Add compose and attic configurations

Add compose directory to store docker/podman compose files for running
on the TrueNAS box
Add attic configurations to auto-listen on all my home boxes to upload
builds
Update nix-conf to support reading from the Attic server

compose/attic.yaml

@@ -0,0 +1,55 @@
+services:
+  attic:
+    container_name: attic
+    image: ghcr.io/zhaofengli/attic:latest
+    command: ["-f", "/attic/server.toml"]
+    restart: unless-stopped
+    ports:
+      - 8080:8080
+    networks:
+      attic:
+      pgattic:
+    volumes:
+      - /mnt/all/configs/attic/server.toml:/attic/server.toml
+      - /mnt/all/containers/attic/data:/attic/storage
+    env_file:
+      - stack.env
+    depends_on:
+      pgattic:
+        condition: service_healthy
+    healthcheck:
+      test:
+        [
+          "CMD-SHELL",
+          "wget --no-verbose --tries=1 --spider http://attic:8080 || exit 1",
+        ]
+      interval: 15s
+      timeout: 10s
+      retries: 10
+      start_period: 15s
+    deploy:
+      resources:
+        reservations:
+          cpus: 1.0
+
+  pgattic:
+    container_name: pgattic
+    image: postgres:17.6-alpine
+    restart: unless-stopped
+    ports: []
+      #- 5432:5432
+    networks:
+      pgattic:
+    volumes:
+      - /mnt/all/containers/attic/postgres:/var/lib/postgresql/data
+    env_file:
+      - stack.env
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+networks:
+  attic:
+  pgattic:

compose/pinchflat.yaml

@@ -0,0 +1,8 @@
+services:
+  pinchflat:
+    image: ghcr.io/kieraneglin/pinchflat:latest
+    ports:
+      - "8945:8945"
+    volumes:
+      - "/mnt/all/configs/pinchflat:/config"
+      - "/mnt/all/video/yt:/downloads"

compose/restic.yaml

@@ -0,0 +1,19 @@
+# Demo of rest-server with prometheus and grafana
+version: "2"
+
+services:
+  restserver:
+    image: "restic/rest-server:0.14.0"
+    volumes:
+      - /mnt/all/backups:/data
+      - /mnt/all/configs/certs:/certs
+    environment:
+      OPTIONS: >-
+        --tls
+        --tls-cert /certs/nas1.shire-zebra.ts.net.crt
+        --tls-key /certs/nas1.shire-zebra.ts.net.key
+        --path /data
+        --prometheus
+        --debug
+    ports:
+      - "30248:8000"

home/baseline/tools.nix

@@ -3,6 +3,7 @@
   home.packages =
     with pkgs;
     [
+      attic-client
       dig
       jqp
       kubernetes-helm

hosts/exodus/default.nix

@@ -11,6 +11,10 @@
     top.nix-hardware.nixosModules.framework-11th-gen-intel
   ];
 
+  age.secrets = {
+    compose-attic.file = ../../secrets/compose/attic.env.age;
+  };
+
   boot = {
     loader = {
       systemd-boot.enable = true;

modules/nix-conf.nix

@@ -42,7 +42,7 @@ in
         substituters =
           (lib.optionals cfg.cache [
             "http://chronicles.shire-zebra.ts.net:9000/binary-cache/"
-            "http://nas1.shire-zebra.ts.net:8080/nixos"
+            "http://nas1.shire-zebra.ts.net:8080/default"
           ])
           ++ [
             "https://ai.cachix.org"

modules/nixos/home.nix

@@ -1,4 +1,9 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
   cfg = config.greg.home;
@@ -13,7 +18,33 @@ with lib;
   };
 
   config = mkIf cfg {
-    time.timeZone = "America/Chicago";
+    age.secrets.attic.file = ../../secrets/attic.age;
     networking.domain = "thehellings.lan";
+    time.timeZone = "America/Chicago";
+
+    systemd.services.attic-client = {
+      enable = true;
+      description = "Attic client watch-store service";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        Type = "simple";
+        Restart = "on-failure";
+        RestartSec = "5s";
+      };
+      preStart = ''
+        set -x
+        mkdir -p $XDG_CONFIG_HOME/attic
+        cp ${config.age.secrets.attic.path} $XDG_CONFIG_HOME/attic/config.toml
+      '';
+      script = "${pkgs.attic-client}/bin/attic watch-store default";
+      environment = {
+        XDG_CONFIG_HOME = "/var/lib/attic-client";
+      };
+    };
+
+    systemd.tmpfiles.rules = [
+      "d /var/lib/attic-client 0755 root root -"
+    ];
   };
 }

modules/nixos/remote-builder.nix

@@ -1,7 +1,6 @@
 {
   config,
   lib,
-  pkgs,
   ...
 }:
 
@@ -40,33 +39,7 @@ with lib;
     greg.tailscale.enable = true;
 
     # The builder user needs to be trusted to submit builds
-    nix.settings =
+    nix.settings = {
-      let
-        upload = getExe (
-          pkgs.writeShellScriptBin "upload-to-cache.sh" ''
-            set -eu
-            set -f
-            export AWS_SHARED_CREDENTIALS_FILE=${config.age.secrets.cache-credentials.path}
-            export IFS=' '
-            ${getExe config.nix.package} store sign --recursive --key-file "${config.age.secrets.private-cache.path}" "$@"
-            ${getExe config.nix.package} copy --to "s3://binary-cache/?scheme=http&endpoint=nas.home%3A9000&profile=default" "$@"
-          ''
-        );
-        uploadRunner = getExe (
-          pkgs.writeShellScriptBin "uploade-to-cache-runner.sh" ''
-            sum=$(printf "$OUT_PATHS" | ${lib.getExe' pkgs.coreutils-full "sha256sum"} | cut -d " " -f1)
-            ${lib.getExe' config.systemd.package "systemd-run"} \
-                --unit "upload-$(${lib.getExe' pkgs.coreutils "date"} +%s%3N)-$sum" \
-                --property Type=exec \
-                --property CollectMode=inactive \
-                --property Group=nixbld \
-                ${upload} $OUT_PATHS
-          ''
-        );
-      in
-      {
-        post-build-hook = uploadRunner;
-        secret-key-files = config.age.secrets.private-cache.path;
       trusted-users = [ config.users.users.remote-builder-user.name ];
     };
 

secrets/secrets.nix

@@ -60,6 +60,7 @@ in
   "jude-forgejo-runner.age".publicKeys = everyone;
   "minio.age".publicKeys = everyone;
 
+  "attic.age".publicKeys = everyone;
   "cache-private-key.age".publicKeys = [
     jeremiah
     isaiah
@@ -119,4 +120,6 @@ in
     user_jeremiah
     user_jude
   ];
+
+  "compose/attic.env.age".publicKeys = everyone;
 }