From 87ead51331bc57326882055e1635a84c2d409af7 Mon Sep 17 00:00:00 2001
From: Ben Sima <ben@bsima.me>
Date: Fri, 20 Dec 2024 13:57:22 -0500
Subject: Create a bootstrap image for Digital Ocean droplets

I need a way to reliably get a NixOS VM provisioned in the cloud, and the
easiest way to do this is to create a qcow2 image, upload it to Digital Ocean,
and use that to start a droplet. This is very much a manual process, but that's
fine, I shouldn't need to do it very often (for now).
---
 Omni/Os/Base.nix | 35 +++++++++++++++++++++++++++++++++++
 Omni/Os/Boot.nix | 14 ++++++++++++++
 2 files changed, 49 insertions(+)
 create mode 100644 Omni/Os/Base.nix
 create mode 100644 Omni/Os/Boot.nix

(limited to 'Omni/Os')

diff --git a/Omni/Os/Base.nix b/Omni/Os/Base.nix
new file mode 100644
index 0000000..8e301e1
--- /dev/null
+++ b/Omni/Os/Base.nix
@@ -0,0 +1,35 @@
+{ config, ... }:
+
+# This module defines common default settings that all OS builds should include.
+
+let ports = import ../Cloud/Ports.nix;
+in {
+  boot.tmp.cleanOnBoot = true;
+  networking.firewall.allowPing = true;
+  nix.settings.substituters =
+    [ "https://cache.nixos.org" ]; # "ssh://dev.simatime.com" ];
+  nix.gc.automatic = true;
+  nix.gc.dates = "Sunday 02:15";
+  nix.optimise.automatic = true;
+  nix.optimise.dates = [ "Sunday 02:30" ];
+  nix.settings.extra-sandbox-paths = [ config.programs.ccache.cacheDir ];
+  nix.settings.trusted-users = [ "ben" ];
+  programs.ccache.enable = true;
+  programs.mosh.enable = true;
+  programs.mosh.withUtempter = true;
+  security.acme.defaults.email = "ben@bsima.me";
+  security.acme.acceptTerms = true;
+  security.sudo.wheelNeedsPassword = false;
+  services.clamav.daemon.enable = true; # security
+  services.clamav.updater.enable = true; # security
+  services.fail2ban.enable = true; # security
+  services.fail2ban.ignoreIP = [ ports.bensIp ]; # my home IP
+  services.fail2ban.maxretry = 10;
+  services.openssh.enable = true;
+  services.openssh.openFirewall = true;
+  services.openssh.settings.X11Forwarding = true;
+  services.openssh.settings.PasswordAuthentication = false;
+  services.openssh.settings.PermitRootLogin = "prohibit-password";
+  system.autoUpgrade.enable = false; # 'true' breaks our nixpkgs pin
+  zramSwap.enable = true;
+}
diff --git a/Omni/Os/Boot.nix b/Omni/Os/Boot.nix
new file mode 100644
index 0000000..c789d89
--- /dev/null
+++ b/Omni/Os/Boot.nix
@@ -0,0 +1,14 @@
+{ bild }:
+/* This target creates a qcow2 image of a barebones NixOS VM which should be used
+   to bootstrap a deployment target.
+
+   The workflow is like this:
+
+   - bild this, you get a qcow2 image
+   - go to https://cloud.digitalocean.com/images/custom_images
+   - upload the image
+   - start a new droplet with this image
+   - once fully provisioned and accessible via ssh, the new droplet can be a deploy
+     target for any other namespace
+*/
+bild.droplet { imports = [ ./Base.nix ../Users.nix ]; }
-- 
cgit v1.2.3