XVM to Hyades migration

Changes

7 changed files (+114/-198)

• .gitignore (new)
  • @@ -0,0 +1,1 @@
    + result
• README.md
  • @@ -1,9 +1,40 @@
    # nixos-config - My NixOS configuration files for my laptop and the server running this site. + My NixOS configuration files for my laptop and the microVM running this site. I generally try to keep these configs simple and pragmatic, so stuff like Home Manager, Firefox extensions, and other 3rd-party flakes are out-of-scope. Besides, I don't want to write hundreds of lines of Nix and spend all day Nixifying my entire setup. This repo is for machine-specific stuff. For my machine-independent configs, see [my dotfiles repo](/dotfiles). Another reason for this separation is so that I can just clone my dotfiles anywhere, not just on NixOS machines. I also made a [NixOS cheatsheet](https://forgejo.mit.edu/SIPB/nixos-cheatsheet/). - Run `NIX_SSHOPTS="-i ~/.ssh/xvm_ed25519" nixos-rebuild switch --target-host root@unnamed.website --flake .#Unnamed-Server` to remotely deploy the server. + Building the server OCI image: + + ```bash + nix build + # NOT the same thing as podman import + podman load < result + podman push forgejo.mit.edu/xy/nixos-config + ``` + + Hyades config: + + ```json + { + "image": "forgejo.mit.edu/xy/nixos-config", + "ports": { + "xy": 80 + }, + "volumes": { + "home": "/home/a", + "ssh-keys": "/etc/ssh/keys", + "srv": "/srv" + }, + "envs": { + "KRUN_INIT_PID1": "1" + }, + "network": "", + "after": [], + "exposeports": [ + 2222 + ] + } + ```
• Unnamed-Server/default.nix
  • @@ -6,72 +6,43 @@
    }: { - # Use lower IO priority for Nix so my server is still responsive while GCing - nix.daemonIOSchedClass = "idle"; - nixpkgs.hostPlatform = "x86_64-linux"; - # https://unnamed.website/posts/nixvm/ - disko.devices.disk.main = { - imageSize = "2000M"; - type = "disk"; - device = "/dev/xvda"; - content = { - type = "gpt"; - partitions = { - boot = { - size = "1M"; - type = "EF02"; - }; - root = { - size = "100%"; - content = { - type = "btrfs"; - subvolumes = { - "/".mountpoint = "/"; - "/home" = { }; - "/nix" = { }; - }; - }; - }; - }; - }; - }; - - # atime is an anti-feature and disabling it should boost perf on XVM - fileSystems."/".options = [ "noatime" ]; - - boot = { - # XVM only has BIOS not UEFI, so no systemd-boot 😭 - loader.grub.enable = true; - # Spooky Xen stuff - initrd.availableKernelModules = [ - "xen-blkfront" - "xen-netfront" + networking = { + # Podman doesn't let us set a hostname + # No need for a firewall when inside a network namespace on Hyades + firewall.enable = false; + # Disable dhcpcd which makes networking really slow + dhcpcd.enable = false; + # Hardcode the MIT nameservers + nameservers = [ + "18.0.70.160" + "18.0.72.3" + "18.0.71.151" ]; }; - networking.hostName = "Unnamed-Server"; - # The best time zone time.timeZone = "UTC"; users.users = { - # For doing updates root.openssh.authorizedKeys.keys = [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPWzNs8PdQKsgSADzbub2XfrZeIrF+jK7M4VMjuRmaIt anthonywang++" ]; - # For normal logins - a.openssh.authorizedKeys.keys = [ - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDLPakDnAelqFTUudQB8X0T7yc/8ekV3jGqpeJb062l anthonywang" - ]; + a = { + openssh.authorizedKeys.keys = [ + "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDLPakDnAelqFTUudQB8X0T7yc/8ekV3jGqpeJb062l anthonywang" + ]; + # krun virtiofs doesn't support ACLs so manually give myself permission to see the journal + extraGroups = [ "systemd-journal" ]; + }; }; - # It's possible to nuke Python by using fishMinimal and gitMinimal but eh it doesn't save that much space and is a hassle programs.tmux.enable = true; services.openssh = { enable = true; + ports = [ 2222 ]; settings = { # https://forgejo.org/docs/latest/admin/recommendations/#git-over-ssh # https://docs.gitlab.com/administration/git_protocol/
  • @@ -80,29 +51,23 @@
    # Don't hack me PasswordAuthentication = false; }; + # Put host keys in a volume instead + generateHostKeys = false; + extraConfig = '' + HostKey /etc/ssh/keys/ssh_host_rsa_key + HostKey /etc/ssh/keys/ssh_host_ed25519_key + ''; }; - # Keep the journal small - services.journald.extraConfig = "SystemMaxUse=1G"; - # My websites services.caddy = { enable = true; - openFirewall = true; - package = pkgs.caddy.withPlugins { - plugins = [ - "github.com/caddy-dns/porkbun@v0.3.1" - "dev.mediocregopher.com/mediocre-caddy-plugins.git@v0.0.0-20250308145011-421597d7c920" - ]; - hash = "sha256-Udje19JSqTeRh+In2ERthj28X2V05d6eYM7YbACryt0="; - }; - # Porkbun API keys - environmentFile = "/etc/caddy/env"; - # By default only errors are logged - logFormat = ""; - # Make Caddy log to stdout instead of to a log file - virtualHosts = builtins.mapAttrs (k: v: v // { logFormat = ""; }) { - "unnamed.website".extraConfig = '' + # TLS is handled by Hyades + globalConfig = '' + auto_https off + ''; + virtualHosts = { + "http://unnamed.website".extraConfig = '' root * /srv/http/www file_server handle_errors {
  • @@ -110,44 +75,21 @@
    file_server } ''; - "git.unnamed.website".extraConfig = '' - handle /robots.txt { - respond "User-agent: * - Disallow: /" - } - # Block scrapers but allow Git clones - @notgit { - # Due to arcane Caddy reasons this still triggers for /robots.txt unless we explicitly ignore it here - not path /robots.txt - not header User-Agent git* - } - proof_of_work @notgit { - # 1 year - challenge_timeout 8760h - } + "http://git.unnamed.website".extraConfig = '' reverse_proxy localhost:5555 ''; - "*.unnamed.website".extraConfig = '' - tls { - dns porkbun { - api_key {env.PORKBUN_API_KEY} - api_secret_key {env.PORKBUN_API_SECRET_KEY} - } - } + "http://*.unnamed.website".extraConfig = '' root * /srv/http/{labels.2} file_server ''; - "{$SECRET_DOMAIN}".extraConfig = '' - root * /srv/http/{$SECRET_PATH} - file_server - ''; - "a.exozy.me ta180m.exozy.me".extraConfig = '' + "http://a.exozy.me http://ta180m.exozy.me".extraConfig = '' redir https://unnamed.website{uri} permanent ''; }; }; # Git server + # It's possible to nuke Python by using fishMinimal and gitMinimal but eh it doesn't save that much space and is a hassle services.legit = { enable = true; config = {
  • @@ -184,19 +126,4 @@
    timerConfig.OnCalendar = "weekly"; }; }; - - # Back up /srv using btrfs snapshots and btrbk - services.btrbk = { - sshAccess = [ - { - key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINoXy/V1rfnAcBJyRMAsqygOAeSNwxf8+oYtWNnUs3Rf btrbk@ThinkPad-X1-Yoga-Gen-6"; - roles = [ - "source" - "info" - "send" - ]; - } - ]; - instances.btrbk.settings.volume."/".subvolume = "srv"; - }; }
