summaryrefslogtreecommitdiff
path: root/hosts/vidhar/network/dhcp
diff options
context:
space:
mode:
Diffstat (limited to 'hosts/vidhar/network/dhcp')
-rw-r--r--hosts/vidhar/network/dhcp/default.nix137
-rw-r--r--hosts/vidhar/network/dhcp/knot-tsig (renamed from hosts/vidhar/network/dhcp/knot-tsig.json.frag)18
2 files changed, 69 insertions, 86 deletions
diff --git a/hosts/vidhar/network/dhcp/default.nix b/hosts/vidhar/network/dhcp/default.nix
index 11460393..e4c3f16e 100644
--- a/hosts/vidhar/network/dhcp/default.nix
+++ b/hosts/vidhar/network/dhcp/default.nix
@@ -48,12 +48,12 @@ in {
48 }; 48 };
49 49
50 client-classes = [ 50 client-classes = [
51 { name = "ipxe-eostre"; 51 # { name = "ipxe-eostre";
52 test = "hexstring(pkt4.mac, ':') == '00:d8:61:79:c5:40' and option[77].hex == 'iPXE-yggdrasil'"; 52 # test = "hexstring(pkt4.mac, ':') == '00:d8:61:79:c5:40' and option[77].hex == 'iPXE-yggdrasil'";
53 next-server = tftpIp; 53 # next-server = tftpIp;
54 boot-file-name = "${nfsrootBaseUrl}/eostre.menu.ipxe"; 54 # boot-file-name = "${nfsrootBaseUrl}/eostre.menu.ipxe";
55 only-if-required = true; 55 # only-if-required = true;
56 } 56 # }
57 { name = "ipxe-yggdrasil"; 57 { name = "ipxe-yggdrasil";
58 test = "option[77].hex == 'iPXE-yggdrasil'"; 58 test = "option[77].hex == 'iPXE-yggdrasil'";
59 next-server = tftpIp; 59 next-server = tftpIp;
@@ -256,40 +256,27 @@ in {
256 } 256 }
257 ]; 257 ];
258 }; 258 };
259 tsig-keys = [
260 { name = "local_key";
261 algorithm = "HMAC-SHA256";
262 secret-file = "/run/credentials/kea-dhcp-ddns-server.service/local_key";
263 }
264 ];
259 }; 265 };
260 }; 266 };
261 }; 267 };
262 268
263 systemd.services.kea-dhcp-ddns-server = { 269 systemd.services.kea-dhcp-ddns-server = {
264 preStart = let
265 configLines = [
266 "<?include \"\${CREDENTIALS_DIRECTORY}/knot-tsig.json.frag\"?>"
267 ] ++ mapAttrsToList (k: v:
268 "\"${k}\": ${builtins.toJSON v}"
269 ) config.services.kea.dhcp-ddns.settings;
270
271 config-template = pkgs.writeText "dhcp-ddns.conf" ''
272 {"DhcpDdns": {
273 ${concatStringsSep ",\n " configLines}
274 }}
275 '';
276 in ''
277 ${pkgs.envsubst}/bin/envsubst -i "${config-template}" -o "''${RUNTIME_DIRECTORY}/dhcp-ddns.conf"
278 '';
279
280 serviceConfig = { 270 serviceConfig = {
281 ExecStart = mkForce ''
282 ${pkgs.kea}/bin/kea-dhcp-ddns -c "''${RUNTIME_DIRECTORY}/dhcp-ddns.conf" ${escapeShellArgs config.services.kea.dhcp-ddns.extraArgs}
283 '';
284 LoadCredential = [ 271 LoadCredential = [
285 "knot-tsig.json.frag:${config.sops.secrets."kea-knot-tsig.json.frag".path}" 272 "local_key:${config.sops.secrets."kea-knot-tsig".path}"
