bundlewrap/nodes/fkusei-locutus.py

185 lines
6.1 KiB
Python
Raw Normal View History

2022-03-09 12:07:55 +00:00
nodes['fkusei-locutus'] = {
'hostname': '172.19.138.96',
'bundles': {
'arch-with-gui',
'bird',
'lldp',
'lm-sensors',
'nfs-client',
'systemd-boot',
'telegraf-battery-usage',
'wireguard',
'voc-tracker-worker',
2022-03-09 12:07:55 +00:00
'zfs',
},
'groups': {
'arch',
},
'metadata': {
'arch-with-gui': {
'autologin_as': 'fkunsmann',
2022-03-09 12:07:55 +00:00
},
'bird': {
'bgp_neighbors': {
'smedia': {
'local_as': 4200128002,
'local_ip': '10.200.128.2',
'neighbor_as': 64900,
'neighbor_ip': '10.200.128.1',
},
},
},
'firewall': {
'port_rules': {
# obs websocket thingie - just allow all RFC1918 ips here
#'4444': {
# '10.0.0.0/8',
# '172.16.0.0/12',
# '192.168.0.0/16',
#},
# For the occasional file-share using `python -m http.server`
'8000': {'*'},
},
},
'interfaces': {
'enp0s31f6': {
'dhcp': True,
'ips': {
'172.19.138.96', # for static dhcp lease
},
'mac': 'e8:6a:64:ef:cc:5c',
},
# there is also wlp2s0, but that's managed by netctl
},
'location': 'home', # not actually true, but needed for static dhcp lease
'nfs-client': {
'mounts': {
'nas-storage': {
'mountpoint': '/mnt/nas',
'serverpath': '172.19.138.20:/storage/nas',
'mount_options': {
'retry=0',
'ro',
},
},
},
},
'openssh': {
'restrict-to': {
'rfc1918',
'ipv6',
},
},
'pacman': {
'linux-lts': True,
'packages': {
# video drivers
'xf86-video-intel': {},
# all that other random stuff one needs
'apachedirectorystudio': {},
'direnv': {},
2022-03-10 19:33:32 +00:00
'freerdp': {},
2022-03-23 19:21:15 +00:00
'sdl_ttf': {}, # for compiling testcard
'thermald': {},
2022-03-09 12:07:55 +00:00
},
},
'systemd-boot': {
'default': 'arch-lts',
'entries': {
'arch-lts': {
'title': 'Arch Linux (LTS kernel)',
'linux': '/vmlinuz-linux-lts',
'initrd': [
'/intel-ucode.img',
'/initramfs-linux-lts.img',
],
'options': {
'zfs=zroot/system/root',
'rw',
},
},
'arch-lts-fallback': {
'title': 'Arch Linux (LTS kernel, no ucode, fallback initramfs)',
'linux': '/vmlinuz-linux-lts',
'initrd': [
'/initramfs-linux-lts-fallback.img',
],
'options': {
'zfs=zroot/system/root',
'rw',
},
},
},
},
'timezone': 'Europe/Berlin',
'users': {
'fkunsmann': {
'password': vault.decrypt('encrypt$gAAAAABgLmmuQGRUStrQawoPee-758emIYn2u8-8ebrgzNAFSp7ifeFDdXXvs-zL3QogwNYlCtBHboH2xfy1rSj6OF5bbNO-tg=='),
'shell': '/usr/bin/fish',
'sudo_commands': {
'ALL',
},
},
'sophie': {
'delete': True,
},
},
'voc-tracker-worker': {
'url': 'https://tracker.c3voc.de/rpc',
'token': vault.decrypt('encrypt$gAAAAABiYqaFl4CqOc8DTQIn49Qq0KgAJSzA19GKPNMbyHIjYg0JkvY0sK43ps8CbJWMRR6hJHVK-nP4vrWLwyoWWqt8N8aASMur4odC2s8pEHQKM0TXg4cRwobQz_lyJgrYa2VYdhcD'),
'secret': vault.decrypt('encrypt$gAAAAABiYqaYbY-3IbnRk-S25pqxrOGN7ovgPo3kBYz8ZqKDedPRzskKZefpLHxBbCOZKjg1XNT4cKbIs5cPCLdj7HdY4beAhnXl4EHZZdxU1zVC7sJCmz9XOS_Ac0UOgOlUFMiet14U'),
},
2022-03-09 12:07:55 +00:00
'wireguard': {
'privatekey': vault.decrypt('smedia$NotViaThisRepository'),
'peers': {
'smedia': {
'endpoint': '185.122.180.82:51820',
2022-03-09 12:07:55 +00:00
'my_ip': '10.200.128.2/20',
'my_port': 51820,
'psk': vault.decrypt('smedia$NotViaThisRepository'),
'pubkey': vault.decrypt('smedia$NotViaThisRepository'),
'their_ip': '10.200.128.1',
2022-03-09 12:07:55 +00:00
},
},
},
'zfs': {
'datasets': {
# this is not a complete list, but we can't create that
# structure using bundlewrap anyway, so there's no point
# in adding it here.
2022-04-03 15:41:27 +00:00
'zroot': {
'compression': 'lz4',
'relatime': 'on',
'xattr': 'sa',
'primarycache': 'metadata'
# encryption is enabled, too.
},
2022-03-09 12:07:55 +00:00
'zroot/system/journal': {
'mountpoint': '/var/log/journal',
'acltype': 'posix',
},
'zroot/system/root': {
'canmount': 'noauto',
'mountpoint': '/',
},
'zroot/user/fkunsmann': {
'mountpoint': '/home/fkunsmann',
},
},
'snapshots': {
'retain_per_dataset': {
'zroot/user/fkunsmann': {
# juuuuuuuust to be sure
'hourly': 100,
},
},
'snapshot_never': {
'zroot/system/journal',
},
},
},
},
'os': 'arch',
}