116 lines
2.8 KiB
Nix
116 lines
2.8 KiB
Nix
{
|
|
pkgs,
|
|
lib,
|
|
config,
|
|
modulesPath,
|
|
...
|
|
}:
|
|
|
|
let
|
|
inherit (lib)
|
|
boolToString
|
|
mkDefault
|
|
mkIf
|
|
optional
|
|
readFile
|
|
;
|
|
in
|
|
|
|
{
|
|
imports = [
|
|
#(modulesPath + "/profiles/headless.nix")
|
|
(modulesPath + "/profiles/qemu-guest.nix")
|
|
];
|
|
|
|
boot.kernelParams = [
|
|
"console=ttyS0,115200n8"
|
|
"panic=1"
|
|
"boot.panic_on_fail"
|
|
];
|
|
boot.initrd.kernelModules = [ "virtio_scsi" ];
|
|
boot.kernelModules = [
|
|
"virtio_pci"
|
|
"virtio_net"
|
|
];
|
|
|
|
# enable OS Login. This also requires setting enable-oslogin=TRUE metadata on
|
|
# instance or project level
|
|
security.googleOsLogin.enable = true;
|
|
|
|
# Use GCE udev rules for dynamic disk volumes
|
|
services.udev.packages = [ pkgs.google-guest-configs ];
|
|
services.udev.path = [ pkgs.google-guest-configs ];
|
|
|
|
# Configure default metadata hostnames
|
|
networking.extraHosts = ''
|
|
169.254.169.254 metadata.google.internal metadata
|
|
'';
|
|
|
|
networking.timeServers = [ "metadata.google.internal" ];
|
|
|
|
networking.usePredictableInterfaceNames = false;
|
|
|
|
# GC has 1460 MTU
|
|
networking.interfaces.eth0.mtu = 1460;
|
|
|
|
systemd.packages = [ pkgs.google-guest-agent ];
|
|
systemd.services.google-guest-agent = {
|
|
wantedBy = [ "multi-user.target" ];
|
|
restartTriggers = [ config.environment.etc."default/instance_configs.cfg".source ];
|
|
path = optional config.users.mutableUsers pkgs.shadow;
|
|
};
|
|
systemd.services.google-startup-scripts.wantedBy = [ "multi-user.target" ];
|
|
systemd.services.google-shutdown-scripts.wantedBy = [ "multi-user.target" ];
|
|
|
|
security.sudo.extraRules = mkIf config.users.mutableUsers [
|
|
{
|
|
groups = [ "google-sudoers" ];
|
|
commands = [
|
|
{
|
|
command = "ALL";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
|
|
security.sudo-rs.extraRules = mkIf config.users.mutableUsers [
|
|
{
|
|
groups = [ "google-sudoers" ];
|
|
commands = [
|
|
{
|
|
command = "ALL";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
|
|
users.groups.google-sudoers = mkIf config.users.mutableUsers { };
|
|
|
|
boot.extraModprobeConfig = readFile "${pkgs.google-guest-configs}/etc/modprobe.d/gce-blacklist.conf";
|
|
|
|
environment.etc."sysctl.d/60-gce-network-security.conf".source =
|
|
"${pkgs.google-guest-configs}/etc/sysctl.d/60-gce-network-security.conf";
|
|
|
|
environment.etc."default/instance_configs.cfg".text = ''
|
|
[Accounts]
|
|
useradd_cmd = useradd -m -s /run/current-system/sw/bin/bash -p * {user}
|
|
|
|
[Daemons]
|
|
accounts_daemon = ${boolToString config.users.mutableUsers}
|
|
|
|
[InstanceSetup]
|
|
# Make sure GCE image does not replace host key that NixOps sets.
|
|
set_host_keys = false
|
|
|
|
[MetadataScripts]
|
|
default_shell = ${pkgs.stdenv.shell}
|
|
|
|
[NetworkInterfaces]
|
|
dhclient_script = ${pkgs.google-guest-configs}/bin/google-dhclient-script
|
|
# We set up network interfaces declaratively.
|
|
setup = false
|
|
'';
|
|
}
|