nixos-config/hosts/plover/README.adoc

= Plover, the general-purpose server
:toc:
:nixos-infect-commit: bca605ce2c91bc4d79bf8afaa4e7ee4fee9563d4

This is Plover, a configuration meant to be used in a low-powered general-purpose machine.
It isn't much of an instance to be seriously used yet but hopefully it is getting there.

This configuration is expected to be deployed in a Google Compute instance.

It has a reasonable set of assumptions to keep in mind when modifying this configuration:

- Most of the defaults are left to the link:https://github.com/NixOS/nixpkgs/tree/f92201f46109aabbbf41b8dc24bb9d342eb93a35/nixos/modules/virtualisation[image profiles from nixpkgs] including networking options and filesystems.
Though, they should be handled on link:./modules/hardware[`./modules/hardware`].

- No additional storage drives.

- At least 32 GB of space is assumed.

Some of the self-hosted services from this server:

* An nginx server which will make tie all of the self-hosted services together.
* A link:https://github.com/dani-garcia/vaultwarden[Vaultwarden] instance for a little password management.
* A link:https://gitea.io/[Gitea] instance for my personal projects.
* A link:https://www.keycloak.org/[Keycloak] instance for identity management.
* A VPN tunnel with link:https://www.wireguard.com/[Wireguard].
* An LDAP server with link:https://www.openldap.org/[OpenLDAP].




[#general-deployment-guidelines]
== General deployment guidelines

If you want to deploy it anywhere else, you have to keep some things in mind.

* This uses link:https://github.com/mozilla/sops[sops] and link:https://github.com/Mic92/sops-nix[sops-nix] to decrypt secrets.
It mainly use the private key to the link:./files/age-key.pub[`./files/age-key.pub`] and move it to the appropriate location (i.e., `/var/lib/sops-nix/key.txt`).

* Be sure to set the appropriate firewalls either in the NixOS configuration or in the VPS provider firewall settings.
Take note some formats such as Google Compute image disable them entirely so it's safer to leave the firewall service and just configure the allowed ports and other settings.

* There are some things that are manually configured such as additional setup for the database.
Mostly related to setting up the proper roles which should be set up with the initial script at this point but there are some still left.

* If needed, restoring the application data from the backup into the services (e.g., Gitea, Keycloak, Vaultwarden).

* Configuring the remaining parts for the services (which unfortunately involves manually going into each application).

* Configure the database users with each appropriate service.

* Configure the services with users if starting from scratch.

** For Gitea, you have to create the main admin user with the admin interface.
+
--
Here's a way to quickly create a user in the admin interface.

[source, shell]
----
sudo -u gitea gitea admin user create --username USERNAME --email EMAIL \
    --random-password --config /var/lib/gitea/custom/conf/app.ini --admin
----
--

** For Vaultwarden, you have to go to the admin page of the Vaultwarden instance (i.e., `$VAULTWARDEN_INSTANCE/admin`), get the admin token to enter, and invite users from there.

** For Keycloak, you have to create the appropriate realms and users as follows from the link:https://www.keycloak.org/docs/20.0.2/server_admin/index.html[server administration guide].
Though, you can easily create one from the command-line interface with `kcadm.sh`.

** For Portunus, this is already taken care of with a seed file.
Still, test the logins as indicated from the seed file.


=== Networking guidelines

Networking for a first-timer can be confusing (at least for me).
So here's the documentation for what is the practices that are following here.

- Internal services is mainly at `172.24.0.0/16`.
- Public services is at an increment to the internal services IP address (i.e., `172.25.0.0/16`).
- Wireguard interfaces are mainly at `10.2xx.0.0/16`.

There are some general guidelines to keep in mind when assigning the IPs statically.

- Servers are intended at `172.1.x.x` to `172.101.x.x`.
- VPNs are at `10.2xx.x.x`.

For more details, you can see the interfaces and their networking-related configuration in link:./modules/hardware/networks.nix[`./modules/hardware/networks.nix`].




== Deploying it as a Google Compute instance

Some documented guidelines to deploy this instance in Google Cloud Platform (GCP) so you won't have to re-read those documentation like a stuck rat the next time you visit them.

