infrastructure

commit 08519b3777c3f9d5263c1c32b27a0f68032941c5
parent 5128e59b3f90b18119cc55e8a532b85bc0a2b2f1
Author: Silas Brack <silasbrack@gmail.com>
Date:   Fri,  4 Oct 2024 07:40:46 +0200

Add working systemd service example

Diffstat:
M
apps/my-app/default.nix
 | 
28
++++++++++++++++++++++++++++
M
infrastructure/README.md
 | 
60
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2 files changed, 88 insertions(+), 0 deletions(-)
diff --git a/apps/my-app/default.nix b/apps/my-app/default.nix
@@ -50,6 +50,34 @@ in {
       ];
     };
 
+    # systemd.services.pokemon-app = {
+    #   wantedBy = [ "multi-user.target" ];
+    #   description = "Start my app server.";
+    #   after = [ "network.target" ];
+    #   serviceConfig = {
+    #     Type = "simple";
+    #     User = "silas";
+    #     # WorkingDirectory = "/home/silas/dev/044-lustre-ssr/";
+    #     # ExecStart = "/home/silas/dev/044-lustre-ssr/prod.sh";
+    #     # Restart = "always";
+    #     # KillMode = "process";
+    #   };
+    #   path = [ pkgs.gleam pkgs.erlang_27 pkgs.rebar3 ];
+    #   script = ''
+    #     cd /home/silas/dev/044-lustre-ssr/
+    #     cd ./client
+    #     gleam clean
+    #     cd ../server
+    #     gleam clean
+    #     cd ../shared
+    #     gleam clean
+    #     cd ../client
+    #     gleam run -m lustre/dev build --outdir=../server/priv/static --minify
+    #     cd ../server
+    #     gleam run
+    #   '';
+    # };
+
     systemd.services = {
       # postgres-migration = {
       #   description = "Postgres migrations";
diff --git a/infrastructure/README.md b/infrastructure/README.md
@@ -9,3 +9,63 @@
 ├── shell.nix     <- Defines the development environment which can be accessed via `nix-shell`
 └── vpn.nix       <- Imported by hive.nix; configures the VPN setup
 ```
+
+## SOPS
+
+## Adding a New Key
+1. Run `sops secrets.yaml`
+2. Add a key-value pair to the file, e.g., `my_secret_key: iaj0t8r34u5r8924hrj2`
+3. Add the key definition to `hive.nix`, e.g., `sops.secrets.my_secret_key = {};`
+4. The secret can be accessed at the `/run/secrets/my_secret_key` file on the server
+
+## Adding a New Machine
+
+## Adding a New Machine to the VPN
+1. Generate a private Wireguard key with `wg genkey > ~/.wireguard.private`
+2. Generate a public Wireguard key with `wg pubkey < ~/.wireguard.private`
+3. Copy the value of the outputted public key, then add a new attribute set in `vpn.nix` under `peers`, i.e. (with `X` autoincrementing),
+
+    ```nix
+    {  # {{your device name}}
+      publicKey = "{{your public key}}";
+      allowedIPs = [ "10.100.0.{{X}}/32" ];
+    }
+    ```
+4. (Option A, if device is using NixOS) Add the following to your `configuration.nix`:
+
+    ```nix
+    networking.firewall = {
+      allowedUDPPorts = [ 10232 ];
+    };
+    networking.wg-quick.interfaces = {
+      wg0 = {
+        address = [ "10.100.0.{{X}}/24" ];
+        dns = [ "10.100.0.1" ];
+        listenPort = 10232;
+        # autostart = false;  # Optional, if you don't want the VPN to start automatically
+        privateKeyFile = "/home/silas/.wireguard.private";
+        peers = [
+          {
+            publicKey = "2jWfr5UmACvuS+0HOfSNgEUYqoqVNnfVDoaatmgEykw=";
+            allowedIPs = [ "0.0.0.0/0" ];
+            endpoint = "188.166.127.72:51820";
+            persistentKeepalive = 25;
+          }
+        ];
+      };
+    };
+    ```
+4. (Option B, if not using NixOS) Install Wireguard, then add the following to your Wireguard configuration:
+
+    ```
+    [Interface]
+    ListenPort = 10232
+    PrivateKey = {{your private key}}
+
+    [Peer]
+    PublicKey = 2jWfr5UmACvuS+0HOfSNgEUYqoqVNnfVDoaatmgEykw=
+    AllowedIPs = 0.0.0.0/0
+    Endpoint = 188.166.127.72:51820
+    PersistentKeepalive = 25
+    ```
+