greg/nixos
1
0
Fork 1
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

NixOS Containers: Improved

Browse Source 
Add personal containers module
Move gitlab into new containers
Move matrix onto Isaiah
This commit is contained in:
Greg Hellings
2024-03-04 15:01:33 -06:00
parent 49e60b180b
commit 57cc340d02
6 changed files with 90 additions and 82 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/myself/container-git.nix
+2 -18
View File
@@ -1,20 +1,11 @@
{ inputs, ...}:
{ config, pkgs, lib, ... }: let
registryPort = 5000;
vpnIp = "100.78.226.76";
containerIp = "192.168.200.2";
in {
imports = [
inputs.agenix.nixosModules.default
inputs.self.modules.nixosModule
];
nixpkgs.overlays = inputs.self.overlays.all;
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
age.secretsMountPoint = "/run/derp";
age.secrets = let
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; };
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
in {
gitlab-secret = cfg "secret";
gitlab-otp = cfg "otp";
@@ -24,13 +15,7 @@ in {
gitlab-cert = cfg "cert";
};
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ 80 registryPort ];
};
useHostResolvConf = lib.mkForce false;
};
networking.firewall.allowedTCPPorts = [ 80 registryPort ];
greg.proxies = let
t = {
@@ -45,7 +30,6 @@ in {
"${vpnIp}" = t;
"git.thehellings.lan" = t;
};
greg.tailscale.enable = true;
virtualisation.docker.enable = true;
hosts/myself/git.nix
+4 -24
View File
@@ -31,25 +31,10 @@ in {
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
containers.gitlab = container {
autoStart = true;
bindMounts = {
"/var/gitlab/state" = {
hostPath = gitlabStateDir;
isReadOnly = false;
};
"/dev/net/tun" = {
hostPath = "/dev/net/tun";
isReadOnly = false;
};
};
forwardPorts = [{
hostPort = 2222;
containerPort = 22;
}];
hostAddress = "192.168.200.1";
localAddress = "192.168.200.2";
config = ((import ./container-git.nix) { inherit inputs; });
greg.containers.gitlab = {
tailscale = true;
subnet = "200";
builder = (import ./container-git.nix);
};
systemd.services = {
@@ -80,11 +65,6 @@ in {
];
};
};
"container@gitlab".serviceConfig = {
DeviceAllow = [ "/dev/net/tun" ];
ProtectKernelModules = false;
PrivateDevices = false;
};
gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path;
};
hosts/myself/matrix.nix
+6 -39
View File
@@ -5,42 +5,14 @@ let
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
in
{
systemd.services."container@matrix".serviceConfig = {
DeviceAllow = [ "/dev/net/tun" ];
ProtectKernelModules = false;
PrivateDevices = false;
};
containers.matrix = {
autoStart = true;
bindMounts = {
"/etc/ssh".hostPath = "/etc/ssh";
"/dev/net/tun" = {
hostPath = "/dev/net/tun";
isReadOnly = false;
};
};
hostAddress = "192.168.204.1";
localAddress = "192.168.204.2";
privateNetwork = true;
config = { pkgs, config, ... }: {
imports = [
inputs.agenix.nixosModules.default
inputs.self.modules.nixosModule
];
nixpkgs.overlays = inputs.self.overlays.all;
networking = {
firewall = {
enable = true;
allowedTCPPorts = [ config.services.dendrite.httpPort ];
};
useHostResolvConf = lib.mkForce false;
};
greg.containers.matrix = {
tailscale = true;
subnet = "204";
builder = { pkgs, config, ... }: {
networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
# Environment secrets
age = {
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
secrets.dendrite = {
file = ../../secrets/dendrite.age;
owner = "dendrite";
@@ -61,12 +33,7 @@ in
User = "dendrite";
};
greg = {
databases.dendrite = {};
tailscale.enable = true;
};
#services.tailscale.interfaceName = "userspace-networking";
greg.databases.dendrite = {};
services.dendrite = {
enable = true;