From 768d9b4989fd242a420e8d4a3634985adbd429c7 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Fri, 15 May 2026 10:47:38 +0200 Subject: [PATCH 01/13] Add hawser module --- modules/hawser.nix | 48 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 modules/hawser.nix diff --git a/modules/hawser.nix b/modules/hawser.nix new file mode 100644 index 0000000..5d48686 --- /dev/null +++ b/modules/hawser.nix @@ -0,0 +1,48 @@ +{ + config, + lib, + ... +}: +let + cfg = config.services.hawser; +in { + options.services.hawser = { + enable = lib.mkEnableOption "hawser, the agent for Dockhand"; + agentName = lib.mkOption { + description = "Name of the hawser agent"; + default = config.networking.hostName; + type = lib.types.str; + }; + dockhandServerUrl = lib.mkOption { + description = "Websocket endpoint the hawser agent can use to connect to dockhand."; + example = "wss://your-dockhand.example.com/api/hawser/connect"; + type = lib.types.str; + }; + tokenSecretFile = lib.mkOption { + description = "Agenix secret containing the token as environment variable TOKEN"; + type = lib.types.anything; + }; + }; + + config = lib.mkIf cfg.enable { + virtualisation.oci-containers.containers = { + hawser = { + image = "ghcr.io/finsys/hawser:0.2.42"; + volumes = [ + "/var/run/docker.sock:/var/run/docker.sock" + ]; + environment = { + STACKS_DIR = "/opt/hawser-stacks"; + DOCKHAND_SERVER_URL = cfg.dockhandServerUrl; + AGENT_NAME = cfg.agentName; + }; + environmentFiles = [ + cfg.tokenSecretFile.path + ]; + extraOptions = [ + ''--mount=type=volume,source=hawser-data,target=/opt/hawser-stacks,volume-driver=local'' + ]; + }; + }; + }; +} From 978e1b97f04894727d613deb8f6d3510e5aec8c3 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Fri, 15 May 2026 10:47:48 +0200 Subject: [PATCH 02/13] Add hawser module to busch-main-docker --- hosts/busch-main-docker/default.nix | 8 ++++++++ hosts/busch-main-docker/secrets.nix | 6 ++++++ 2 files changed, 14 insertions(+) create mode 100644 hosts/busch-main-docker/secrets.nix diff --git a/hosts/busch-main-docker/default.nix b/hosts/busch-main-docker/default.nix index 21d1cc9..4575315 100644 --- a/hosts/busch-main-docker/default.nix +++ b/hosts/busch-main-docker/default.nix @@ -4,6 +4,7 @@ imports = [ ../../modules/disko/legacy-full-ext4.nix + ./secrets.nix ../../users/julius/nixos-server.nix ../../modules/nix.nix @@ -12,6 +13,7 @@ ../../modules/server-cli.nix ../../modules/sshd.nix ../../modules/docker.nix + ../../modules/hawser.nix ../../modules/netbird-client.nix "${inputs.secrets}/modules/opkssh.nix" @@ -34,6 +36,12 @@ docker.setupKey = "B9ECD884-B445-4156-8643-D0F34D64C200"; }; + services.hawser = { + enable = true; + dockhandServerUrl = "wss://dockhand-connect.jfreudenberger.de/api/hawser/connect"; + tokenSecretFile = config.age.secrets.hawser-token; + }; + # This option defines the first version of NixOS you have installed on this particular machine, # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. # Most users should NEVER change this value after the initial install, for any reason, diff --git a/hosts/busch-main-docker/secrets.nix b/hosts/busch-main-docker/secrets.nix new file mode 100644 index 0000000..f06e116 --- /dev/null +++ b/hosts/busch-main-docker/secrets.nix @@ -0,0 +1,6 @@ +{ inputs, ... }: +{ + age.secrets = { + hawser-token.file = "${inputs.secrets}/secrets/busch-main-docker/hawser-token"; + }; +} From 46c276db41ab367135cfcf5ca10907c8c0499a5f Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Fri, 15 May 2026 10:49:13 +0200 Subject: [PATCH 03/13] Enable systemd-resolved for netbird clients This enables resolving of internal and external domains from withing containers. --- modules/netbird-client.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modules/netbird-client.nix b/modules/netbird-client.nix index e2b04db..1cd15ba 100644 --- a/modules/netbird-client.nix +++ b/modules/netbird-client.nix @@ -57,6 +57,8 @@ in { }; systemd.services.