Move out Renard configuration as Renne

Signed-off-by: Mel <mel@rnrd.eu>

7 files changed, 176 insertions, 1 deletions

diff --git a/flake.nix b/flake.nix
index ac30df6..c5489eb 100644
--- a/flake.nix
+++ b/flake.nix
@@ -72,7 +72,8 @@
     machines = with systems; mkMachines [
       { name = "corsac"; system = x86; tailscale.ip = "100.64.100.100"; }
       { name = "lapin"; system = arm; tailscale.ip = "100.83.254.27"; }
-      { name = "renard"; system = x86; tailscale.ip = "100.75.17.75"; }
+      { name = "renard"; system = x86; tailscale.ip = "100.123.100.75"; }
+      { name = "renne"; system = x86; tailscale.ip = "100.75.17.75"; }
       { name = "loup"; system = x86; tailscale.ip = "100.70.108.22"; }
       { name = "fourmi"; system = arm; tailscale.ip = "100.99.119.83"; }
       { name = "taupe"; system = arm; tailscale.ip = "100.103.211.75"; }
diff --git a/machines/renne/default.nix b/machines/renne/default.nix
new file mode 100644
index 0000000..8473613
--- /dev/null
+++ b/machines/renne/default.nix
@@ -0,0 +1,109 @@
+{ me, machines, ... }:
+
+{
+  imports = [
+    ../../modules/common.nix
+
+    ./hardware.nix
+    ./devices.nix
+
+    ../../services/minecraft.nix
+  ];
+
+  foundation = {
+    www = {
+      enable = true;
+
+      public = true;
+      tailnet = true;
+    };
+
+    monitoring = {
+      client.enable = true;
+
+      services = [
+        "base"
+        "tailnet"
+        "mel"
+        "shorest"
+      ];
+    };
+  };
+
+  services.nginx.virtualHosts = {
+    base.locations = {
+      "/stuff/" = {
+        alias = "/var/www/html/";
+      };
+
+      # redirect to akkoma on lapin
+      "/.well-known/webfinger" = {
+        return = "301 https://soc.rnrd.eu$request_uri";
+      };
+
+      # delegate matrix to subdomain `matrix.rnrd.eu`
+      "/.well-known/matrix/server" = {
+        return = "200 '{ \"m.server\": \"matrix.rnrd.eu:443\" }'";
+        extraConfig = ''
+          default_type application/json;
+        '';
+      };
+      "/.well-known/matrix/client" = {
+        return = ''
+          200 '{
+            "m.homeserver": {
+              "base_url": "https://matrix.rnrd.eu/"
+            },
+            "org.matrix.msc3575.proxy": {
+              "url": "https://matrix.rnrd.eu/"
+            }
+          }'
+        '';
+        extraConfig = ''
+          default_type application/json;
+          add_header "Access-Control-Allow-Origin" *;
+        '';
+      };
+    };
+
+    "sho.rest" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:5000";
+      };
+      extraConfig = ''
+        access_log /var/log/nginx/shorest.access.log json_combined;
+      '';
+    };
+
+    "mel.gg" = {
+      enableACME = true;
+      forceSSL = true;
+      root = "/srv/mel";
+      extraConfig = ''
+        access_log /var/log/nginx/mel.access.log json_combined;
+      '';
+    };
+
+    "catskill.dev" = {
+      enableACME = true;
+      forceSSL = true;
+      root = "/srv/catskill";
+      extraConfig = ''
+        access_log /var/log/nginx/catskill.access.log json_combined;
+      '';
+    };
+
+    "moth.run" = {
+      enableACME = true;
+      forceSSL = true;
+      root = "/srv/moth";
+      extraConfig = ''
+        access_log /var/log/nginx/moth.access.log json_combined;
+      '';
+    };
+  };
+
+  system.stateVersion = "24.05";
+}
diff --git a/machines/renne/devices.nix b/machines/renne/devices.nix
new file mode 100644
index 0000000..d952488
--- /dev/null
+++ b/machines/renne/devices.nix
@@ -0,0 +1,27 @@
+{ config, pkgs, ... }:
+
+{
+  boot.initrd = {
+    availableKernelModules = [ "virtio_pci" "virtio_scsi" ];
+    kernelModules = [ "dm-snapshot" ];
+  };
+
+  boot.loader.grub = {
+    enable = true;
+    device = "/dev/sda";
+  };
+
+  zramSwap = {
+    enable = true;
+    algorithm = "zstd";
+    swapDevices = 1;
+    memoryPercent = 50;
+  };
+
+  systemd.network.networks."10-wan" = {
+    name = "ens18";
+    DHCP = "ipv4";
+    address = [ "2a02:c207:2042:1313::1" ];
+    routes = [ { Gateway = "fe80::1"; } ];
+  };
+}
diff --git a/machines/renne/hardware.nix b/machines/renne/hardware.nix
new file mode 100644
index 0000000..f7d1d6b
--- /dev/null
+++ b/machines/renne/hardware.nix
@@ -0,0 +1,23 @@
+# Do not modify this file!  It was generated by ‘nixos-generate-config’
+# and may be overwritten by future invocations.  Please make changes
+# to /etc/nixos/configuration.nix instead.
+{ config, lib, pkgs, modulesPath, ... }:
+
+{
+  imports =
+    [ (modulesPath + "/profiles/qemu-guest.nix")
+    ];
+
+  boot.initrd.availableKernelModules = [ "ata_piix" "uhci_hcd" "virtio_pci" "virtio_scsi" "sd_mod" ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" =
+    { device = "/dev/disk/by-uuid/258bcc4c-22a7-4c4c-a264-568b7194dffc";
+      fsType = "ext4";
+    };
+
+  swapDevices = [ ];
+
+}
diff --git a/machines/renne/home.nix b/machines/renne/home.nix
new file mode 100644
index 0000000..dce0783
--- /dev/null
+++ b/machines/renne/home.nix
@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+
+{
+  imports = [
+    ../../modules/home/common.nix
+  ];
+
+  home.stateVersion = "24.05";
+}
diff --git a/secrets/keys.nix b/secrets/keys.nix
index 5786879..a720d74 100644
--- a/secrets/keys.nix
+++ b/secrets/keys.nix
@@ -1,6 +1,11 @@
 let
   machines = {
     renard = {
+      user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILb8Mp1GCV2nD/VbIusgOKAlx7CzB6stvnz7RTnE0DS5";
+      system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEJUlOFCmrscfstDFL1QOP2mp70T/maqZhtAzfOONmX8";
+    };
+
+    renne = {
       user = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINs2TTjnQvDNr/S3lPLWYOnZi00YIMrRUDH8cpBz1k1m";
       system = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ/qDL7+86+0H6NkPs/w4GYiWQwT/4YAx9O2J7sLkKmf";
     };
diff --git a/secrets/secrets.nix b/secrets/secrets.nix
index 24a4abb..8b3e165 100644
--- a/secrets/secrets.nix
+++ b/secrets/secrets.nix
@@ -4,6 +4,7 @@ let
   inherit (keys) allAdmins allSystems;
   inherit (keys.system)
     renard
+    renne
     lapin
     corsac
     fourmi