feat(hosts/12kingdoms-suzu): migrate tailscale into microvm - mitsuha

hosts/12kingdoms-suzu/microvm-host.nix

@@ -20,73 +20,16 @@
 
       specialArgs = {inherit myvars mylib daeuniverse agenix mysecrets nuenv;};
 
-      config = {
-        imports = [
-          ./router
-          ../../secrets/nixos.nix
-          ../../modules/nixos/base/ssh.nix
-          ../../modules/nixos/base/user-group.nix
-          ../../modules/base.nix
-        ];
+      config.imports = [./suzi];
+    };
 
-        modules.secrets.server.network.enable = true;
+    mitsuha = {
+      autostart = true;
+      restartIfChanged = true;
 
-        microvm = {
-          mem = 1024; # RAM allocation in MB
-          vcpu = 1; # Number of Virtual CPU cores
+      specialArgs = {inherit myvars mylib nuenv;};
 
-          interfaces = [
-            {
-              type = "tap";
-              id = "vm-suzi"; # should be prefixed with "vm-"
-              mac = "02:00:00:00:00:01";
-            }
-          ];
-
-          # Block device images for persistent storage
-          # microvm use tmpfs for root(/), so everything else
-          # is ephemeral and will be lost on reboot.
-          #
-          # you can check this by running `df -Th` & `lsblk` in the VM.
-          volumes = [
-            {
-              mountPoint = "/var";
-              image = "var.img";
-              size = 512;
-            }
-            {
-              mountPoint = "/etc";
-              image = "etc.img";
-              size = 50;
-            }
-          ];
-
-          # shares can not be set to `neededForBoot = true;`
-          # so if you try to use a share in boot script(such as system.activationScripts), it will fail!
-          shares = [
-            {
-              # It is highly recommended to share the host's nix-store
-              # with the VMs to prevent building huge images.
-              # a host's /nix/store will be picked up so that no
-              # squashfs/erofs will be built for it.
-              #
-              # by this way, /nix/store is readonly in the VM,
-              # and thus the VM can't run any command that modifies
-              # the store. such as nix build, nix shell, etc...
-              # if you want to run nix commands in the VM, see
-              # https://github.com/astro/microvm.nix/blob/main/doc/src/shares.md#writable-nixstore-overlay
-              tag = "ro-store"; # Unique virtiofs daemon tag
-              proto = "virtiofs"; # virtiofs is faster than 9p
-              source = "/nix/store";
-              mountPoint = "/nix/.ro-store";
-            }
-          ];
-
-          hypervisor = "qemu";
-          # Control socket for the Hypervisor so that a MicroVM can be shutdown cleanly
-          socket = "control.socket";
-        };
-      };
+      config.imports = [./mitsuha];
     };
   };
 }

