diff --git a/1-nixos-node/configuration.nix b/1-nixos-node/configuration.nix index 0dacc0e..7ce6e09 100644 --- a/1-nixos-node/configuration.nix +++ b/1-nixos-node/configuration.nix @@ -49,6 +49,9 @@ preferred_address_family = "ipv4"; %{if cpu_total_compute != null ~} cpu_total_compute = ${cpu_total_compute}; +%{endif ~} +%{if node_class != null ~} + node_class = "${node_class}"; %{endif ~} host_volume = { %{ for volume in host_volumes ~} @@ -116,6 +119,17 @@ # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service) virtualisation.docker.enable = true; +%{if node_class == "latte-panda-n150" ~} + # Enable Intel iGPU (N150 UHD Graphics) for OpenVINO / VA-API workloads running in Docker + hardware.graphics = { + enable = true; + extraPackages = with pkgs; [ + intel-media-driver # VA-API (iHD) + intel-compute-runtime # OpenCL / oneAPI + ]; + }; + +%{endif ~} # Proper systemd service definition for macvlan network creation systemd.services.docker-macvlan-network = { description = "Ensure macvlan Docker network exists"; diff --git a/1-nixos-node/node.tf b/1-nixos-node/node.tf index 2901ce9..bd681a7 100644 --- a/1-nixos-node/node.tf +++ b/1-nixos-node/node.tf @@ -21,6 +21,7 @@ variable "nodes" { bind_interface = string bootstrap = optional(bool, false) # Optional field for bootstrap nodes cpu_total_compute = optional(number, null) # Optional field for CPU total compute + node_class = optional(string, null) # Optional Nomad node_class for scheduling constraints host_volumes = list(string) })) } @@ -32,6 +33,7 @@ locals { bind_interface = v.bind_interface bootstrap = v.bootstrap cpu_total_compute = v.cpu_total_compute + node_class = v.node_class host_volumes = v.host_volumes }) } diff --git a/1-nixos-node/terraform.tfstate b/1-nixos-node/terraform.tfstate index 92ad0f6..a199333 100644 --- a/1-nixos-node/terraform.tfstate +++ b/1-nixos-node/terraform.tfstate @@ -1,7 +1,7 @@ { "version": 4, - "terraform_version": "1.13.0", - "serial": 466, + "terraform_version": "1.14.4", + "serial": 478, "lineage": "db7dcf21-a255-0ec4-c8b8-d4a7559b3768", "outputs": {}, "resources": [ @@ -15,9 +15,9 @@ "index_key": "jaglan-beta-m02", "schema_version": 0, "attributes": { - "id": "20885568041573411", + "id": "8422106709762172940", "triggers": { - "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m02\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" + "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m02\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n node_class = \"latte-panda-n150\";\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Enable Intel iGPU (N150 UHD Graphics) for OpenVINO / VA-API workloads running in Docker\n hardware.graphics = {\n enable = true;\n extraPackages = with pkgs; [\n intel-media-driver # VA-API (iHD)\n intel-compute-runtime # OpenCL / oneAPI\n ];\n };\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" } }, "sensitive_attributes": [], @@ -27,9 +27,9 @@ "index_key": "jaglan-beta-m03", "schema_version": 0, "attributes": { - "id": "8964185922177726837", + "id": "7951044103972849543", "triggers": { - "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m03\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" + "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m03\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n node_class = \"latte-panda-n150\";\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Enable Intel iGPU (N150 UHD Graphics) for OpenVINO / VA-API workloads running in Docker\n hardware.graphics = {\n enable = true;\n extraPackages = with pkgs; [\n intel-media-driver # VA-API (iHD)\n intel-compute-runtime # OpenCL / oneAPI\n ];\n };\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" } }, "sensitive_attributes": [], @@ -39,9 +39,9 @@ "index_key": "jaglan-beta-m04", "schema_version": 0, "attributes": { - "id": "4708096322431007624", + "id": "4405779833874024105", "triggers": { - "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m04\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" + "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m04\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n node_class = \"latte-panda-n150\";\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Enable Intel iGPU (N150 UHD Graphics) for OpenVINO / VA-API workloads running in Docker\n hardware.graphics = {\n enable = true;\n extraPackages = with pkgs; [\n intel-media-driver # VA-API (iHD)\n intel-compute-runtime # OpenCL / oneAPI\n ];\n };\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" } }, "sensitive_attributes": [], @@ -51,9 +51,9 @@ "index_key": "jaglan-beta-m05", "schema_version": 0, "attributes": { - "id": "918821712793114600", + "id": "9059089332190666531", "triggers": { - "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m05\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" + "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m05\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n node_class = \"latte-panda-n150\";\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Enable Intel iGPU (N150 UHD Graphics) for OpenVINO / VA-API workloads running in Docker\n hardware.graphics = {\n enable = true;\n extraPackages = with pkgs; [\n intel-media-driver # VA-API (iHD)\n intel-compute-runtime # OpenCL / oneAPI\n ];\n };\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" } }, "sensitive_attributes": [], diff --git a/1-nixos-node/terraform.tfstate.backup b/1-nixos-node/terraform.tfstate.backup index 3128b4e..e033325 100644 --- a/1-nixos-node/terraform.tfstate.backup +++ b/1-nixos-node/terraform.tfstate.backup @@ -1,7 +1,7 @@ { "version": 4, - "terraform_version": "1.13.0", - "serial": 