Archived
Refactor flake targets into platform x build-type matrix
Generates all nixosConfigurations from mkTarget(platform, buildType, hostPath) instead of hand-written per-host blocks, so adding a new platform or build type is a one-line addition. Per-machine identity (hostname, hostId, secrets, stateVersion) moves into hosts/<name>/host.nix; platform-specific config (hardware, boot, networking) into modules/platforms/*.nix; build-type config (minimal/server/docker/gui/ nix-cache/pxe-boot) into modules/build-types/*.nix. Old flat targets (nixos, docker, server, nix-cache, nix-minimal, pxe-boot) are replaced by the 17-target <platform>-<buildtype> matrix; each new target was verified to evaluate before its old counterpart was removed. CI workflows and docs/aliases now discover hosts dynamically via nixosConfigurations attrNames and /etc/flake-target instead of hardcoded lists, so they can't drift from flake.nix again. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
Claude Sonnet 5
@@ -0,0 +1,40 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
# Pins the Docker Engine version, carried forward from the pre-refactor
|
||||
# `docker` target's inline pkgs overlay.
|
||||
nixpkgs.overlays = [
|
||||
(final: prev: {
|
||||
docker = prev.docker_29;
|
||||
docker_cli = prev.docker_29;
|
||||
})
|
||||
];
|
||||
|
||||
imports = [
|
||||
../docker/mount-data.nix
|
||||
../docker/enable-service.nix
|
||||
../tailscale/enable-service.nix
|
||||
../rotate-traefik-logs.nix
|
||||
../raspi/mount-data.nix
|
||||
../services/nextcloud-cron-job.nix
|
||||
../services/docker-health-to-gotify.nix
|
||||
../services/enable-rpcbind.nix
|
||||
];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
nfs-utils
|
||||
];
|
||||
|
||||
boot.supportedFilesystems = [ "nfs" ];
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"L+ /home/nixos/docker - - - - /mnt/docker/config"
|
||||
"d /mnt/docker 0755 nixos users -"
|
||||
"d /mnt/raspi-backup 0755 nixos users -"
|
||||
];
|
||||
|
||||
users.users.nixos.extraGroups = [ "docker" ];
|
||||
services.openssh.settings.PermitRootLogin = "yes";
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 8080 443 8090 ];
|
||||
}
|
||||
@@ -0,0 +1,57 @@
|
||||
{ config, pkgs, lib, inputs, ... }:
|
||||
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
inputs.nixos-conf-editor.packages.${pkgs.system}.nixos-conf-editor
|
||||
nodejs
|
||||
appimage-run
|
||||
seahorse
|
||||
vscode
|
||||
p7zip
|
||||
popsicle # balena-etcher
|
||||
shotcut
|
||||
gimp
|
||||
pdfarranger
|
||||
terminator
|
||||
libreoffice-qt
|
||||
transmission_4-qt
|
||||
];
|
||||
|
||||
boot.loader.grub.useOSProber = true;
|
||||
|
||||
services.xserver.enable = true;
|
||||
services.xserver.displayManager.lightdm.enable = true;
|
||||
services.xserver.desktopManager.cinnamon.enable = true;
|
||||
|
||||
services.xserver.xkb = {
|
||||
layout = "au";
|
||||
variant = "";
|
||||
};
|
||||
|
||||
services.printing.enable = true;
|
||||
|
||||
security.rtkit.enable = true;
|
||||
services.pipewire = {
|
||||
enable = true;
|
||||
alsa.enable = true;
|
||||
alsa.support32Bit = true;
|
||||
pulse.enable = true;
|
||||
};
|
||||
|
||||
users.users.nixos.extraGroups = [ "networkmanager" ];
|
||||
|
||||
programs.firefox.enable = true;
|
||||
|
||||
services.xrdp.enable = true;
|
||||
services.xrdp.defaultWindowManager = "cinnamon-session";
|
||||
services.xrdp.openFirewall = true;
|
||||
nixpkgs.config.allowUnfree = true;
|
||||
|
||||
services.gnome.gnome-keyring.enable = true;
