528 lines
14 KiB
Nix
528 lines
14 KiB
Nix
# This is a WIP *example* meta.nix file for Metanix.
|
||
# It captures intent / semantics, not final implementation details.
|
||
# Expect this shape to evolve as Metanix grows teeth.
|
||
|
||
{
|
||
##############################
|
||
# Global / world-level config
|
||
##############################
|
||
|
||
domain = "kasear.net";
|
||
|
||
##############################
|
||
# Locations, subnets, hosts
|
||
#
|
||
# Shape:
|
||
# locations.<location> = {
|
||
# owner = "yaro"; # optional: default owner for this location
|
||
# admins = [ "ops" ]; # optional: location-wide admins
|
||
# users = [ "monitor" ]; # optional: location-relevant users
|
||
#
|
||
# <subnet> = {
|
||
# vlan = int; # optional (e.g. cloud may omit)
|
||
# dhcp = { start = 10; end = 250; }; # optional
|
||
#
|
||
# owner = "ops"; # optional: overrides location.owner
|
||
# admins = [ "sre" ]; # optional: adds/overrides admins
|
||
# users = [ "resident" ]; # optional: extra users relevant here
|
||
#
|
||
# hosts = {
|
||
# <hostname> = {
|
||
# role = "router" | "server" | "adminWorkstation" | "coreServer" | ...;
|
||
# hw-address = "aa:bb:cc:dd:ee:ff"; # optional
|
||
# aliases = [ "fqdn" ... ]; # optional
|
||
# interface = "eno2"; # optional
|
||
# dns = false; # optional, default true
|
||
# hostId = 42; # optional, for special cases
|
||
#
|
||
# # Identity hints in THIS CONTEXT ONLY:
|
||
# # These drive host-context privileges & network-plane semantics.
|
||
# # System-level privilege is resolved later across all hosts.
|
||
# owner = "yaro"; # this host’s admin owner
|
||
# admins = [ "ops" "sre" ]; # host-level admins
|
||
# users = [ "analytics" ]; # host-level plain users
|
||
# };
|
||
# };
|
||
# };
|
||
# };
|
||
##############################
|
||
|
||
locations = {
|
||
cloud = {
|
||
# cloud-level identity hints (example)
|
||
owner = "yaro";
|
||
admins = [ "ops" ];
|
||
users = [ "monitor" ];
|
||
|
||
dmz = {
|
||
hosts = {
|
||
eris = {
|
||
role = "router";
|
||
aliases = [ "frontend.kasear.net" ];
|
||
# Example: eris dmz-side is not an admin plane for anyone by default
|
||
users = [ "monitor" ];
|
||
};
|
||
|
||
deimos-cloud = {
|
||
role = "server";
|
||
interface = "wg0";
|
||
# Maybe this side is treated as non-admin ingress
|
||
users = [ "analytics" ];
|
||
};
|
||
};
|
||
};
|
||
|
||
infra = {
|
||
# infra is effectively the config plane type for this location
|
||
owner = "yaro";
|
||
admins = [ "ops" ];
|
||
|
||
hosts = {
|
||
metatron = {
|
||
role = "coreServer";
|
||
owner = "yaro"; # full admin plane for yaro here
|
||
admins = [ "ops" ];
|
||
};
|
||
|
||
loki-cloud = {
|
||
role = "adminWorkstation";
|
||
owner = "yaro"; # admin workstation for yaro in cloud
|
||
users = [ "analytics" ]; # non-admin local user still allowed
|
||
};
|
||
};
|
||
};
|
||
};
|
||
|
||
home = {
|
||
owner = "yaro";
|
||
admins = [ "ops" ];
|
||
|
||
dmz = {
|
||
vlan = 1;
|
||
|
||
hosts = {
|
||
io = {
|
||
role = "router";
|
||
aliases = [ "external.kasear.net" ];
|
||
};
|
||
|
||
europa-dmz = {
|
||
role = "router";
|
||
};
|
||
|
||
deimos = {
|
||
role = "server";
|
||
hw-address = "10:98:36:a0:2c:b2";
|
||
interface = "eno2";
|
||
aliases = [
|
||
"kasear.net"