* A GCP Compute Instance image of the configuration is available to be stored at your storage buckets.
You can simply build it at `packages.plover-gce` and store it there.
+
You can take it further automating it by running link:../../scripts/generate-and-upload-gce-image[`../../scripts/generate-and-upload-gce-image`] which is just a modified version of the link:https://github.com/NixOS/nixpkgs/blob/ebdafd7244832f1f52cacd3eda39f2156988957e/nixos/maintainers/scripts/gce/create-gce.sh[`create-gce.sh` script from nixpkgs].

* If you already have access to at least one GCP KMS key, then skip this part.
Add a key to be used for deployment to wherever relevant file in the link:./secrets[secrets directory]. footnote:[Of course, you need previous keys which you're likely using the private age key for this system.]
For this, you'll have to create a GCP keyring on their key management system (KMS) and generate a key there.

* Enable link:https://cloud.google.com/compute/docs/oslogin/set-up-oslogin[OS Login] for your Compute Engine instance.

* Enable HTTP and HTTPS traffic in the firewall settings.

* Don't forget to set the appropriate scopes for the instance.
Use the least privileged scopes as much as possible.

* Reserve a static IP address, pls.
Just don't forget to immediately assign it to the instance since it will charge higher if you just leave it alone.

* Creating a dedicated link:https://cloud.google.com/iam/docs/service-accounts[service account] for the VM is recommended.
Just make sure to set the least amount of privileges for that account.




== Deploying it to Hetzner Cloud

A deployment to Hetzner Cloud is composed of mainly three things:

- A server.
- A firewall.
- A private network.

First, we will set up the latter two before creating the server. footnote:[Though, it can be created in any order, it's just personal preferences at this point.]

Setting up a firewall is pretty simple as the TCP/UDP ports is patterned after the allowed IP ranges in the host configuration.
You can set up a firewall from Hetzner Cloud web UI but you can also deploy one with `hcloud`.

[source, shell]
----
hcloud firewall create --name tcp-fw
hcloud firewall create --name udp-fw

hcloud firewall add-rule tcp-fw --direction in --protocol tcp --port 22 --description "Secure shells"
hcloud firewall add-rule tcp-fw --direction in --protocol tcp --port 80 --description "HTTP server"
hcloud firewall add-rule tcp-fw --direction in --protocol tcp --port 433 --description "HTTPS server"
hcloud firewall add-rule tcp-fw --direction in --protocol tcp --port 389 --description "LDAP server"
hcloud firewall add-rule tcp-fw --direction in --protocol tcp --port 636 --description "LDAPS server"

hcloud firewall add-rule udp-fw --direction in --protocol udp --port 51820 --description "Wireguard"
hcloud firewall add-rule tcp-fw --direction in --protocol udp --port 389 --description "LDAP server"
hcloud firewall add-rule tcp-fw --direction in --protocol udp --port 636 --description "LDAPS server"
----

Next up, the networking setup which is composed of a public IP used for accessing some services and a private network used to communicate inside of the network.
However, the main reason we have a private network is to setup a VPN service to hide some of the more sensitive services.

You can create one from Hetzner Cloud web UI.
If you want to create with `hcloud`, however...

[source, shell]
----
hcloud network create --name plover-local --ip-range 172.16.0.0/12
----

To deploy this to Hetzner Cloud, just initialize a server and run link:https://github.com/elitak/nixos-infect/[nixos-infect] script.
As an example, you can run the server with the following link:https://community.hetzner.com/tutorials/basic-cloud-config[cloud config].

[source, yaml, subs=attributes]
----
#cloud-config

runcmd:
  - curl https://raw.githubusercontent.com/elitak/nixos-infect/{nixos-infect-commit}/nixos-infect | NIX_CHANNEL=nixos-unstable bash 2>&1 | tee /tmp/infect.log
----

You could also easily create a server with `hcloud` with the following command:

[source, shell]
----
hcloud server create --location hel1 --type cx21 --image ubuntu-22.04 \
    --firewall tcp-fw --firewall udp-fw \
    --network plover-local \
    --user-data-from-file ./files/hcloud/hcloud-user-data.yml \
    --ssh-key foodogsquared@foodogsquared.one \
    --name nixos-plover
----

If you don't want to setup the firewall in the system, you could use the firewall from Hetzner (which is recommended anyways).

Then, don't forget to setup the prerequisites such as filesystems properly.
Here's a set of commands setting up to the current filesystem configuration.

[source, shell]
----
e2label /dev/sda1 nixos
fatlabel /dev/sda15 boot
----

Next, do the steps as written from <<general-deployment-guidelines>>.