mikl
79260cec6f
- Rename muscari -> heather (YC VM). rosemary reserved for future EU server. - Add hosts/heather/image.nix: YC guest profile + qcow2 build target based on nixos/lib/make-disk-image.nix (the nixpkgs-standard cloud image builder). partitionTableType=legacy (MBR + single ext4 root, label nixos), GRUB in MBR on /dev/vda, virtio drivers, console=ttyS0, cloud-init (Ec2 datasource) so poppy ssh key auto-lands from YC metadata, growPartition. - Drop disko flake input + disk-config.nix (was only for nixos-anywhere runtime install; replaced by make-disk-image build-time approach, no kexec). - Add home/server.nix: minimal headless home for NixOS hosts (no ollama/ texliveFull/kitty/syncthing/pass). flake mkNixos uses it instead of full ./home. - k3s.nix: drop dead firewall block (firewall off in image.nix -> trustedInterfaces was a no-op). Cilium manages pod networking via BPF. - image.baseName=heather, configurationLimit=1, remove virtio dups (qemu-guest profile already provides most). - Fix sha256 pin on forgejo mikl.keys (was stale, would break fetchurl). - home/zsh.nix: source yandex-cloud yc completion.
39 lines
No EOL
1.5 KiB
Nix
39 lines
No EOL
1.5 KiB
Nix
# heather — k3s single-node cluster на YC (NixOS 25.11, собирается как qcow2-образ)
|
||
# https://git.iscg.dev/mikl/nix-config
|
||
#
|
||
# Перенесено из muscari (переименование 2026-07-11).
|
||
# VM на Yandex Cloud, 2 vCPU / 8 GB / 64 GB SSD (network-ssd), Legacy BIOS.
|
||
# Образ NixOS собирается как qcow2 (см. ./image.nix, make-disk-image.nix) и
|
||
# заливается как boot disk в YC. НЕ через nixos-anywhere — kexec на YC хрупкий.
|
||
# См. memory/yandex-nixos-qcow2.md.
|
||
|
||
{ config, pkgs, lib, ... }:
|
||
{
|
||
imports = [
|
||
./image.nix # YC guest profile + qcow2 build target (заменяет disk-config.nix)
|
||
./k3s.nix
|
||
];
|
||
|
||
networking = {
|
||
hostName = "heather";
|
||
firewall.allowedTCPPorts = [
|
||
22 # SSH
|
||
80 # HTTP (Ingress через Traefik)
|
||
443 # HTTPS (Ingress через Traefik)
|
||
# 6443 не открываем — kubectl через SSH-туннель
|
||
];
|
||
};
|
||
# useDHCP задаёт ./image.nix (mkDefault) — облачный профиль.
|
||
|
||
# SSH ключи для mikl: forgejo .keys endpoint с sha256-pinning.
|
||
# Poppy-ключ (этот ноутбук) лежит там последней строкой.
|
||
users.users.mikl.openssh.authorizedKeys.keyFiles = [
|
||
(pkgs.fetchurl {
|
||
url = "https://git.iscg.dev/mikl.keys";
|
||
sha256 = "sha256-Omc/3NJn0nM8SWeF33trFwOAVgSX0fXB5dfEakcRoTA=";
|
||
})
|
||
];
|
||
|
||
# После первой установки 25.11 не трогаем (NixOS convention)
|
||
system.stateVersion = "25.11";
|
||
} |