From b65ab2f80194b7cb1abdd03b6a159f58799f3bf4 Mon Sep 17 00:00:00 2001 From: Florian Sesser <florian@privatestorage.io> Date: Mon, 3 May 2021 22:19:57 +0000 Subject: [PATCH] Add local development network morph configuration --- morph/grid/local/config.json | 10 ++++ morph/grid/local/grid.nix | 35 +++++++++++ morph/grid/local/vagrant-guest.nix | 86 +++++++++++++++++++++++++++ morph/grid/local/virtual-hardware.nix | 36 +++++++++++ 4 files changed, 167 insertions(+) create mode 100644 morph/grid/local/config.json create mode 100644 morph/grid/local/grid.nix create mode 100644 morph/grid/local/vagrant-guest.nix create mode 100644 morph/grid/local/virtual-hardware.nix diff --git a/morph/grid/local/config.json b/morph/grid/local/config.json new file mode 100644 index 00000000..56184fbc --- /dev/null +++ b/morph/grid/local/config.json @@ -0,0 +1,10 @@ +{ "publicStoragePort": 8898 +, "ristrettoSigningKeyPath": "../../PrivateStorageSecrets/ristretto.signing-key" +, "stripeSecretKeyPath": "../../PrivateStorageSecrets/privatestorageio-testing-stripe.secret" +, "passValue": 1000000 +, "issuerDomain": "payments.localdev" +, "letsEncryptAdminEmail": "florian@privatestorage.io" +, "allowedChargeOrigins": [ + "http://localhost:5000" + ] +} diff --git a/morph/grid/local/grid.nix b/morph/grid/local/grid.nix new file mode 100644 index 00000000..800a04b9 --- /dev/null +++ b/morph/grid/local/grid.nix @@ -0,0 +1,35 @@ +# Load the helper function and call it with arguments tailored for the local +# grid. It will make the morph configuration for us. We share this function +# with the production grid and have one fewer possible point of divergence. +import ../../lib/make-grid.nix { + name = "LocalDev"; + config = ./config.json; + nodes = cfg: + let + sshUsers = import ../../../../PrivateStorageSecrets/localdev-users.nix; + in { + "payments1" = import ../../lib/issuer.nix (rec { + publicIPv4 = "192.168.67.21"; + inherit sshUsers; + hardware = import ./virtual-hardware.nix ({ inherit publicIPv4; }); + stateVersion = "19.03"; + services.openssh.permitRootLogin = "yes"; + } // cfg); + + "storage1" = import ../../lib/make-testing.nix (rec { + publicIPv4 = "192.168.67.22"; + inherit sshUsers; + hardware = import ./virtual-hardware.nix ({ inherit publicIPv4; }); + stateVersion = "19.09"; + services.openssh.permitRootLogin = "yes"; + } // cfg); + + "storage2" = import ../../lib/make-testing.nix (rec { + publicIPv4 = "192.168.67.23"; + inherit sshUsers; + hardware = import ./virtual-hardware.nix ({ inherit publicIPv4; }); + stateVersion = "19.09"; + services.openssh.permitRootLogin = "yes"; + } // cfg); + }; +} diff --git a/morph/grid/local/vagrant-guest.nix b/morph/grid/local/vagrant-guest.nix new file mode 100644 index 00000000..8505b2f3 --- /dev/null +++ b/morph/grid/local/vagrant-guest.nix @@ -0,0 +1,86 @@ +# Minimal configuration that vagrant depends on + +{ config, pkgs, ... }: +let + # Vagrant uses an insecure shared private key by default, but we + # don't use the authorizedKeys attribute under users because it should be + # removed on first boot and replaced with a random one. This script sets + # the correct permissions and installs the temporary key if no + # ~/.ssh/authorized_keys exists. + install-vagrant-ssh-key = pkgs.writeScriptBin "install-vagrant-ssh-key" '' + #!