|
||||
security.pam.services.login.enableGnomeKeyring = true;
|
||||
|
||||
services.xserver.displayManager.sessionCommands = ''
|
||||
eval $(gnome-keyring-daemon --start --components=secrets,ssh)
|
||||
export SSH_AUTH_SOCK
|
||||
'';
|
||||
}
|
||||
@@ -0,0 +1,13 @@
|
||||
{ pkgs, ... }:
|
||||
|
||||
{
|
||||
networking.networkmanager.enable = true;
|
||||
|
||||
users.users.nixos.extraGroups = [ "networkmanager" ];
|
||||
|
||||
environment.systemPackages = with pkgs; [
|
||||
inetutils
|
||||
mtr
|
||||
sysstat
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,8 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
../nix-cache/server.nix
|
||||
../beszel/enable-agent.nix
|
||||
];
|
||||
}
|
||||
@@ -0,0 +1,156 @@
|
||||
{ config, lib, pkgs, inputs, ... }:
|
||||
|
||||
let
|
||||
pxeRoot = "/srv/pxe";
|
||||
httpRoot = "${pxeRoot}/http";
|
||||
tftpRoot = "${pxeRoot}/tftp";
|
||||
pxeBaseUrl = "http://192.168.2.247";
|
||||
|
||||
bootIpxe = pkgs.writeText "boot.ipxe" ''
|
||||
#!ipxe
|
||||
|
||||
dhcp
|
||||
echo Booting from PXE server...
|
||||
chain ${pxeBaseUrl}/menu.ipxe
|
||||
'';
|
||||
|
||||
autoexecIpxe = pkgs.writeText "autoexec.ipxe" ''
|
||||
#!ipxe
|
||||
|
||||
dhcp
|
||||
chain ${pxeBaseUrl}/boot.ipxe
|
||||
'';
|
||||
|
||||
systemRescueIpxe = pkgs.writeText "systemrescue.ipxe" ''
|
||||
#!ipxe
|
||||
|
||||
set base ${pxeBaseUrl}
|
||||
|
||||
kernel ''${base}/systemrescue/sysresccd/boot/x86_64/vmlinuz initrd=sysresccd.img archisobasedir=sysresccd archiso_http_srv=''${base}/systemrescue/ ip=dhcp checksum
|
||||
initrd ''${base}/systemrescue/sysresccd/boot/x86_64/sysresccd.img sysresccd.img
|
||||
boot
|
||||
'';
|
||||
|
||||
stageSystemRescue = pkgs.writeShellScript "stage-systemrescue" ''
|
||||
set -eu
|
||||
|
||||
iso="${httpRoot}/images/systemrescue.iso"
|
||||
staged="${httpRoot}/systemrescue"
|
||||
tmp="${httpRoot}/.systemrescue.tmp"
|
||||
previous="${httpRoot}/.systemrescue.previous"
|
||||
|
||||
if [ ! -e "$iso" ]; then
|
||||
echo "SystemRescue ISO not found at $iso; skipping staging."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
rm -rf "$tmp"
|
||||
mkdir -p "$tmp"
|
||||
|
||||
${pkgs.libarchive}/bin/bsdtar -C "$tmp" -xf "$iso"
|
||||
|
||||
test -f "$tmp/sysresccd/boot/x86_64/vmlinuz"
|
||||
test -f "$tmp/sysresccd/boot/x86_64/sysresccd.img"
|
||||
chmod -R a+rX "$tmp"
|
||||
|
||||
rm -rf "$previous"
|
||||
if [ -e "$staged" ]; then
|
||||
mv "$staged" "$previous"
|
||||
fi
|
||||
|
||||
mv "$tmp" "$staged"
|
||||
rm -rf "$previous"
|
||||
'';
|
||||
|
||||
menuIpxe = pkgs.writeText "menu.ipxe" ''
|
||||
#!ipxe
|
||||
|
||||
set base ${pxeBaseUrl}
|
||||
|
||||
menu PXE Boot Menu
|
||||
item nixos NixOS Installer
|
||||
item rescue Rescue Environment
|
||||
item shell iPXE Shell
|
||||
item reboot Reboot
|
||||
|
||||
choose target && goto ''${target}
|
||||
|
||||
:nixos
|
||||
kernel ''${base}/nixos/bzImage ip=dhcp
|
||||
initrd ''${base}/nixos/initrd
|
||||
boot
|
||||
|
||||
:rescue
|
||||
chain ''${base}/systemrescue.ipxe
|
||||
|
||||
:shell
|
||||
shell
|
||||
|
||||
:reboot
|
||||
reboot
|
||||
'';
|
||||
in
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
ipxe
|
||||
];
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
|
||||
virtualHosts."pxe-boot" = {
|
||||
default = true;
|
||||
root = httpRoot;
|
||||
locations."/" = {
|
||||
extraConfig = ''
|
||||
autoindex on;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# TFTP is only used to deliver the initial iPXE bootloader. After iPXE
