Add jupiter vps

Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>

README.md

@@ -37,10 +37,11 @@ Any `options.nix` files create custom option definitions when present.
 
 Below is a table of all hosts, with links to their respective README files, which may provide further details and/or post-installation checklists.
 
-| Host        | README                                                   |
-| ----------- | -------------------------------------------------------- |
-| `installer` | [hosts/installer/README.md](./hosts/installer/README.md) |
-| `eirene`    | [hosts/eirene/README.md](./hosts/eirene/README.md)       |
-| `elara`     | [hosts/elara/README.md](./hosts/elara/README.md)         |
-| `himalia`   | [hosts/himalia/README.md](./hosts/himalia/README.md)     |
-| `jupiter`   | [hosts/jupiter/README.md](./hosts/jupiter/README.md)     |
+| Host          | README                                                       |
+| ------------- | ------------------------------------------------------------ |
+| `installer`   | [hosts/installer/README.md](./hosts/installer/README.md)     |
+| `eirene`      | [hosts/eirene/README.md](./hosts/eirene/README.md)           |
+| `elara`       | [hosts/elara/README.md](./hosts/elara/README.md)             |
+| `himalia`     | [hosts/himalia/README.md](./hosts/himalia/README.md)         |
+| `jupiter`     | [hosts/jupiter/README.md](./hosts/jupiter/README.md)         |
+| `jupiter-vps` | [hosts/jupiter-vps/README.md](./hosts/jupiter-vps/README.md) |

flake.nix

@@ -160,6 +160,12 @@
           modules = [ ./hosts/jupiter ];
           specialArgs = { inherit inputs system; };
         };
+
+        jupiter-vps = nixpkgs.lib.nixosSystem rec {
+          system = "x86_64-linux";
+          modules = [ ./hosts/jupiter-vps ];
+          specialArgs = { inherit inputs system; };
+        };
       };
     }
     // inputs.flake-utils.lib.eachSystem [ "x86_64-linux" ] (

hosts/.gitignore

@@ -1,2 +1,2 @@
-*/secrets/ssh_host_ed25519_key
-*/secrets/.decrypted~*
+**/secrets/ssh_host_ed25519_key
+**/secrets/.decrypted~*

hosts/common/configs/system/boot/default.nix

@@ -10,11 +10,9 @@
       timeout = 1;
       efi.canTouchEfiVariables = true;
     };
+
     initrd.systemd.enable = true;
     kernelPackages = pkgs.linuxPackages_latest;
-    supportedFilesystems = [
-      "btrfs"
-      "ntfs"
-    ];
+    supportedFilesystems = [ "btrfs" ];
   };
 }

hosts/common/configs/system/impermanence/default.nix

@@ -1,32 +1,12 @@
-{ config, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 {
   imports = [ ./options.nix ];
 
-  boot.initrd.systemd = {
-    enable = true;
-
-    initrdBin = with pkgs; [
-      coreutils
-      util-linux
-      findutils
-      btrfs-progs
-    ];
-
-    services.impermanence = {
-      description = "Rollback BTRFS subvolumes to a pristine state";
-      wantedBy = [ "initrd.target" ];
-      before = [ "sysroot.mount" ];
-      after = [
-        "cryptsetup.target"
-        "local-fs-pre.target"
-      ];
-      unitConfig.DefaultDependencies = false;
-      serviceConfig.Type = "oneshot";
-      environment.DEVICE = config.environment.impermanence.device;
-      script = builtins.readFile ./scripts/wipe.sh;
-    };
-  };
-
   # uuidgen -r | tr -d -
   # https://github.com/NixOS/nixpkgs/blob/master/nixos/doc/manual/administration/systemd-state.section.md
   # https://github.com/NixOS/nixpkgs/pull/286140/files
@@ -36,6 +16,8 @@
   fileSystems."/persist".neededForBoot = true;
 
   environment = {
+    impermanence.enable = true;
+
     etc."machine-id".source = pkgs.runCommandLocal "machine-id-link" { } ''
       ln -s ${config.sops.secrets."machineId".path} $out
     '';

hosts/common/configs/system/impermanence/options.nix

@@ -1,6 +1,7 @@
 {
   config,
   lib,
+  pkgs,
   utils,
   ...
 }:
@@ -47,12 +48,16 @@ in
     with lib;
     with types;
     {
-      impermanence.device = mkOption {
-        type = str;
-        default = config.disko.devices.disk.main.content.partitions.root.content.content.device;
-        description = ''
-          LUKS BTRFS partition to wipe on boot.
-        '';
+      impermanence = {
+        enable = mkEnableOption "Impermanence";
+
+        device = mkOption {
+          type = str;
+          default = config.disko.devices.disk.main.content.partitions.root.content.content.device;
+          description = ''
+            LUKS BTRFS partition to wipe on boot.
+          '';
+        };
       };
 
