This repository has no description
2.6 kB
93 lines
1# seems to work, very slow though
2
3{ config, lib, pkgs, ... }:
4let
5
6 cname = "green-cryfs";
7
8in {
9 imports = [
10 <stockholm/lass/2configs/container-networking.nix>
11 <stockholm/lass/2configs/syncthing.nix>
12 ];
13
14 programs.fuse.userAllowOther = true;
15
16 services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/cryfs" = {
17 devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
18 ignorePerms = false;
19 };
20
21 lass.bindfs."/var/lib/sync-containers/${cname}/cryfs" = {
22 source = "/var/lib/sync-containers/${cname}/cryfs";
23 options = [
24 "-M ${toString config.users.users.syncthing.uid} -u root -g root"
25 ];
26 };
27
28
29 systemd.services."container@${cname}".reloadIfChanged = mkForce false;
30 containers.${cname} = {
31 config = { ... }: {
32 environment.systemPackages = [
33 pkgs.git
34 pkgs.rxvt-unicode-unwrapped.terminfo
35 ];
36 services.openssh.enable = true;
37 users.users.root.openssh.authorizedKeys.keys = [
38 config.krebs.users.lass.pubkey
39 ];
40 system.activationScripts.fuse = {
41 text = ''
42 ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
43 '';
44 deps = [];
45 };
46 };
47 allowedDevices = [
48 { modifier = "rwm"; node = "/dev/fuse"; }
49 ];
50 autoStart = false;
51 enableTun = true;
52 privateNetwork = true;
53 hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
54 localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
55 };
56
57 environment.systemPackages = [
58 (pkgs.writeDashBin "init-${cname}" ''
59 set -euf
60 set -x
61
62 mkdir -p /var/lib/sync-containers/${cname}/cryfs
63 '')
64 (pkgs.writeDashBin "start-${cname}" ''
65 set -euf
66 set -x
67
68 mkdir -p /var/lib/containers/${cname}/var/state
69
70 STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
71 if [ "$STATE" = 'down' ]; then
72 ${pkgs.nixos-container}/bin/nixos-container start ${cname}
73 fi
74
75 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
76 set -x
77
78 mkdir -p /var/state/var_src
79 ln -sfTr /var/state/var_src /var/src
80 touch /etc/NIXOS
81 ''}
82
83 if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
84 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
85 fi
86 '')
87 (pkgs.writeDashBin "stop-${cname}" ''
88 set -euf
89
90 ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
91 '')
92 ];
93}