ERPU nixfiles

Welcome to the erpu nix configuration (experimental). This might be how we want to run our infrastructure.

General layout

• flake.nix: Entrypoint & specifies dependencies
• flake.lock: generated file, gives dependencies currently used
• modules/: custom modules that aren't in nixpkgs
• common/: meta-level config, reusable across machines
• regiolis/: server-specific config
• secrets.yaml: contains encrypted secret values of the configuration. sops-nix is used to manage these; keys are in .sops.yaml

Working with this repo

You will need a flake-enabled nix installation, and have your ssh config set up so that ssh regiolis will connect to regiolis.erpu.eu. You may wish to see bootstrap.md for more detailed notes.

Alternatively, log in to regiolis, and work on the machine directly; it has a working Nix installation. Note that if you do so & mess up networking, there's no magic rolling back to when it still worked!

Deploying remotely

It's recommended to use deploy_rs:

deploy .#regiolis -k --ssh-user <username> [--dry-activate]

Among other niceties, this tool will install a watchdog during the deploy. If it fails to be contacted afterwards (e.g. because the deploy broke networking), it will automatically roll back the machine to the previously deployed state. "Dry activation" will show you what would be done, but not actually change anything.

Alternatively, using just nixos-rebuild:

nixos-rebuild --flake .#regiolis --target-host regiolis \
 --use-remote-sudo --use-substitutes [test|switch|dry-activate]

Re-deploying on regiolis itself

Check out this git repository, and inside it, do:

nixos-rebuild --flake .#regiolis [test|switch|dry-activate]

Adding Users

Look into common/users.nix, and define a new block in the same pattern as the other ones. Add an ssh key!

For secrets access, take the new user's age key (or use ssh-to-age to make their ssh key into one), and add it to .sops.yaml, then do sops updatekeys secrets.yaml.

Testing regiolis locally

When making substantial changes it's a good idea to test them in a local environment first.

For this purpose there's a local virtual machine configuration in tests/regiolis.nix inheriting some of regiolis' config. Please also commit additions to this environment so others can test with it more easily.

Use nix run --print-build-logs --show-trace .#tests.regiolis.driverInteractive to build the VM, then enter test_script() to run it.

To get a shell either enter root into the QEMU window or use ssh root@vsock/3.

The testing environment currently exposes Authentik on https://login.erpu.eu (user akadmin, password test) and Zulip on https://zulip.erpu.eu via a SOCKS5 proxy. To interact with the SOCKS proxy use nix run .#tests-firefox.

To edit the environment's secrets use SOPS_AGE_KEY_FILE=tests/secrets.age.key sops tests/secrets.yaml.

LICENSE

This project is licensed under the BSD 2-Clause "Simplified" License.

The license texts and file annotations get maintained using the REUSE SOFTWARE tool. See REUSE.toml.

Contributors are encouraged to add their own name to the copyright annotations of files they contribute to! Please use the following command for that purpose:

# Optional: Get the reuse tool from nix
nix develop
reuse annotate --license BSD-2-Clause --copyright-prefix spdx-string --merge-copyrights --copyright "Your Name" path/to/file