|
||
"cloud.kasear.net"
|
||
"git.kasear.net"
|
||
"majike.kasear.net"
|
||
"media.kasear.net"
|
||
"minecraft.kasear.net"
|
||
"public.kasear.net"
|
||
"test.kasear.net"
|
||
"vault.kasear.net"
|
||
"vikali.kasear.net"
|
||
"vpn.kasear.net"
|
||
"www.kasear.net"
|
||
"yaro.kasear.net"
|
||
];
|
||
owner = "yaro"; # home-dmz plane: yaro is owner
|
||
admins = [ "ops" ];
|
||
};
|
||
|
||
container-host = {
|
||
role = "containerHost";
|
||
dns = false;
|
||
};
|
||
|
||
cloud-container = { role = "server"; dns = false; };
|
||
default-container = { role = "server"; dns = false; };
|
||
foregejo-container = { role = "server"; dns = false; };
|
||
majike-container = { role = "server"; dns = false; };
|
||
media-container = { role = "server"; dns = false; };
|
||
vault-container = { role = "server"; dns = false; };
|
||
vikali-container = { role = "server"; dns = false; };
|
||
vpn-container = { role = "server"; dns = false; };
|
||
yaro-container = { role = "server"; dns = false; };
|
||
};
|
||
};
|
||
|
||
main = {
|
||
vlan = 10;
|
||
dhcp = { start = 1; end = 250; };
|
||
|
||
hosts = {
|
||
europa = {
|
||
role = "router";
|
||
aliases = [ "internal.kasear.net" ];
|
||
};
|
||
|
||
terra = {
|
||
role = "infraDevice";
|
||
hw-address = "48:a9:8a:2d:7f:34";
|
||
aliases = [ "core.kasear.net" ];
|
||
# terra as admin workstation-like infra endpoint
|
||
role = "adminWorkstation";
|
||
owner = "yaro";
|
||
};
|
||
|
||
artemis = {
|
||
role = "infraDevice";
|
||
hw-address = "54:af:97:02:2f:15";
|
||
};
|
||
|
||
luna = {
|
||
role = "infraDevice";
|
||
hw-address = "30:23:03:48:4c:75";
|
||
};
|
||
|
||
phobos = {
|
||
role = "server";
|
||
hw-address = "10:98:36:a9:4a:26";
|
||
aliases = [
|
||
"pbx.kasear.net"
|
||
"private.kasear.net"
|
||
];
|
||
};
|
||
|
||
printer = {
|
||
role = "printer";
|
||
hw-address = "84:25:19:60:de:1e";
|
||
aliases = [ "printer.kasear.net" ];
|
||
};
|
||
|
||
tv = {
|
||
role = "media";
|
||
hw-address = "00:18:dd:04:9b:a8";
|
||
aliases = [ "tv.kasear.net" ];
|
||
};
|
||
|
||
ip-phone = {
|
||
role = "phone";
|
||
hw-address = "80:5e:c0:de:3d:66";
|
||
};
|
||
};
|
||
};
|
||
|
||
guest = {
|
||
vlan = 20;
|
||
dhcp = { start = 1; end = 250; };
|
||
|
||
hosts = {
|
||
europa-guest = { role = "router"; };
|
||
};
|
||
};
|
||
|
||
iot = {
|
||
vlan = 30;
|
||
|
||
hosts = {
|
||
europa-iot = { role = "router"; };
|
||
|
||
phobos-iot = {
|
||
role = "server";
|
||
hw-address = "10:98:36:a9:4a:26";
|
||
};
|
||
|
||
kitchen-echo = {
|
||
role = "appliance";
|
||
hw-address = "50:dc:e7:80:91:55";
|
||
};
|
||
|
||
bedroom-echo = {
|
||
role = "appliance";
|
||
hw-address = "f8:54:b8:21:f6:83";
|
||
};
|
||
|
||
lab-echo = {
|
||
role = "appliance";
|
||
hw-address = "08:84:9d:74:4d:c6";
|
||
};
|
||
|
||
camera1 = {
|
||
role = "camera";
|
||
hw-address = "9c:8e:cd:38:95:1f";
|
||
aliases = [ "camera1.kasear.net" ];
|
||
};
|
||
|
||
camera2 = {
|
||
role = "camera";
|
||
hw-address = "9c:8e:cd:38:95:15";
|
||
aliases = [ "camera2.kasear.net" ];
|
||
};
|
||
|
||
camera2-wifi = {
|
||
role = "camera";
|
||
hw-address = "9c:8e:cd:38:9a:fd";
|
||
};
|
||
|
||
samsung-tv = {
|
||
role = "appliance";
|
||
hw-address = "04:e4:b6:23:81:fc";
|
||
};
|
||
};
|
||
};
|
||
|
||
