Heimdall is now a VM on Hetzner Cloud running headscale

machines/heimdall/configuration.nix

@@ -1,99 +1,76 @@
 { self, ... } @ inputs:
-{ modulesPath, ... }:
+{ modulesPath, lib, ... }:
-let
+# let
-  pkgs = self.inputs.nixpkgs.legacyPackages.x86_64-linux;
+#   pkgs = self.inputs.nixpkgs.legacyPackages.x86_64-linux;
-in
+# in
 {
   imports = [
-    "${modulesPath}/virtualisation/proxmox-lxc.nix"
+    "${modulesPath}/profiles/qemu-guest.nix"
 
     ../../users/root
     ../../users/erwin
   ];
 
   eboskma = {
-    users.erwin.enable = true;
+    users.erwin = {
+      enable = true;
+      server = true;
+    };
+    headscale = {
+      enable = true;
+      baseDomain = "asgard.datarift.nl";
+      serverUrl = "https://heimdall.datarift.nl";
+    };
     nix-common = {
       enable = true;
-      remote-builders = true;
     };
   };
 
-  proxmoxLXC = {
-    privileged = true;
-  };
-
   networking = {
-    # hostName = "heimdall";
+    hostName = "heimdall";
-    # useDHCP = false;
+    domain = "datarift.nl";
 
-    nat = {
+    nameservers = [ "8.8.8.8" ];
-      enable = true;
+    defaultGateway = "172.31.1.1";
-      externalInterface = "br0";
+    defaultGateway6 = {
-      internalInterfaces = [ "wg0" ];
+      address = "fe80::1";
+      interface = "eth0";
     };
-
+    dhcpcd.enable = false;
+    usePredictableInterfaceNames = lib.mkForce false;
     interfaces = {
-      br0 = {
+      eth0 = {
-        ipv4.addresses = [{ address = "10.0.0.250"; prefixLength = 24; }];
+        ipv4.addresses = [
+          { address = "159.69.211.175"; prefixLength = 32; }
+        ];
+        ipv6.addresses = [
+          { address = "2a01:4f8:1c1e:5fb2::1"; prefixLength = 64; }
+          { address = "fe80::9400:2ff:fe12:a2eb"; prefixLength = 64; }
+        ];
+        ipv4.routes = [{ address = "172.31.1.1"; prefixLength = 32; }];
+        ipv6.routes = [{ address = "fe80::1"; prefixLength = 128; }];
       };
+
     };
+  };
+  services.udev.extraRules = ''
+    ATTR{address}=="96:00:02:12:a2:eb", NAME="eth0"
+  '';
 
-    # firewall.trustedInterfaces = [ "eth1" ];
+  ### Hetzner stuff
-
+  boot = {
-    bridges = {
+    cleanTmpDir = true;
-      br0 = {
+    loader.grub.device = "/dev/sda";
-        interfaces = [ "eth0" ];
+    initrd = {
-        rstp = true;
+      availableKernelModules = [ "ata_piix" "uhci_hcd" "xen_blkfront" "vmw_pvscsi" ];
-      };
+      kernelModules = [ "nvme" ];
-    };
-
-    # defaultGateway = {
-    #   address = "10.2.0.1";
-    #   interface = "eth1";
-    # };
-    nameservers = [ "10.0.0.254" ];
-
-    wireguard.interfaces = {
-      wg0 = {
-        ips = [ "10.1.0.0/24" ];
-        listenPort = 51820;
-        privateKeyFile = "/run/secrets/wireguard_key";
-        postSetup = [
-          "${pkgs.iptables}/bin/iptables -A FORWARD -i %i -j ACCEPT"
-          "${pkgs.iptables}/bin/iptables -A FORWARD -o %i -j ACCEPT"
-          "${pkgs.iptables}/bin/iptables -t nat -A POSTROUTING -o br0 -j MASQUERADE"
-        ];
-        postShutdown = [
-          "${pkgs.iptables}/bin/iptables -D FORWARD -i %i -j ACCEPT"
-          "${pkgs.iptables}/bin/iptables -D FORWARD -o %i -j ACCEPT"
-          "${pkgs.iptables}/bin/iptables -t nat -D POSTROUTING -o br0 -j MASQUERADE"
-        ];
-        peers = [
-          # horus
-          # {
-          #   publicKey = "";
-          #   persistentKeepalive = 25;
-          #   allowedIPs = [
-          #     "10.1.0.0/24"
-          #     "10.0.0.0/24"
-          #   ];
-          # }
-          # iphone
-          {
-            publicKey = "SlJSLRMaqoujNsTkzQRZlNLBGB0Q/tt3b8KijFEaH2s=";
-            persistentKeepalive = 25;
-            allowedIPs = [
-              "10.1.0.0/24"
-              "10.0.0.0/24"
-            ];
-          }
-        ];
-      };
     };
   };
 
