feat(hosts/12kingdoms-suzu): migrate tailscale into microvm - mitsuha

hosts/12kingdoms-rakushun/default.nix

@@ -22,7 +22,6 @@ in {
 
     ./gitea.nix
     ./caddy.nix
-    ./tailscale.nix
   ];
 
   networking = {

hosts/12kingdoms-suzu/microvm-host.nix

@@ -20,73 +20,16 @@
 
       specialArgs = {inherit myvars mylib daeuniverse agenix mysecrets nuenv;};
 
-      config = {
-        imports = [
-          ./router
-          ../../secrets/nixos.nix
-          ../../modules/nixos/base/ssh.nix
-          ../../modules/nixos/base/user-group.nix
-          ../../modules/base.nix
-        ];
+      config.imports = [./suzi];
+    };
 
-        modules.secrets.server.network.enable = true;
+    mitsuha = {
+      autostart = true;
+      restartIfChanged = true;
 
-        microvm = {
-          mem = 1024; # RAM allocation in MB
-          vcpu = 1; # Number of Virtual CPU cores
+      specialArgs = {inherit myvars mylib nuenv;};
 
-          interfaces = [
-            {
-              type = "tap";
-              id = "vm-suzi"; # should be prefixed with "vm-"
-              mac = "02:00:00:00:00:01";
-            }
-          ];
-
-          # Block device images for persistent storage
-          # microvm use tmpfs for root(/), so everything else
-          # is ephemeral and will be lost on reboot.
-          #
-          # you can check this by running `df -Th` & `lsblk` in the VM.
-          volumes = [
-            {
-              mountPoint = "/var";
-              image = "var.img";
-              size = 512;
-            }
-            {
-              mountPoint = "/etc";
-              image = "etc.img";
-              size = 50;
-            }
-          ];
-
-          # shares can not be set to `neededForBoot = true;`
-          # so if you try to use a share in boot script(such as system.activationScripts), it will fail!
-          shares = [
-            {
-              # It is highly recommended to share the host's nix-store
-              # with the VMs to prevent building huge images.
-              # a host's /nix/store will be picked up so that no
-              # squashfs/erofs will be built for it.
-              #
-              # by this way, /nix/store is readonly in the VM,
-              # and thus the VM can't run any command that modifies
-              # the store. such as nix build, nix shell, etc...
-              # if you want to run nix commands in the VM, see
-              # https://github.com/astro/microvm.nix/blob/main/doc/src/shares.md#writable-nixstore-overlay
-              tag = "ro-store"; # Unique virtiofs daemon tag
-              proto = "virtiofs"; # virtiofs is faster than 9p
-              source = "/nix/store";
-              mountPoint = "/nix/.ro-store";
-            }
-          ];
-
-          hypervisor = "qemu";
-          # Control socket for the Hypervisor so that a MicroVM can be shutdown cleanly
-          socket = "control.socket";
-        };
-      };
+      config.imports = [./mitsuha];
     };
   };
 }