286 ]; 273 ];
287 }; 274 };
288 }; 275 };
289 276
290 sops.secrets."kea-knot-tsig.json.frag" = { 277 sops.secrets."kea-knot-tsig" = {
291 format = "binary"; 278 format = "binary";
292 sopsFile = ./knot-tsig.json.frag; 279 sopsFile = ./knot-tsig;
293 }; 280 };
294 281
295 services.nginx.virtualHosts."nfsroot.vidhar.yggdrasil" = { 282 services.nginx.virtualHosts."nfsroot.vidhar.yggdrasil" = {
@@ -349,7 +336,7 @@ in {
349 goto start 336 goto start
350 337
351 :memtest 338 :memtest
352 iseq ''${platform} efi && chain --autofree memtest.efi || chain --autofree memtest.bin 339 chain --autofree mt86plus.efi
353 goto start 340 goto start
354 ''} $out/installer-${system}.menu.ipxe 341 ''} $out/installer-${system}.menu.ipxe
355 ''))) 342 '')))
@@ -360,61 +347,61 @@ in {
360 mkdir $out 347 mkdir $out
361 install -m 0444 -t $out \ 348 install -m 0444 -t $out \
362 ${ipxe}/{ipxe.efi,i386-ipxe.efi,ipxe.lkrn} \ 349 ${ipxe}/{ipxe.efi,i386-ipxe.efi,ipxe.lkrn} \
363 ${pkgs.memtest86plus}/{memtest.efi,memtest.bin} 350 ${pkgs.memtest86plus}/mt86plus.efi
364 install -m 0444 ${sources.netbootxyz-efi.src} $out/netboot.xyz.efi 351 install -m 0444 ${sources.netbootxyz-efi.src} $out/netboot.xyz.efi
365 install -m 0444 ${sources.netbootxyz-lkrn.src} $out/netboot.xyz.lkrn 352 install -m 0444 ${sources.netbootxyz-lkrn.src} $out/netboot.xyz.lkrn
366 '') 353 '')
367 (builtins.addErrorContext "while evaluating eostre" (let 354 # (builtins.addErrorContext "while evaluating eostre" (let
368 eostreBuild' = (flake.nixosConfigurations.eostre.extendModules { 355 # eostreBuild' = (flake.nixosConfigurations.eostre.extendModules {
369 modules = [ 356 # modules = [
370 ({ ... }: { 357 # ({ ... }: {
371 config.nfsroot.storeDevice = "${nfsIp}:nix-store"; 358 # config.nfsroot.storeDevice = "${nfsIp}:nix-store";
372 config.nfsroot.registrationUrl = "${nfsrootBaseUrl}/eostre/registration"; 359 # config.nfsroot.registrationUrl = "${nfsrootBaseUrl}/eostre/registration";
373 config.system.nixos.label = "eostre"; 360 # config.system.nixos.label = "eostre";
374 }) 361 # })
375 ]; 362 # ];
376 }); 363 # });
377 eostreBuild = eostreBuild'.config.system.build; 364 # eostreBuild = eostreBuild'.config.system.build;
378 in builtins.toPath (pkgs.runCommandLocal "eostre" {} '' 365 # in builtins.toPath (pkgs.runCommandLocal "eostre" {} ''
379 mkdir -p $out/eostre 366 # mkdir -p $out/eostre
380 install -m 0444 -t $out/eostre \ 367 # install -m 0444 -t $out/eostre \
381 ${eostreBuild.initialRamdisk}/initrd \ 368 # ${eostreBuild.initialRamdisk}/initrd \
