NixOS Containers: Improved
Add personal containers module Move gitlab into new containers Move matrix onto Isaiah
This commit is contained in:
Greg Hellings
@@ -1,20 +1,11 @@
|
||||
{ inputs, ...}:
|
||||
{ config, pkgs, lib, ... }: let
|
||||
registryPort = 5000;
|
||||
vpnIp = "100.78.226.76";
|
||||
containerIp = "192.168.200.2";
|
||||
in {
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
inputs.self.modules.nixosModule
|
||||
];
|
||||
|
||||
nixpkgs.overlays = inputs.self.overlays.all;
|
||||
|
||||
age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
age.secretsMountPoint = "/run/derp";
|
||||
age.secrets = let
|
||||
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "github"; mode = "0444"; };
|
||||
cfg = n: { file = ../../secrets/gitlab/${n}.age; owner = "gitlab"; group = "gitlab"; mode = "0444"; };
|
||||
in {
|
||||
gitlab-secret = cfg "secret";
|
||||
gitlab-otp = cfg "otp";
|
||||
@@ -24,13 +15,7 @@ in {
|
||||
gitlab-cert = cfg "cert";
|
||||
};
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 registryPort ];
|
||||
};
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [ 80 registryPort ];
|
||||
|
||||
greg.proxies = let
|
||||
t = {
|
||||
@@ -45,7 +30,6 @@ in {
|
||||
"${vpnIp}" = t;
|
||||
"git.thehellings.lan" = t;
|
||||
};
|
||||
greg.tailscale.enable = true;
|
||||
|
||||
virtualisation.docker.enable = true;
|
||||
|
||||
|
||||
+4
-24
@@ -31,25 +31,10 @@ in {
|
||||
|
||||
system.activationScripts.makeGitlabDir = lib.stringAfter [ "var" ] "mkdir -p ${gitlabStateDir} && touch ${gitlabStateDir}/touch";
|
||||
|
||||
containers.gitlab = container {
|
||||
autoStart = true;
|
||||
bindMounts = {
|
||||
"/var/gitlab/state" = {
|
||||
hostPath = gitlabStateDir;
|
||||
isReadOnly = false;
|
||||
};
|
||||
"/dev/net/tun" = {
|
||||
hostPath = "/dev/net/tun";
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
forwardPorts = [{
|
||||
hostPort = 2222;
|
||||
containerPort = 22;
|
||||
}];
|
||||
hostAddress = "192.168.200.1";
|
||||
localAddress = "192.168.200.2";
|
||||
config = ((import ./container-git.nix) { inherit inputs; });
|
||||
greg.containers.gitlab = {
|
||||
tailscale = true;
|
||||
subnet = "200";
|
||||
builder = (import ./container-git.nix);
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
@@ -80,11 +65,6 @@ in {
|
||||
];
|
||||
};
|
||||
};
|
||||
"container@gitlab".serviceConfig = {
|
||||
DeviceAllow = [ "/dev/net/tun" ];
|
||||
ProtectKernelModules = false;
|
||||
PrivateDevices = false;
|
||||
};
|
||||
gitlab-runner.serviceConfig.EnvironmentFile = config.age.secrets.docker-auth.path;
|
||||
};
|
||||
|
||||
|
||||
+6
-39
@@ -5,42 +5,14 @@ let
|
||||
conn = "postgresql:///dendrite?sslmode=disable&host=/run/postgresql";
|
||||
in
|
||||
{
|
||||
systemd.services."container@matrix".serviceConfig = {
|
||||
DeviceAllow = [ "/dev/net/tun" ];
|
||||
ProtectKernelModules = false;
|
||||
PrivateDevices = false;
|
||||
};
|
||||
containers.matrix = {
|
||||
autoStart = true;
|
||||
bindMounts = {
|
||||
"/etc/ssh".hostPath = "/etc/ssh";
|
||||
"/dev/net/tun" = {
|
||||
hostPath = "/dev/net/tun";
|
||||
isReadOnly = false;
|
||||
};
|
||||
};
|
||||
hostAddress = "192.168.204.1";
|
||||
localAddress = "192.168.204.2";
|
||||
privateNetwork = true;
|
||||
config = { pkgs, config, ... }: {
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
inputs.self.modules.nixosModule
|
||||
];
|
||||
|
||||
nixpkgs.overlays = inputs.self.overlays.all;
|
||||
|
||||
networking = {
|
||||
firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ config.services.dendrite.httpPort ];
|
||||
