP renumber via a DNS-only update.
+  nfsServer = vars.haLanNfsFqdn;
 in
 {
  fileSystems.${vars.nfsShares.pxebootImages.mountpoint} = {
@@ -3,12 +3,11 @@
 {
  # Run dnsmasq on the LAN interface as a forwarding-only resolver for
  # *.ts.net (Tailscale MagicDNS names). FreeIPA's bind-dyndb-ldap
-  # cannot reach 100.100.100.100 (Tailscale's internal resolver) directly
-  # because the DC is not a Tailscale node. This host IS a Tailscale node
-  # and can reach 100.100.100.100 via its tailscale0 interface, so it
-  # acts as an intermediary: FreeIPA has a conditional forward zone for
-  # ts.net pointing here (vars.tailscaleRouterIp), and this dnsmasq
-  # instance forwards those queries onward to Tailscale's resolver.
+  # cannot reach vars.tailscaleResolverIp directly because the DC is not a
+  # Tailscale node. This host IS a Tailscale node and can reach it via
+  # tailscale0, so it acts as an intermediary: FreeIPA has a conditional
+  # forward zone for ts.net pointing here (vars.tailscaleRouterIp), and this
+  # dnsmasq instance forwards those queries onward to Tailscale's resolver.
  #
  # Configure FreeIPA once after deploying this host:
  #   kinit admin
@@ -29,32 +28,26 @@
    resolveLocalQueries = false;
    settings = {
      # Listen only on the LAN interface — not tailscale0 or loopback.
-      # bind-interfaces prevents dnsmasq from binding to 0.0.0.0 and
-      # then filtering by interface later; combined with `interface` this
-      # ensures it genuinely listens only on eth0.
+      # bind-interfaces prevents dnsmasq from binding to 0.0.0.0 and then
+      # filtering by interface later; combined with `interface` this ensures
+      # it genuinely listens only on eth0.
      bind-interfaces = true;
      interface = [ vars.lxcLanInterface ];

-      # Forward-only: no local /etc/hosts or /etc/resolv.conf reading,
-      # no negative caching of NXDOMAIN for names this instance doesn't
-      # serve. All ts.net queries come from FreeIPA's conditional forwarder
-      # and must be answered by Tailscale's resolver.
+      # Forward-only: no local /etc/hosts or /etc/resolv.conf reading, no
+      # negative caching of NXDOMAIN for names this instance doesn't serve.
+      # All ts.net queries come from FreeIPA's conditional forwarder and must
+      # be answered by Tailscale's resolver.
      no-hosts = true;
      no-resolv = true;

-      # Tailscale's internal "Quad100" resolver — reachable from any
-      # Tailscale node via the tailscale0 interface. Scoped to the
-      # specific tailnet subdomain (vars.tailnetDomain) rather than
-      # all of ts.net: FreeIPA refuses to shadow ts.net (a real public
-      # TLD with DNSimple nameservers) so the conditional forward zone
-      # in FreeIPA must use the tailnet-specific subdomain instead:
-      #   ipa dnsforwardzone-add ${vars.tailnetDomain} \
-      #     --forwarder=${vars.tailscaleRouterIp} \
-      #     --forward-policy=only
-      server = [ "/${vars.tailnetDomain}/100.100.100.100" ];
+      # Forward *.tailnetDomain to Tailscale's internal resolver, scoped to
+      # the tailnet-specific subdomain rather than all of ts.net (FreeIPA
+      # refuses to shadow ts.net, a real public TLD).
+      server = [ "/${vars.tailnetDomain}/${vars.tailscaleResolverIp}" ];
    };
  };

-  networking.firewall.allowedUDPPorts = [ 53 ];
-  networking.firewall.allowedTCPPorts = [ 53 ];
+  networking.firewall.allowedUDPPorts = [ vars.ports.dns ];
+  networking.firewall.allowedTCPPorts = [ vars.ports.dns ];
 }