${config.services.netbird.clients.wt0.service.name}.path = [ pkgs.shadow ]; + services.resolved.enable = true; + virtualisation.oci-containers.containers = { netbird = { image = "netbirdio/netbird:${clientVersion}-rootless"; From 30ec05595789bfdbfa3fcfe8655731bfd3ca3b7b Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Fri, 15 May 2026 10:49:49 +0200 Subject: [PATCH 04/13] Enable server routing features on netbird-server --- modules/netbird-docker.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/modules/netbird-docker.nix b/modules/netbird-docker.nix index a71f2ed..921073e 100644 --- a/modules/netbird-docker.nix +++ b/modules/netbird-docker.nix @@ -49,6 +49,7 @@ in { }; config = lib.mkIf cfg.enable { + services.netbird.useRoutingFeatures = lib.mkDefault "server"; virtualisation.oci-containers.containers = { netbird-dashboard = { image = "netbirdio/dashboard:v${dashboardVersion}"; From 689787372f617e23da3be8be804b7793ad492cbe Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Thu, 21 May 2026 00:42:44 +0200 Subject: [PATCH 05/13] Add lanzaboote --- flake.lock | 136 ++++++++++++++++++++++++++++++++++++++++++++++++++--- flake.nix | 5 ++ 2 files changed, 134 insertions(+), 7 deletions(-) diff --git a/flake.lock b/flake.lock index 53ad049..5a10b98 100644 --- a/flake.lock +++ b/flake.lock @@ -43,6 +43,21 @@ "type": "github" } }, + "crane": { + "locked": { + "lastModified": 1765145449, + "narHash": "sha256-aBVHGWWRzSpfL++LubA0CwOOQ64WNLegrYHwsVuVN7A=", + "owner": "ipetkov", + "repo": "crane", + "rev": "69f538cdce5955fcd47abfed4395dc6d5194c1c5", + "type": "github" + }, + "original": { + "owner": "ipetkov", + "repo": "crane", + "type": "github" + } + }, "disko": { "inputs": { "nixpkgs": [ @@ -64,6 +79,22 @@ } }, "flake-compat": { + "flake": false, + "locked": { + "lastModified": 1761588595, + "narHash": "sha256-XKUZz9zewJNUj46b4AJdiRZJAvSZ0Dqj2BNfXvFlJC4=", + "owner": "edolstra", + "repo": "flake-compat", + "rev": "f387cd2afec9419c8ee37694406ca490c3f34ee5", + "type": "github" + }, + "original": { + "owner": "edolstra", + "repo": "flake-compat", + "type": "github" + } + }, + "flake-compat_2": { "flake": false, "locked": { "lastModified": 1696426674, @@ -79,7 +110,7 @@ "type": "github" } }, - "flake-compat_2": { + "flake-compat_3": { "locked": { "lastModified": 1747046372, "narHash": "sha256-CIVLLkVgvHYbgI2UpXvIIBJ12HWgX+fjA8Xf8PUmqCY=", @@ -95,6 +126,28 @@ } }, "gitignore": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "pre-commit", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1709087332, + "narHash": "sha256-HG2cCnktfHsKV0s4XW83gU3F57gaTljL9KNSuG6bnQs=", + "owner": "hercules-ci", + "repo": "gitignore.nix", + "rev": "637db329424fd7e46cf4185293b9cc8c88c95394", + "type": "github" + }, + "original": { + "owner": "hercules-ci", + "repo": "gitignore.nix", + "type": "github" + } + }, + "gitignore_2": { "inputs": { "nixpkgs": [ "lazy-apps", @@ -158,6 +211,30 @@ "type": "github" } }, + "lanzaboote": { + "inputs": { + "crane": "crane", + "nixpkgs": [ + "nixpkgs" + ], + "pre-commit": "pre-commit", + "rust-overlay": "rust-overlay" + }, + "locked": { + "lastModified": 1765382359, + "narHash": "sha256-RJmgVDzjRI18BWVogG6wpsl1UCuV6ui8qr4DJ1LfWZ8=", + "owner": "nix-community", + "repo": "lanzaboote", + "rev": "e8c096ade12ec9130ff931b0f0e25d2f1bc63607", + "type": "github" + }, + "original": { + "owner": "nix-community", + "ref": "v1.0.0", + "repo": "lanzaboote", + "type": "github" + } + }, "lazy-apps": { "inputs": { "nixpkgs": [ @@ -275,10 +352,33 @@ "type": "github" } }, - "pre-commit-hooks": { + "pre-commit": { "inputs": { "flake-compat": "flake-compat", "gitignore": "gitignore", + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1765016596, + "narHash": "sha256-rhSqPNxDVow7OQKi4qS5H8Au0P4S3AYbawBSmJNUtBQ=", + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "rev": "548fc44fca28a5e81c5d6b846e555e6b9c2a5a3c", + "type": "github" + }, + "original": { + "owner": "cachix", + "repo": "pre-commit-hooks.nix", + "type": "github" + } + }, + "pre-commit-hooks": { + "inputs": { + "flake-compat": "flake-compat_2", + "gitignore": "gitignore_2", "nixpkgs": [ "lazy-apps", "nixpkgs" @@ -301,7 +401,7 @@ }, "proxmox-nixos": { "inputs": { - "flake-compat": "flake-compat_2", + "flake-compat": "flake-compat_3", "nixpkgs-libvncserver": "nixpkgs-libvncserver", "nixpkgs-stable": "nixpkgs-stable_2", "utils": "utils" @@ -326,6 +426,7 @@ "auto-cpufreq": "auto-cpufreq", "disko": "disko", "home-manager": "home-manager_2", + "lanzaboote": "lanzaboote", "lazy-apps": "lazy-apps", "nixos-hardware": "nixos-hardware", "nixpkgs": "nixpkgs", @@ -335,14 +436,35 @@ "systems": "systems_3" } }, + "rust-overlay": { + "inputs": { + "nixpkgs": [ + "lanzaboote", + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1765075567, + "narHash": "sha256-KFDCdQcHJ0hE3Nt5Gm5enRIhmtEifAjpxgUQ3mzSJpA=", + "owner": "oxalica", + "repo": "rust-overlay", + "rev": "769156779b41e8787a46ca3d7d76443aaf68be6f", + "type": "github" + }, + "original": { + "owner": "oxalica", + "repo": "rust-overlay", + "type": "github" + } + }, "secrets": { "flake": false, "locked": { - "lastModified": 1777152364, - "narHash": "sha256-yS8TxtPFFf7xIDNbsErZUnTBLn2fnyCcC4On+t3v1Zs=", + "lastModified": 1778873193, + "narHash": "sha256-RCK8ucxAV4voI/eAnZrY2/RxRohlXYVP4eFWO4ES4n8=", "ref": "refs/heads/main", - "rev": "bfb7da1297d73100a56a044d09792fc6e59357e6", - "revCount": 34, + "rev": "b0dd25d41a5ffa4fc1cfb57eeaf24cc9fb777589", + "revCount": 36, "type": "git", "url": "ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git" }, diff --git a/flake.nix b/flake.nix index e26cc43..d61bcc8 100644 --- a/flake.nix +++ b/flake.nix @@ -38,6 +38,10 @@ darwin.follows = ""; }; }; + lanzaboote = { + url = "github:nix-community/lanzaboote/v1.0.0"; + inputs.nixpkgs.follows = "nixpkgs"; + }; secrets = { url = "git+ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git"; flake = false; @@ -55,6 +59,7 @@ proxmox-nixos, agenix, disko, + lanzaboote, systems, ... } @ inputs: let From fb0c6eb80b84decdd4ce8fa91610dcc75c2091c3 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Thu, 21 May 2026 00:44:57 +0200 Subject: [PATCH 06/13] Add host xcy --- flake.nix | 18 +++++ hosts/xcy/default.nix | 104 +++++++++++++++++++++++++++ hosts/xcy/disko.nix | 103 ++++++++++++++++++++++++++ hosts/xcy/hardware-configuration.nix | 25 +++++++ hosts/xcy/secrets.nix | 6 ++ 5 files changed, 256 insertions(+) create mode 100644 hosts/xcy/default.nix create mode 100644 hosts/xcy/disko.nix create mode 100644 hosts/xcy/hardware-configuration.nix create mode 100644 hosts/xcy/secrets.nix diff --git a/flake.nix b/flake.nix index d61bcc8..e8d1f34 100644 --- a/flake.nix +++ b/flake.nix @@ -198,6 +198,24 @@ ]; }; + xcy = nixpkgs.lib.nixosSystem rec { + system = "x86_64-linux"; + + specialArgs = { + inherit inputs outputs; + pkgs-unstable = import nixpkgs-unstable { + inherit system; + }; + }; + + modules = [ + disko.nixosModules.disko + agenix.nixosModules.default + lanzaboote.nixosModules.lanzaboote + ./hosts/xcy + ]; + }; + }; homeConfigurations = { diff --git a/hosts/xcy/default.nix b/hosts/xcy/default.nix new file mode 100644 index 0000000..0c62fef --- /dev/null +++ b/hosts/xcy/default.nix @@ -0,0 +1,104 @@ +{ inputs, outputs, config, lib, pkgs, pkgs-unstable, ... }: + +{ + imports = + [ + ./secrets.nix + ./disko.nix + + ../../users/julius/nixos-server.nix + ../../modules/nix.nix + ../../modules/locale.nix + ../../modules/server-cli.nix + ../../modules/sshd.nix + ../../modules/docker.nix + ../../modules/hawser.nix + ../../modules/netbird-client.nix + ../../modules/auto-upgrade.nix + "${inputs.secrets}/modules/opkssh.nix" + # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; + + services.netbird-client = { + enable = true; + managementUrl = "https://netbird.jfreudenberger.de"; + host.setupKey = "86D1861F-193B-44F5-9B03-1E34C126FA6F"; + docker.setupKey = "A9715FB6-8BF2-4274-BE02-43740A3BD4D9"; + }; + + services.hawser = { + enable = true; + dockhandServerUrl = "wss://dockhand-connect.jfreudenberger.de/api/hawser/connect"; + tokenSecretFile = config.age.secrets.hawser-token; + }; + + networking.firewall = { + checkReversePath = "loose"; + allowedTCPPorts = [ + # Ports for Unifi Server + 11443 + 5005 + 9543 + 6789 + 8080 + 8443 + 8444 + 11084 + 5671 + 8880 + 8881 + 8882 + + # Home assistant + 8123 + ]; + allowedUDPPorts = [ + # Unifi Server + 3478 + 5514 + 10003 + ]; + }; + + + boot.kernel.sysctl = { + "net.ipv4.conf.all.forwarding" = true; + "net.ipv6.conf.all.forwarding" = true; + }; + + boot = { + tmp.cleanOnBoot = true; + tmp.useTmpfs = true; + growPartition = true; + initrd.systemd.enable = true; + loader = { + efi.canTouchEfiVariables = true; + grub.enable = false; + systemd-boot.enable = false; + }; + lanzaboote = { + enable = true; + pkiBundle = "/var/lib/sbctl"; + extraEfiSysMountPoints = [ + "/boot-fallback" + ]; + }; + }; + + networking.hostName = "xcy"; # Define your hostname. + + # This option defines the first version of NixOS you have installed on this particular machine, + # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. + # Most users should NEVER change this value after the initial install, for any reason, + # even if you've upgraded your system to a new NixOS release. + # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, + # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how + # to actually do that. + # This value being lower than the current NixOS release does NOT mean your system is + # out of date, out of support, or vulnerable. + # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, + # and migrated your data accordingly. + # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . + system.stateVersion = "25.05"; # Did you read the comment? +} diff --git a/hosts/xcy/disko.nix b/hosts/xcy/disko.nix new file mode 100644 index 0000000..a75ce71 --- /dev/null +++ b/hosts/xcy/disko.nix @@ -0,0 +1,103 @@ +{ + disko.devices = { + disk = { + disk1 = { + type = "disk"; + device = "/dev/disk/by-id/ata-Samsung_SSD_850_PRO_256GB_S251NX0H809669K"; + content = { + type = "gpt"; + partitions = { + MBR = { + type = "EF02"; # for grub MBR + size = "1M"; + priority = 1; # Needs to be first partition + }; + ESP = { + priority = 1; + name = "ESP"; + size = "2G"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot"; + mountOptions = [ "umask=0077" ]; + }; + }; + crypt_p1 = { + size = "100%"; + content = { + type = "luks"; + name = "p1"; + settings = { + allowDiscards = true; + }; + }; + }; + }; + }; + }; + disk2 = { + type = "disk"; + device = "/dev/disk/by-id/nvme-eui.1843558044350001001b448b4495a259"; + content = { + type = "gpt"; + partitions = { + MBR = { + type = "EF02"; # for grub MBR + size = "1M"; + priority = 1; # Needs to be first partition + }; + ESP = { + priority = 1; + name = "ESP"; + size = "2G"; + type = "EF00"; + content = { + type = "filesystem"; + format = "vfat"; + mountpoint = "/boot-fallback"; + mountOptions = [ "umask=0077" ]; + }; + }; + crypt_p2 = { + size = "100%"; + content = { + type = "luks"; + name = "p2"; + settings = { + allowDiscards = true; + }; + content = { + type = "btrfs"; + extraArgs = [ + "-d raid1" + "-m raid1" + "/dev/mapper/p1" + ]; + subvolumes = { + "/rootfs" = { + mountpoint = "/"; + }; + "/home" = { + mountOptions = [ "compress=zstd" ]; + mountpoint = "/home"; + }; + "/nix" = { + mountOptions = [ "compress=zstd" "noatime" ]; + mountpoint = "/nix"; + }; + "/swap" = { + mountpoint = "/.swapvol"; + swap.swapfile.size = "32G"; + }; + }; + }; + }; + }; + }; + }; + }; + }; + }; +} diff --git a/hosts/xcy/hardware-configuration.nix b/hosts/xcy/hardware-configuration.nix new file mode 100644 index 0000000..d4ae174 --- /dev/null +++ b/hosts/xcy/hardware-configuration.nix @@ -0,0 +1,25 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/installer/scan/not-detected.nix") + ]; + + boot.initrd.availableKernelModules = [ "xhci_pci" "ahci" "nvme" "usb_storage" "usbhid" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ "dm-snapshot" ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + # Enables DHCP on each ethernet and wireless interface. In case of scripted networking + # (the default) this is the recommended approach. When using systemd-networkd it's + # still possible to use this option, but it's recommended to use it in conjunction + # with explicit per-interface declarations with `networking.interfaces..useDHCP`. + networking.useDHCP = lib.mkDefault true; + # networking.interfaces.enp1s0.useDHCP = lib.mkDefault true; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; + hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware; +} diff --git a/hosts/xcy/secrets.nix b/hosts/xcy/secrets.nix new file mode 100644 index 0000000..4add6e7 --- /dev/null +++ b/hosts/xcy/secrets.nix @@ -0,0 +1,6 @@ +{ inputs, ... }: +{ + age.secrets = { + hawser-token.file = "${inputs.secrets}/secrets/xcy/hawser-token"; + }; +} From 403aea8947f1ed15b34bea027502d49d7e091052 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Thu, 21 May 2026 00:45:17 +0200 Subject: [PATCH 07/13] Update netbird docker image tags --- modules/netbird-docker.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/netbird-docker.nix b/modules/netbird-docker.nix index 921073e..76f9b70 100644 --- a/modules/netbird-docker.nix +++ b/modules/netbird-docker.nix @@ -10,8 +10,8 @@ let cfg = config.services.netbird-docker; netbirdCfg = config.services.netbird; - serverVersion = "0.69.0"; - dashboardVersion = "2.37.1"; + serverVersion = "0.70.5"; + dashboardVersion = "2.38.0"; in { From 10efb5bdf34b7018fd461f66d8f5ca824bebd58f Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Thu, 21 May 2026 00:45:31 +0200 Subject: [PATCH 08/13] Add extraPorts option to netbird-docker --- modules/netbird-docker.nix | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/modules/netbird-docker.nix b/modules/netbird-docker.nix index 76f9b70..56c7d6c 100644 --- a/modules/netbird-docker.nix +++ b/modules/netbird-docker.nix @@ -34,6 +34,14 @@ in { ''; type = lib.types.anything; }; + extraPorts = lib.mkOption { + description = '' + Extra ports to open for L4 routing. + Ports described in the config (https://docs.netbird.io/selfhosted/migration/enable-reverse-proxy#exposing-l4-ports) can be specified here. + ''; + type = lib.types.listOf lib.types.str; + default = [ ]; + }; }; }; }; @@ -168,7 +176,7 @@ in { autoStart = true; ports = [ "51820:51820/udp" - ]; + ] ++ cfg.proxy.extraPorts; networks = [ "traefik" ]; From b6e7e0a7dc2665f78cd410b225ee87d70760cf7d Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Thu, 21 May 2026 00:47:08 +0200 Subject: [PATCH 09/13] Update netbird client image tag --- modules/netbird-client.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/netbird-client.nix b/modules/netbird-client.nix index 1cd15ba..2edf19d 100644 --- a/modules/netbird-client.nix +++ b/modules/netbird-client.nix @@ -10,7 +10,7 @@ let cfg = config.services.netbird-client; - clientVersion = "0.69.0"; + clientVersion = "0.71.2"; clientConfiguration = lib.types.submodule { options = { From 3a0fe99688d4e4e57fd5ec547985b8fff2d1ba66 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Thu, 21 May 2026 00:47:36 +0200 Subject: [PATCH 10/13] Add option for docker subnet for netbird webproxy network The same subnet on different routing peers makes problems for the reverse proxy feature. Therefore add the possibility to set a different subnet on different hosts. --- modules/netbird-client.