Something went wrong. Try again.
Tangled infrastructure definitions in Nix
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321{ description = "nix infra for tangled";
inputs = { nixpkgs.url = "github:nixos/nixpkgs/nixos-25.11"; tangled.url = "git+https://knot1.tangled.sh/tangled.org/core"; tangled-svfe.url = "git+https://tangled.org/tangled.org/core?ref=sv-fe"; tangled-lexicons = { url = "git+https://tangled.org/tangled.org/core?ref=sv-fe"; flake = false; }; hydrant = { url = "git+https://tangled.org/ptr.pet/hydrant"; flake = false; }; hydrant-fork = { url = "git+https://tangled.org/boltless.me/hydrant?ref=patch"; flake = false; }; microcosm-rs = { url = "git+https://knot1.tangled.sh/boltless.me/microcosm-rs?ref=nix-vendor-fjall"; flake = false; }; tangled-ozone.url = "git+https://tangled.org/oppi.li/ozone?ref=customized"; tranquil-mock-pds.url = "git+https://tangled.org/boltless.me/tranquil-pds?ref=liar"; tranquil-org-pds.url = "git+https://tangled.org/oppi.li/tranquil-pds?ref=op/vynuyrksymxl"; colmena.url = "github:zhaofengli/colmena/release-0.4.x"; cloudflare-ips-v4 = { url = "file+https://www.cloudflare.com/ips-v4"; flake = false; }; cloudflare-ips-v6 = { url = "file+https://www.cloudflare.com/ips-v6"; flake = false; }; # Aggregated prefix lists for the clouds hosting the scraper fleet. # AS45102 = Alibaba (hosting, announces both 8.208/12 and 47.80/13); # AS132203 = Tencent. Deliberately *not* AS37963 (Alibaba China): it # announces 9.4M addresses and none of the observed traffic. # Refresh with `nix flake update asn-alibaba asn-tencent`. asn-alibaba = { url = "file+https://raw.githubusercontent.com/ipverse/asn-ip/9ded4fded5a63e5c49c43dfbe56461633e879254/as/45102/aggregated.json"; flake = false; }; asn-tencent = { url = "file+https://raw.githubusercontent.com/ipverse/asn-ip/9ded4fded5a63e5c49c43dfbe56461633e879254/as/132203/aggregated.json"; flake = false; }; disko = { url = "github:nix-community/disko"; inputs.nixpkgs.follows = "nixpkgs"; }; nixery-flake = { type = "github"; owner = "tazjin"; repo = "nixery"; flake = false; }; atlogin.url = "git+https://tangled.org/anirudh.fi/atlogin?rev=6fb1a6799585acbc26399ed821fca44abf12466d"; };
outputs = { nixpkgs, disko, colmena, cloudflare-ips-v4, cloudflare-ips-v6, asn-alibaba, asn-tencent, nixery-flake, tangled, tangled-svfe, tangled-lexicons, hydrant, hydrant-fork, microcosm-rs, atlogin, tangled-ozone, tranquil-mock-pds, tranquil-org-pds, ... }: let lib = nixpkgs.lib; system = "x86_64-linux"; supportedSystems = ["x86_64-linux" "x86_64-darwin" "aarch64-linux" "aarch64-darwin"]; forAllSystems = lib.genAttrs supportedSystems; nixpkgsFor = forAllSystems (system: nixpkgs.legacyPackages.${system}); commonArgs = import ./common/ssh.nix; cloudflareRanges = lib.filter (line: line != "") (lib.concatMap (input: lib.splitString "\n" (builtins.readFile input.outPath)) [cloudflare-ips-v4 cloudflare-ips-v6]); scraperAsnRanges = lib.concatMap (input: (builtins.fromJSON (builtins.readFile input.outPath)).prefixes.ipv4) [asn-alibaba asn-tencent];
baseModules = [ disko.nixosModules.disko ./common/base.nix ./common/nginx.nix ./common/tailscale.nix ];
mkHost = hostname: extraModules: lib.nixosSystem { inherit system; specialArgs = { inherit commonArgs cloudflareRanges scraperAsnRanges; hydrant-src = hydrant; microcosm-src = microcosm-rs; tangled-lexicons-src = tangled-lexicons; nixery-pkgs = import nixery-flake.outPath { pkgs = import nixpkgs {inherit system;}; }; tangled-pkgs = tangled.packages.x86_64-linux; tangled-svfe-pkgs = tangled-svfe.packages.x86_64-linux; } // (hosts.${hostname}.specialArgs or {}); modules = baseModules ++ [./hosts/${hostname}/configuration.nix] ++ extraModules; };
mkColmenaHost = hostname: targetHost: targetPort: extraModules: { deployment = { inherit targetHost targetPort; targetUser = "tangler"; buildOnTarget = true; }; nixpkgs.system = system; time.timeZone = "Europe/Helsinki"; imports = baseModules ++ [./hosts/${hostname}/configuration.nix] ++ extraModules; };
