This repository has no description
5.5 kB
159 lines
1{ config, ... }:
2{
3
4 krebs.sync-containers3.containers.red = {
5 sshKey = "${config.krebs.secret.directory}/containers/red/sync.key";
6 ephemeral = true;
7 };
8
9 # containers.${ctr.name} = {
10 # config = {
11 # environment.systemPackages = [
12 # pkgs.dhcpcd
13 # pkgs.git
14 # pkgs.jq
15 # ];
16 # networking.useDHCP = lib.mkForce true;
17 # systemd.services.autoswitch = {
18 # environment = {
19 # NIX_REMOTE = "daemon";
20 # };
21 # wantedBy = [ "multi-user.target" ];
22 # serviceConfig.ExecStart = pkgs.writers.writeDash "autoswitch" ''
23 # if test -e /var/src/nixos-config; then
24 # /run/current-system/sw/bin/nixos-rebuild -I /var/src switch || :
25 # fi
26 # '';
27 # unitConfig.X-StopOnRemoval = false;
28 # };
29 # };
30 # autoStart = false;
31 # enableTun = true;
32 # privateNetwork = true;
33 # hostBridge = "ctr0";
34 # bindMounts = {
35 # "/etc/resolv.conf".hostPath = "/etc/resolv.conf";
36 # "/var/lib/self-state/disk-image" = {
37 # hostPath = "/var/lib/sync-containers3/${ctr.name}";
38 # isReadOnly = true;
39 # };
40 # };
41 # };
42
43 # systemd.services."${ctr.name}_scheduler" = {
44 # wantedBy = [ "multi-user.target" ];
45 # path = with pkgs; [
46 # coreutils
47 # consul
48 # cryptsetup
49 # mount
50 # util-linux
51 # systemd
52 # untilport
53 # ];
54 # serviceConfig = {
55 # Restart = "always";
56 # RestartSec = "15s";
57 # ExecStart = "${pkgs.consul}/bin/consul lock container_${ctr.name} ${pkgs.writers.writeDash "${ctr.name}-start" ''
58 # set -efux
59 # trap ${pkgs.writers.writeDash "stop-${ctr.name}" ''
60 # set -efux
61 # /run/current-system/sw/bin/nixos-container stop ${ctr.name} || :
62 # umount /var/lib/nixos-containers/${ctr.name}/var/state || :
63 # cryptsetup luksClose ${ctr.name} || :
64 # ''} INT TERM EXIT
65 # consul kv put containers/${ctr.name}/host ${config.networking.hostName}
66 # cryptsetup luksOpen --key-file /var/src/secrets/containers/${ctr.name}/luks /var/lib/sync-containers3/${ctr.name}/disk ${ctr.name}
67 # mkdir -p /var/lib/nixos-containers/${ctr.name}/var/state
68 # mount /dev/mapper/${ctr.name} /var/lib/nixos-containers/${ctr.name}/var/state
69 # ln -frs /var/lib/nixos-containers/${ctr.name}/var/state/var_src /var/lib/nixos-containers/${ctr.name}/var/src
70 # /run/current-system/sw/bin/nixos-container start ${ctr.name}
71 # set +x
72 # until /run/wrappers/bin/ping -q -c 1 ${ctr.name}.r > /dev/null; do sleep 5; done
73 # while /run/wrappers/bin/ping -q -c 1 ${ctr.name}.r > /dev/null; do sleep 5; done
74 # ''}";
75 # };
76 # };
77
78 # users.groups."container_${ctr.name}" = {};
79 # users.users."container_${ctr.name}" = {
80 # group = "container_${ctr.name}";
81 # isSystemUser = true;
82 # home = "/var/lib/sync-containers3/${ctr.name}";
83 # createHome = true;
84 # homeMode = "705";
85 # openssh.authorizedKeys.keys = [
86 # config.krebs.users.lass.pubkey
87 # ];
88 # };
89
90 # systemd.timers."${ctr.name}_syncer" = {
91 # timerConfig = {
92 # RandomizedDelaySec = 300;
93 # };
94 # };
95 # systemd.services."${ctr.name}_syncer" = {
96 # path = with pkgs; [
97 # coreutils
98 # rsync
99 # openssh
100 # systemd
101 # ];
102 # startAt = "*:0/1";
103 # serviceConfig = {
104 # User = "container_${ctr.name}";
105 # LoadCredential = [
106 # "ssh_key:${toString <secrets>}/containers/${ctr.name}/sync.key"
107 # ];
108 # ExecCondition = pkgs.writers.writeDash "${ctr.name}_checker" ''
109 # set -efu
110 # ! systemctl is-active --quiet container@${ctr.name}.service
111 # '';
112 # ExecStart = pkgs.writers.writeDash "${ctr.name}_syncer" ''
113 # set -efu
114 # rsync -a -e "ssh -i $CREDENTIALS_DIRECTORY/ssh_key" --inplace container_sync@${ctr.name}.r:disk-image/disk $HOME/disk
115 # '';
116 # };
117 # };
118
119 # # networking
120 # networking.networkmanager.unmanaged = [ "ctr0" ];
121 # networking.interfaces.dummy0.virtual = true;
122 # networking.bridges.ctr0.interfaces = [ "dummy0" ];
123 # networking.interfaces.ctr0.ipv4.addresses = [{
124 # address = "10.233.0.1";
125 # prefixLength = 24;
126 # }];
127 # systemd.services."dhcpd-ctr0" = {
128 # wantedBy = [ "multi-user.target" ];
129 # after = [ "network.target" ];
130 # serviceConfig = {
131 # Type = "forking";
132 # Restart = "always";
133 # DynamicUser = true;
134 # StateDirectory = "dhcpd-ctr0";
135 # User = "dhcpd-ctr0";
136 # Group = "dhcpd-ctr0";
137 # AmbientCapabilities = [
138 # "CAP_NET_RAW" # to send ICMP messages
139 # "CAP_NET_BIND_SERVICE" # to bind on DHCP port (67)
140 # ];
141 # ExecStartPre = "${pkgs.coreutils}/bin/touch /var/lib/dhcpd-ctr0/dhcpd.leases";
142 # ExecStart = "${pkgs.dhcp}/bin/dhcpd -4 -lf /var/lib/dhcpd-ctr0/dhcpd.leases -cf ${pkgs.writeText "dhpd.conf" ''
143 # default-lease-time 600;
144 # max-lease-time 7200;
145 # authoritative;
146 # ddns-update-style interim;
147 # log-facility local1; # see dhcpd.nix
148
149 # option subnet-mask 255.255.255.0;
150 # option routers 10.233.0.1;
151 # # option domain-name-servers 8.8.8.8; # TODO configure dns server
152 # subnet 10.233.0.0 netmask 255.255.255.0 {
153 # range 10.233.0.10 10.233.0.250;
154 # }
155 # ''} ctr0";
156 # };
157 # };
158
159}