storage = {
|
||
vlan = 40;
|
||
dhcp = { start = 1; end = 250; };
|
||
|
||
hosts = {
|
||
europa-storage = { role = "router"; };
|
||
|
||
ganymede = {
|
||
role = "nas";
|
||
aliases = [ "storage.kasear.net" ];
|
||
};
|
||
};
|
||
};
|
||
|
||
management = {
|
||
vlan = 70;
|
||
|
||
hosts = {
|
||
deimos-idrac = {
|
||
role = "oobMgmt";
|
||
hw-address = "10:98:36:a0:2c:b3";
|
||
};
|
||
|
||
phobos-idrac = {
|
||
role = "oobMgmt";
|
||
hw-address = "10:98:36:a9:4a:27";
|
||
};
|
||
|
||
ganymede-idrac = {
|
||
role = "oobMgmt";
|
||
hw-address = "14:18:77:51:4b:b5";
|
||
};
|
||
};
|
||
};
|
||
};
|
||
};
|
||
|
||
##############################
|
||
# Systems
|
||
#
|
||
# systems.<systemName> = {
|
||
# tags = [
|
||
# "router" # role-like behavior
|
||
# "public" # exposed to public internet
|
||
# "upstream" # authoritative / config-plane provider (Kea/Knot/Unbound/WG server)
|
||
# "downstream" # router profile consuming upstream config-plane
|
||
# ];
|
||
#
|
||
# # Primary/default context for this system
|
||
# location = "home" | "cloud" | ...;
|
||
# subnet = "dmz" | "main" | ...;
|
||
#
|
||
# # Hosts that represent this system in different contexts.
|
||
# # Metanix will:
|
||
# # - compute per-host identity/privilege from locations
|
||
# # - then collapse them to system-level privileges using a
|
||
# # "highest privilege across hosts" rule when conflicts occur.
|
||
# hosts = [ "deimos" "deimos-cloud" ];
|
||
#
|
||
# # Optional: system-level identity hints (mostly additive)
|
||
# # owner = "yaro";
|
||
# # admins = [ "ops" ];
|
||
# # users = [ "monitor" ];
|
||
#
|
||
# services = {
|
||
# <serviceName> = {
|
||
# enable = true; # optional; presence may imply true
|
||
# tags = [ "upstream" ]; # service-specific semantics (optional)
|
||
# config = { }; # free-form options for the module
|
||
# };
|
||
# };
|
||
#
|
||
# resources = {
|
||
# <resourceName> = {
|
||
# # describes what this system provides (DNS, DHCP, WG, etc)
|
||
# # Metanix will map this to actual service configs.
|
||
# };
|
||
# };
|
||
#
|
||
# consumers = {
|
||
# <resourceName> = {
|
||
# provider = "phobos" | "frontend.kasear.net" | "1.1.1.1" | "metatron";
|
||
# };
|
||
# };
|
||
#
|
||
# configuration = ./systems/.../default.nix; # local NixOS config hook
|
||
# };
|
||
##############################
|
||
|
||
systems = {
|
||
eris = {
|
||
tags = [ "router" "public" /* "downstream" */ ];
|
||
location = "cloud";
|
||
subnet = "dmz";
|
||
hosts = [ "eris" ];
|
||
|
||
services = {
|
||
# Example: public-facing Unbound, could act as upstream resolver
|
||
unbound = {
|
||
enable = true;
|
||
tags = [ "upstream" ];
|
||
config = { };
|
||
};
|
||
|
||
wireguard = {
|
||
enable = true;
|
||
config = { };
|
||
};
|
||
};
|
||
|
||
resources = {
|
||
dns = { };
|
||
wireguard = { };
|
||
};
|
||
|
||
consumers = {
|
||
# Example: eris itself might delegate recursion to some other system
|
||
# or upstream; here we override the global default to "metatron".
|
||
dns = { provider = "metatron"; };
|
||
};
|
||
|
||
configuration = ./systems/x86_64-linux/eris/default.nix;
|
||
};
|
||
|
||
deimos = {
|
||
tags = [ "server" "public" ];
|
||
location = "home";
|
||
subnet = "dmz";
|
||
hosts = [ "deimos" "deimos-cloud" ];
