From 57cc340d028a3be80badeb958f3d31121e0b9892 Mon Sep 17 00:00:00 2001 From: Greg Hellings Date: Mon, 4 Mar 2024 15:01:33 -0600 Subject: [PATCH] NixOS Containers: Improved Add personal containers module Move gitlab into new containers Move matrix onto Isaiah --- hosts/myself/container-git.nix | 20 +-------- hosts/myself/git.nix | 28 ++----------- hosts/myself/matrix.nix | 45 +++----------------- modules/nixos/backup.nix | 2 +- modules/nixos/container.nix | 76 ++++++++++++++++++++++++++++++++++ modules/nixos/default.nix | 1 + 6 files changed, 90 insertions(+), 82 deletions(-) create mode 100644 modules/nixos/container.nix diff --git a/hosts/myself/container-git.nix b/hosts/myself/container-git.nix index 71366f2..9635979 100644 --- a/hosts/myself/container-git.nix +++ b/hosts/myself/container-git.nix @@ -1,20 +1,11 @@ -{ inputs, ...}: { config, pkgs, lib, ... }: let registryPort = 5000; vpnIp = "100.78.226.76"; containerIp = "192.168.200.2"; in { - imports = [ - inputs.agenix.nixosModules.default - inputs.self.modules.nixosModule - ]; - - nixpkgs.overlays = inputs.self.overlays.all; - - age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; age.secretsMountPoint = "/run/derp"; age.secrets = let - cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; }; + cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; }; in { gitlab-secret = cfg "secret"; gitlab-otp = cfg "otp"; @@ -24,13 +15,7 @@ in { gitlab-cert = cfg "cert"; }; - networking = { - firewall = { - enable = true; - allowedTCPPorts = [ 80 registryPort ]; - }; - useHostResolvConf = lib.mkForce false; - }; + networking.firewall.allowedTCPPorts = [ 80 registryPort ]; greg.proxies = let t = { @@ -45,7 +30,6 @@ in { "${vpnIp}" = t; "git.thehellings.lan" = t; }; - greg.tailscale.enable = true; virtualisation.docker.enable = true; diff --git a/hosts/myself/git.nix b/hosts/myself/git.nix index 32d1bdd..4cd6d5e 100644 --- a/hosts/myself/git.nix +++ b/hosts/myself/git.nix @@ -31,25 +31,10 @@ in { system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch"; - containers.gitlab = container { - autoStart = true; - bindMounts = { - "/var/gitlab/state" = { - hostPath = gitlabStateDir; - isReadOnly = false; - }; - "/dev/net/tun" = { - hostPath = "/dev/net/tun"; - isReadOnly = false; - }; - }; - forwardPorts = [{ - hostPort = 2222; - containerPort = 22; - }]; - hostAddress = "192.168.200.1"; - localAddress = "192.168.200.2"; - config = ((import ./container-git.nix) { inherit inputs; }); + greg.containers.gitlab = { + tailscale = true; + subnet = "200"; + builder = (import ./container-git.nix); }; systemd.services = { @@ -80,11 +65,6 @@ in { ]; }; }; - "container@gitlab".serviceConfig = { - DeviceAllow = [ "/dev/net/tun" ]; - ProtectKernelModules = false; - PrivateDevices = false; - }; gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path; }; diff --git a/hosts/myself/matrix.nix b/hosts/myself/matrix.nix index 4aaee73..bc0b4c5 100644 --- a/hosts/myself/matrix.nix +++ b/hosts/myself/matrix.nix @@ -5,42 +5,14 @@ let conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql"; in { - systemd.services."container@matrix".serviceConfig = { - DeviceAllow = [ "/dev/net/tun" ]; - ProtectKernelModules = false; - PrivateDevices = false; - }; - containers.matrix = { - autoStart = true; - bindMounts = { - "/etc/ssh".hostPath = "/etc/ssh"; - "/dev/net/tun" = { - hostPath = "/dev/net/tun"; - isReadOnly = false; - }; - }; - hostAddress = "192.168.204.1"; - localAddress = "192.168.204.2"; - privateNetwork = true; - config = { pkgs, config, ... }: { - imports = [ - inputs.agenix.nixosModules.default - inputs.self.modules.nixosModule - ]; - - nixpkgs.overlays = inputs.self.overlays.all; - - networking = { - firewall = { - enable = true; - allowedTCPPorts = [ config.services.dendrite.httpPort ]; - }; - useHostResolvConf = lib.mkForce false; - }; + greg.containers.matrix = { + tailscale = true; + subnet = "204"; + builder = { pkgs, config, ... }: { + networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ]; # Environment secrets age = { - identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; secrets.dendrite = { file = ../../secrets/dendrite.age; owner = "dendrite"; @@ -61,12 +33,7 @@ in User = "dendrite"; }; - greg = { - databases.dendrite = {}; - tailscale.enable = true; - }; - - #services.tailscale.interfaceName = "userspace-networking"; + greg.databases.dendrite = {}; services.dendrite = { enable = true; diff --git a/modules/nixos/backup.nix b/modules/nixos/backup.nix index db87f85..8ce05ac 100644 --- a/modules/nixos/backup.nix +++ b/modules/nixos/backup.nix @@ -11,7 +11,7 @@ let makeService = name: job: { serviceConfig = { User = job.user; - ExecStarPre = lib.optionalString (job.pre != "") job.pre; + ExecStartPre = lib.optionalString (job.pre != "") job.pre; ExecStart = "${pkgs.rsync}/bin/rsync -avz --delete -e '${pkgs.openssh}/bin/ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null' ${job.src}/ backup@chronicles.shire-zebra.ts.net:/volume1/NetBackup/${job.dest}"; ExecStartPost = lib.optionalString (job.post != "") job.post; }; diff --git a/modules/nixos/container.nix b/modules/nixos/container.nix new file mode 100644 index 0000000..07b3420 --- /dev/null +++ b/modules/nixos/container.nix @@ -0,0 +1,76 @@ +{ config, lib, inputs, ... }: + +let + cfg = config.greg.containers; + + # Create a container with all our default settings + + makeContainer = name: container: let + agekey = "/etc/ssh/agenix_key"; + in { + autoStart = true; + hostAddress = "192.168.${container.subnet}.1"; + localAddress = "192.168.${container.subnet}.2"; + privateNetwork = true; + bindMounts = { + "${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key"; # This is needed for agenix to + }; + enableTun = container.tailscale; + config = { config, pkgs, ... }: { + imports = [ + inputs.agenix.nixosModules.default + inputs.self.modules.nixosModule + container.builder + ]; + + nixpkgs.overlays = inputs.self.overlays.all; + + networking = { + firewall.enable = true; + useHostResolvConf = lib.mkForce false; + }; + + age.identityPaths = [ agekey ]; + + greg.tailscale.enable = container.tailscale; + }; + }; +in { + options.greg.containers = lib.mkOption { + default = {}; + + type = with lib.types; attrsOf ( submodule ( + { + options = { + tailscale = lib.mkOption { + type = bool; + default = false; + description = "Enable tailscale in the container"; + }; + subnet = lib.mkOption { + type = str; + default = "200"; + }; + builder = lib.mkOption { + default = { ... }: {}; + description = '' + This needs to be a function, like the one for + a container's config. It will setup the core system above the + defaults set in this module. + ''; + example = '' + { pkgs, config, lib, ... } : + { + services.openssh.enable = true; + } + ''; + }; + }; + } + )); + }; + + config = { + containers = builtins.mapAttrs makeContainer cfg; + }; +} diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index a4712bd..96bf46d 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -4,6 +4,7 @@ imports = [ ../baseline.nix ./backup.nix + ./container.nix ./db.nix ./gnome.nix ./home.nix