${pkgs.runtimeShell} + if [ ! -e ~/.ssh/authorized_keys ]; then + mkdir -m 0700 -p ~/.ssh + echo "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEA6NF8iallvQVp22WDkTkyrtvp9eWW6A8YVr+kz4TjGYe7gHzIw+niNltGEFHzD8+v1I2YJ6oXevct1YeS0o9HZyN1Q9qgCgzUFtdOKLv6IedplqoPkcmF0aYet2PkEDo3MlTBckFXPITAMzF8dJSIFo9D8HfdOV0IAdx4O7PtixWKn5y2hMNG0zQPyUecp4pzC6kivAIhyfHilFR61RGL+GPXQ2MWZWFYbAGjyiYJnAmCP3NOTd0jMZEnDkbUvxhMmBYSdETk1rRgm+R4LOzFUGaHqHDLKLX+FIPKcF96hrucXzcWyLbIbEgE98OHlnVYCzRdK8jlqm8tehUc9c9WhQ== vagrant insecure public key" >> ~/.ssh/authorized_keys + chmod 0600 ~/.ssh/authorized_keys + fi + ''; +in +{ + # Services to enable: + + # Enable the OpenSSH daemon. + services.openssh.enable = true; + + # Enable DBus + services.dbus.enable = true; + + # Replace ntpd by timesyncd + services.timesyncd.enable = true; + + # Packages for Vagrant + environment.systemPackages = with pkgs; [ + findutils + gnumake + iputils + jq + nettools + netcat + nfs-utils + rsync + ]; + + users.users.root = { password = "vagrant"; }; + + # Creates a "vagrant" group & user with password-less sudo access + users.groups.vagrant = { + name = "vagrant"; + members = [ "vagrant" ]; + }; + users.extraUsers.vagrant = { + isNormalUser = true; + createHome = true; + group = "vagrant"; + extraGroups = [ "users" "wheel" ]; + password = "vagrant"; + home = "/home/vagrant"; + useDefaultShell = true; + }; + + systemd.services.install-vagrant-ssh-key = { + description = "Vagrant SSH key install (if needed)"; + after = [ "fs.target" ]; + wants = [ "fs.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + ExecStart = "${install-vagrant-ssh-key}/bin/install-vagrant-ssh-key"; + User = "vagrant"; + # So it won't be (needlessly) restarted: + RemainAfterExit = true; + }; + }; + + security.sudo.wheelNeedsPassword = false; + + security.sudo.extraConfig = + '' + Defaults:root,%wheel env_keep+=LOCALE_ARCHIVE + Defaults:root,%wheel env_keep+=NIX_PATH + Defaults:root,%wheel env_keep+=TERMINFO_DIRS + Defaults env_keep+=SSH_AUTH_SOCK + Defaults lecture = never + root ALL=(ALL) SETENV: ALL + %wheel ALL=(ALL) NOPASSWD: ALL, SETENV: ALL + ''; +} + diff --git a/morph/grid/local/virtual-hardware.nix b/morph/grid/local/virtual-hardware.nix new file mode 100644 index 00000000..d5e9067b --- /dev/null +++ b/morph/grid/local/virtual-hardware.nix @@ -0,0 +1,36 @@ +{ publicIPv4, ... }: +{ + imports = [ ./vagrant-guest.nix ]; + + virtualisation.virtualbox.guest.enable = true; + + # Use the GRUB 2 boot loader. + boot.loader.grub.enable = true; + boot.loader.grub.version = 2; + boot.loader.grub.device = "/dev/sda"; + + boot.initrd.availableKernelModules = [ "ata_piix" "sd_mod" "sr_mod" ]; + boot.initrd.kernelModules = [ ]; + boot.kernelModules = [ ]; + boot.extraModulePackages = [ ]; + + # remove the fsck that runs at startup. It will always fail to run, stopping + # your boot until you press *. + boot.initrd.checkJournalingFS = false; + + networking.interfaces.enp0s8.ipv4.addresses = [{ + address = publicIPv4; + prefixLength = 24; + }]; + + fileSystems."/storage" = { fsType = "tmpfs"; }; + fileSystems."/" = + { device = "/dev/sda1"; + fsType = "ext4"; + }; + swapDevices = [ ]; + + # We want to push packages with morph without having to sign them + nix.trustedUsers = [ "@wheel" "root" "vagrant" ]; +} + -- GitLab