foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-01-31 16:57:55 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity
15722347eb
nixos-config/hosts/plover
History
Gabriel Arazas 15722347eb hosts/plover: add periodic cleanup to Gitea dumps
2022-12-28 14:09:33 +08:00
..
files hosts/plover: update SSH keypair 2022-12-12 10:26:30 +08:00
secrets hosts/plover: add Keycloak service 2022-12-13 08:33:51 +08:00
default.nix hosts/plover: add periodic cleanup to Gitea dumps 2022-12-28 14:09:33 +08:00
hardware-configuration.nix hosts/ni: update config 2022-11-25 21:27:25 +08:00
README.adoc hosts/plover: update config 2022-12-10 18:45:36 +08:00

README.adoc

This is Plover, a configuration meant to be used in a low-powered general-purpose machine. It isn’t much of an instance to be seriously used yet but hopefully it is getting there.

This configuration is expected to be deployed in a Google Compute instance.

It has a reasonable set of assumptions to keep in mind when modifying this configuration:

  • Most of the defaults are left to the image profiles from nixpkgs including networking options and filesystems.

  • No additional storage drives.

  • At least 32 GB of space is assumed.

Some of the self-hosted services from this server:

  • An nginx server which will make tie all of the self-hosted services together.

  • A Vaultwarden instance for a little password management.

  • A Gitea instance for my personal projects.

General deployment guidelines

If you want to deploy it anywhere else, you have to keep some things in mind.

  • This uses sops and sops-nix to decrypt secrets. It mainly use the private key to the ./files/age-key.pub and move it to the appropriate location (i.e., /var/lib/sops-nix/key.txt).

  • Be sure to set the appropriate firewalls either in the NixOS configuration or in the VPS provider firewall settings. Take note some formats such as Google Compute image disable them entirely so it’s safer to leave the firewall service and just configure the allowed ports and other settings.

Deploying it as a Google Compute instance

Some documented guidelines to deploy this instance in Google Cloud Platform (GCP) so you won’t have to re-read those documentation like a stuck rat the next time you visit them.

  • A GCP Compute Instance image of the configuration is available to be stored at your storage buckets. You can simply build it at packages.plover-gce and store it there.

    You can take it further automating it by running ../../scripts/generate-and-upload-gce-image which is just a modified version of the create-gce.sh script from nixpkgs.

  • If you already have access to at least one GCP KMS key, then skip this part. Add a key to be used for deployment to wherever relevant file in the secrets directory. [1] For this, you’ll have to create a GCP keyring on their key management system (KMS) and generate a key there.

  • Enable OS Login for your Compute Engine instance.

  • Enable HTTP and HTTPS traffic in the firewall settings.

  • Don’t forget to set the appropriate scopes for the instance. Use the least privileged scopes as much as possible.

  • Reserve a static IP address, pls. Just don’t forget to immediately assign it to the instance since it will charge higher if you just leave it alone.

  • Creating a dedicated service account for the VM is recommended. Just make sure to set the least amount of privileges for that account.

1. Of course, you need previous keys which you’re likely using the private age key for this system.