hosts/12kingdoms-suzu/microvm.md

@@ -30,6 +30,14 @@ microvm -r my-microvm
 ## 2. run `systemctl stop microvm@my-microvm` in the host
 ```
 
+## VM's pros compared to container
+
+1. VM has its own kernel, so it can use a fullfeatured kernel or customise the kernel's
+   configuration, without affecting the host.
+1. VM use a fullfeatured init system, so it can run services like a real machine.
+1. VM can use a fullfeatured network stack, so it can run network services like a real machine. it's
+   very useful for hosting some network services(such as tailscale, dae, etc).
+
 ## FAQ
 
 ### 1. enter the vm without ssh

hosts/12kingdoms-suzu/mitsuha/default.nix

@@ -0,0 +1,65 @@
+{mylib, ...}: {
+  imports =
+    (mylib.scanPaths ./.)
+    ++ [
+      ../../../modules/nixos/base/ssh.nix
+      ../../../modules/nixos/base/user-group.nix
+      ../../../modules/base.nix
+    ];
+
+  microvm = {
+    mem = 1024; # RAM allocation in MB
+    vcpu = 1; # Number of Virtual CPU cores
+
+    interfaces = [
+      {
+        type = "tap";
+        id = "vm-mitsuha"; # should be prefixed with "vm-"
+        mac = "02:00:00:00:00:02"; # Unique MAC address
+      }
+    ];
+
+    # Block device images for persistent storage
+    # microvm use tmpfs for root(/), so everything else
+    # is ephemeral and will be lost on reboot.
+    #
+    # you can check this by running `df -Th` & `lsblk` in the VM.
+    volumes = [
+      {
+        mountPoint = "/var";
+        image = "var.img";
+        size = 512;
+      }
+      {
+        mountPoint = "/etc";
+        image = "etc.img";
+        size = 50;
+      }
+    ];
+
+    # shares can not be set to `neededForBoot = true;`
+    # so if you try to use a share in boot script(such as system.activationScripts), it will fail!
+    shares = [
+      {
+        # It is highly recommended to share the host's nix-store
+        # with the VMs to prevent building huge images.
+        # a host's /nix/store will be picked up so that no
+        # squashfs/erofs will be built for it.
+        #
+        # by this way, /nix/store is readonly in the VM,
+        # and thus the VM can't run any command that modifies
+        # the store. such as nix build, nix shell, etc...
+        # if you want to run nix commands in the VM, see
+        # https://github.com/astro/microvm.nix/blob/main/doc/src/shares.md#writable-nixstore-overlay
+        tag = "ro-store"; # Unique virtiofs daemon tag
+        proto = "virtiofs"; # virtiofs is faster than 9p
+        source = "/nix/store";
+        mountPoint = "/nix/.ro-store";
+      }
+    ];
+
+    hypervisor = "qemu";
+    # Control socket for the Hypervisor so that a MicroVM can be shutdown cleanly
+    socket = "control.socket";
+  };
+}

hosts/12kingdoms-suzu/mitsuha/networking.nix

@@ -0,0 +1,19 @@
+{myvars, ...}: let
+  hostName = "mitsuha";
+  inherit (myvars.networking) mainGateway nameservers;
+  inherit (myvars.networking.hostsAddr.${hostName}) ipv4;
+
+  ipv4WithMask = "${ipv4}/24";
+in {
+  systemd.network.enable = true;
+
+  systemd.network.networks."20-lan" = {
+    matchConfig.Type = "ether";
+    networkConfig = {
+      Address = [ipv4WithMask];
+      Gateway = mainGateway;
+      DNS = nameservers;
+      DHCP = "no";
+    };
+  };
+}

hosts/12kingdoms-suzu/mitsuha/tailscale.nix

@@ -1,13 +1,9 @@
-{
-  config,
-  pkgs,
-  ...
-}:
+{pkgs, ...}:
 # =============================================================
 #
 # Tailscale - your own private network(VPN) that uses WireGuard
 #
-# It's open souce and free for personal use,
+# It's open source and free for personal use,
 # and it's really easy to setup and use.
 # Tailscale has great client coverage for Linux, windows, Mac, android, and iOS.
 # Tailscale is more mature and stable compared to other alternatives such as netbird/netmaker.

hosts/12kingdoms-suzu/router/default.nix

@@ -1,3 +0,0 @@
-{mylib, ...}: {
-  imports = mylib.scanPaths ./.;
-}

hosts/12kingdoms-suzu/suzi/default.nix

@@ -0,0 +1,68 @@
+{mylib, ...}: {
+  imports =
+    (mylib.scanPaths ./.)
+    ++ [
+      ../../../secrets/nixos.nix
+      ../../../modules/nixos/base/ssh.nix
+      ../../../modules/nixos/base/user-group.nix
+      ../../../modules/base.nix
+    ];
+
+  modules.secrets.server.network.enable = true;
+
+  microvm = {
+    mem = 1024; # RAM allocation in MB
+    vcpu = 1; # Number of Virtual CPU cores
+
+    interfaces = [
+      {
+        type = "tap";
+        id = "vm-suzi"; # should be prefixed with "vm-"
+        mac = "02:00:00:00:00:01"; # unique MAC address
+      }
+    ];
+
+    # Block device images for persistent storage
+    # microvm use tmpfs for root(/), so everything else
+    # is ephemeral and will be lost on reboot.
+    #
+    # you can check this by running `df -Th` & `lsblk` in the VM.
+    volumes = [
+      {
+        mountPoint = "/var";
+        image = "var.img";
+        size = 512;
+      }
+      {
+        mountPoint = "/etc";
+        image = "etc.img";
+        size = 50;
+      }
+    ];
+
+    # shares can not be set to `neededForBoot = true;`
+    # so if you try to use a share in boot script(such as system.activationScripts), it will fail!
+    shares = [
+      {
+        # It is highly recommended to share the host's nix-store
+        # with the VMs to prevent building huge images.
+        # a host's /nix/store will be picked up so that no
+        # squashfs/erofs will be built for it.
+        #
+        # by this way, /nix/store is readonly in the VM,
+        # and thus the VM can't run any command that modifies
+        # the store. such as nix build, nix shell, etc...
+        # if you want to run nix commands in the VM, see
+        # https://github.com/astro/microvm.nix/blob/main/doc/src/shares.md#writable-nixstore-overlay
+        tag = "ro-store"; # Unique virtiofs daemon tag
+        proto = "virtiofs"; # virtiofs is faster than 9p
+        source = "/nix/store";
+        mountPoint = "/nix/.ro-store";
+      }
+    ];
+
+    hypervisor = "qemu";
+    # Control socket for the Hypervisor so that a MicroVM can be shutdown cleanly
+    socket = "control.socket";
+  };
+}

vars/networking.nix

@@ -75,9 +75,13 @@
       ipv4 = "192.168.5.179";
     };
     suzi = {
-      iface = "eth1";
+      iface = "eth1"; # fake iface, it's not used by the host
       ipv4 = "192.168.5.178";
     };
+    mitsuha = {
+      iface = "eth1"; # fake iface, it's not used by the host
+      ipv4 = "192.168.5.177";
+    };
 
     # ============================================
     # Kubernetes Clusters