From 7bc465b41469cfeabf76bcc129a2457f02c2ecc9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Torjus=20H=C3=A5kestad?= Date: Sat, 7 Feb 2026 13:26:28 +0100 Subject: [PATCH] hosts: add testvm01, testvm02, testvm03 test hosts Three permanent test hosts for validating deployment and bootstrapping workflow. Each host configured with: - Static IP (10.69.13.20-22/24) - Vault AppRole integration - Bootstrap from deploy-test-hosts branch Co-Authored-By: Claude Opus 4.5 --- flake.nix | 27 ++++++++++++ hosts/testvm01/configuration.nix | 66 ++++++++++++++++++++++++++++++ hosts/testvm01/default.nix | 5 +++ hosts/testvm02/configuration.nix | 66 ++++++++++++++++++++++++++++++ hosts/testvm02/default.nix | 5 +++ hosts/testvm03/configuration.nix | 66 ++++++++++++++++++++++++++++++ hosts/testvm03/default.nix | 5 +++ terraform/vault/hosts-generated.tf | 16 ++++++++ terraform/vms.tf | 24 +++++++++++ 9 files changed, 280 insertions(+) create mode 100644 hosts/testvm01/configuration.nix create mode 100644 hosts/testvm01/default.nix create mode 100644 hosts/testvm02/configuration.nix create mode 100644 hosts/testvm02/default.nix create mode 100644 hosts/testvm03/configuration.nix create mode 100644 hosts/testvm03/default.nix diff --git a/flake.nix b/flake.nix index 91e32b9..fae0a17 100644 --- a/flake.nix +++ b/flake.nix @@ -195,6 +195,33 @@ ./hosts/vault01 ]; }; + testvm01 = nixpkgs.lib.nixosSystem { + inherit system; + specialArgs = { + inherit inputs self sops-nix; + }; + modules = commonModules ++ [ + ./hosts/testvm01 + ]; + }; + testvm02 = nixpkgs.lib.nixosSystem { + inherit system; + specialArgs = { + inherit inputs self sops-nix; + }; + modules = commonModules ++ [ + ./hosts/testvm02 + ]; + }; + testvm03 = nixpkgs.lib.nixosSystem { + inherit system; + specialArgs = { + inherit inputs self sops-nix; + }; + modules = commonModules ++ [ + ./hosts/testvm03 + ]; + }; }; packages = forAllSystems ( { pkgs }: diff --git a/hosts/testvm01/configuration.nix b/hosts/testvm01/configuration.nix new file mode 100644 index 0000000..77b71fe --- /dev/null +++ b/hosts/testvm01/configuration.nix @@ -0,0 +1,66 @@ +{ + config, + lib, + pkgs, + ... +}: + +{ + imports = [ + ../template2/hardware-configuration.nix + + ../../system + ../../common/vm + ]; + + # Host metadata (adjust as needed) + homelab.host = { + tier = "test"; # Start in test tier, move to prod after validation + }; + + nixpkgs.config.allowUnfree = true; + boot.loader.grub.enable = true; + boot.loader.grub.device = "/dev/vda"; + + networking.hostName = "testvm01"; + networking.domain = "home.2rjus.net"; + networking.useNetworkd = true; + networking.useDHCP = false; + services.resolved.enable = true; + networking.nameservers = [ + "10.69.13.5" + "10.69.13.6" + ]; + + systemd.network.enable = true; + systemd.network.networks."ens18" = { + matchConfig.Name = "ens18"; + address = [ + "10.69.13.20/24" + ]; + routes = [ + { Gateway = "10.69.13.1"; } + ]; + linkConfig.RequiredForOnline = "routable"; + }; + time.timeZone = "Europe/Oslo"; + + nix.settings.experimental-features = [ + "nix-command" + "flakes" + ]; + nix.settings.tarball-ttl = 0; + environment.systemPackages = with pkgs; [ + vim + wget + git + ]; + + # Open ports in the firewall. + # networking.firewall.allowedTCPPorts = [ ... ]; + # networking.firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + networking.firewall.enable = false; + + system.stateVersion = "25.11"; # Did you read the comment? +} \ No newline at end of file diff --git a/hosts/testvm01/default.nix b/hosts/testvm01/default.nix new file mode 100644 index 0000000..57ed4b4 --- /dev/null +++ b/hosts/testvm01/default.nix @@ -0,0 +1,5 @@ +{ ... }: { + imports = [ + ./configuration.nix + ]; +} \ No newline at end of file diff --git a/hosts/testvm02/configuration.nix b/hosts/testvm02/configuration.nix new file mode 100644 index 0000000..dd3d718 --- /dev/null +++ b/hosts/testvm02/configuration.nix @@ -0,0 +1,66 @@ +{ + config, + lib, + pkgs, + ... +}: + +{ + imports = [ + ../template2/hardware-configuration.nix + + ../../system + ../../common/vm + ]; + + # Host metadata (adjust as needed) + homelab.host = { + tier = "test"; # Start in test tier, move to prod after validation + }; + + nixpkgs.config.allowUnfree = true; + boot.loader.grub.enable = true; + boot.loader.grub.device = "/dev/vda"; + + networking.hostName = "testvm02"; + networking.domain = "home.2rjus.net"; + networking.useNetworkd = true; + networking.useDHCP = false; + services.resolved.enable = true; + networking.nameservers = [ + "10.69.13.5" + "10.69.13.6" + ]; + + systemd.network.enable = true; + systemd.network.networks."ens18" = { + matchConfig.Name = "ens18"; + address = [ + "10.69.13.21/24" + ]; + routes = [ + { Gateway = "10.69.13.1"; } + ]; + linkConfig.RequiredForOnline = "routable"; + }; + time.timeZone = "Europe/Oslo"; + + nix.settings.experimental-features = [ + "nix-command" + "flakes" + ]; + nix.settings.tarball-ttl = 0; + environment.systemPackages = with pkgs; [ + vim + wget + git + ]; + + # Open ports in the firewall. + # networking.firewall.allowedTCPPorts = [ ... ]; + # networking.firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + networking.firewall.enable = false; + + system.stateVersion = "25.11"; # Did you read the comment? +} \ No newline at end of file diff --git a/hosts/testvm02/default.nix b/hosts/testvm02/default.nix new file mode 100644 index 0000000..57ed4b4 --- /dev/null +++ b/hosts/testvm02/default.nix @@ -0,0 +1,5 @@ +{ ... }: { + imports = [ + ./configuration.nix + ]; +} \ No newline at end of file diff --git a/hosts/testvm03/configuration.nix b/hosts/testvm03/configuration.nix new file mode 100644 index 0000000..9ac7f5d --- /dev/null +++ b/hosts/testvm03/configuration.nix @@ -0,0 +1,66 @@ +{ + config, + lib, + pkgs, + ... +}: + +{ + imports = [ + ../template2/hardware-configuration.nix + + ../../system + ../../common/vm + ]; + + # Host metadata (adjust as needed) + homelab.host = { + tier = "test"; # Start in test tier, move to prod after validation + }; + + nixpkgs.config.allowUnfree = true; + boot.loader.grub.enable = true; + boot.loader.grub.device = "/dev/vda"; + + networking.hostName = "testvm03"; + networking.domain = "home.2rjus.net"; + networking.useNetworkd = true; + networking.useDHCP = false; + services.resolved.enable = true; + networking.nameservers = [ + "10.69.13.5" + "10.69.13.6" + ]; + + systemd.network.enable = true; + systemd.network.networks."ens18" = { + matchConfig.Name = "ens18"; + address = [ + "10.69.13.22/24" + ]; + routes = [ + { Gateway = "10.69.13.1"; } + ]; + linkConfig.RequiredForOnline = "routable"; + }; + time.timeZone = "Europe/Oslo"; + + nix.settings.experimental-features = [ + "nix-command" + "flakes" + ]; + nix.settings.tarball-ttl = 0; + environment.systemPackages = with pkgs; [ + vim + wget + git + ]; + + # Open ports in the firewall. + # networking.firewall.allowedTCPPorts = [ ... ]; + # networking.firewall.allowedUDPPorts = [ ... ]; + # Or disable the firewall altogether. + networking.firewall.enable = false; + + system.stateVersion = "25.11"; # Did you read the comment? +} \ No newline at end of file diff --git a/hosts/testvm03/default.nix b/hosts/testvm03/default.nix new file mode 100644 index 0000000..57ed4b4 --- /dev/null +++ b/hosts/testvm03/default.nix @@ -0,0 +1,5 @@ +{ ... }: { + imports = [ + ./configuration.nix + ]; +} \ No newline at end of file diff --git a/terraform/vault/hosts-generated.tf b/terraform/vault/hosts-generated.tf index 7b3049b..630a7bb 100644 --- a/terraform/vault/hosts-generated.tf +++ b/terraform/vault/hosts-generated.tf @@ -5,6 +5,22 @@ # Each host gets access to its own secrets under hosts//* locals { generated_host_policies = { + "testvm01" = { + paths = [ + "secret/data/hosts/testvm01/*", + ] + } + "testvm02" = { + paths = [ + "secret/data/hosts/testvm02/*", + ] + } + "testvm03" = { + paths = [ + "secret/data/hosts/testvm03/*", + ] + } + } # Placeholder secrets - user should add actual secrets manually or via tofu diff --git a/terraform/vms.tf b/terraform/vms.tf index b7c6c5d..35d66b2 100644 --- a/terraform/vms.tf +++ b/terraform/vms.tf @@ -38,6 +38,30 @@ locals { disk_size = "20G" flake_branch = "vault-setup" # Bootstrap from this branch instead of master } + "testvm01" = { + ip = "10.69.13.20/24" + cpu_cores = 2 + memory = 2048 + disk_size = "20G" + flake_branch = "deploy-test-hosts" + vault_wrapped_token = "s.3XeDNvlhS5wqjjeOw1w7q4Cp" + } + "testvm02" = { + ip = "10.69.13.21/24" + cpu_cores = 2 + memory = 2048 + disk_size = "20G" + flake_branch = "deploy-test-hosts" + vault_wrapped_token = "s.JDFHGWsWUBU9vKAFZK3XPu3X" + } + "testvm03" = { + ip = "10.69.13.22/24" + cpu_cores = 2 + memory = 2048 + disk_size = "20G" + flake_branch = "deploy-test-hosts" + vault_wrapped_token = "s.Msj0c4viIrvxprxRZZqw3jj4" + } } # Compute VM configurations with defaults applied