bundlewrap/nodes/kunsi-p14s.py

269 lines
8.6 KiB
Python
Raw Normal View History

nodes['kunsi-p14s'] = {
2022-02-12 17:07:47 +00:00
'hostname': 'localhost',
'bundles': {
'arch-with-gui',
2022-02-12 17:56:54 +00:00
'backup-client',
'lldp',
'lm-sensors',
2022-02-13 08:54:06 +00:00
'nfs-client',
2022-11-21 18:31:49 +00:00
'openvpn-client',
2022-02-13 08:24:11 +00:00
'systemd-boot',
'telegraf-battery-usage',
2022-03-11 12:58:38 +00:00
'vmhost',
2022-04-22 13:08:27 +00:00
'voc-tracker-worker',
'wireguard',
'zfs',
},
'groups': {
'arch',
},
'metadata': {
'arch-with-gui': {
'autologin_as': 'kunsi',
},
'backup-client': {
# only alert people if we're missing more than a week of backups
'one_backup_every_hours': 7 * 24,
},
'firewall': {
'port_rules': {
# obs websocket thingie - just allow all RFC1918 ips here
#'4444': {
# '10.0.0.0/8',
# '172.16.0.0/12',
# '192.168.0.0/16',
#},
# For the occasional file-share using `python -m http.server`
2023-09-24 18:59:58 +00:00
'8000/tcp': {'*'},
},
},
'interfaces': {
'br0': {
'ips': {'10.73.100.103/16'},
'gateway4': '10.73.0.254',
'dhcp': True,
},
# there is also wlp3s0, but that's managed by netctl
},
2022-02-13 08:54:06 +00:00
'nfs-client': {
'mounts': {
'nas-scansnap': {
'mountpoint': '/mnt/scansnap',
'serverpath': '172.19.138.20:/srv/scansnap',
'mount_options': {
'retry=0',
'rw',
},
},
'nas-storage': {
'mountpoint': '/mnt/nas',
'serverpath': '172.19.138.20:/storage/nas',
'mount_options': {
'retry=0',
'ro',
},
},
},
},
'nftables': {
'forward': {
'50-routing': [
'ct state { related, established } accept',
2023-12-16 09:41:26 +00:00
'oifname wlan0 accept',
],
},
'postrouting': {
'50-routing': [
2023-12-16 09:41:26 +00:00
'oifname wlan0 masquerade',
],
},
},
'openssh': {
'restrict-to': {
'rfc1918',
},
},
2022-11-21 18:31:49 +00:00
'openvpn-client': {
'configs': {
'c3voc': {
'running': None,
'enabled': False,
},
'smedia-priv': {
'running': None,
'enabled': False,
},
2022-11-21 18:31:49 +00:00
},
},
'pacman': {
'no_extract': {
'etc/sudoers.d/ctdb', # samba junk
},
'packages': {
# for hardware support
'amd-ucode': {},
'mesa': {},
# various video drivers
'libva-mesa-driver': {},
'mesa-vdpau': {},
'xf86-video-amdgpu': {},
# all that other random stuff one needs
2022-03-05 13:20:29 +00:00
'abcde': {},
2022-02-17 17:03:54 +00:00
'apachedirectorystudio': {},
'claws-mail': {},
'claws-mail-themes': {},
'ferdi-bin': {},
2022-02-13 16:05:51 +00:00
'gumbo-parser': {}, # for claws litehtml
2023-04-03 16:39:42 +00:00
'inkstitch': {}, # for RZL embroidery machine
'obs-studio': {},
2022-03-05 13:20:29 +00:00
'perl-musicbrainz-discid': {}, # for abcde
'perl-webservice-musicbrainz': {}, # for abcde
2023-03-14 08:24:12 +00:00
'sdl_ttf': {}, # for compiling testcard
2023-04-03 16:39:42 +00:00
'x32edit': {},
},
},
2022-02-13 08:24:11 +00:00
'systemd-boot': {
'default': 'arch',
2022-02-13 08:24:11 +00:00
'entries': {
'arch': {
'title': 'Arch Linux',
'linux': '/vmlinuz-linux',
2022-02-13 08:24:11 +00:00
'initrd': [
'/amd-ucode.img',
'/initramfs-linux.img',
2022-02-13 08:24:11 +00:00
],
'options': {
