Add nix-infra-machine

2026-09-17 02:12:55 +02:00 · 2026-03-15 18:31:53 +01:00
parent 28ea6f4a47
commit 1034986fa1
79 changed files with 14465 additions and 0 deletions
@@ -0,0 +1,160 @@
+{ config, pkgs, lib, ... }: {
+  # Enable HAProxy with test configuration including HTTPS
+  config.infrastructure.haproxy = {
+    enable = true;
+    openFirewall = true;
+
+    # Enable self-signed certificates for testing HTTPS
+    selfSigned = {
+      enable = true;
+      domains = [ "localhost" "test.local" ];
+    };
+
+    # SSL/TLS settings
+    ssl = {
+      minVersion = "TLSv1.2";
+      hsts = {
+        enable = true;
+        maxAge = 31536000;
+        includeSubDomains = true;
+      };
+    };
+
+    # Note: ACME/Let's Encrypt cannot be fully tested in VM environment
+    # as it requires DNS resolution and public internet access.
+    # For production, set acme.enable = true and configure domains
+    acme = {
+      enable = false;  # Disabled for testing
+      acceptTerms = false;
+      email = "test@example.com";
+      staging = true;  # Use staging server to avoid rate limits
+      domains = {};
+    };
+
+    # Frontend configurations
+    frontends = {
+      # HTTP frontend - handles incoming HTTP traffic
+      http-in = {
+        bind = [ "*:80" ];
+        mode = "http";
+        options = [ "httplog" ];
+        acls = [
+          "is_health path /health"
+          "is_api path_beg /api"
+          "is_acme path_beg /.well-known/acme-challenge/"
+        ];
+        httpRequest = [
+          "set-header X-Forwarded-Proto http"
+        ];
+        useBackend = [
+          "health_backend if is_health"
+          "api_backend if is_api"
+          "acme_backend if is_acme"
+        ];
+        defaultBackend = "web_backend";
+      };
+
+      # HTTPS frontend - handles incoming HTTPS traffic with self-signed cert
+      https-in = {
+        bind = [ "*:443 ssl crt /var/lib/haproxy/certs/localhost.pem" ];
+        mode = "http";
+        options = [ "httplog" ];
+        acls = [
+          "is_health path /health"
+          "is_api path_beg /api"
+        ];
+        httpRequest = [
+          "set-header X-Forwarded-Proto https"
+          "set-header X-Forwarded-For %[src]"
+        ];
+        useBackend = [
+          "health_backend if is_health"
+          "api_backend if is_api"
+        ];
+        defaultBackend = "web_backend";
+      };
+    };
+
+    # Backend configurations
+    backends = {
+      # Web backend - serves static content
+      web_backend = {
+        mode = "http";
+        balance = "roundrobin";
+        options = [ "httpchk GET /" ];
+        servers = [
+          "local 127.0.0.1:8080 check"
+        ];
+      };
+
+      # API backend
+      api_backend = {
+        mode = "http";
+        balance = "roundrobin";
+        options = [ "httpchk GET /api/health" ];
+        servers = [
+          "api1 127.0.0.1:8081 check"
+        ];
+      };
+
+      # Health check backend - returns OK for monitoring
+      health_backend = {
+        mode = "http";
+        balance = "roundrobin";
+        extraConfig = ''
+          http-request return status 200 content-type text/plain string "OK"
+        '';
+      };
+
+      # ACME challenge backend (for Let's Encrypt webroot validation)
+      acme_backend = {
+        mode = "http";
+        balance = "roundrobin";
+        servers = [
+          "acme 127.0.0.1:8888 check"
+        ];
+      };
+    };
+
+    # Stats listen section - HAProxy stats page
+    listen = {
+      stats = {
+        bind = [ "*:8404" ];
+        mode = "http";
+        extraConfig = ''
+          stats enable
+          stats uri /stats
+          stats refresh 10s
+          stats admin if LOCALHOST
+        '';
+      };
+    };
+  };
+
+  # Simple test backend server using Python's HTTP server
+  config.systemd.services.test-backend = {
+    description = "Test backend server for HAProxy";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    serviceConfig = {
+      Type = "simple";
+      ExecStart = "${pkgs.python3}/bin/python3 -m http.server 8080 --directory /var/www/test";
+      Restart = "always";
+      RestartSec = "5s";
+    };
+  };
+
+  # Create test web content
+  config.systemd.tmpfiles.rules = [
+    "d /var/www/test 0755 root root -"
+    "f /var/www/test/index.html 0644 root root - '<html><body><h1>HAProxy Test Page</h1><p>Backend server is working!</p></body></html>'"
+  ];
+
+  # Install utilities for testing
+  config.environment.systemPackages = with pkgs; [
+    curl
+    openssl
+    python3
+  ];
+}
+