|
||
|
||
services = {
|
||
# enable is optional; presence in this attrset implies enable = true by default.
|
||
headscale = { enable = true; config = { }; };
|
||
nginx-proxy = { enable = true; config = { }; };
|
||
nginx = { enable = true; config = { }; };
|
||
httpd = { enable = false; config = { }; }; # explicit disable
|
||
nextcloud = { enable = true; config = { }; };
|
||
jellyfin = { enable = true; config = { }; };
|
||
foregejo = { enable = true; config = { }; };
|
||
vaultwarden = { enable = true; config = { }; };
|
||
};
|
||
|
||
resources = {
|
||
# logical resources provided by this system
|
||
web = { };
|
||
media = { };
|
||
git = { };
|
||
auth = { };
|
||
};
|
||
|
||
consumers = {
|
||
dns = { provider = "eris"; }; # use eris as DNS
|
||
dhcp = { provider = "phobos"; }; # explicit, even if matches default
|
||
};
|
||
|
||
configuration = ./systems/x86_64-linux/deimos/default.nix;
|
||
};
|
||
};
|
||
|
||
##############################
|
||
# Global resource consumers
|
||
#
|
||
# Defaults that apply if systems.<name>.consumers.<res>.provider
|
||
# is not specified.
|
||
##############################
|
||
|
||
consumers = {
|
||
dhcp = {
|
||
provider = "phobos";
|
||
};
|
||
|
||
dns = {
|
||
provider = "1.1.1.1";
|
||
};
|
||
|
||
wireguard = {
|
||
provider = "frontend.kasear.net";
|
||
};
|
||
};
|
||
|
||
##############################
|
||
# Policy layer (identities, ACL, shared configs)
|
||
#
|
||
# Intended shape:
|
||
#
|
||
# policy = {
|
||
# users = {
|
||
# yaro = { uid = 10010; groups = [ "admins" ]; ... };
|
||
# ops = { uid = 10011; groups = [ "ops" ]; ... };
|
||
# };
|
||
#
|
||
# groups = {
|
||
# admins = { gid = 20010; members = [ "yaro" ]; };
|
||
# ops = { gid = 20011; members = [ "ops" ]; };
|
||
# };
|
||
#
|
||
# globals = {
|
||
# # Global identities that tend to exist everywhere.
|
||
# owner = [ "root-overlord" ]; # potential global owners
|
||
# admins = [ "sre" ]; # global admins
|
||
# users = [ "monitor" ]; # global plain users
|
||
# };
|
||
#
|
||
# configurations = {
|
||
# firefoxProfile = {
|
||
# targets = {
|
||
# users = [ "devs" ];
|
||
# groups = [ "desktopUsers" ];
|
||
# # systems / locations / subnets could also be targeted
|
||
# };
|
||
#
|
||
# module = ./policy/firefox.nix; # NixOS/home-manager module
|
||
# options = {
|
||
# extensions = [ "uBlockOrigin" "multi-account-containers" ];
|
||
# homepage = "https://intranet.kasear.net";
|
||
# };
|
||
# };
|
||
#
|
||
# extraHosts = {
|
||
# targets = {
|
||
# systems = [ "deimos" "metatron" ];
|
||
# };
|
||
#
|
||
# module = ./policy/extra-hosts.nix;
|
||
# options = {
|
||
# hosts = {
|
||
# "special.internal" = "203.0.113.7";
|
||
# };
|
||
# };
|
||
# };
|
||
# };
|
||
#
|
||
# acl = {
|
||
# "storage-access" = {
|
||
# principals = [ "admins" "mediaClients" ];
|
||
# resources = [ "ganymede" ];
|
||
# capabilities = [ "mount-nfs" "read-media" ];
|
||
# };
|
||
#
|
||
# "cloud-admin" = {
|
||
# principals = [ "yaro" "admins" ];
|
||
# resources = [ "location:cloud" ];
|
||
# capabilities = [ "ssh" "sudo" "manage-services" ];
|
||
# };
|
||
# };
|
||
# };
|
||
##############################
|
||
|
||
policy = {
|
||
users = { };
|
||
groups = { };
|
||
globals = {
|
||
owner = [ ];
|
||
admins = [ ];
|
||
users = [ ];
|
||
};
|
||
configurations = { };
|
||
acl = { };
|
||
};
|
||
}
|