• configuration.nix
  • @@ -6,6 +6,7 @@
    }: { + # We enable Nix on the microVM too for nix run and because it doesn't add much space nix = { # BAD NIX STORE STOP BEING 100GB # Don't run the optimiser automatically though, since it doesn't save that much space and messes up generation build dates
  • @@ -37,10 +38,6 @@
    tmp.useTmpfs = true; }; - # NixOS is a disk destroyer - # I NEED ZSTD - fileSystems."/".options = [ "compress=zstd" ]; - # Download more RAM zramSwap.enable = true;
  • @@ -50,7 +47,6 @@
    extraGroups = [ "wheel" ]; # I can't bash you know shell = pkgs.fish; - initialPassword = "change asap"; }; # Enable the boring stuff
  • @@ -64,28 +60,10 @@
    # Apparently hugo is mission-critical software now hugo micro - # Usually installed by default but not for my XVM server + # Usually installed by default but not on my microVM because of the docker-container profile rsync ]; - # It sync things I guess - services.syncthing = { - enable = true; - user = "a"; - group = "users"; - openDefaultPorts = true; - # The default when running Syncthing normally - configDir = "/home/a/.local/state/syncthing"; - }; - - # THE ONLY CORRECT BACKUP METHOD - services.btrbk.instances.btrbk.settings = { - timestamp_format = "short"; - snapshot_dir = "/.snapshots"; - snapshot_preserve = "3d 3w 3m *y"; - snapshot_preserve_min = "latest"; - }; - # BLAZINGLY FAST MEMORY SAFE security.sudo-rs.enable = true;
• flake.lock
  • @@ -1,26 +1,5 @@
    { "nodes": { - "disko": { - "inputs": { - "nixpkgs": [ - "nixpkgs" - ] - }, - "locked": { - "lastModified": 1768920986, - "narHash": "sha256-CNzzBsRhq7gg4BMBuTDObiWDH/rFYHEuDRVOwCcwXw4=", - "owner": "nix-community", - "repo": "disko", - "rev": "de5708739256238fb912c62f03988815db89ec9a", - "type": "github" - }, - "original": { - "owner": "nix-community", - "ref": "latest", - "repo": "disko", - "type": "github" - } - }, "legit": { "inputs": { "nixpkgs": [
  • @@ -28,11 +7,11 @@
    ] }, "locked": { - "lastModified": 1784969287, - "narHash": "sha256-TFwNUaLgxXjn65WqpmE21cagRwdeE2bNO+eO9Gg0JG8=", + "lastModified": 1785496917, + "narHash": "sha256-yU6Of7ZPgkEoXPR8QlPJhCexVlJrxMmc7QK0BIs5AHw=", "owner": "pocka", "repo": "legit", - "rev": "f483e5f03df08cbbb675620c7e4aeb3394826d97", + "rev": "8e0d9c4694b25533d3091535c75a210caf8ed645", "type": "github" }, "original": {
  • @@ -63,11 +42,11 @@
    }, "nixpkgs": { "locked": { - "lastModified": 1784796856, - "narHash": "sha256-wWFrV5/Qbm+lyt5x20E/bSbfJiGKMo4RCxZV8cl/WZI=", + "lastModified": 1785454630, + "narHash": "sha256-LQy14TZp77TwbQf40gg1V3jo8FwJG0jGDkAH+zRHqg8=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "e2587caef70cea85dd97d7daab492899902dbf5d", + "rev": "1559d3daa3ecc813a650b79375ea61b6741b8746", "type": "github" }, "original": {
  • @@ -79,7 +58,6 @@
    }, "root": { "inputs": { - "disko": "disko", "legit": "legit", "nixathena": "nixathena", "nixpkgs": "nixpkgs"
• flake.nix
  • @@ -1,13 +1,6 @@
    { inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; - # For building an image for XVM - # https://lantian.pub/en/article/modify-computer/nixos-low-ram-vps.lantian/ - # https://unnamed.website/posts/nixvm/ - disko = { - url = "github:nix-community/disko/latest"; - inputs.nixpkgs.follows = "nixpkgs"; - }; legit = { url = "github:pocka/legit"; inputs.nixpkgs.follows = "nixpkgs";