2023-12-16 09:41:26 +00:00
'net.ifnames=0',
2022-02-13 08:24:11 +00:00
'rw',
2023-12-16 09:41:26 +00:00
'zfs=zroot/system/root',
2022-02-13 08:24:11 +00:00
},
},
'arch-fallback': {
'title': 'Arch Linux (no ucode, fallback initramfs)',
'linux': '/vmlinuz-linux',
2022-02-13 08:24:11 +00:00
'initrd': [
'/initramfs-linux-fallback.img',
2022-02-13 08:24:11 +00:00
],
'options': {
2023-12-16 09:41:26 +00:00
'net.ifnames=0',
2022-02-13 08:24:11 +00:00
'rw',
2023-12-16 09:41:26 +00:00
'zfs=zroot/system/root',
2022-02-13 08:24:11 +00:00
},
},
},
},
'sysctl': {
'options': {
'net.ipv4.ip_forward': '1',
},
},
'systemd-networkd': {
'bridges': {
'br0': {
'match': {
'en*',
'eth*',
},
},
},
},
'timezone': 'Europe/Berlin',
'users': {
'kunsi': {
'password': vault.decrypt('encrypt$gAAAAABgLmmuQGRUStrQawoPee-758emIYn2u8-8ebrgzNAFSp7ifeFDdXXvs-zL3QogwNYlCtBHboH2xfy1rSj6OF5bbNO-tg=='),
'shell': '/usr/bin/fish',
},
'sophie': {
'delete': True,
},
},
2022-04-22 13:08:27 +00:00
'voc-tracker-worker': {
'url': 'https://tracker.c3voc.de/rpc',
'token': vault.decrypt('encrypt$gAAAAABiYqaFl4CqOc8DTQIn49Qq0KgAJSzA19GKPNMbyHIjYg0JkvY0sK43ps8CbJWMRR6hJHVK-nP4vrWLwyoWWqt8N8aASMur4odC2s8pEHQKM0TXg4cRwobQz_lyJgrYa2VYdhcD'),
'secret': vault.decrypt('encrypt$gAAAAABiYqaYbY-3IbnRk-S25pqxrOGN7ovgPo3kBYz8ZqKDedPRzskKZefpLHxBbCOZKjg1XNT4cKbIs5cPCLdj7HdY4beAhnXl4EHZZdxU1zVC7sJCmz9XOS_Ac0UOgOlUFMiet14U'),
},
'wireguard': {
'peers': {
'htz-cloud.wireguard': {
'auto_connection': False,
'endpoint': 'wireguard.htz-cloud.kunbox.net:1194',
'my_ip': '172.19.136.65',
'my_port': 51819,
'their_ip': '172.19.136.64',
'routes': {
'172.19.128.0/20',
},
},
},
},
'zfs': {
2022-04-03 07:48:50 +00:00
'pools': {
'zroot': {
'when_creating': {
'config': [{
'devices': [
'/dev/disk/by-id/nvme-UMIS_RPETJ1T24MGE2QDQ_SS0L25218X3RC1BG1182-part2',
],
}],
'ashift': 12,
},
},
},
2022-02-12 17:56:54 +00:00
'datasets': {
# this is not a complete list, but we can't create that
# structure using bundlewrap anyway, so there's no point
# in adding it here.
2022-03-11 12:58:38 +00:00
'zroot': {
'compression': 'lz4',
'relatime': 'on',
'xattr': 'sa',
2022-04-03 15:41:27 +00:00
'primarycache': 'metadata'
2022-03-11 12:58:38 +00:00
# encryption is enabled, too.
},
'zroot/movies': {
'mountpoint': '/media/movies',
},
2022-02-13 07:56:52 +00:00
'zroot/system/journal': {
'mountpoint': '/var/log/journal',
'acltype': 'posix',
},
2022-03-11 12:58:38 +00:00
'zroot/system/libvirt': {
'mountpoint': '/var/lib/libvirt',
'needed_by': {
'bundle:vmhost',
},
},
2022-04-27 03:42:11 +00:00
'zroot/system/video': {
'mountpoint': '/video',
'needed_by': {
'bundle:voc-tracker-worker',
},
},
2022-02-12 17:56:54 +00:00
'zroot/system/root': {
'canmount': 'noauto',
2023-03-27 12:09:00 +00:00
'mountpoint': 'legacy',
2022-02-12 17:56:54 +00:00
},
'zroot/user/kunsi': {
'mountpoint': '/home/kunsi',
},
},
'snapshots': {
'retain_per_dataset': {
'zroot/user/kunsi': {
# juuuuuuuust to be sure
'hourly': 100,
},
},
'snapshot_never': {
'zroot/movies',
'zroot/system/journal',
2022-04-27 03:42:11 +00:00
'zroot/system/video',
},
},
},
},
'os': 'arch',
}