Moved bind into microvm (#48)

dd-ix · Jan 13, 2024 · 6a3b2a1 · 6a3b2a1
1 parent 3c32dc2
commit 6a3b2a1
Show file tree

Hide file tree

Showing 9 changed files with 146 additions and 18 deletions.
diff --git a/flake.lock b/flake.lock
diff --git a/flake.nix b/flake.nix
@@ -4,6 +4,17 @@
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-23.11";
 
+    sops-nix = {
+      url = "github:mic92/sops-nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+      inputs.nixpkgs-stable.follows = "nixpkgs";
+    };
+
+    microvm = {
+      url = "github:astro/microvm.nix";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
+
     presence = {
       url = "github:dd-ix/presence";
       inputs.nixpkgs.follows = "nixpkgs";
@@ -19,19 +30,13 @@
       flake = false;
     };
 
-    sops-nix = {
-      url = "github:mic92/sops-nix";
-      inputs.nixpkgs.follows = "nixpkgs";
-      inputs.nixpkgs-stable.follows = "nixpkgs";
-    };
-
     keycloak-theme = {
       url = "github:dd-ix/keycloak-theme";
       flake = false;
     };
   };
 
-  outputs = inputs@{ self, nixpkgs, foundation, presence, website-content, sops-nix, keycloak-theme }: {
+  outputs = inputs@{ self, nixpkgs, sops-nix, microvm, foundation, presence, website-content, keycloak-theme }: {
     nixosConfigurations =
       let
         overlays = [
@@ -45,6 +50,7 @@
 
         nixos-modules = [
           sops-nix.nixosModules.default
+          microvm.nixosModules.host
           presence.nixosModules.default
           foundation.nixosModules.default
         ];
@@ -66,6 +72,15 @@
             }
           ] ++ nixos-modules;
         };
+        ns-mno001 = nixpkgs.lib.nixosSystem {
+          system = "x86_64-linux";
+          specialArgs = { inherit inputs self; };
+          modules = [
+            microvm.nixosModules.microvm
+            ./hosts/ns-mno001/default.nix
+            ./modules/dd-ix
+          ];
+        };
       };
   };
 }
diff --git a/hosts/mno001/network.nix b/hosts/mno001/network.nix
@@ -63,11 +63,9 @@ in
     networks."10-uplink" = {
       matchConfig.Name = "uplink";
 
-      address = [ "212.111.245.178/29" "212.111.245.179/29" ];
+      address = [ "212.111.245.178/29" ];
       routes = [
-        {
-          routeConfig.Gateway = "212.111.245.177";
-        }
+        { routeConfig.Gateway = "212.111.245.177"; }
       ];
 
       vlan = [ "uplink" ];
@@ -90,6 +88,11 @@ in
         Bond = "${bond_device_name}"; # Enslaving to bond
       };
     };
+
+    networks."11-microvm-inet" = {
+      matchConfig.Name = "vm-inet-*";
+      vlan = [ "uplink" ];
+    };
   };
 
   # enabling and configuring firewall

diff --git a/hosts/ns-mno001/configuration.nix b/hosts/ns-mno001/configuration.nix
@@ -0,0 +1,34 @@
+{ ... }:
+let
+  mac = "a2:18:9f:dc:4d:16";
+in
+{
+  microvm = {
+    hypervisor = "cloud-hypervisor";
+    mem = 2048;
+    vcpu = 2;
+
+    interfaces = [{
+      type = "tap";
+      id = "vm-inet-ns";
+      mac = mac;
+    }];
+  };
+
+  systemd.network.networks = {
+    "10-lan" = {
+      matchConfig.MACAddress = mac;
+      addresses = [
+        { addressConfig.Address = "212.111.245.179/29"; }
+        { addressConfig.Address = "2a01:7700:80b0:6000::53/64"; }
+      ];
+      routes = [
+        { routeConfig.Gateway = "212.111.245.177/29"; }
+        { routeConfig.Gateway = "fe80::defa/64"; }
+      ];
+      linkConfig.RequiredForOnline = "routable";
+    };
+  };
+
+  system.stateVersion = "23.11";
+}
diff --git a/hosts/ns-mno001/default.nix b/hosts/ns-mno001/default.nix
@@ -0,0 +1,6 @@
+{ ... }: {
+  imports = [
+    ./configuration.nix
+    ../../modules/management/bind.nix
+  ];
+}
diff --git a/modules/management/bind9.nix → modules/management/bind.nix b/modules/management/bind9.nix → modules/management/bind.nix
@@ -54,9 +54,6 @@ in
 
       # track stats on zones
       zone-statistics yes;
-
-      # send notifies from correct source addr
-      notify-source 212.111.245.179;
     '';
   };
 }
diff --git a/modules/management/default.nix b/modules/management/default.nix
@@ -6,7 +6,6 @@
     ./keycloak.nix
     ./netbox.nix
     ./listmonk.nix
-    ./bind9.nix
     ./vaultwarden.nix
     ./bookstack.nix
     ./zammad.nix

diff --git a/resources/0.b.0.8.0.0.7.7.1.0.a.2.ip6.arpa.zone b/resources/0.b.0.8.0.0.7.7.1.0.a.2.ip6.arpa.zone
@@ -4,7 +4,7 @@
 $TTL    1h         ; default TTL for zone
 
 @    SOA  ns.dd-ix.net.  noc.dd-ix.net.  (
-        2024011300  ; Serial
+        2024011301  ; Serial
         7200        ; Refresh
         3600        ; Retry
         1209600     ; Expire
@@ -30,6 +30,7 @@ a.f.e.d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.4 PTR  gw-v601.dd-ix.net.
 ;; PTR SVC Public Services
 a.f.e.d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.6  PTR  gw-v100.dd-ix.net.
 a.f.e.d.0.0.0.0.0.0.0.0.0.0.0.0.1.0.0.6  PTR  gw-v101.dd-ix.net.
+3.5.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.6  PTR  ns.dd-ix.net.
 
 ;; PTR SVC Internal Services
 a.f.e.d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.7  PTR  gw-v102.dd-ix.net.

diff --git a/resources/dd-ix.net.zone b/resources/dd-ix.net.zone
@@ -4,7 +4,7 @@
 $TTL    1h         ; default TTL for zone
 
 @        SOA  ns.dd-ix.net.  noc.dd-ix.net.  (
-              2024011300  ; Serial
+              2024011301  ; Serial
               7200        ; Refresh
               3600        ; Retry
               1209600     ; Expire
@@ -38,6 +38,7 @@ mno01    A      212.111.245.178
 ;; Services
 rpx      A      212.111.245.178
 ns       A      212.111.245.179
+         AAAA   2a01:7700:80b0:6000::53 
 wg       CNAME  fw01