hosts = { appview = { modules = [ tangled.nixosModules.appview ./hosts/appview/services/appview.nix ./hosts/appview/services/nginx.nix ./hosts/appview/services/litestream.nix ]; target = "95.111.205.38"; port = 2222; };
hyd-eu-1 = { modules = [./modules/hyd-node]; target = "46.224.9.195"; };
mock-eu-1 = { modules = [ ./modules/hyd-node/hydrant.nix tranquil-mock-pds.nixosModules.tranquil-pds ./hosts/mock-eu-1/services/mock-pds.nix ./hosts/mock-eu-1/services/nginx.nix ]; specialArgs.hydrant-src = hydrant-fork; target = "35.228.210.244"; };
pds = { modules = [ ./hosts/pds/services/nginx.nix ./hosts/pds/services/pds.nix ./hosts/pds/services/pocket.nix ]; target = "tngl.sh"; };
nixery = { modules = [ tangled.nixosModules.spindle ./hosts/nixery/services/nginx.nix ./hosts/nixery/services/openbao/openbao.nix ./hosts/nixery/services/openbao/proxy.nix ./hosts/nixery/services/nixery.nix ]; target = "nixery.tangled.sh"; };
spindle = { modules = [ tangled.nixosModules.spindle ./hosts/spindle/services/openbao/openbao.nix ./hosts/spindle/services/openbao/proxy.nix ./hosts/spindle/services/spindle.nix ./hosts/spindle/services/nginx.nix ]; target = "spindle.alpha.tangled.sh"; };
spindle-hel = { modules = [ tangled-svfe.nixosModules.spindle ./hosts/spindle-hel/services/openbao/openbao.nix ./hosts/spindle-hel/services/openbao/proxy.nix ./hosts/spindle-hel/services/spindle.nix ./hosts/spindle-hel/services/cache.nix ./hosts/spindle-hel/services/nginx.nix ]; target = "135.181.240.228"; port = 2222; };
prometheus-hel = { modules = [ ./hosts/prometheus-hel/services/prometheus.nix ]; target = "62.238.19.177"; };
sandbox-hel = { modules = [ tangled-svfe.nixosModules.deliberi ./hosts/sandbox-hel/services/deliberi.nix ./hosts/sandbox-hel/services/nginx.nix ]; target = "95.216.140.191"; };
ozone-hel = { modules = [ tangled-ozone.nixosModules.ozone ./hosts/ozone-hel/services/ozone.nix ./hosts/ozone-hel/services/nginx.nix ]; target = "62.238.114.62"; };
tranquil-nbg = { modules = [ tranquil-org-pds.nixosModules.default ./hosts/tranquil-nbg/services/tranquil-pds.nix ./hosts/tranquil-nbg/services/nginx.nix ]; target = "2.28.48.178"; };
knot1 = { modules = [ tangled-svfe.nixosModules.knot-rs ./hosts/knot1/services/knot2.nix ./hosts/knot1/services/nginx.nix ./hosts/knot1/services/ssh.nix ]; target = "85.9.211.103"; port = 2222; };
mirror-fsn = { modules = [ tangled-svfe.nixosModules.knotmirror tangled-svfe.nixosModules.zoekt-tnglserver atlogin.nixosModules.default ./hosts/mirror-fsn/services/knotmirror.nix ./hosts/mirror-fsn/services/nginx.nix ./hosts/mirror-fsn/services/atlogin.nix ./hosts/mirror-fsn/services/zoekt.nix ]; target = "136.243.149.102"; }; }; in { nixosConfigurations = lib.mapAttrs (name: host: mkHost name host.modules) hosts;
colmenaHive = colmena.lib.makeHive ( { meta = { nixpkgs = nixpkgs.legacyPackages.${system}; specialArgs = { inherit commonArgs cloudflareRanges scraperAsnRanges; hydrant-src = hydrant; microcosm-src = microcosm-rs; tangled-lexicons-src = tangled-lexicons; nixery-pkgs = import nixery-flake.outPath { pkgs = import nixpkgs {inherit system;}; }; tangled-pkgs = tangled.packages.x86_64-linux; tangled-svfe-pkgs = tangled-svfe.packages.x86_64-linux; }; nodeSpecialArgs = lib.mapAttrs (_: host: host.specialArgs or {}) hosts; }; } // lib.mapAttrs (name: host: mkColmenaHost name host.target (host.port or 22) host.modules) hosts ); apps = lib.genAttrs ["x86_64-darwin" "aarch64-darwin"] (system: let pkgs = import nixpkgs { inherit system; config.allowUnfreePredicate = pkg: builtins.elem (lib.getName pkg) ["terraform"]; }; # deploy-gcp.nu shells out to all of these deploy-gcp = pkgs.writeShellScriptBin "deploy-gcp" '' export PATH="${lib.makeBinPath [ pkgs.nushell pkgs.google-cloud-sdk pkgs.terraform pkgs.git pkgs.jujutsu pkgs.openssh pkgs.curl ]}:$PATH" exec ${pkgs.nushell}/bin/nu ${./deploy-gcp.nu} "$@" ''; in { deploy-gcp = { type = "app"; program = "${deploy-gcp}/bin/deploy-gcp"; }; });
formatter = forAllSystems (system: nixpkgsFor.${system}.alejandra);
};}