othrayte/infra
1
0
Fork 0
Code Issues 1 Pull Requests 7 Actions 1 Packages Projects Releases Wiki Activity
Files
85178d9c9252ef586f30dc5ff011c25889bd242f
infra/1-nixos-node/terraform.tfstate
Adrian Cowan 85178d9c92
All checks were successful
CI / Terraform fmt + validate (push) Successful in 20s
Details
Add Gitea act-runner and test actions for the repo
2026-04-19 14:11:47 +10:00

103 lines
43 KiB
JSON
Raw Blame History

{
"version": 4,
"terraform_version": "1.14.4",
"serial": 495,
"lineage": "db7dcf21-a255-0ec4-c8b8-d4a7559b3768",
"outputs": {},
"resources": [
{
"mode": "managed",
"type": "null_resource",
"name": "deploy_nixos",
"provider": "provider[\"registry.terraform.io/hashicorp/null\"]",
"instances": [
{
"index_key": "jaglan-beta-m02",
"schema_version": 0,
"attributes": {
"id": "3268794189670956974",
"triggers": {
"configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m02\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n node_class = \"latte-panda-n150\";\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n plugin.docker.config.volumes.enabled = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Enable Intel iGPU (N150 UHD Graphics) for OpenVINO / VA-API workloads running in Docker\n hardware.graphics = {\n enable = true;\n extraPackages = with pkgs; [\n intel-media-driver # VA-API (iHD)\n intel-compute-runtime # OpenCL / oneAPI\n ];\n };\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
}
},
"sensitive_attributes": [],
"identity_schema_version": 0
},
{
"index_key": "jaglan-beta-m03",
"schema_version": 0,
"attributes": {
"id": "3297823675888659322",
"triggers": {
"configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m03\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n node_class = \"latte-panda-n150\";\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n plugin.docker.config.volumes.enabled = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Enable Intel iGPU (N150 UHD Graphics) for OpenVINO / VA-API workloads running in Docker\n hardware.graphics = {\n enable = true;\n extraPackages = with pkgs; [\n intel-media-driver # VA-API (iHD)\n intel-compute-runtime # OpenCL / oneAPI\n ];\n };\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
}
},
"sensitive_attributes": [],
"identity_schema_version": 0
},
{
"index_key": "jaglan-beta-m04",
"schema_version": 0,
"attributes": {
"id": "1201897732452559880",
"triggers": {
"configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m04\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n node_class = \"latte-panda-n150\";\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n plugin.docker.config.volumes.enabled = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Enable Intel iGPU (N150 UHD Graphics) for OpenVINO / VA-API workloads running in Docker\n hardware.graphics = {\n enable = true;\n extraPackages = with pkgs; [\n intel-media-driver # VA-API (iHD)\n intel-compute-runtime # OpenCL / oneAPI\n ];\n };\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
}
},
"sensitive_attributes": [],
"identity_schema_version": 0
},
{
"index_key": "jaglan-beta-m05",
"schema_version": 0,
"attributes": {
"id": "1014569097848288622",
"triggers": {
"configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m05\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 7200;\n node_class = \"latte-panda-n150\";\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n plugin.docker.config.volumes.enabled = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"enp1s0\";\n interface.advertise = \"enp1s0\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Enable Intel iGPU (N150 UHD Graphics) for OpenVINO / VA-API workloads running in Docker\n hardware.graphics = {\n enable = true;\n extraPackages = with pkgs; [\n intel-media-driver # VA-API (iHD)\n intel-compute-runtime # OpenCL / oneAPI\n ];\n };\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface enp1s0\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=enp1s0 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
}
},
"sensitive_attributes": [],
"identity_schema_version": 0
},
{
"index_key": "jaglan-beta-m20",
"schema_version": 0,
"attributes": {
"id": "5433552964097828613",
"triggers": {
"configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m20\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 10000;\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n plugin.docker.config.volumes.enabled = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"ens2\";\n interface.advertise = \"ens2\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface ens2\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=ens2 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
}
},
"sensitive_attributes": [],
"identity_schema_version": 0
},
{
"index_key": "jaglan-beta-m21",
"schema_version": 0,
"attributes": {
"id": "4075263390053612248",
"triggers": {
"configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m21\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 10000;\n host_volume = {\n traefik = {\n path = \"/opt/traefik\";\n read_only = false;\n };\n postgres = {\n path = \"/opt/postgres\";\n read_only = false;\n };\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n plugin.docker.config.volumes.enabled = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"ens2\";\n interface.advertise = \"ens2\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n # Create a directory for traefik to store its data\n \"d /opt/traefik 0755 root root -\"\n # Create a directory for postgres to store its data\n \"d /opt/postgres 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface ens2\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=ens2 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