  • @@ -44,15 +37,26 @@
    }; Unnamed-Server = nixpkgs.lib.nixosSystem { modules = [ - "${nixpkgs}/nixos/modules/profiles/minimal.nix" + "${nixpkgs}/nixos/modules/profiles/docker-container.nix" ./configuration.nix ./Unnamed-Server - inputs.disko.nixosModules.default inputs.legit.nixosModules.default ]; }; }; - packages.${system}.image = self.nixosConfigurations.Unnamed-Server.config.system.build.diskoImages; + packages.${system}.default = pkgs.dockerTools.buildLayeredImage { + name = "forgejo.mit.edu/xy/nixos-config"; + tag = "latest"; + # Yeah just chuck the whole toplevel in there + contents = [ self.nixosConfigurations.Unnamed-Server.config.system.build.toplevel ]; + # This runs nixos/modules/system/boot/stage-2-init.sh + config.Entrypoint = [ "/init" ]; + # The toplevel has an /etc symlink so nuke it to get a writable /etc + extraCommands = '' + rm -f etc + mkdir etc + ''; + }; # I love autoformatters formatter.${system} = pkgs.nixfmt-tree; };
• laptop.nix
  • @@ -27,6 +27,10 @@ in
    efi.canTouchEfiVariables = true; }; + # NixOS is a disk destroyer + # I NEED ZSTD + fileSystems."/".options = [ "compress=zstd" ]; + # Need to manually run this command due to KDE Connect and MIT network wonkiness: # nmcli connection modify "MIT SECURE" +ipv4.routes "10.29.0.0/16 10.29.208.1" networking.networkmanager.enable = true;
  • @@ -247,34 +251,27 @@ in
    package = pkgs.ollama-vulkan; }; - # Back up local /home and Unnamed-Server's /srv using btrfs snapshots and btrbk - services.btrbk.instances.btrbk.settings.volume = { - "/".subvolume = "/home"; - "ssh://unnamed.website/" = { - ssh_user = "btrbk"; - subvolume = "srv"; - snapshot_dir = "/.snapshots"; - snapshot_preserve_min = "all"; - snapshot_create = "no"; - target = "/.snapshots"; - target_preserve = "3d 3w 3m *y"; - target_preserve_min = "latest"; - send_compressed_data = "yes"; - }; + # It sync things I guess + services.syncthing = { + enable = true; + user = "a"; + group = "users"; + openDefaultPorts = true; + # The default when running Syncthing normally + configDir = "/home/a/.local/state/syncthing"; }; - systemd.services.btrbk-btrbk.serviceConfig = { - # Wait for internet connectivity if we just booted up - # network-online.target only waits for nm-online -s -q which doesn't necessarily mean the network is up - ExecStartPre = "${pkgs.networkmanager}/bin/nm-online -q"; - # Make /.snapshots/srv point to latest - ExecStartPost = - # + makes this run as root instead of the btrbk user - "+" - + pkgs.writers.writeFish "symlink-latest-srv" '' - cd /.snapshots - ln -snf (ls | grep srv | tail -n1) srv - ''; + + # THE ONLY CORRECT BACKUP METHOD + services.btrbk.instances.btrbk.settings = { + timestamp_format = "short"; + snapshot_dir = "/.snapshots"; + snapshot_preserve = "3d 3w 3m *y"; + snapshot_preserve_min = "latest"; + volume."/".subvolume = "/home"; }; + # Wait for internet connectivity if we just booted up + # network-online.target only waits for nm-online -s -q which doesn't necessarily mean the network is up + systemd.services.btrbk-btrbk.serviceConfig.ExecStartPre = "${pkgs.networkmanager}/bin/nm-online -q"; # Add SSH key to agent during desktop login systemd.user.services.ssh-add = {