463, + "terraform_version": "1.14.4", + "serial": 475, "lineage": "db7dcf21-a255-0ec4-c8b8-d4a7559b3768", "outputs": {}, "resources": [ @@ -15,9 +15,9 @@ "index_key": "jaglan-beta-m02", "schema_version": 0, "attributes": { - "id": "20885568041573411", + "id": "8422106709762172940", "triggers": { - "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m02\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" + "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m02\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n node_class = \"latte-panda-n150\";\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Enable Intel iGPU (N150 UHD Graphics) for OpenVINO / VA-API workloads running in Docker\n hardware.graphics = {\n enable = true;\n extraPackages = with pkgs; [\n intel-media-driver # VA-API (iHD)\n intel-compute-runtime # OpenCL / oneAPI\n ];\n };\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" } }, "sensitive_attributes": [], @@ -27,9 +27,9 @@ "index_key": "jaglan-beta-m03", "schema_version": 0, "attributes": { - "id": "8964185922177726837", + "id": "7951044103972849543", "triggers": { - "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m03\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" + "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m03\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n node_class = \"latte-panda-n150\";\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Enable Intel iGPU (N150 UHD Graphics) for OpenVINO / VA-API workloads running in Docker\n hardware.graphics = {\n enable = true;\n extraPackages = with pkgs; [\n intel-media-driver # VA-API (iHD)\n intel-compute-runtime # OpenCL / oneAPI\n ];\n };\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" } }, "sensitive_attributes": [], @@ -39,9 +39,9 @@ "index_key": "jaglan-beta-m04", "schema_version": 0, "attributes": { - "id": "4708096322431007624", + "id": "4405779833874024105", "triggers": { - "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m04\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" + "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m04\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n node_class = \"latte-panda-n150\";\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Enable Intel iGPU (N150 UHD Graphics) for OpenVINO / VA-API workloads running in Docker\n hardware.graphics = {\n enable = true;\n extraPackages = with pkgs; [\n intel-media-driver # VA-API (iHD)\n intel-compute-runtime # OpenCL / oneAPI\n ];\n };\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" } }, "sensitive_attributes": [], @@ -51,9 +51,9 @@ "index_key": "jaglan-beta-m05", "schema_version": 0, "attributes": { - "id": "4972863132701658569", + "id": "918821712793114600", "triggers": { - "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m05\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # Configure systemd-resolved to forward .consul domains to Consul DNS\n services.resolved = {\n enable = true;\n dnssec = \"false\";\n domains = [ \"~consul\" ];\n extraConfig = ''\n DNS=127.0.0.1:8600\n DNSStubListener=yes\n '';\n };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n # Configure recursors for non-.consul domain resolution\n recursors = [ \"192.168.1.1\" \"1.1.1.1\" ];\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker = {\n enable = true;\n # Configure Docker to use systemd-resolved for DNS\n daemon.settings = {\n dns = [ \"127.0.0.53\" ];\n };\n };\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" + "configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m05\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n" } }, "sensitive_attributes": [], diff --git a/2-nomad-config/2-ingress/traefik.nomad.hcl b/2-nomad-config/2-ingress/traefik.nomad.hcl index 4d5f7b4..90da4c5 100644 --- a/2-nomad-config/2-ingress/traefik.nomad.hcl +++ b/2-nomad-config/2-ingress/traefik.nomad.hcl @@ -157,11 +157,6 @@ http: service: unraid middlewares: - auth - frigate: - rule: "Host(`frigate.othrayte.one`)" - service: frigate - middlewares: - - auth kopia: rule: "Host(`kopia.othrayte.one`)" service: kopia @@ -199,10 +194,6 @@ http: loadBalancer: servers: - url: "http://betelgeuse-seven-unraid.lan:80" - frigate: - loadBalancer: - servers: - - url: "http://betelgeuse-seven-unraid.lan:5000" kopia: loadBalancer: servers: diff --git a/2-nomad-config/frigate.nomad.hcl b/2-nomad-config/frigate.nomad.hcl new file mode 100644 index 0000000..f31532a --- /dev/null +++ b/2-nomad-config/frigate.nomad.hcl @@ -0,0 +1,216 @@ +job "frigate" { + # Pin to N150 LattePanda nodes - Intel UHD iGPU for OpenVINO-accelerated detection. + # hardware.graphics (intel-compute-runtime) is deployed to these nodes via configuration.nix. + constraint { + attribute = "${node.class}" + value = "latte-panda-n150" + } + + group "frigate" { + count = 1 + + network { + port "http" { + to = 5000 + } + } + + # Prestart: restore Frigate's SQLite DB from the Litestream file replica on the CIFS share. + # Runs to completion before the frigate task starts. Safe on first boot (-if-replica-exists + # is a no-op when no replica exists yet). + task "litestream-restore" { + lifecycle { + hook = "prestart" + sidecar = false + } + + driver = "docker" + + config { + image = "litestream/litestream:0.5.9" + command = "restore" + args = ["-if-replica-exists", "-config", "/local/litestream.yml", "/alloc/data/frigate.db"] + } + + # Litestream config: replicate to /config/frigate.db.litestream/ on the CIFS share. + # Litestream writes its own segment format - no SQLite advisory locking involved. + # Frigate must be configured with database.path: /alloc/data/frigate.db in config.yml. + template { + data = <