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/modules/netbird-client.nix b/modules/netbird-client.nix index 2edf19d..f6429f9 100644 --- a/modules/netbird-client.nix +++ b/modules/netbird-client.nix @@ -37,6 +37,11 @@ in { description = "Configuration for docker connection"; type = clientConfiguration; }; + dockerSubnet = lib.mkOption { + description = "Second part of ipv4 subnet"; + type = lib.types.str; + default = "20"; + }; }; config = lib.mkIf cfg.enable { @@ -94,7 +99,7 @@ in { Type = "oneshot"; }; script = '' - docker network inspect webproxy || docker network create webproxy --ipv4 --ipv6 --subnet=172.20.0.0/16 --gateway=172.20.0.1 + docker network inspect webproxy || docker network create webproxy --ipv4 --ipv6 --subnet=172.${cfg.dockerSubnet}.0.0/16 --gateway=172.${cfg.dockerSubnet}.0.1 ''; }; }; From 5a167d808eadb95d6de6406de5381b03d33fe02e Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Thu, 21 May 2026 00:48:35 +0200 Subject: [PATCH 11/13] Change webproxy subnet for busch-main-docker --- hosts/busch-main-docker/default.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/hosts/busch-main-docker/default.nix b/hosts/busch-main-docker/default.nix index 4575315..ce7c502 100644 --- a/hosts/busch-main-docker/default.nix +++ b/hosts/busch-main-docker/default.nix @@ -20,6 +20,7 @@ # Include the results of the hardware scan. ./hardware-configuration.nix ]; + # Use the GRUB 2 boot loader. boot = { loader.grub = { @@ -33,7 +34,8 @@ enable = true; managementUrl = "https://netbird.jfreudenberger.de"; host.setupKey = "DB64713B-FB23-49F1-A4A7-9B9E37B585D4"; - docker.setupKey = "B9ECD884-B445-4156-8643-D0F34D64C200"; + docker.setupKey = "0028C8B8-BE57-4045-B16E-507B110AF24D"; + dockerSubnet = "30"; }; services.hawser = { From 4f575fcf3448ed185194f6695644a2b158dceb35 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Mon, 8 Jun 2026 01:56:47 +0200 Subject: [PATCH 12/13] Add host busch-gpu-docker --- flake.lock | 8 +-- flake.nix | 17 +++++ hosts/busch-gpu-docker/default.nix | 72 +++++++++++++++++++ .../hardware-configuration.nix | 17 +++++ hosts/busch-gpu-docker/secrets.nix | 6 ++ 5 files changed, 116 insertions(+), 4 deletions(-) create mode 100644 hosts/busch-gpu-docker/default.nix create mode 100644 hosts/busch-gpu-docker/hardware-configuration.nix create mode 100644 hosts/busch-gpu-docker/secrets.nix diff --git a/flake.lock b/flake.lock index 5a10b98..761f9fc 100644 --- a/flake.lock +++ b/flake.lock @@ -460,11 +460,11 @@ "secrets": { "flake": false, "locked": { - "lastModified": 1778873193, - "narHash": "sha256-RCK8ucxAV4voI/eAnZrY2/RxRohlXYVP4eFWO4ES4n8=", + "lastModified": 1779441912, + "narHash": "sha256-Le50mFgpetFC8gyc1j3+oXEjRV3lZdeU2vqBtoWaAJo=", "ref": "refs/heads/main", - "rev": "b0dd25d41a5ffa4fc1cfb57eeaf24cc9fb777589", - "revCount": 36, + "rev": "847ed2f52fd5ff0ead5958d6932b219b4254a2bf", + "revCount": 38, "type": "git", "url": "ssh://git@git.jfreudenberger.de/JuliusFreudenberger/nix-private.git" }, diff --git a/flake.nix b/flake.nix index e8d1f34..217baab 100644 --- a/flake.nix +++ b/flake.nix @@ -163,6 +163,23 @@ ]; }; + busch-gpu-docker = nixpkgs.lib.nixosSystem rec { + system = "x86_64-linux"; + + specialArgs = { + inherit inputs outputs; + pkgs-unstable = import nixpkgs-unstable { + inherit system; + }; + }; + + modules = [ + ./hosts/busch-gpu-docker + disko.nixosModules.disko + agenix.nixosModules.default + ]; + }; + srv01-hf = nixpkgs.lib.nixosSystem rec { system = "x86_64-linux"; diff --git a/hosts/busch-gpu-docker/default.nix b/hosts/busch-gpu-docker/default.nix new file mode 100644 index 0000000..d7870cd --- /dev/null +++ b/hosts/busch-gpu-docker/default.nix @@ -0,0 +1,72 @@ +{ inputs, outputs, config, lib, pkgs, pkgs-unstable, ... }: + +{ + imports = + [ + ../../modules/disko/legacy-full-ext4.nix + ./secrets.nix + + ../../users/julius/nixos-server.nix + ../../modules/nix.nix + ../../modules/auto-upgrade.nix + ../../modules/locale.nix + ../../modules/server-cli.nix + ../../modules/sshd.nix + ../../modules/docker.nix + ../../modules/hawser.nix + ../../modules/netbird-client.nix + "${inputs.secrets}/modules/opkssh.nix" + + # Include the results of the hardware scan. + ./hardware-configuration.nix + ]; + + # Use the GRUB 2 boot loader. + boot = { + loader.grub = { + enable = true; + }; + tmp.useTmpfs = true; + }; + + hardware = { + graphics.enable = true; + nvidia = { + package = config.boot.kernelPackages.nvidiaPackages.legacy_470; + # TODO GTX 970 or GTX 960 driver 580 (>= 545) + }; + nvidia-container-toolkit.enable = true; + }; + nixpkgs.config.nvidia.acceptLicense = true; + services.xserver.videoDrivers = [ "nvidia" ]; + + networking.hostName = "docker-gpu"; # Define your hostname. + + services.netbird-client = { + enable = true; + managementUrl = "https://netbird.jfreudenberger.de"; + host.setupKey = "830217A8-BE0A-4919-A262-3CF7599487BA"; + docker.setupKey = "C4C9FAE3-5FAE-4949-B8E8-BEDA3B954859"; + dockerSubnet = "40"; + }; + + services.hawser = { + enable = true; + dockhandServerUrl = "wss://dockhand-connect.jfreudenberger.de/api/hawser/connect"; + tokenSecretFile = config.age.secrets.hawser-token; + }; + + # This option defines the first version of NixOS you have installed on this particular machine, + # and is used to maintain compatibility with application data (e.g. databases) created on older NixOS versions. + # Most users should NEVER change this value after the initial install, for any reason, + # even if you've upgraded your system to a new NixOS release. + # This value does NOT affect the Nixpkgs version your packages and OS are pulled from, + # so changing it will NOT upgrade your system - see https://nixos.org/manual/nixos/stable/#sec-upgrading for how + # to actually do that. + # This value being lower than the current NixOS release does NOT mean your system is + # out of date, out of support, or vulnerable. + # Do NOT change this value unless you have manually inspected all the changes it would make to your configuration, + # and migrated your data accordingly. + # For more information, see `man configuration.nix` or https://nixos.org/manual/nixos/stable/options#opt-system.stateVersion . + system.stateVersion = "25.05"; # Did you read the comment? +} diff --git a/hosts/busch-gpu-docker/hardware-configuration.nix b/hosts/busch-gpu-docker/hardware-configuration.nix new file mode 100644 index 0000000..ada6268 --- /dev/null +++ b/hosts/busch-gpu-docker/hardware-configuration.nix @@ -0,0 +1,17 @@ +# Do not modify this file! It was generated by ‘nixos-generate-config’ +# and may be overwritten by future invocations. Please make changes +# to /etc/nixos/configuration.nix instead. +{ config, lib, pkgs, modulesPath, ... }: + +{ + imports = + [ (modulesPath + "/profiles/qemu-guest.nix") + ]; + + boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "ehci_pci" "ahci" "virtio_pci" "virtio_scsi" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ "kvm-intel" ]; + boot.extraModulePackages = [ ]; + + nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux"; +} diff --git a/hosts/busch-gpu-docker/secrets.nix b/hosts/busch-gpu-docker/secrets.nix new file mode 100644 index 0000000..093c7a0 --- /dev/null +++ b/hosts/busch-gpu-docker/secrets.nix @@ -0,0 +1,6 @@ +{ inputs, ... }: +{ + age.secrets = { + hawser-token.file = "${inputs.secrets}/secrets/busch-gpu-docker/hawser-token"; + }; +} From 578386193bb95464ee6f834591cd82dfef430da3 Mon Sep 17 00:00:00 2001 From: JuliusFreudenberger Date: Mon, 8 Jun 2026 11:54:26 +0200 Subject: [PATCH 13/13] Update flake.lock --- flake.lock | 74 +++++++++++++++++++++++++++++++++--------------------- 1 file changed, 45 insertions(+), 29 deletions(-) diff --git a/flake.lock b/flake.lock index 761f9fc..0b4945c 100644 --- a/flake.lock +++ b/flake.lock @@ -30,11 +30,11 @@ ] }, "locked": { - "lastModified": 1778403279, - "narHash": "sha256-qOn95CiAxdt+x0YV5Qrc039HFpByEvURVCHPzCVr8tE=", + "lastModified": 