|
1 | | -{ config, lib, pkgs, ... }: |
| 1 | +{ lib, ... }: |
2 | 2 |
|
3 | 3 | with lib; |
4 | | -let |
5 | | - |
6 | | - cfg = config.virtualisation.azure.agent; |
7 | | - |
8 | | - provisionedHook = pkgs.writeScript "provisioned-hook" '' |
9 | | - #!${pkgs.runtimeShell} |
10 | | - /run/current-system/systemd/bin/systemctl start provisioned.target |
11 | | - ''; |
12 | | - |
13 | | -in |
14 | | -{ |
15 | | - |
16 | | - ###### interface |
17 | | - |
18 | | - options.virtualisation.azure.agent = { |
19 | | - enable = mkOption { |
20 | | - default = false; |
21 | | - description = "Whether to enable the Windows Azure Linux Agent."; |
22 | | - }; |
23 | | - verboseLogging = mkOption { |
24 | | - default = false; |
25 | | - description = "Whether to enable verbose logging."; |
26 | | - }; |
27 | | - mountResourceDisk = mkOption { |
28 | | - default = true; |
29 | | - description = "Whether the agent should format (ext4) and mount the resource disk to /mnt/resource."; |
30 | | - }; |
31 | | - }; |
32 | | - |
33 | | - ###### implementation |
34 | | - |
35 | | - config = lib.mkIf cfg.enable { |
36 | | - assertions = [{ |
37 | | - assertion = config.networking.networkmanager.enable == false; |
38 | | - message = "Windows Azure Linux Agent is not compatible with NetworkManager"; |
39 | | - }]; |
40 | | - |
41 | | - boot.initrd.kernelModules = [ "ata_piix" ]; |
42 | | - networking.firewall.allowedUDPPorts = [ 68 ]; |
43 | | - |
44 | | - |
45 | | - environment.etc."waagent.conf".text = '' |
46 | | - # |
47 | | - # Microsoft Azure Linux Agent Configuration |
48 | | - # |
49 | | -
|
50 | | - # Enable extension handling. Do not disable this unless you do not need password reset, |
51 | | - # backup, monitoring, or any extension handling whatsoever. |
52 | | - Extensions.Enabled=y |
53 | | -
|
54 | | - # How often (in seconds) to poll for new goal states |
55 | | - Extensions.GoalStatePeriod=6 |
56 | | -
|
57 | | - # Which provisioning agent to use. Supported values are "auto" (default), "waagent", |
58 | | - # "cloud-init", or "disabled". |
59 | | - Provisioning.Agent=auto |
60 | | -
|
61 | | - # Password authentication for root account will be unavailable. |
62 | | - Provisioning.DeleteRootPassword=n |
63 | | -
|
64 | | - # Generate fresh host key pair. |
65 | | - Provisioning.RegenerateSshHostKeyPair=n |
66 | | -
|
67 | | - # Supported values are "rsa", "dsa", "ecdsa", "ed25519", and "auto". |
68 | | - # The "auto" option is supported on OpenSSH 5.9 (2011) and later. |
69 | | - Provisioning.SshHostKeyPairType=ed25519 |
70 | | -
|
71 | | - # Monitor host name changes and publish changes via DHCP requests. |
72 | | - Provisioning.MonitorHostName=y |
73 | | -
|
74 | | - # How often (in seconds) to monitor host name changes. |
75 | | - Provisioning.MonitorHostNamePeriod=30 |
76 | | -
|
77 | | - # Decode CustomData from Base64. |
78 | | - Provisioning.DecodeCustomData=n |
79 | | -
|
80 | | - # Execute CustomData after provisioning. |
81 | | - Provisioning.ExecuteCustomData=n |
82 | | -
|
83 | | - # Algorithm used by crypt when generating password hash. |
84 | | - #Provisioning.PasswordCryptId=6 |
85 | | -
|
86 | | - # Length of random salt used when generating password hash. |
87 | | - #Provisioning.PasswordCryptSaltLength=10 |
88 | | -
|
89 | | - # Allow reset password of sys user |
90 | | - Provisioning.AllowResetSysUser=n |
91 | | -
|
92 | | - # Format if unformatted. If 'n', resource disk will not be mounted. |
93 | | - ResourceDisk.Format=${if cfg.mountResourceDisk then "y" else "n"} |
94 | | -
|
95 | | - # File system on the resource disk |
96 | | - # Typically ext3 or ext4. FreeBSD images should use 'ufs2' here. |
97 | | - ResourceDisk.Filesystem=ext4 |
98 | | -
|
99 | | - # Mount point for the resource disk |
100 | | - ResourceDisk.MountPoint=/mnt/resource |
101 | | -
|
102 | | - # Create and use swapfile on resource disk. |
103 | | - ResourceDisk.EnableSwap=n |
