This repository has no description
2.0 kB
59 lines
1{
2 self,
3 config,
4 ...
5}:
6let
7 # starkstrom is deliberately not in the shared kartei registry; its retiolum
8 # identity lives in retiolum/ (self.retiolum), which every superconfig
9 # machine injects into its tinc host set. Move that entry into kartei/lass if
10 # the rest of krebs should be able to reach it too.
11 net = self.retiolum.hosts.starkstrom.nets.retiolum;
12in
13{
14 imports = [
15 ../../configs
16 ../../configs/retiolum.nix
17 ../../configs/ssh-redirect.nix
18 ../../configs/autoupdate.nix
19 ../../configs/sigexec/executor.nix
20 ./ipfs.nix
21 ./ipfs-endpoint.nix
22 ];
23
24 # krebs.build.host and the monitoring/dns bits still read this card, so build
25 # it from the same data rather than repeating the addresses and keys.
26 # stockholm's host type additionally insists on the legacy RSA pubkey, which
27 # tincr ignores; via is left out because stockholm resolves it to a net
28 # submodule, not a name.
29 krebs.hosts.starkstrom = {
30 owner = config.krebs.users.lass;
31 monitoring = true;
32 nets.retiolum = {
33 inherit (net) ip4 ip6 aliases;
34 tinc = {
35 pubkey = config.clan.core.vars.generators.retiolum.files."retiolum.rsa_key.pub".value;
36 inherit (net.tinc) pubkey_ed25519;
37 };
38 };
39 };
40
41 krebs.build.host = config.krebs.hosts.starkstrom;
42
43 # The fleet has no retiolum route here (see kartei note above), so the
44 # sigexec dashboard on neoprism reaches this executor over public TLS
45 # instead: nginx strips /sigexec/ so the executor verifies the same paths
46 # the statements were signed over (/jobs etc).
47 services.nginx.virtualHosts."starkstrom.lassul.us".locations."/sigexec/" = {
48 proxyPass = "http://127.0.0.1:7601/";
49 extraConfig = ''
50 # Long-lived chunked job streams: unbuffered, generous timeouts (logs on
51 # a pending job blocks until approval).
52 proxy_buffering off;
53 proxy_read_timeout 1d;
54 proxy_send_timeout 1d;
55 '';
56 };
57
58 system.stateVersion = "25.11";
59}