       persistence =
@@ -179,7 +184,32 @@ in
     let
       all = lib.lists.flatten (builtins.concatMap builtins.attrValues (builtins.attrValues cfg));
     in
-    {
+    lib.mkIf config.environment.impermanence.enable {
+      boot.initrd.systemd = {
+        enable = true;
+
+        initrdBin = with pkgs; [
+          coreutils
+          util-linux
+          findutils
+          btrfs-progs
+        ];
+
+        services.impermanence = {
+          description = "Rollback BTRFS subvolumes to a pristine state";
+          wantedBy = [ "initrd.target" ];
+          before = [ "sysroot.mount" ];
+          after = [
+            "cryptsetup.target"
+            "local-fs-pre.target"
+          ];
+          unitConfig.DefaultDependencies = false;
+          serviceConfig.Type = "oneshot";
+          environment.DEVICE = config.environment.impermanence.device;
+          script = builtins.readFile ./scripts/wipe.sh;
+        };
+      };
+
       fileSystems = builtins.mapAttrs (_: _: { neededForBoot = true; }) cfg;
 
       systemd = {
@@ -244,6 +274,13 @@ in
         );
       };
 
+      environment.persistence."/persist" = {
+        "/etc/nixos" = { };
+        "/var/lib/nixos" = { };
+        "/var/lib/systemd" = { };
+        "/var/log" = { };
+      };
+
       assertions =
         let
           paths = builtins.map (c: c.path) all;

hosts/common/configs/system/sops/default.nix

@@ -22,10 +22,13 @@
 
     age = {
       generateKey = true;
-      sshKeyPaths = [
-        config.environment.persistence."/persist/state"."/etc/ssh/ssh_host_ed25519_key".source
-      ];
       keyFile = "/var/lib/sops-nix/key.txt";
+
+      sshKeyPaths =
+        if config.environment.impermanence.enable then
+          [ config.environment.persistence."/persist"."/etc/ssh/ssh_host_ed25519_key".source ]
+        else
+          [ "/etc/ssh/ssh_host_ed25519_key" ];
     };
   };
 }

hosts/common/configs/system/ssh/default.nix

@@ -6,5 +6,6 @@
     elara.publicKeyFile = ../../../../elara/secrets/ssh_host_ed25519_key.pub;
     himalia.publicKeyFile = ../../../../himalia/secrets/ssh_host_ed25519_key.pub;
     jupiter.publicKeyFile = ../../../../jupiter/secrets/ssh_host_ed25519_key.pub;
+    jupiter-vps.publicKeyFile = ../../../../jupiter-vps/secrets/ssh_host_ed25519_key.pub;
   };
 }

hosts/eirene/default.nix

@@ -51,6 +51,8 @@
 
   networking.hostName = "eirene";
 
+  boot.supportedFilesystems = [ "ntfs" ];
+
   fileSystems."/mnt/windows" = {
     device = "/dev/disk/by-id/nvme-Samsung_SSD_980_PRO_2TB_S69ENF0R841140X-part3";
     fsType = "ntfs3";

hosts/jupiter-vps/README.md

@@ -0,0 +1,12 @@
+# jupiter-vps
+
+## Installation Instructions
+
+1. Provision an OVHcloud VPS on Ubuntu 22.04
+2. Add personal public key
+3. Add a CNAME entry for `vps.karaolidis.com` pointing to the VPS IP/host
+4. Run `hosts/jupiter-vps/install.sh`
+
+## Update Instructions
+
+1. Run `nixos-rebuild switch --flake .#jupiter-vps --target-host root@vps.karaolidis.com`

hosts/jupiter-vps/configs/boot/default.nix

@@ -0,0 +1,12 @@
+{ pkgs, ... }:
+{
+  boot = {
+    loader.grub = {
+      efiSupport = true;
+      efiInstallAsRemovable = true;
+      timeoutStyle = "hidden";
+    };
+
+    kernelPackages = pkgs.linuxPackages_latest;
+  };
+}

hosts/jupiter-vps/configs/sshd/default.nix

@@ -0,0 +1,8 @@
+{ lib, ... }:
+{
+  services.openssh.settings.PermitRootLogin = lib.mkForce "prohibit-password";
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEWDA5vnIB7KE2VG28Ovg5rXtQqxFwMXsfozLsH0BNZS nick@karaolidis.com"
+  ];
+}