382 ${eostreBuild.kernel}/bzImage \ 369 # ${eostreBuild.kernel}/bzImage \
383 ${eostreBuild.netbootIpxeScript}/netboot.ipxe \ 370 # ${eostreBuild.netbootIpxeScript}/netboot.ipxe \
384 ${pkgs.closureInfo { rootPaths = eostreBuild.storeContents; }}/registration 371 # ${pkgs.closureInfo { rootPaths = eostreBuild.storeContents; }}/registration
385 install -m 0444 ${pkgs.writeText "eostre.menu.ipxe" '' 372 # install -m 0444 ${pkgs.writeText "eostre.menu.ipxe" ''
386 #!ipxe 373 # #!ipxe
387 374
388 set menu-timeout 5000 375 # set menu-timeout 5000
389 376
390 :start 377 # :start
391 menu iPXE boot menu for eostre 378 # menu iPXE boot menu for eostre
392 item eostre ${with eostreBuild'; "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})"} 379 # item eostre ${with eostreBuild'; "${config.system.nixos.distroName} ${config.system.nixos.codeName} ${config.system.nixos.label} (Linux ${config.boot.kernelPackages.kernel.modDirVersion})"}
393 item memtest memtest86plus 380 # item memtest memtest86plus
394 item netboot netboot.xyz 381 # item netboot netboot.xyz
395 item shell iPXE shell 382 # item shell iPXE shell
396 choose --timeout ''${menu-timeout} --default eostre selected || goto shell 383 # choose --timeout ''${menu-timeout} --default eostre selected || goto shell
397 set menu-timeout 0 384 # set menu-timeout 0
398 goto ''${selected} 385 # goto ''${selected}
399 386
400 :shell 387 # :shell
401 set menu-timeout 0 388 # set menu-timeout 0
402 shell 389 # shell
403 goto start 390 # goto start
404 391
405 :eostre 392 # :eostre
406 chain eostre/netboot.ipxe 393 # chain eostre/netboot.ipxe
407 goto start 394 # goto start
408 395
409 :netboot 396 # :netboot
410 iseq ''${platform} efi && chain --autofree netboot.xyz.efi || chain --autofree netboot.xyz.lkrn 397 # iseq ''${platform} efi && chain --autofree netboot.xyz.efi || chain --autofree netboot.xyz.lkrn
411 goto start 398 # goto start
412 399
413 :memtest 400 # :memtest
414 iseq ''${platform} efi && chain --autofree memtest.efi || chain --autofree memtest.bin 401 # chain --autofree mt86plus.efi
415 goto start 402 # goto start
416 ''} $out/eostre.menu.ipxe 403 # ''} $out/eostre.menu.ipxe
417 ''))) 404 # '')))
418 ]; 405 ];
419 }; 406 };
420 }; 407 };
diff --git a/hosts/vidhar/network/dhcp/knot-tsig.json.frag b/hosts/vidhar/network/dhcp/knot-tsig
index c10115cf..73a8f11d 100644
--- a/hosts/vidhar/network/dhcp/knot-tsig.json.frag
+++ b/hosts/vidhar/network/dhcp/knot-tsig
@@ -1,18 +1,14 @@
1{ 1{