-  boot.isContainer = true;
+  fileSystems."/" = { device = "/dev/sda1"; fsType = "ext4"; };
+
+  zramSwap.enable = true;
+  ### END Hetzner stuff
 
   time.timeZone = "Europe/Amsterdam";
 
@@ -101,10 +78,10 @@ in
 
   services.openssh.enable = true;
 
-  sops.defaultSopsFile = ./secrets.yaml;
+  # sops.defaultSopsFile = ./secrets.yaml;
-  sops.secrets = {
+  # sops.secrets = {
-    wireguard_key = { };
+  #   wireguard_key = { };
-  };
+  # };
 
-  system.stateVersion = "22.05";
+  system.stateVersion = "23.05";
 }

modules/headscale/default.nix

@@ -0,0 +1,63 @@
+{ pkgs, config, lib, ... }:
+with lib;
+let
+  cfg = config.eboskma.headscale;
+in
+{
+  options.eboskma.headscale = {
+    enable = mkEnableOption "headscale";
+    serverUrl = mkOption {
+      description = "Server URL";
+      type = types.str;
+    };
+    baseDomain = mkOption {
+      description = "Tailscale MagicDNS base domain";
+      type = types.str;
+      default = null;
+    };
+  };
+
+  config = mkIf cfg.enable {
+    services.headscale = {
+      enable = true;
+      settings = {
+        dns_config = {
+          override_local_dns = true;
+          base_domain = cfg.baseDomain;
+          nameservers = [
+            "1.1.1.1"
+          ];
+        };
+
+        server_url = cfg.serverUrl;
+
+        ip_prefixes = [
+          "fd7a:115c:a1e0::/48"
+          "100.64.0.0/10"
+        ];
+      };
+    };
+
+    services.caddy = {
+      enable = true;
+
+      email = "erwin@datarift.nl";
+
+      virtualHosts = {
+        "${cfg.serverUrl}" = {
+          extraConfig = ''
+            reverse_proxy localhost:8080
+          '';
+        };
+      };
+    };
+
+    security.acme.acceptTerms = true;
+
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+    environment.systemPackages = [ pkgs.headscale ];
+
+    users.users.${config.eboskma.var.mainUser}.extraGroups = [ "headscale" ];
+  };
+}

users/erwin/server.nix

@@ -0,0 +1,60 @@
+{ pkgs, config, lib, inputs, ... }:
+with lib;
+let
+  cfg = config.eboskma.users.erwin;
+in
+{
+  config = mkIf cfg.server {
+    home-manager.users.erwin = {
+      _module.args.flake-inputs = inputs;
+
+      programs.home-manager.enable = true;
+      programs.command-not-found.enable = true;
+
+      home.username = "erwin";
+      home.homeDirectory = "/home/erwin";
+
+      nixpkgs.config.allowUnfree = true;
+
+      home.stateVersion = "23.05";
+
+      eboskma = {
+        programs = {
+          bat.enable = true;
+          git = {
+            enable = true;
+            name = "Erwin Boskma";
+            email = "erwin@datarift.nl";
+          };
+          neovim.enable = true;
+          nushell.enable = true;
+          ssh.enable = true;
+          starship.enable = true;
+        };
+      };
+
+      home.packages = with pkgs; [
+        atool
+        bottom
+        btop
+        fd
+        git
+        iotop
+        procs
+        ripgrep
+        units
+      ];
+
+      xdg = {
+        enable = true;
+      };
+
+      imports = [
+        ../../modules/options
+      ] ++ (map (mod: (../../home-manager/modules + "/${mod}")) (builtins.attrNames (builtins.readDir ../../home-manager/modules)));
+
+    };
+    programs.bandwhich.enable = true;
+
+  };
+}