104 | | -
|
105 | | - # Size of the swapfile. |
106 | | - ResourceDisk.SwapSizeMB=0 |
107 | | -
|
108 | | - # Comma-separated list of mount options. See mount(8) for valid options. |
109 | | - ResourceDisk.MountOptions=None |
110 | | -
|
111 | | - # Enable verbose logging (y|n) |
112 | | - Logs.Verbose=${if cfg.verboseLogging then "y" else "n"} |
113 | | -
|
114 | | - # Enable Console logging, default is y |
115 | | - # Logs.Console=y |
116 | | -
|
117 | | - # Enable periodic log collection, default is n |
118 | | - Logs.Collect=n |
119 | | -
|
120 | | - # How frequently to collect logs, default is each hour |
121 | | - Logs.CollectPeriod=3600 |
122 | | -
|
123 | | - # Is FIPS enabled |
124 | | - OS.EnableFIPS=n |
125 | | -
|
126 | | - # Root device timeout in seconds. |
127 | | - OS.RootDeviceScsiTimeout=300 |
128 | | -
|
129 | | - # How often (in seconds) to set the root device timeout. |
130 | | - OS.RootDeviceScsiTimeoutPeriod=30 |
131 | | -
|
132 | | - # If "None", the system default version is used. |
133 | | - OS.OpensslPath=${pkgs.openssl_3.bin}/bin/openssl |
134 | | -
|
135 | | - # Set the SSH ClientAliveInterval |
136 | | - # OS.SshClientAliveInterval=180 |
137 | | -
|
138 | | - # Set the path to SSH keys and configuration files |
139 | | - OS.SshDir=/etc/ssh |
140 | | -
|
141 | | - # If set, agent will use proxy server to access internet |
142 | | - #HttpProxy.Host=None |
143 | | - #HttpProxy.Port=None |
144 | | -
|
145 | | - # Detect Scvmm environment, default is n |
146 | | - # DetectScvmmEnv=n |
147 | | -
|
148 | | - # |
149 | | - # Lib.Dir=/var/lib/waagent |
150 | | -
|
151 | | - # |
152 | | - # DVD.MountPoint=/mnt/cdrom/secure |
153 | | -
|
154 | | - # |
155 | | - # Pid.File=/var/run/waagent.pid |
156 | | -
|
157 | | - # |
158 | | - # Extension.LogDir=/var/log/azure |
159 | | -
|
160 | | - # |
161 | | - # Home.Dir=/home |
162 | | -
|
163 | | - # Enable RDMA management and set up, should only be used in HPC images |
164 | | - OS.EnableRDMA=n |
165 | | -
|
166 | | - # Enable checking RDMA driver version and update |
167 | | - # OS.CheckRdmaDriver=y |
168 | | -
|
169 | | - # Enable or disable goal state processing auto-update, default is enabled |
170 | | - AutoUpdate.Enabled=n |
171 | | -
|
172 | | - # Determine the update family, this should not be changed |
173 | | - # AutoUpdate.GAFamily=Prod |
174 | | -
|
175 | | - # Determine if the overprovisioning feature is enabled. If yes, hold extension |
176 | | - # handling until inVMArtifactsProfile.OnHold is false. |
177 | | - # Default is enabled |
178 | | - EnableOverProvisioning=n |
179 | | -
|
180 | | - # Allow fallback to HTTP if HTTPS is unavailable |
181 | | - # Note: Allowing HTTP (vs. HTTPS) may cause security risks |
182 | | - # OS.AllowHTTP=n |
183 | | -
|
184 | | - # Add firewall rules to protect access to Azure host node services |
185 | | - OS.EnableFirewall=n |
186 | | -
|
187 | | - # How often (in seconds) to check the firewall rules |
188 | | - OS.EnableFirewallPeriod=30 |
189 | | -
|
190 | | - # How often (in seconds) to remove the udev rules for persistent network interface |
191 | | - # names (75-persistent-net-generator.rules and /etc/udev/rules.d/70-persistent-net.rules) |
192 | | - OS.RemovePersistentNetRulesPeriod=30 |
193 | | -
|
194 | | - # How often (in seconds) to monitor for DHCP client restarts |
195 | | - OS.MonitorDhcpClientRestartPeriod=30 |
196 | | - ''; |
197 | | - |
198 | | - services.udev.packages = [ pkgs.waagent ]; |
199 | | - |
200 | | - # Provide waagent-shipped udev rules in initrd too. |
201 | | - boot.initrd.services.udev.packages = [ pkgs.waagent ]; |
202 | | - # udev rules shell out to chmod, cut and readlink, which are all |
203 | | - # provided by pkgs.coreutils, which is in services.udev.path, but not |
204 | | - # boot.initrd.services.udev.binPackages. |
205 | | - boot.initrd.services.udev.binPackages = [ pkgs.coreutils ]; |
