mikl
1f960a53a5
Migrated muscari from nix-config-legacy (preserved for reference per
garden.md) to new multi-host flake structure.
Includes:
- hosts/muscari/default.nix: hostname, GRUB (BIOS), firewall
(22/80/443), SSH keys via forgejo .keys endpoint with sha256 pinning,
stateVersion 25.11
- hosts/muscari/disk-config.nix: disko config — 512M ESP + ext4 root,
device = /dev/vda (YC standard-v3 single virtio disk)
- hosts/muscari/k3s.nix: k3s single-node with --flannel-backend=none
(Cilium to be installed separately via Helm)
Architecture decisions (unchanged from legacy):
- Bootloader: GRUB (VM is in Legacy BIOS mode — see PREREQUISITES.md
check 5+11 in projects/servers/muscari/)
- Filesystem: ext4 root + vfat ESP (ESP unused in BIOS but ready if
ever switched to UEFI)
- Build deps: nixpkgs/nixos-25.11
Verification (after commit):
- nix flake show: nixosConfigurations.{muscari,rosemary} OK
- muscari.networking.hostName = "muscari"
- muscari.boot.loader.grub.enable = true
- muscari.boot.loader.systemd-boot.enable = false
- muscari.services.k3s.enable = true
- fileSystems derived correctly from disko
- poppy (darwin) and rosemary (NixOS) configs untouched
Session: verify plan
49 lines
No EOL
1.6 KiB
Nix
49 lines
No EOL
1.6 KiB
Nix
# muscari — k3s single-node cluster на YC (Debian 12 → NixOS 25.11 через nixos-install в tmux)
|
||
# https://git.iscg.dev/mikl/nix-config
|
||
#
|
||
# Этот host перенесён из nix-config-legacy (см. commits в legacy repo).
|
||
# VM: 158.160.166.30, 2 vCPU / 8 GB / 64 GB SSD (network-ssd), Legacy BIOS
|
||
|
||
{ config, pkgs, lib, ... }:
|
||
{
|
||
imports = [
|
||
./disk-config.nix
|
||
./k3s.nix
|
||
];
|
||
|
||
networking = {
|
||
hostName = "muscari";
|
||
useDHCP = true;
|
||
firewall.allowedTCPPorts = [
|
||
22 # SSH
|
||
80 # HTTP (Ingress через Traefik)
|
||
443 # HTTPS (Ingress через Traefik)
|
||
# 6443 не открываем — kubectl через SSH-туннель
|
||
];
|
||
};
|
||
|
||
# Bootloader — GRUB (Legacy BIOS mode, см. PREREQUISITES.md check 5+11)
|
||
boot.loader.grub = {
|
||
enable = true;
|
||
device = "/dev/vda";
|
||
useOSProber = false;
|
||
};
|
||
boot.loader.systemd-boot.enable = lib.mkForce false;
|
||
boot.loader.efi.canTouchEfiVariables = lib.mkForce false;
|
||
|
||
# SSH ключи для mikl: forgejo .keys endpoint с sha256-pinning
|
||
# + hardcoded fallback ключ для восстановления
|
||
users.users.mikl.openssh.authorizedKeys.keyFiles = [
|
||
(pkgs.fetchurl {
|
||
url = "https://git.iscg.dev/mikl.keys";
|
||
sha256 = "sha256-4n6QLUPozdhHOmsRCuFn7HR9BU3nF0/GR2E7s5Lpz+Q=";
|
||
})
|
||
];
|
||
|
||
# fileSystems — определяется через disko (см. disk-config.nix)
|
||
# Не задаём явно fileSystems."/" чтобы не конфликтовать с disko
|
||
|
||
# После nixos-install первая установка 25.11,
|
||
# потом не трогаем (NixOS convention)
|
||
system.stateVersion = "25.11";
|
||
} |