|
||||
# starts, all further assets are fetched via nginx over HTTP.
|
||||
services.atftpd = {
|
||||
enable = true;
|
||||
root = tftpRoot;
|
||||
extraOptions = [
|
||||
"--verbose=5"
|
||||
];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${pxeRoot} 0755 root root -"
|
||||
"d ${httpRoot} 0755 root root -"
|
||||
"d ${httpRoot}/images 0755 root root -"
|
||||
"d ${httpRoot}/nixos 0755 root root -"
|
||||
"d ${httpRoot}/systemrescue 0755 root root -"
|
||||
"d ${httpRoot}/ubuntu 0755 root root -"
|
||||
"d ${httpRoot}/rescue 0755 root root -"
|
||||
"d ${tftpRoot} 0755 root root -"
|
||||
"C+ ${httpRoot}/boot.ipxe 0644 root root - ${bootIpxe}"
|
||||
"C+ ${httpRoot}/menu.ipxe 0644 root root - ${menuIpxe}"
|
||||
"C+ ${httpRoot}/systemrescue.ipxe 0644 root root - ${systemRescueIpxe}"
|
||||
"C+ ${tftpRoot}/autoexec.ipxe 0644 root root - ${autoexecIpxe}"
|
||||
"C+ ${tftpRoot}/ipxe.efi 0644 root root - ${pkgs.ipxe}/ipxe.efi"
|
||||
"C+ ${tftpRoot}/undionly.kpxe 0644 root root - ${pkgs.ipxe}/undionly.kpxe"
|
||||
];
|
||||
|
||||
systemd.services.stage-systemrescue = {
|
||||
description = "Stage SystemRescue ISO contents for HTTP PXE boot";
|
||||
after = [
|
||||
"local-fs.target"
|
||||
"systemd-tmpfiles-setup.service"
|
||||
];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = stageSystemRescue;
|
||||
};
|
||||
};
|
||||
|
||||
services.openssh.settings.PermitRootLogin = "yes";
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 ];
|
||||
networking.firewall.allowedUDPPorts = [ 69 ];
|
||||
}
|
||||
@@ -0,0 +1,28 @@
|
||||
{ ... }:
|
||||
|
||||
{
|
||||
imports = [
|
||||
../beszel/enable-agent.nix
|
||||
../services/zfs/enable-service.nix
|
||||
];
|
||||
|
||||
boot.zfs.extraPools = [ "tank" ];
|
||||
|
||||
systemd.services.nfs-server = {
|
||||
after = [ "zfs-mount.service" ];
|
||||
requires = [ "zfs-mount.service" ];
|
||||
};
|
||||
|
||||
services.nfs.server = {
|
||||
enable = true;
|
||||
exports = ''
|
||||
/tank/docker/config 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
|
||||
/tank/docker/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
|
||||
/tank/docker/databases 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
|
||||
/tank/docker/nextcloud-data 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
|
||||
/tank/raspi/volumes 192.168.2.0/24(rw,sync,no_subtree_check,no_root_squash)
|
||||
'';
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 111 2049 ];
|
||||
}
|
||||
Reference in New Issue
Block a user