206 | | - |
207 | | - networking.dhcpcd.persistent = true; |
208 | | - |
209 | | - services.logrotate = { |
210 | | - enable = true; |
211 | | - settings."/var/log/waagent.log" = { |
212 | | - compress = true; |
213 | | - frequency = "monthly"; |
214 | | - rotate = 6; |
215 | | - }; |
216 | | - }; |
217 | | - |
218 | | - systemd.targets.provisioned = { |
219 | | - description = "Services Requiring Azure VM provisioning to have finished"; |
220 | | - }; |
221 | | - |
222 | | - systemd.services.consume-hypervisor-entropy = |
223 | | - { |
224 | | - description = "Consume entropy in ACPI table provided by Hyper-V"; |
225 | | - |
226 | | - wantedBy = [ "sshd.service" "waagent.service" ]; |
227 | | - before = [ "sshd.service" "waagent.service" ]; |
228 | | - |
229 | | - path = [ pkgs.coreutils ]; |
230 | | - script = |
231 | | - '' |
232 | | - echo "Fetching entropy..." |
233 | | - cat /sys/firmware/acpi/tables/OEM0 > /dev/random |
234 | | - ''; |
235 | | - serviceConfig.Type = "oneshot"; |
236 | | - serviceConfig.RemainAfterExit = true; |
237 | | - serviceConfig.StandardError = "journal+console"; |
238 | | - serviceConfig.StandardOutput = "journal+console"; |
239 | | - }; |
240 | | - |
241 | | - systemd.services.waagent = { |
242 | | - wantedBy = [ "multi-user.target" ]; |
243 | | - after = [ "network-online.target" "sshd.service" ]; |
244 | | - wants = [ "network-online.target" ]; |
245 | | - |
246 | | - path = [ |
247 | | - pkgs.e2fsprogs |
248 | | - pkgs.bash |
249 | | - |
250 | | - pkgs.findutils |
251 | | - pkgs.gnugrep |
252 | | - pkgs.gnused |
253 | | - pkgs.iproute2 |
254 | | - pkgs.iptables |
255 | | - |
256 | | - # for hostname |
257 | | - pkgs.nettools |
258 | | - |
259 | | - pkgs.openssh |
260 | | - pkgs.openssl |
261 | | - pkgs.parted |
262 | | - |
263 | | - # for pidof |
264 | | - pkgs.procps |
265 | | - |
266 | | - # for useradd, usermod |
267 | | - pkgs.shadow |
268 | | - |
269 | | - pkgs.util-linux # for (u)mount, fdisk, sfdisk, mkswap |
270 | | - |
271 | | - # waagent's Microsoft.OSTCExtensions.VMAccessForLinux needs Python 3 |
272 | | - pkgs.python39 |
273 | | - |
274 | | - # waagent's Microsoft.CPlat.Core.RunCommandLinux needs lsof |
275 | | - pkgs.lsof |
276 | | - ]; |
277 | | - description = "Windows Azure Agent Service"; |
278 | | - unitConfig.ConditionPathExists = "/etc/waagent.conf"; |
279 | | - serviceConfig = { |
280 | | - ExecStart = "${pkgs.waagent}/bin/waagent -daemon"; |
281 | | - Type = "simple"; |
282 | | - }; |
283 | | - }; |
284 | | - |
285 | | - # waagent will generate files under /etc/sudoers.d during provisioning |
286 | | - security.sudo.extraConfig = '' |
287 | | - #includedir /etc/sudoers.d |
288 | | - ''; |
289 | | - |
290 | | - }; |
291 | | -} |
| 4 | +warn |
| 5 | + '' |
| 6 | + `virtualisation.azure.agent` provided by `azure-agent.nix` module has been replaced |
| 7 | + by `services.waagent` options, and will be removed in a future release. |
| 8 | + '' |
| 9 | + { |
| 10 | + |
| 11 | + imports = [ |
| 12 | + (mkRenamedOptionModule |
| 13 | + [ |
| 14 | + "virtualisation" |
| 15 | + "azure" |
| 16 | + "agent" |
| 17 | + "enable" |
| 18 | + ] |
| 19 | + [ |
| 20 | + "services" |
| 21 | + "waagent" |
| 22 | + "enable" |
| 23 | + ] |
| 24 | + ) |
| 25 | + (mkRenamedOptionModule |
| 26 | + [ |
| 27 | + "virtualisation" |
| 28 | + "azure" |
| 29 | + "agent" |
| 30 | + "verboseLogging" |
| 31 | + ] |
| 32 | + [ |
| 33 | + "services" |
| 34 | + "waagent" |
| 35 | + "settings" |
| 36 | + "Logs" |
| 37 | + "Verbose" |
| 38 | + ] |
| 39 | + ) |
| 40 | + (mkRenamedOptionModule |
| 41 | + [ |
| 42 | + "virtualisation" |
| 43 | + "azure" |
| 44 | + "agent" |
| 45 | + "mountResourceDisk" |
| 46 | + ] |
| 47 | + [ |
| 48 | + "services" |
| 49 | + "waagent" |
| 50 | + "settings" |
| 51 | + "ResourceDisk" |
| 52 | + "Format" |
| 53 | + ] |
| 54 | + ) |
| 55 | + ]; |
| 56 | + } |
0 commit comments