This repository has no description
2.5 kB
97 lines
1{ config, pkgs, ... }:
2let
3
4 cname = "green-plain";
5
6in
7{
8 imports = [
9 <stockholm/lass/2configs/container-networking.nix>
10 <stockholm/lass/2configs/syncthing.nix>
11 ];
12
13 programs.fuse.userAllowOther = true;
14
15 services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = {
16 devices = [
17 "icarus"
18 "skynet"
19 "littleT"
20 "shodan"
21 "mors"
22 "morpheus"
23 ];
24 ignorePerms = false;
25 };
26
27 krebs.permown."/var/lib/containers/${cname}/var/state" = {
28 file-mode = "u+rw";
29 directory-mode = "u+rwx";
30 owner = "syncthing";
31 keepGoing = true;
32 };
33
34 systemd.services."container@${cname}".reloadIfChanged = mkForce false;
35 containers.${cname} = {
36 config =
37 { ... }:
38 {
39 environment.systemPackages = [
40 pkgs.git
41 pkgs.rxvt-unicode-unwrapped.terminfo
42 ];
43 services.openssh.enable = true;
44 users.users.root.openssh.authorizedKeys.keys = [
45 config.krebs.users.lass.pubkey
46 ];
47 system.activationScripts.fuse = {
48 text = ''
49 ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
50 '';
51 deps = [ ];
52 };
53 };
54 allowedDevices = [
55 {
56 modifier = "rwm";
57 node = "/dev/fuse";
58 }
59 ];
60 autoStart = false;
61 enableTun = true;
62 privateNetwork = true;
63 hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
64 localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
65 };
66
67 environment.systemPackages = [
68 (pkgs.writeDashBin "start-${cname}" ''
69 set -euf
70 set -x
71
72 mkdir -p /var/lib/containers/${cname}/var/state
73
74 STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
75 if [ "$STATE" = 'down' ]; then
76 ${pkgs.nixos-container}/bin/nixos-container start ${cname}
77 fi
78
79 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
80 set -x
81
82 mkdir -p /var/state/var_src
83 ln -sfTr /var/state/var_src /var/src
84 touch /etc/NIXOS
85 ''}
86
87 if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
88 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
89 fi
90 '')
91 (pkgs.writeDashBin "stop-${cname}" ''
92 set -euf
93
94 ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
95 '')
96 ];
97}