};
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
greg.containers.matrix = {
|
||||
tailscale = true;
|
||||
subnet = "204";
|
||||
builder = { pkgs, config, ... }: {
|
||||
networking.firewall.allowedTCPPorts = [ config.services.dendrite.httpPort ];
|
||||
|
||||
# Environment secrets
|
||||
age = {
|
||||
identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
|
||||
secrets.dendrite = {
|
||||
file = ../../secrets/dendrite.age;
|
||||
owner = "dendrite";
|
||||
@@ -61,12 +33,7 @@ in
|
||||
User = "dendrite";
|
||||
};
|
||||
|
||||
greg = {
|
||||
databases.dendrite = {};
|
||||
tailscale.enable = true;
|
||||
};
|
||||
|
||||
#services.tailscale.interfaceName = "userspace-networking";
|
||||
greg.databases.dendrite = {};
|
||||
|
||||
services.dendrite = {
|
||||
enable = true;
|
||||
|
||||
@@ -11,7 +11,7 @@ let
|
||||
makeService = name: job: {
|
||||
serviceConfig = {
|
||||
User = job.user;
|
||||
ExecStarPre = lib.optionalString (job.pre != "") job.pre;
|
||||
ExecStartPre = lib.optionalString (job.pre != "") job.pre;
|
||||
ExecStart = "${pkgs.rsync}/bin/rsync -avz --delete -e '${pkgs.openssh}/bin/ssh -oStrictHostKeyChecking=no -oUserKnownHostsFile=/dev/null' ${job.src}/ backup@chronicles.shire-zebra.ts.net:/volume1/NetBackup/${job.dest}";
|
||||
ExecStartPost = lib.optionalString (job.post != "") job.post;
|
||||
};
|
||||
|
||||
@@ -0,0 +1,76 @@
|
||||
{ config, lib, inputs, ... }:
|
||||
|
||||
let
|
||||
cfg = config.greg.containers;
|
||||
|
||||
# Create a container with all our default settings
|
||||
|
||||
makeContainer = name: container: let
|
||||
agekey = "/etc/ssh/agenix_key";
|
||||
in {
|
||||
autoStart = true;
|
||||
hostAddress = "192.168.${container.subnet}.1";
|
||||
localAddress = "192.168.${container.subnet}.2";
|
||||
privateNetwork = true;
|
||||
bindMounts = {
|
||||
"${agekey}".hostPath = "/etc/ssh/ssh_host_ed25519_key"; # This is needed for agenix to
|
||||
};
|
||||
enableTun = container.tailscale;
|
||||
config = { config, pkgs, ... }: {
|
||||
imports = [
|
||||
inputs.agenix.nixosModules.default
|
||||
inputs.self.modules.nixosModule
|
||||
container.builder
|
||||
];
|
||||
|
||||
nixpkgs.overlays = inputs.self.overlays.all;
|
||||
|
||||
networking = {
|
||||
firewall.enable = true;
|
||||
useHostResolvConf = lib.mkForce false;
|
||||
};
|
||||
|
||||
age.identityPaths = [ agekey ];
|
||||
|
||||
greg.tailscale.enable = container.tailscale;
|
||||
};
|
||||
};
|
||||
in {
|
||||
options.greg.containers = lib.mkOption {
|
||||
default = {};
|
||||
|
||||
type = with lib.types; attrsOf ( submodule (
|
||||
{
|
||||
options = {
|
||||
tailscale = lib.mkOption {
|
||||
type = bool;
|
||||
default = false;
|
||||
description = "Enable tailscale in the container";
|
||||
};
|
||||
subnet = lib.mkOption {
|
||||
type = str;
|
||||
default = "200";
|
||||
};
|
||||
builder = lib.mkOption {
|
||||
default = { ... }: {};
|
||||
description = ''
|
||||
This needs to be a function, like the one for
|
||||
a container's config. It will setup the core system above the
|
||||
defaults set in this module.
|
||||
'';
|
||||
example = ''
|
||||
{ pkgs, config, lib, ... } :
|
||||
{
|
||||
services.openssh.enable = true;
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
));
|
||||
};
|
||||
|
||||
config = {
|
||||
containers = builtins.mapAttrs makeContainer cfg;
|
||||
};
|
||||
}
|
||||
@@ -4,6 +4,7 @@
|
||||
imports = [
|
||||
../baseline.nix
|
||||
./backup.nix
|
||||
./container.nix
|
||||
./db.nix
|
||||
./gnome.nix
|
||||
./home.nix
|
||||
|
||||
Reference in New Issue
Block a user