2 "data": "ENC[AES256_GCM,data:cGcoqYZ341xQOFukDm4J5KDfG6+NaNbk2U2k4YGneRsAoPJZe/8KDmVr8TBWFCXXbuzeCGbiuXRVBmtYSEIqbqTN4u00RdQgpeL72cB3ZFd2c7cideEQV5z802pqFfXSlmLBC01OPG3TwAgk6xhQYSn5IcBTIL6fRF235Y9Q8k/X96rhfwPRVq84,iv:UoweWBcVuQIXeWFFl/WNUHLXG8nEri1UuTskC2I26hU=,tag:TJldVr2LDTmKA3ozZoX+cQ==,type:str]", 2 "data": "ENC[AES256_GCM,data:ZjPqKfUCRYD4iD7yC7qObZhBAMll0DXNzImZ43TM0D8SXRtANqG6YnfwQuJ7,iv:GXD5LutgEz6ktGEtpI9z41IJLLzIMj6OvPADQlZcvwk=,tag:v9ISQFDubtLWcb2mVHa4zA==,type:str]",
3 "sops": { 3 "sops": {
4 "kms": null,
5 "gcp_kms": null,
6 "azure_kv": null,
7 "hc_vault": null,
8 "age": [ 4 "age": [
9 { 5 {
10 "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l", 6 "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCYk5tM1lPRXc0MGpHZENQ\ndDU2M2VKY2t2VGFrcTUvd0NrU3VMZGQ3NHlNClNTaWVjdDNTQXh6WDFmMDk3SWtn\ncjJjRzUxODFFL25Ic0dabyt1ZW5xRE0KLS0tIDJlT0NTVDlXNWphQ1B0VTQ1U0NH\nNktRNlIrQzdhRjZ0SjR0T3oyRkZiWXMKX28S4SySQguT1cgMZpDY4o/OKY6IvjT9\n1oUzwx/BzBbC2JbpGYvQQgp/qfiM2k0oXmQlfdTv8kD/MoOqPO8E1Q==\n-----END AGE ENCRYPTED FILE-----\n",
11 "enc": "-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCYk5tM1lPRXc0MGpHZENQ\ndDU2M2VKY2t2VGFrcTUvd0NrU3VMZGQ3NHlNClNTaWVjdDNTQXh6WDFmMDk3SWtn\ncjJjRzUxODFFL25Ic0dabyt1ZW5xRE0KLS0tIDJlT0NTVDlXNWphQ1B0VTQ1U0NH\nNktRNlIrQzdhRjZ0SjR0T3oyRkZiWXMKX28S4SySQguT1cgMZpDY4o/OKY6IvjT9\n1oUzwx/BzBbC2JbpGYvQQgp/qfiM2k0oXmQlfdTv8kD/MoOqPO8E1Q==\n-----END AGE ENCRYPTED FILE-----\n" 7 "recipient": "age1qffdqvy9arld9zd5a5cylt0n98xhcns5shxhrhwjq5g4qa844ejselaa4l"
12 } 8 }
13 ], 9 ],
14 "lastmodified": "2022-03-15T13:52:17Z", 10 "lastmodified": "2026-07-29T06:39:18Z",
15 "mac": "ENC[AES256_GCM,data:rTelaGx5S2E2oYPNGfctFbgDKdyRX8tpVTqLtpcCAJ8MS5ppFTjnSwYi4yQHvTicfAPNz7hGJYAnTdyC2QDTciJgkS6KC3CCXWCimkTybBdVW4Azwz9iBZCpWu+rB1vcQhSLlLCaKmKskkqDZZ5+mfuaXc+TT2uwTA0SDtZWvnM=,iv:ANCZ1fHy6w/svEE53o7rWsp5qU15qoriqyVMzClH6J0=,tag:H92RM5GuLIl9/kslq4tzkQ==,type:str]", 11 "mac": "ENC[AES256_GCM,data:hj/YR0N8NhGHQEcCOjt/r+rfM8plkaUZoee9sI25evvEvOlfX69YRxUv1vyd6Sqd9wPEgCsF5STnMXFQhq3zgGjoTFcdHU+olRVmRq9rkYQo/ButZ/NEIQ7uc5b4FRPdPwOGF14aSpgI67F35oRavv1vtk10zGme+X0I1VXTIqE=,iv:rMUL+CyTLhQBJrsQJQPhN75FjCf5uGFh1z6KAXKDeB8=,tag:bpeQZ3UPZ10tCrgveoDklg==,type:str]",
16 "pgp": [ 12 "pgp": [
17 { 13 {
18 "created_at": "2023-01-30T11:00:34Z", 14 "created_at": "2023-01-30T11:00:34Z",
@@ -21,6 +17,6 @@
21 } 17 }
22 ], 18 ],
23 "unencrypted_suffix": "_unencrypted", 19 "unencrypted_suffix": "_unencrypted",
24 "version": "3.7.1" 20 "version": "3.13.2"
25 } 21 }
26} \ No newline at end of file 22}
generated by cgit v1.2.3 (git 2.25.1) at 2026-08-06 08:15:45 +0000