hosts/jupiter-vps/configs/wireguard/default.nix

@@ -0,0 +1,50 @@
+{
+  config,
+  inputs,
+  pkgs,
+  ...
+}:
+{
+  boot.kernel.sysctl."net.ipv4.ip_forward" = 1;
+
+  networking.firewall = {
+    allowedTCPPorts =
+      inputs.self.nixosConfigurations.jupiter.config.networking.firewall.allowedTCPPorts;
+
+    allowedUDPPorts = [
+      51820
+    ] ++ inputs.self.nixosConfigurations.jupiter.config.networking.firewall.allowedUDPPorts;
+  };
+
+  sops.secrets."wireguard" = { };
+
+  networking.wireguard.interfaces.wg0 =
+    let
+      iptables = "${pkgs.iptables}/bin/iptables";
+    in
+    {
+      ips = [ "10.100.0.1/24" ];
+      listenPort = 51820;
+      privateKeyFile = config.sops.secrets."wireguard".path;
+
+      postSetup = [
+        "${iptables} -t nat -A PREROUTING -i ens3 -p tcp --dport 22 -j RETURN"
+        "${iptables} -t nat -A PREROUTING -i ens3 -j DNAT --to-destination 10.100.0.2"
+        "${iptables} -t nat -A POSTROUTING -o wg0 -j MASQUERADE"
+      ];
+
+      postShutdown = [
+        "${iptables} -t nat -D PREROUTING -i ens3 -p tcp --dport 22 -j RETURN"
+        "${iptables} -t nat -D PREROUTING -i ens3 -j DNAT --to-destination 10.100.0.2"
+        "${iptables} -t nat -D POSTROUTING -o wg0 -j MASQUERADE"
+      ];
+
+      peers = [
+        {
+          name = "jupiter";
+          allowedIPs = [ "10.100.0.2/32" ];
+          publicKey = "Lvx7bpyqI8rUrxYVDolz7T+EPuRWDohJAAToq7kH7EU=";
+        }
+      ];
+    };
+}

hosts/jupiter-vps/default.nix

@@ -0,0 +1,26 @@
+{ inputs, lib, ... }:
+{
+  imports = [
+    inputs.disko.nixosModules.disko
+    ./format.nix
+
+    ./hardware
+
+    ../common/configs/system/impermanence
+    ../common/configs/system/nix
+    ../common/configs/system/nixpkgs
+    ../common/configs/system/sops
+    ../common/configs/system/sshd
+    ../common/configs/system/system
+    ../common/configs/system/users
+    ../common/configs/system/zsh
+
+    ./configs/boot
+    ./configs/sshd
+    ./configs/wireguard
+  ];
+
+  networking.hostName = "jupiter-vps";
+
+  environment.impermanence.enable = lib.mkForce false;
+}

hosts/jupiter-vps/format.nix

@@ -0,0 +1,39 @@
+{
+  disko.devices = {
+    disk.main = {
+      device = "/dev/sda";
+      type = "disk";
+      content = {
+        type = "gpt";
+        partitions = {
+          boot = {
+            name = "boot";
+            size = "1M";
+            type = "EF02";
+          };
+          esp = {
+            name = "esp";
+            size = "512M";
+            type = "EF00";
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+              mountOptions = [ "umask=0077" ];
+            };
+          };
+          root = {
+            name = "root";
+            size = "100%";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [ "defaults" ];
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/jupiter-vps/hardware/default.nix

@@ -0,0 +1,28 @@
+{ ... }:
+{
+  boot = {
+    initrd = {
+      availableKernelModules = [
+        "ata_piix"
+        "uhci_hcd"
+        "virtio_pci"
+        "virtio_scsi"
+        "virtio_net"
+        "virtio_mmio"
+        "virtio_blk"
+        "9p"
+        "9pnet_virtio"
+        "sd_mod"
+      ];
+
+      kernelModules = [
+        "virtio_balloon"
+        "virtio_console"
+        "virtio_rng"
+        "virtio_gpu"
+      ];
+    };
+
+    kernelModules = [ "kvm-amd" ];
+  };
+}

hosts/jupiter-vps/install.sh

@@ -0,0 +1,17 @@
+#!/usr/bin/env bash
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+temp=$(mktemp -d)
+
+cleanup() {
+  rm -rf "$temp"
+}
+trap cleanup EXIT
+
+install -d -m 755 "$temp/etc/ssh"
+cp ./hosts/jupiter-vps/secrets/ssh_host_ed25519_key "$temp/etc/ssh/ssh_host_ed25519_key"
+
+nix run github:nix-community/nixos-anywhere -- --flake .#jupiter-vps --extra-files "$temp" --target-host ubuntu@vps.karaolidis.com -i ~/.ssh/ssh_personal_ed25519_key

hosts/jupiter-vps/secrets/ssh_host_ed25519_key.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIEQGAjeS+Q5aB8uTmy//XyFRFihtUBeWJbFhIi8YEa3 root@jupiter-vps

hosts/jupiter/default.nix

@@ -1,8 +1,6 @@
 { lib, inputs, ... }:
 {
   imports = [
-    ../../lib
-
     inputs.disko.nixosModules.disko
     ./format.nix
 
@@ -32,6 +30,11 @@
     ./users/nick
   ];
 
+  networking = {
+    hostName = "jupiter";
+    extraHosts = lib.strings.concatStringsSep "\n" [ "127.0.0.1 karaolidis.local" ];
+  };
+
   fileSystems."/mnt/storage" = {
     label = "storage";
     fsType = "btrfs";
@@ -43,12 +46,4 @@
       "noatime"
     ];
   };
-
-  networking = {
-    hostName = "jupiter";
-    extraHosts = lib.strings.concatStringsSep "\n" [ "127.0.0.1 karaolidis.local" ];
-  };
-
-  i18n.defaultLocale = "en_US.UTF-8";
-  sops.defaultSopsFile = ./secrets/secrets.yaml;
 }