colmena: configuration et doc

README.md

@@ -71,3 +71,36 @@ commande :
 ```bash
 $ nix fmt
 ```
+
+## Colmena
+
+Pour faciliter le redeploiement des machines, l'outils colmena est utilisé.
+Pour cela, l'ensemble des machines doivent être écrite dans la `flake` au
+format `colmena.<name>`. Des tags peuvent être ajouté avec `deployment.tags`
+afin redéployer un groupe de machines en même temps.
+
+Pour utiliser les commandes suivantes, il est nécessaire d'avoir colmena sur
+son ordinateur. La commande `nix develop` s'en chargera.
+
+Remarque :
+
+> Si l'ensemble des fichiers du repertoire ne sont pas commit, alors colmena
+> considérera que le répertoire est "impure". S'il est vraiment nécessaire
+> d'appliquer la confifuration, il est possible de le faire à l'aide du flag
+> `--impure`.
+
+### Build
+
+```bash
+$ colmena build # Build toutes les machines
+$ colmena build --on <machine> # Build uniquement la machine <machine>
+$ colmena build --on @<tag> # Build les machines possédant ce tag
+```
+
+### Apply
+
+```bash
+$ colmena apply # Apply toutes les machines
+$ colmena apply --on <machine> # Apply uniquement la machine <machine>
+$ colmena apply --on @<tag> # Apply les machines possédant ce tag
+```

devshells/default.nix

@@ -5,5 +5,6 @@ pkgs.mkShell {
 
   packages = [
     agenix.packages.x86_64-linux.default
+    pkgs.colmena
   ];
 }

disks/layout_vm_log.nix

@@ -0,0 +1,24 @@
+{ ... }:
+
+{
+  disko.devices = {
+    disk = {
+      logs = {
+        type = "disk";
+        content = {
+          type = "gpt";
+          partitions = {
+            data = {
+              size = "100%";
+              content = {
+                type = "filesystem";
+                format = "ext4";
+                mountpoint = "/var/log";
+              };
+            };
+          };
+        };
+      };
+    };
+  };
+}

flake.nix

@@ -34,42 +34,86 @@
     }:
     flake-parts.lib.mkFlake { inherit inputs; } {
       imports = [ inputs.treefmt-nix.flakeModule ];
-
       systems = [ "x86_64-linux" ];
 
-      flake = with nixpkgs.lib; {
+      flake = with nixpkgs.lib;
-        nixosConfigurations =
+        let
-          let
+          defaultConfig = [
-            defaultConfig = [
+            ./profiles/common
-              ./profiles/common
 
-              agenix.nixosModules.default
+            agenix.nixosModules.default
-              disko.nixosModules.disko
+            disko.nixosModules.disko
-            ];
+          ];
-            defaultVM = [
+          defaultVM = [
-              ./profiles/vm
+            ./profiles/vm
-              ./disks/layout_vm.nix
+            ./disks/layout_vm.nix
-            ]
+          ]
-            ++ defaultConfig;
+          ++ defaultConfig;
-          in
+          machines = {
-          {
+            jitsi = {
-            grafana = nixosSystem {
+              domain = "pub.infra.auro.re";
-              specialArgs = inputs;
+              tags = [ "vm" ];
-              modules = [
+              config = [ ./hosts/vm/jitsi ] ++ defaultVM;
-                ./hosts/vm/grafana
-              ]
-              ++ defaultVM;
             };
-            # VL: Peut-être avoir de l'auto-discovery: On a beaucoup trop de machines
+            grafana = {
-            jitsi = nixosSystem {
+              domain = "ext.infra.auro.re";
-              specialArgs = inputs;
+              tags = [ "vm" ];
-              modules = [
+              config = [
-                ./hosts/vm/jitsi
+                ./hosts/vm/grafana
-              ]
+              ] ++ defaultVM;
-              ++ defaultVM;
+            };
+            log-2 = {
+              domain = "int.infra.auro.re";
+              tags = [ "vm" "log" ];
+              config = [
+                ./hosts/vm/log-2
+                ./disks/layout_vm_log.nix
+              ] ++ defaultVM;
             };
           };
-      };
+          colmena_conf = builtins.mapAttrs
+            (
+              name: conf: {
+                deployment = {
+                  targetHost = "${name}.${conf.domain}";
+                  targetPort = 22;
+                  targetUser = "root";
+                  tags = conf.tags;
+                };
+                networking = {
+                  hostName = name;
+                  domain = conf.domain;
+                };
+                imports = conf.config;
+              }
+            )
+            machines;
+          nixos_conf = builtins.mapAttrs
+            (
+              name: conf: nixosSystem {
+                specialArgs = inputs;
+                modules = [{
+                  networking = {
+                    hostName = name;
+                    domain = conf.domain;
+                  };
+                }] ++ conf.config;
+              }
+            )
+            machines;
+        in
+        {
+          colmena = {
+            meta = {
+              nixpkgs = import nixpkgs {
+                system = "x86_64-linux";
+                overlays = [ ];
+              };
+            };
+          } // colmena_conf;
+
+          nixosConfigurations = nixos_conf;
+        };
 
       perSystem = { config, pkgs, system, ... }:
         {
@@ -80,13 +124,9 @@
           # Formatter
           treefmt.config = {
             package = pkgs.treefmt;
-
             programs = {
-              # *.nix
+              nixpkgs-fmt.enable = true; # *.nix
-              nixpkgs-fmt.enable = true;
+              prettier.enable = true; # *.md (and more)
-
-              # *.md (and more)
-              prettier.enable = true;
             };
           };
         };

hosts/vm/grafana/default.nix

@@ -5,11 +5,6 @@
     ./grafana.nix
   ];
 
