Servers named by service provided instead of by application.
This commit is contained in:
@@ -34,6 +34,7 @@
|
||||
| ---------------------------------------------------------| ---------------------------------------------------------------------------------| --------------------------------------------------------|
|
||||
| **No flakes** | Simplify onboarding and avoid a steep learning curve. | Configuration via `configuration.nix` + `callPackage`. |
|
||||
| **Modular structure** | Separate configurations by machine type and service. | Clear and maintainable directory tree. |
|
||||
| **Servers named by service, not by application** | Indicate what the machine does (git01 = Git forge) rather than the software (Gitea). Allows changing the underlying app without renaming. | Hosts under `hosts/servers/<service>01` (e.g. `git01`, `pass01`, `dns01`). |
|
||||
| **`callPackage` for modules** | Make modules autonomous, portable, and reusable. | Each module is an independent Nix package. |
|
||||
| **Separation of `user-profiles/` and `users/`** | Distinguish generic roles (e.g., `admin`) from concrete users (e.g., `xavier`). | Flexibility to apply profiles to multiple users. |
|
||||
| **`deploy.sh` script** | Automate deployment on existing machines. | Clone/update the repo + `nixos-rebuild switch`. |
|
||||
@@ -58,17 +59,17 @@ nixos-infra/
|
||||
│
|
||||
├── hosts/ # Machine configurations
|
||||
│ ├── servers/ # Servers (hypervisors, VMs, LXCs)
|
||||
│ │ ├── pve01/ # Hypervisor 1
|
||||
│ │ ├── hyper01/ # Hypervisor 1
|
||||
│ │ │ └── configuration.nix
|
||||
│ │ ├── pve02/ # Hypervisor 2
|
||||
│ │ ├── hyper02/ # Hypervisor 2
|
||||
│ │ │ └── configuration.nix
|
||||
│ │ ├── dns01/ # LXC container for DNS (master)
|
||||
│ │ │ └── configuration.nix
|
||||
│ │ ├── dns02/ # LXC container for DNS (slave)
|
||||
│ │ │ └── configuration.nix
|
||||
│ │ ├── gitea01/ # LXC container for Gitea
|
||||
│ │ ├── git01/ # LXC container for Git forge (e.g. Gitea)
|
||||
│ │ │ └── configuration.nix
|
||||
│ │ ├── vaultwarden/ # LXC container for Vaultwarden
|
||||
│ │ ├── pass01/ # LXC container for password manager (e.g. Vaultwarden)
|
||||
│ │ │ └── configuration.nix
|
||||
│ │ └── rp01/ # LXC container for reverse proxy
|
||||
│ │ └── configuration.nix
|
||||
@@ -158,11 +159,12 @@ nixos-infra/
|
||||
|
||||
| Name | Machine Type | Services | IPv4 | IPv6 Token |
|
||||
| ----------| --------------------| -------------| ------| ------------|
|
||||
| pve01 | Hypervisor | Proxmox | | |
|
||||
| pve02 | Hypervisor | Proxmox | | |
|
||||
| hyper01 | Hypervisor | Proxmox | | |
|
||||
| hyper02 | Hypervisor | Proxmox | | |
|
||||
| dns01 | LXC Container | DNS | | |
|
||||
| gitea01 | LXC Container | Gitea | | |
|
||||
| vault01 | LXC Container | Vaultwarden | | |
|
||||
| git01 | LXC Container | Git forge | | |
|
||||
| pass01 | LXC Container | Password mgr| | |
|
||||
| rp01 | LXC Container | Reverse proxy| | |
|
||||
| sting | Workstation | | | |
|
||||
| PC-FRIDA | Workstation | | | |
|
||||
|
||||
@@ -285,8 +287,9 @@ nixos-infra/
|
||||
## **💡 Notes and Best Practices**
|
||||
|
||||
- **Naming** :
|
||||
- Use explicit names for machines (e.g., `dns01`, `gitea01`).
|
||||
- For LXC containers, prefer short and descriptive names.
|
||||
- **Servers**: Name by service, not by application (e.g., `git01`, `pass01`, `dns01`).
|
||||
- **Workstations**: Use descriptive hostnames (e.g., `sting`, `gaia`).
|
||||
- **Hypervisors**: Prefix with `hyper` (e.g., `hyper01`, `hyper02`).
|
||||
- **Security** :
|
||||
- Disable root SSH access once deployment is complete.
|
||||
- Use SSH keys for authentication.
|
||||
|
||||
@@ -3,9 +3,9 @@
|
||||
{
|
||||
imports = [
|
||||
# Module pour les conteneurs LXC
|
||||
(builtins.callPackage ../../../modules/machine-types/lxc.nix {})
|
||||
../../../modules/machine-types/lxc.nix
|
||||
# Module pour le reverse proxy
|
||||
(builtins.callPackage ../../../modules/services/reverse-proxy/default.nix {})
|
||||
../../../modules/services/reverse-proxy/default.nix
|
||||
];
|
||||
|
||||
# Configuration réseau (IPv4 + IPv6)
|
||||
@@ -19,8 +19,8 @@
|
||||
|
||||
# Liste des services à exposer via le reverse proxy
|
||||
services.reverse-proxy.publicServices = [
|
||||
{ host = "gitea"; internalHost = "gitea01"; port = 3000; }
|
||||
{ host = "vaultwarden"; internalHost = "vault01"; port = 80; }
|
||||
{ host = "git"; internalHost = "git01"; port = 3000; }
|
||||
{ host = "pass"; internalHost = "pass01"; port = 80; }
|
||||
# Ajoutez ici d'autres services (ex: dns01, etc.)
|
||||
];
|
||||
|
||||
|
||||
@@ -26,10 +26,6 @@
|
||||
'';
|
||||
};
|
||||
|
||||
# Prise en charge IPv6
|
||||
# TODO : check whether explicitly enabling IPv6 is still encessary in 2026
|
||||
networking.ipv6.forwarding = true;
|
||||
|
||||
# Default configuration for a LXC container
|
||||
config = lib.mkIf config.lxc.enable {
|
||||
# Disabling useless services
|
||||
|
||||
@@ -27,9 +27,8 @@ in
|
||||
virtualHosts = map (service: {
|
||||
host = "${service.host}.lagraula.fr";
|
||||
reverseProxy = "http://${service.internalHost}.lagraula.fr:${toString service.port}";
|
||||
# Challenge ACME HTTP-01 (par défaut)
|
||||
tls = {
|
||||
email = "xavier@lagraula.fr"; # À adapter
|
||||
email = config.services.caddy.email or "xavier@lagraula.fr";
|
||||
};
|
||||
}) (config.services.reverse-proxy.publicServices or []);
|
||||
|
||||
|
||||
@@ -86,7 +86,7 @@ agenix -e secrets/<name>.age
|
||||
|
||||
### `update-nixpkgs.sh` — Update the nixpkgs pin
|
||||
|
||||
Updates `pkgs/nixpkgs.json` with the latest commit from nixpkgs unstable.
|
||||
Updates `pkgs/nixpkgs.json` with the latest commit from nixpkgs stable.
|
||||
|
||||
## Deployment workflow (LXC containers)
|
||||
|
||||
|
||||
Reference in New Issue
Block a user