NixOS Containers: Improved

Add personal containers module
Move gitlab into new containers
Move matrix onto Isaiah

hosts/myself/container-git.nix

@@ -1,20 +1,11 @@
-{ inputs, ...}:
 { config, pkgs, lib, ... }: let
 	registryPort = 5000;
 	vpnIp = "100.78.226.76";
 	containerIp = "192.168.200.2";
 in {
-	imports = [
-		inputs.agenix.nixosModules.default
-		inputs.self.modules.nixosModule
-	];
-
-	nixpkgs.overlays = inputs.self.overlays.all;
-
-	age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 	age.secretsMountPoint = "/run/derp";
 	age.secrets = let
-		cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; };
+		cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
 	in {
 		gitlab-secret = cfg "secret";
 		gitlab-otp = cfg "otp";
@@ -24,13 +15,7 @@ in {
 		gitlab-cert = cfg "cert";
 	};
 
-	networking = {
+	networking.firewall.allowedTCPPorts = [ 80 registryPort ];
-		firewall = {
-			enable = true;
-			allowedTCPPorts = [ 80 registryPort ];
-		};
-		useHostResolvConf = lib.mkForce false;
-	};
 
 	greg.proxies = let
 		t = {
@@ -45,7 +30,6 @@ in {
 		"${vpnIp}" = t;
 		"git.thehellings.lan" = t;
 	};
-	greg.tailscale.enable = true;
 
 	virtualisation.docker.enable = true;
 

hosts/myself/git.nix

@@ -31,25 +31,10 @@ in  {
 	
 	system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
 
-	containers.gitlab = container {
+	greg.containers.gitlab = {
-		autoStart = true;
+		tailscale = true;
-		bindMounts = {
+		subnet = "200";
-			"/var/gitlab/state" = {
+		builder = (import ./container-git.nix);
-				hostPath = gitlabStateDir;
-				isReadOnly = false;
-			};
-			"/dev/net/tun" = {
-				hostPath = "/dev/net/tun";
-				isReadOnly = false;
-			};
-		};
-		forwardPorts = [{
-			hostPort = 2222;
-			containerPort = 22;
-		}];
-		hostAddress = "192.168.200.1";
-		localAddress = "192.168.200.2";
-		config = ((import ./container-git.nix) { inherit inputs; });
 	};
 
 	systemd.services = {
@@ -80,11 +65,6 @@ in  {
 				];
 			};
 		};
-		"container@gitlab".serviceConfig = {
-			DeviceAllow = [ "/dev/net/tun" ];
-			ProtectKernelModules = false;
-			PrivateDevices = false;
-		};
 		gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path;
 	};
 

hosts/myself/matrix.nix

@@ -5,42 +5,14 @@ let
 	conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
 in
 {
-	systemd.services."container@matrix".serviceConfig = {
+	greg.containers.matrix = {
-		DeviceAllow = [ "/dev/net/tun" ];
+		tailscale = true;
-		ProtectKernelModules = false;
+		subnet = "204";
-		PrivateDevices = false;
+		builder = { pkgs, config, ... }: {
-	};
+			networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
-	containers.matrix = {
-		autoStart = true;
-		bindMounts = {
-			"/etc/ssh".hostPath = "/etc/ssh";
-			"/dev/net/tun" = {
-				hostPath = "/dev/net/tun";
-				isReadOnly = false;
-			};
-		};
-		hostAddress = "192.168.204.1";
-		localAddress = "192.168.204.2";
-		privateNetwork = true;
-		config = { pkgs, config, ... }: {
-			imports = [
-				inputs.agenix.nixosModules.default
-				inputs.self.modules.nixosModule
-			];
-
-			nixpkgs.overlays = inputs.self.overlays.all;
-
-			networking = {
-				firewall = {
-					enable = true;
-					allowedTCPPorts = [ config.services.dendrite.httpPort ];
-				};
-				useHostResolvConf = lib.mkForce false;
-			};
 
 			# Environment secrets
 			age = {
-				identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
 				secrets.dendrite = {
 					file = ../../secrets/dendrite.age;
 					owner = "dendrite";
@@ -61,12 +33,7 @@ in
 				User = "dendrite";
 			};
 
-			greg = {
+			greg.databases.dendrite = {};
-				databases.dendrite = {};
-				tailscale.enable = true;
-			};
-
-			#services.tailscale.interfaceName = "userspace-networking";
 
 			services.dendrite = {
 				enable = true;

modules/nixos/backup.nix

@@ -11,7 +11,7 @@ let
 	makeService = name: job: {
 		serviceConfig = {
 			User = job.user;
-			ExecStarPre = lib.optionalString (job.pre != "") job.pre;
+			ExecStartPre = lib.optionalString (job.pre != "") job.pre;
 			ExecStart = "${pkgs.rsync}/bin/rsync -avz --delete -e '${pkgs.openssh}/bin/ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null' ${job.src}/ backup@chronicles.shire-zebra.ts.net:/volume1/NetBackup/${job.dest}";
 			ExecStartPost = lib.optionalString (job.post != "") job.post;
 		};

modules/nixos/container.nix

@@ -0,0 +1,76 @@
+{ config, lib, inputs, ... }:
+
+let
+	cfg = config.greg.containers;
+
+	# Create a container with all our default settings
+
+	makeContainer = name: container: let
+		agekey = "/etc/ssh/agenix_key";
+	in {
+		autoStart = true;
+		hostAddress = "192.168.${container.subnet}.1";
+		localAddress = "192.168.${container.subnet}.2";
+		privateNetwork = true;
+		bindMounts = {
+			"${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key";  # This is needed for agenix to 
+		};
+		enableTun = container.tailscale;
+		config = { config, pkgs, ... }: {
+			imports = [
+				inputs.agenix.nixosModules.default
+				inputs.self.modules.nixosModule
+				container.builder
+			];
+
+			nixpkgs.overlays = inputs.self.overlays.all;
+
+			networking = {
+				firewall.enable = true;
+				useHostResolvConf = lib.mkForce false;
+			};
+
+			age.identityPaths = [ agekey ];
+
+			greg.tailscale.enable = container.tailscale;
+		};
+	};
+in {
+	options.greg.containers = lib.mkOption {
+		default = {};
+
+		type = with lib.types; attrsOf ( submodule (
+			{
+				options = {
+					tailscale = lib.mkOption {
+						type = bool;
+						default = false;
+						description = "Enable tailscale in the container";
+					};
+					subnet = lib.mkOption {
+						type = str;
+						default = "200";
+					};
+					builder = lib.mkOption {
+						default = { ... }: {};
+						description = ''
+							This needs to be a function, like the one for
+							a container's config. It will setup the core system above the
+							defaults set in this module.
+						'';
+						example = ''
+							{ pkgs, config, lib, ... } :
+							{
+								services.openssh.enable = true;
+							}
+						'';
+					};
+				};
+			}
+		));
+	};
+
+	config = {
+		containers = builtins.mapAttrs makeContainer cfg;
+	};
+}

modules/nixos/default.nix

@@ -4,6 +4,7 @@
 	imports = [
 		../baseline.nix
 		./backup.nix
+		./container.nix
 		./db.nix
 		./gnome.nix
 		./home.nix