-  networking = {
-    hostName = "grafana";
-    domain = "ext.infra.auro.re";
-  };
-
   boot.loader.systemd-boot.enable = true;
 
   systemd.network = {

hosts/vm/jitsi/default.nix

@@ -5,11 +5,6 @@
     ./jitsi.nix
   ];
 
-  networking = {
-    hostName = "jitsi";
-    domain = "pub.infra.auro.re";
-  };
-
   boot.loader.systemd-boot.enable = true;
 
   systemd.network = {

hosts/vm/log-2/default.nix

@@ -0,0 +1,51 @@
+{ ... }:
+
+{
+  imports = [
+    ./log.nix
+  ];
+
+  disko.devices.disk.logs.device = "/dev/disk/by-id/scsi-0QEMU_QEMU_HARDDISK_drive-scsi1";
+
+  boot.loader.systemd-boot.enable = true;
+
+  systemd.network = {
+    enable = true;
+
+    links = {
+      "10-int" = {
+        matchConfig.MACAddress = "04:00:00:37:f2:a1";
+        linkConfig.Name = "int";
+      };
+    };
+
+    networks = {
+      "10-int" = {
+        domains = [
+          "int.infra.auro.re"
+          "auro.re"
+        ];
+        matchConfig.Name = "int";
+        linkConfig.RequiredForOnline = "routable";
+        address = [
+          "10.206.1.10/16"
+          "2a09:6840:206::1:10/64"
+        ];
+        routes = [
+          { Gateway = "10.206.0.1"; }
+          { Gateway = "2a09:6840:206::1"; }
+        ];
+        dns = [
+          "10.206.1.1"
+          "10.206.1.2"
+          "2a09:6840:206::1:1"
+          "2a09:6840:206::1:2"
+        ];
+      };
+    };
+  };
+
+  # TODO: script de rotation des logs
+
+  system.stateVersion = "25.05";
+}

hosts/vm/log-2/log.nix

@@ -0,0 +1,43 @@
+{ ... }:
+
+{
+  services.rsyslogd = {
+    extraConfig = ''
+      module(load="mmrm1stspace")
+      module(load="imrelp")
+
+      template(name="incomingFilename" type="list") {
+          constant(value="/var/log/remote/")
+          property(name="fromhost-ip")
+          constant(value="/")
+          property(name="timegenerated" dateFormat="year")
+          constant(value="-")
+          property(name="timegenerated" dateFormat="month")
+          constant(value="-")
+          property(name="timegenerated" dateFormat="day")
+          constant(value=".log")
+      }
+
+      ruleset(name="handleIncomingLogs") {
+          action(type="mmrm1stspace")
+          action(
+              type="omfile"
+              dynaFile="incomingFilename"
+              template="RSYSLOG_FileFormat"
+          )
+      }
+
+      input(
+          type="imrelp"
+          port="20514"
+          ruleset="handleIncomingLogs"
+      )
+    '';
+  };
+
+  networking.firewall.allowedTCPPorts = [ 20514 ];
+
+  systemd.tmpfiles.rules = [
+    "d /var/log/remote 0750 root root -"
+  ];
+}

profiles/common/default.nix

@@ -8,6 +8,7 @@
     ./ntp.nix
     ./programs.nix
     ./prometheus-node-exporter.nix
+    ./rsyslog.nix
     ./ssh.nix
     ./tmp.nix
   ];

profiles/common/rsyslog.nix

@@ -0,0 +1,59 @@
+{ lib, ... }:
+
+{
+  services.rsyslogd = {
+    enable = true;
+    defaultConfig = ''
+      # TODO: Vérifier s'il existe des services qui ne savent pas envoyer
+      #       leurs logs sur journald (peut-être freeradius)
+      global(
+          workDirectory="/var/spool/rsyslog" # TODO: read the doc
+          preserveFQDN="on"
+      )
+
+      module(load="imjournal")
+      module(load="mmjsonparse")
+      module(load="omrelp")
+
+      module(
+          load="builtin:omfile"
+          template="RSYSLOG_FileFormat"
+          fileOwner="root"
+          fileGroup="root"
+          fileCreateMode="0640"
+          dirCreateMode="0755"
+      )
+
+      ruleset(name="sendLogsToRemote") {
+          action(
+              type="omrelp"
+
+              target="10.206.1.10"
+              port="20514"
+
+              queue.type="LinkedList"
+              queue.spoolDirectory="/var/spool/rsyslog"
+              queue.fileName="queue_1"
+              queue.saveOnShutdown="on"
+
+              queue.highWatermark="500"
+              queue.lowWatermark="100"
+              queue.checkpointInterval="200"
+              queue.syncqueuefiles="on"
+              queue.maxDiskSpace="500m"
+
+              action.resumeRetryCount="-1"
+              action.reportSuspension="on"
+              action.reportSuspensionContinuation="on"
+          )
+      }
+
+      # Send local logs to the remote collector
+      call sendLogsToRemote
+    '';
+  };
+
+  # Pas de risque de boucle dès lors qu'on n'injecte pas les logs
+  # dans journald. 
+  systemd.services.syslog.serviceConfig.StandardOutput = lib.mkForce "journal";
+}

profiles/vm/nginx.nix

@@ -6,5 +6,14 @@
     recommendedOptimisation = true;
     recommendedGzipSettings = true;
     recommendedProxySettings = true;
+
+    # TODO: Les logs nginx sont préfixés 2 fois avec le hostname
+    #       du service.
+    # TODO: Ces logs pourraient avoir un app-name pour faciliter
+    #       le filtrage (nginx access, nginx error).
+    appendHttpConfig = ''
+      access_log syslog:server=unix:/dev/log combined;
+      error_log syslog:server=unix:/dev/log;
+    '';
   };
 }