0 Fork 0

mirror of https://github.com/ryan4yin/nix-config.git synced 2026-11-13 12:13:46 +01:00

Files

T

Ryan Yin d4aa25d368 fix(k3s): deny pod sources the etcd client port 2379

The etcd client API listens on the masters' static LAN address, and the
pod-source deny lists omitted it. Add 2379 to both nft drop lines and
assert it in the security-k3s-pod-firewall eval test. 2381 (etcd
metrics, scraped by in-cluster monitoring) stays reachable by design.

Pairs with the matching Cilium egressDeny port in k8s-gitops.

Assisted-by: DeepSeek Harness (gpt-6-astra)

2026-10-24 14:16:14 +08:00

colmenaSystem.nix

fix(colmena): deploy the systems nixosConfigurations evaluates

2026-10-21 20:59:07 +08:00

default.nix

chore: remove dead configuration (#352 )

2026-10-03 10:09:38 +08:00

genK3sAgentModule.nix

fix(k3s): deny pod sources the etcd client port 2379

2026-10-24 14:16:14 +08:00

genK3sServerModule.nix

fix(k3s): deny pod sources the etcd client port 2379

2026-10-24 14:16:14 +08:00

genLibvirtDomainXml.nix

fix(nfs,libvirt): restrict the golden export and bind VNC to loopback (#400 )

2026-10-07 15:10:52 +08:00

genMicrovmGuestModule.nix

docs: review and correct comments and documentation (#436 )

2026-10-12 10:02:38 +08:00

genVmHostModule.nix

fix(power): drop TuneD for native CPU scaling (#461 )

2026-10-16 16:45:08 +08:00

macosSystem.nix

feat: format via 'ls **/*.nix | each { |it| nixfmt $it.name }'

2025-07-30 12:17:24 +08:00

nixosSystem.nix

chore: replace nixos-generators image outputs

2026-06-14 14:10:08 +08:00

README.md

docs: fix stale claims and AI-flavored prose (#397 )

2026-10-07 14:48:36 +08:00

README.md

Library

This directory contains helper functions used by outputs/default.nix (and the installer flake) to reduce code duplication and make it easier to add new machines.

Current Functions

Core System Generators

macosSystem.nix - macOS configuration generator for nix-darwin
nixosSystem.nix - NixOS configuration generator
colmenaSystem.nix - Remote deployment configuration for colmena

Specialized Module Generators

genK3sServerModule.nix - K3s server node configuration generator
genK3sAgentModule.nix - K3s agent/worker node configuration generator
genVmHostModule.nix - physical VM host (bridge + libvirt) configuration generator
genMicrovmGuestModule.nix - NixOS microVM guest configuration generator
genLibvirtDomainXml.nix - libvirt domain XML generator (imported directly by host configs)

Entry Point

default.nix - Main entry point that imports the generators and exports them as a single attribute set, plus the relativeToRoot and scanPaths helpers

Usage

The generators import the shared host modules, so a new machine supplies its own values and system-specific attributes. colmenaSystem covers remote deployment, and genLibvirtDomainXml renders the domain XML for one guest.

Architecture Support

x86_64-linux: Primary desktop systems
aarch64-linux: ARM64 Linux systems (Apple Silicon, SBCs)
aarch64-darwin: Apple Silicon macOS systems