hosts/12kingdoms-suzu/microvm.md

@@ -30,6 +30,14 @@ microvm -r my-microvm
 ## 2. run `systemctl stop microvm@my-microvm` in the host
 ```
 
+## VM's pros compared to container
+
+1. VM has its own kernel, so it can use a fullfeatured kernel or customise the kernel's
+   configuration, without affecting the host.
+1. VM use a fullfeatured init system, so it can run services like a real machine.
+1. VM can use a fullfeatured network stack, so it can run network services like a real machine. it's
+   very useful for hosting some network services(such as tailscale, dae, etc).
+
 ## FAQ
 
 ### 1. enter the vm without ssh

hosts/12kingdoms-suzu/mitsuha/default.nix

@@ -0,0 +1,65 @@
+{mylib, ...}: {
+  imports =
+    (mylib.scanPaths ./.)
+    ++ [
+      ../../../modules/nixos/base/ssh.nix
+      ../../../modules/nixos/base/user-group.nix
+      ../../../modules/base.nix
+    ];
+
+  microvm = {
+    mem = 1024; # RAM allocation in MB
+    vcpu = 1; # Number of Virtual CPU cores
+
+    interfaces = [
+      {
+        type = "tap";
+        id = "vm-mitsuha"; # should be prefixed with "vm-"
+        mac = "02:00:00:00:00:02"; # Unique MAC address
+      }
+    ];
+
+    # Block device images for persistent storage
+    # microvm use tmpfs for root(/), so everything else
+    # is ephemeral and will be lost on reboot.
+    #
+    # you can check this by running `df -Th` & `lsblk` in the VM.
+    volumes = [
+      {
+        mountPoint = "/var";
+        image = "var.img";
+        size = 512;
+      }
+      {
+        mountPoint = "/etc";
+        image = "etc.img";
+        size = 50;
+      }
+    ];
+
+    # shares can not be set to `neededForBoot = true;`
+    # so if you try to use a share in boot script(such as system.activationScripts), it will fail!
+    shares = [
+      {
+        # It is highly recommended to share the host's nix-store
+        # with the VMs to prevent building huge images.
+        # a host's /nix/store will be picked up so that no
+        # squashfs/erofs will be built for it.
+        #
+        # by this way, /nix/store is readonly in the VM,
+        # and thus the VM can't run any command that modifies
+        # the store. such as nix build, nix shell, etc...
+        # if you want to run nix commands in the VM, see
+        # https://github.com/astro/microvm.nix/blob/main/doc/src/shares.md#writable-nixstore-overlay
+        tag = "ro-store"; # Unique virtiofs daemon tag
+        proto = "virtiofs"; # virtiofs is faster than 9p
+        source = "/nix/store";
+        mountPoint = "/nix/.ro-store";
+      }
+    ];
+
+    hypervisor = "qemu";
+    # Control socket for the Hypervisor so that a MicroVM can be shutdown cleanly
+    socket = "control.socket";
+  };
+}

hosts/12kingdoms-suzu/mitsuha/networking.nix

@@ -0,0 +1,19 @@
+{myvars, ...}: let
+  hostName = "mitsuha";
+  inherit (myvars.networking) mainGateway nameservers;
+  inherit (myvars.networking.hostsAddr.${hostName}) ipv4;
+
+  ipv4WithMask = "${ipv4}/24";
+in {
+  systemd.network.enable = true;
+
+  systemd.network.networks."20-lan" = {
+    matchConfig.Type = "ether";
+    networkConfig = {
+      Address = [ipv4WithMask];
+      Gateway = mainGateway;
+      DNS = nameservers;
+      DHCP = "no";
+    };
+  };
+}

hosts/12kingdoms-suzu/mitsuha/tailscale.nix

@@ -0,0 +1,42 @@
+{pkgs, ...}:
+# =============================================================
+#
+# Tailscale - your own private network(VPN) that uses WireGuard
+#
+# It's open source and free for personal use,
+# and it's really easy to setup and use.
+# Tailscale has great client coverage for Linux, windows, Mac, android, and iOS.
+# Tailscale is more mature and stable compared to other alternatives such as netbird/netmaker.
+# Maybe I'll give netbird/netmaker a try when they are more mature, but for now, I'm sticking with Tailscale.
+#
+# How to use:
+#  1. Create a Tailscale account at https://login.tailscale.com
+#  2. Login via `tailscale login`
+#  3. join into your Tailscale network via `tailscale up --advertise-routes 192.168.5.0/24`
+#  4. If you prefer automatic connection to Tailscale, use the `authKeyFile` option` in the config below.
+#
+# Status Data:
+#   `journalctl -u tailscaled` shows tailscaled's logs
+#   logs indicate that tailscale store its data in /var/lib/tailscale
+#   which is already persistent across reboots(via impermanence.nix)
+#
+# References:
+# https://github.com/NixOS/nixpkgs/blob/nixos-23.11/nixos/modules/services/networking/tailscale.nix
+#
+# =============================================================
+{
+  # make the tailscale command usable to users
+  environment.systemPackages = [pkgs.tailscale];
+
+  # enable the tailscale service
+  services.tailscale = {
+    enable = true;
+    port = 41641;
+    interfaceName = "tailscale0";
+    # allow the Tailscale UDP port through the firewall
+    openFirewall = true;
+    useRoutingFeatures = "server";
+    extraUpFlags = "--advertise-routes 192.168.5.0/24";
+    # authKeyFile = "/var/lib/tailscale/authkey";
+  };
+}

hosts/12kingdoms-suzu/router/default.nix

@@ -1,3 +0,0 @@
-{mylib, ...}: {
-  imports = mylib.scanPaths ./.;
-}

hosts/12kingdoms-suzu/suzi/default.nix

@@ -0,0 +1,68 @@
+{mylib, ...}: {
+  imports =
+    (mylib.scanPaths ./.)
+    ++ [
+      ../../../secrets/nixos.nix
+      ../../../modules/nixos/base/ssh.nix
+      ../../../modules/nixos/base/user-group.nix
+      ../../../modules/base.nix
+    ];
+
+  modules.secrets.server.network.enable = true;
+
+  microvm = {
+    mem = 1024; # RAM allocation in MB
+    vcpu = 1; # Number of Virtual CPU cores
+
+    interfaces = [
+      {
+        type = "tap";
+        id = "vm-suzi"; # should be prefixed with "vm-"
+        mac = "02:00:00:00:00:01"; # unique MAC address
+      }
+    ];
+
+    # Block device images for persistent storage
+    # microvm use tmpfs for root(/), so everything else
+    # is ephemeral and will be lost on reboot.
+    #
+    # you can check this by running `df -Th` & `lsblk` in the VM.
+    volumes = [
+      {
+        mountPoint = "/var";
+        image = "var.img";
+        size = 512;
+      }
+      {
+        mountPoint = "/etc";
+        image = "etc.img";
+        size = 50;
+      }
+    ];
+
+    # shares can not be set to `neededForBoot = true;`
+    # so if you try to use a share in boot script(such as system.activationScripts), it will fail!
+    shares = [
+      {
+        # It is highly recommended to share the host's nix-store
+        # with the VMs to prevent building huge images.
+        # a host's /nix/store will be picked up so that no
+        # squashfs/erofs will be built for it.
+        #
+        # by this way, /nix/store is readonly in the VM,
+        # and thus the VM can't run any command that modifies
+        # the store. such as nix build, nix shell, etc...
+        # if you want to run nix commands in the VM, see
+        # https://github.com/astro/microvm.nix/blob/main/doc/src/shares.md#writable-nixstore-overlay
+        tag = "ro-store"; # Unique virtiofs daemon tag
+        proto = "virtiofs"; # virtiofs is faster than 9p
+        source = "/nix/store";
+        mountPoint = "/nix/.ro-store";
+      }
+    ];
+
+    hypervisor = "qemu";
+    # Control socket for the Hypervisor so that a MicroVM can be shutdown cleanly
+    socket = "control.socket";
+  };
+}