This repository has no description
2.0 kB
55 lines
1{ config, lib, ... }:
2{
3 imports = [
4 ../../2configs
5 ../../2configs/retiolum.nix
6 ../../2configs/ssh-redirect.nix
7 ../../2configs/autoupdate.nix
8 ../../2configs/sigexec/executor.nix
9 ./ipfs.nix
10 ./ipfs-endpoint.nix
11 ];
12
13 # starkstrom is not (yet) in the shared kartei registry, so its retiolum
14 # identity is declared here. Migrate this block into kartei/lass to give the
15 # rest of the fleet starkstrom's keys (full mesh); until then only starkstrom
16 # knows the peers it ConnectTo's.
17 # Pubkeys are read from this machine's clan vars, so they always match the
18 # private keys deployed to the host.
19 krebs.hosts.starkstrom = {
20 owner = config.krebs.users.lass;
21 monitoring = true;
22 nets.retiolum = {
23 ip4.addr = "10.243.0.100";
24 ip6.addr = "42:0:ce16::100";
25 aliases = [ "starkstrom.r" ];
26 tinc.pubkey = config.clan.core.vars.generators.retiolum.files."retiolum.rsa_key.pub".value;
27 # tincr writes the pub as `Ed25519PublicKey = <key>`; keep only the key.
28 tinc.pubkey_ed25519 = lib.last (
29 lib.splitString " " (
30 lib.removeSuffix "\n"
31 config.clan.core.vars.generators.retiolum.files."retiolum.ed25519_key.pub".value
32 )
33 );
34 };
35 };
36
37 krebs.build.host = config.krebs.hosts.starkstrom;
38
39 # The fleet has no retiolum route here (see kartei note above), so the
40 # sigexec dashboard on neoprism reaches this executor over public TLS
41 # instead: nginx strips /sigexec/ so the executor verifies the same paths
42 # the statements were signed over (/jobs etc).
43 services.nginx.virtualHosts."starkstrom.lassul.us".locations."/sigexec/" = {
44 proxyPass = "http://127.0.0.1:7601/";
45 extraConfig = ''
46 # Long-lived chunked job streams: unbuffered, generous timeouts (logs on
47 # a pending job blocks until approval).
48 proxy_buffering off;
49 proxy_read_timeout 1d;
50 proxy_send_timeout 1d;
51 '';
52 };
53
54 system.stateVersion = "25.11";
55}