}
},
"sensitive_attributes": [],
"identity_schema_version": 0
},
{
"index_key": "jaglan-beta-m22",
"schema_version": 0,
"attributes": {
"id": "7878226664521626065",
"triggers": {
"configuration_content": "{ config, lib, pkgs, ... }:\n{\n imports =\n [ # Include the results of the hardware scan.\n ./hardware-configuration.nix\n ];\n\n nixpkgs.config.allowUnfree = true;\n\n # Use the systemd-boot EFI boot loader.\n boot.loader.systemd-boot.enable = true;\n boot.loader.efi.canTouchEfiVariables = true;\n\n networking.hostName = \"jaglan-beta-m22\"; # Define your hostname.\n\n time.timeZone = \"Australia/Melbourne\";\n\n # List packages installed in system profile. To search, run:\n # $ nix search wget\n # environment.systemPackages = with pkgs; [\n # vim # Do not forget to add an editor to edit configuration.nix! The Nano editor is also installed by default.\n # wget\n # ];\n\n # Some programs need SUID wrappers, can be configured further or are\n # started in user sessions.\n # programs.mtr.enable = true;\n # programs.gnupg.agent = {\n # enable = true;\n # enableSSHSupport = true;\n # };\n\n # List services that you want to enable:\n services = {\n nomad = {\n enable = true;\n enableDocker = true;\n dropPrivileges = false;\n settings = {\n datacenter = \"jaglan-beta\";\n server = {\n enabled = true;\n };\n client = {\n enabled = true;\n preferred_address_family = \"ipv4\";\n cpu_total_compute = 10000;\n host_volume = {\n };\n cni_path = \"${pkgs.cni-plugins}/bin\";\n };\n plugin.docker.config.allow_privileged = true;\n plugin.docker.config.volumes.enabled = true;\n };\n extraPackages = with pkgs; [\n cni-plugins\n consul\n ];\n };\n consul = {\n enable = true;\n webUi = true;\n interface.bind = \"ens2\";\n interface.advertise = \"ens2\";\n forceAddrFamily = \"ipv4\";\n extraConfig = {\n client_addr = \"{{ GetPrivateInterfaces | exclude \\\"type\\\" \\\"ipv6\\\" | join \\\"address\\\" \\\" \\\" }} {{ GetAllInterfaces | include \\\"flags\\\" \\\"loopback\\\" | join \\\"address\\\" \\\" \\\" }}\";\n server = true;\n retry_join = [\n \"jaglan-beta-m01\"\n \"jaglan-beta-m02\"\n \"jaglan-beta-m03\"\n \"jaglan-beta-m04\"\n \"jaglan-beta-m05\"\n \"jaglan-beta-m20\"\n \"jaglan-beta-m21\"\n \"jaglan-beta-m22\"\n ];\n datacenter = \"jaglan-beta\";\n connect.enabled = true;\n ports.grpc = 8502;\n };\n };\n openssh = {\n enable = true;\n settings.PermitRootLogin = \"yes\";\n };\n };\n\n systemd.tmpfiles.rules = [\n # Fix issue where nomad needs alloc_mounts to be writable\n \"d /var/lib/alloc_mounts 0755 root root -\"\n ];\n\n # Open ports in the firewall. 80/443 are for HTTP/HTTPS (terraform), 464X are the default ports for Nomad, 830X are the default ports for Consul.\n networking.firewall.allowedTCPPorts = [ 80 443 8081 4646 4647 4648 8300 8301 8500 ];\n networking.firewall.allowedUDPPorts = [ 8301 ];\n\n # Ensure Docker daemon is available (Nomad enableDocker only configures Nomad, does not guarantee docker service)\n virtualisation.docker.enable = true;\n\n # Proper systemd service definition for macvlan network creation\n systemd.services.docker-macvlan-network = {\n description = \"Ensure macvlan Docker network exists\";\n after = [ \"network-online.target\" \"docker.service\" ];\n wants = [ \"network-online.target\" \"docker.service\" ];\n wantedBy = [ \"multi-user.target\" ];\n serviceConfig = {\n Type = \"oneshot\";\n };\n # Provide required binaries in PATH\n path = [ pkgs.docker pkgs.bash pkgs.coreutils pkgs.iproute2 pkgs.gnugrep ];\n script = ''\n set -euo pipefail\n NET_NAME=macvlan\n if docker network inspect \"$NET_NAME\" \u003e/dev/null 2\u003e\u00261; then\n echo \"Docker network $NET_NAME already exists\"\n exit 0\n fi\n echo \"Creating Docker macvlan network $NET_NAME on interface ens2\"\n # We intentionally do NOT use --ip-range here to avoid allocating the\n # same reserved pool on every host (which could lead to collisions if\n # multiple macvlan containers are started across nodes). Instead, we\n # give critical services (like UniFi) an explicit static IP via the\n # Nomad job (Docker static assignment) and rely on manual DHCP\n # reservations to prevent conflicts.\n #\n # If you later need multiple macvlan-assigned containers per host,\n # consider one of these strategies:\n # 1. Per-host distinct network name + ip-range slice (macvlan-m01, ...)\n # 2. Parameterize an ip-range per host in Terraform and template here\n # 3. Keep a registry of allocated static IPs in Consul KV / Nomad vars\n docker network create -d macvlan \\\n --subnet=192.168.1.0/24 \\\n --gateway=192.168.1.1 \\\n -o parent=ens2 \\\n \"$NET_NAME\"\n echo \"Docker macvlan network $NET_NAME created\"\n '';\n restartIfChanged = false; # Don't rerun just because comment changed\n };\n\n # Copy the NixOS configuration file and link it from the resulting system\n # (/run/current-system/configuration.nix). This is useful in case you\n # accidentally delete configuration.nix.\n system.copySystemConfiguration = true;\n \n # Defines the initial NixOS version for compatibility with older application data.\n # Do NOT change this value after installation without careful consideration.\n system.stateVersion = \"24.11\"; # Did you read the comment?\n}\n"
}
},
"sensitive_attributes": [],
"identity_schema_version": 0
}
]
}
],
"check_results": null
}
Reference in New Issue View Git Blame Copy Permalink