1780814819, + "narHash": "sha256-tCqZRB4pvZlcz2cMi7mfvhFRsfdkbFMP67jGNciogmc=", "owner": "AdnanHodzic", "repo": "auto-cpufreq", - "rev": "c1ba0fe5df2542681e8dfcef6b0aa0217cf9edb4", + "rev": "f325b2a221ab9adb5bb729a1e5d7a45aea686382", "type": "github" }, "original": { @@ -65,11 +65,11 @@ ] }, "locked": { - "lastModified": 1777713215, - "narHash": "sha256-8GzXDOXckDWwST8TY5DbwYFjdvQLlP7K9CLSVx6iTTo=", + "lastModified": 1780290312, + "narHash": "sha256-eTAlX0CwgB84Ts3GaBd944A3DRXVMzgA0EqroZBISUo=", "owner": "nix-community", "repo": "disko", - "rev": "63b4e7e6cf75307c1d26ac3762b886b5b0247267", + "rev": "115e5211780054d8a890b41f0b7734cafad54dfe", "type": "github" }, "original": { @@ -197,11 +197,11 @@ ] }, "locked": { - "lastModified": 1778401693, - "narHash": "sha256-OVHdCqXXUF5UdGkH+FF2ZL06OLZjj2kvP2dIUmzVWoo=", + "lastModified": 1779506708, + "narHash": "sha256-QOD/CNm196nCJRheux/URi4/HE66fthdOMqCJoPP1Y0=", "owner": "nix-community", "repo": "home-manager", - "rev": "389b83002efc26f1145e89a6a8e6edc5a6435948", + "rev": "3ee51fbdac8c8bdfe1e7e1fcaba6520a563f394f", "type": "github" }, "original": { @@ -257,12 +257,15 @@ } }, "nixos-hardware": { + "inputs": { + "nixpkgs": "nixpkgs" + }, "locked": { - "lastModified": 1778143761, - "narHash": "sha256-lkesY6x2X2qxlqLM7CT2iM/0rP2JB7fruPN3h8POXmI=", + "lastModified": 1780310866, + "narHash": "sha256-fPBRVf6A5xlACYcOI59shGrjURuvwu0lRsDoSCEXt/I=", "owner": "NixOS", "repo": "nixos-hardware", - "rev": "3bcaa367d4c550d687a17ac792fd5cda214ee871", + "rev": "4ed851c979641e28597a05086332d75cdc9e395f", "type": "github" }, "original": { @@ -274,18 +277,15 @@ }, "nixpkgs": { "locked": { - "lastModified": 1778003029, - "narHash": "sha256-q/nkKLDtHIyLjZpKhWk3cSK5IYsFqtMd6UtXF3ddjgA=", - "owner": "nixos", - "repo": "nixpkgs", - "rev": "0c88e1f2bdb93d5999019e99cb0e61e1fe2af4c5", - "type": "github" + "lastModified": 1767892417, + "narHash": "sha256-8bW3q88CEg2u4hSP66Vf4lpbLonHz7hqDNBMcCY7E9U=", + "rev": "3497aa5c9457a9d88d71fa93a4a8368816fbeeba", + "type": "tarball", + "url": "https://releases.nixos.org/nixos/unstable/nixos-26.05pre924538.3497aa5c9457/nixexprs.tar.xz" }, "original": { - "owner": "nixos", - "ref": "nixos-25.11", - "repo": "nixpkgs", - "type": "github" + "type": "tarball", + "url": "https://channels.nixos.org/nixos-unstable/nixexprs.tar.xz" } }, "nixpkgs-libvncserver": { @@ -338,11 +338,11 @@ }, "nixpkgs-unstable": { "locked": { - "lastModified": 1777954456, - "narHash": "sha256-hGdgeU2Nk87RAuZyYjyDjFL6LK7dAZN5RE9+hrDTkDU=", + "lastModified": 1780243769, + "narHash": "sha256-x5UQuRsH3MqI0U9afaXSNqzTPSeZlRLvFAav2Ux1pNw=", "owner": "nixos", "repo": "nixpkgs", - "rev": "549bd84d6279f9852cae6225e372cc67fb91a4c1", + "rev": "331800de5053fcebacf6813adb5db9c9dca22a0c", "type": "github" }, "original": { @@ -352,6 +352,22 @@ "type": "github" } }, + "nixpkgs_2": { + "locked": { + "lastModified": 1780511130, + "narHash": "sha256-2v9lT4ya59Lh1FqPeLnz1MoX9y/wz2huqfe9RtQZITk=", + "owner": "nixos", + "repo": "nixpkgs", + "rev": "535f3e6942cb1cead3929c604320d3db54b542b9", + "type": "github" + }, + "original": { + "owner": "nixos", + "ref": "nixos-25.11", + "repo": "nixpkgs", + "type": "github" + } + }, "pre-commit": { "inputs": { "flake-compat": "flake-compat", @@ -407,11 +423,11 @@ "utils": "utils" }, "locked": { - "lastModified": 1777731636, - "narHash": "sha256-OkFcWIKnrl0n5ULcFnzmLjdfD7Z8IHtYLge3e7EuARs=", + "lastModified": 1779805430, + "narHash": "sha256-SyjG3ld9PyGVxjJOHmhOyWA3tbHgWqIDXBu28f/HLjE=", "owner": "SaumonNet", "repo": "proxmox-nixos", - "rev": "22b690085bfb2b82cbbc8e9d637a67c9c704b6db", + "rev": "d2537c08100f135b609389a8cd98f6424339de8c", "type": "github" }, "original": { @@ -429,7 +445,7 @@ "lanzaboote": "lanzaboote", "lazy-apps": "lazy-apps", "nixos-hardware": "nixos-hardware", - "nixpkgs": "nixpkgs", + "nixpkgs": "nixpkgs_2", "nixpkgs-unstable": "nixpkgs-unstable", "proxmox-nixos": "proxmox-nixos", "secrets": "secrets",