nixos/portcullis: Add initial config

New bare-metal box headed for Nikhef, intended to take over most of estuary's colony edge routing. This is the bootstrap config only: the hardware, the single-NVMe ESP + LVM layout, and enough networking to boot and be reachable. It is being staged at home before it is racked, so it has no colony assignments yet. Every 2.5G port takes DHCP and whichever one is patched in brings the box up; kea registers the DHCP hostname, so the deploy node points at portcullis.dyn.h.nul.ie until there is a real colony FQDN for it. The host key was adopted from the installer session and seeded onto the persist volume before first boot, so my.secrets.key could be set up front -- which makes portcullis a recipient of the user-passwd secret that my.user declares for every box. Documented with a box page, a row in the colony site index, and a note in the colony section of networking.md that the topology is expected to change once portcullis takes over from estuary. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
2026-08-19 01:30:59 +01:00
parent d1b9358069
commit 0aade09d7e
7 changed files with 264 additions and 74 deletions
@@ -0,0 +1,115 @@
+{ lib, ... }:
+let
+  inherit (lib.my.c.colony) domain;
+in
+{
+  nixos.systems.portcullis = {
+    system = "x86_64-linux";
+    nixpkgs = "mine-stable";
+    home-manager = "mine-stable";
+
+    configuration = { lib, pkgs, config, ... }:
+      {
+        hardware = {
+          enableRedistributableFirmware = true;
+          cpu = {
+            intel.updateMicrocode = true;
+          };
+        };
+
+        boot = {
+          kernelModules = [ "kvm-intel" ];
+          kernelParams = [ "intel_iommu=on" ];
+          initrd = {
+            availableKernelModules = [ "xhci_pci" "nvme" "usb_storage" "usbhid" "sd_mod" "sr_mod" ];
+            kernelModules = [ "dm-snapshot" ];
+          };
+        };
+
+        fileSystems = {
+          "/boot" = {
+            device = "/dev/disk/by-uuid/1A70-EBCB";
+            fsType = "vfat";
+            options = [ "fmask=0022" "dmask=0022" ];
+          };
+          "/nix" = {
+            device = "/dev/main/portcullis-nix";
+            fsType = "ext4";
+          };
+          "/persist" = {
+            device = "/dev/main/portcullis-persist";
+            fsType = "ext4";
+            neededForBoot = true;
+          };
+        };
+
+        networking = { inherit domain; };
+
+        environment.systemPackages = with pkgs; [
+          pciutils
+          usbutils
+          ethtool
+          lm_sensors
+          smartmontools
+        ];
+
+        systemd.network = {
+          # Only one port is patched in while the box is being staged, so don't block
+          # boot on the others coming up.
+          wait-online.anyInterface = true;
+
+          links = {
+            "10-et2g5-0" = {
+              matchConfig.PermanentMACAddress = "00:d0:b4:05:ed:48";
+              linkConfig.Name = "et2g5-0";
+            };
+            "10-et2g5-1" = {
+              matchConfig.PermanentMACAddress = "00:d0:b4:05:ed:49";
+              linkConfig.Name = "et2g5-1";
+            };
+            "10-et2g5-2" = {
+              matchConfig.PermanentMACAddress = "00:d0:b4:05:ed:4a";
+              linkConfig.Name = "et2g5-2";
+            };
+            "10-et2g5-3" = {
+              matchConfig.PermanentMACAddress = "00:d0:b4:05:ed:4b";
+              linkConfig.Name = "et2g5-3";
+            };
+
+            "11-et10g-0" = {
+              matchConfig.PermanentMACAddress = "60:be:b4:2e:9b:a2";
+              linkConfig.Name = "et10g-0";
+            };
+            "11-et10g-1" = {
+              matchConfig.PermanentMACAddress = "60:be:b4:2e:9b:a3";
+              linkConfig.Name = "et10g-1";
+            };
+          };
+
+          networks = {
+            # TODO: replace with the colony assignments and routing config once portcullis is
+            # racked at Nikhef. Until then it is staged on the home lo VLAN, so every 2.5G port
+            # takes DHCP and whichever one is patched in provides connectivity. kea registers
+            # the DHCP hostname, making the box reachable as `portcullis.dyn.h.nul.ie`.
+            "80-bootstrap" = {
+              matchConfig.Name = "et2g5-*";
+              DHCP = "yes";
+              networkConfig.IPv6PrivacyExtensions = "no";
+              linkConfig.RequiredForOnline = "routable";
+            };
+          };
+        };
+
+        my = {
+          # As above: no colony assignment yet, so point deploy at the staging DHCP name.
+          deploy.node.hostname = "portcullis.dyn.${lib.my.c.home.domain}";
+
+          secrets = {
+            key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAUolR93Byg+Daw8pUYHVpQ34ioxSc2C8vzj9F4KbqMs";
+          };
+
+          server.enable = true;
+        };
+      };
+  };
+}