This repository has no description
3.3 kB
111 lines
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7{
8 imports = [
9 <stockholm/lass/2configs/container-networking.nix>
10 {
11 #hack for already defined
12 systemd.services."container@blue".reloadIfChanged = lib.mkForce false;
13 systemd.services."container@blue".preStart = ''
14 ${pkgs.mount}/bin/mount | ${pkgs.gnugrep}/bin/grep -q '^encfs on /var/lib/containers/blue'
15 '';
16 systemd.services."container@blue".preStop = ''
17 /run/wrappers/bin/fusermount -u /var/lib/containers/blue
18 '';
19 }
20 ];
21
22 system.activationScripts.containerPermissions = ''
23 mkdir -p /var/lib/containers
24 chmod 711 /var/lib/containers
25 '';
26
27 containers.blue = {
28 config =
29 { ... }:
30 {
31 environment.systemPackages = [
32 pkgs.git
33 pkgs.rxvt-unicode-unwrapped.terminfo
34 ];
35 services.openssh.enable = true;
36 users.users.root.openssh.authorizedKeys.keys = [
37 config.krebs.users.lass.pubkey
38 ];
39 };
40 autoStart = false;
41 enableTun = true;
42 privateNetwork = true;
43 hostAddress = "10.233.2.9";
44 localAddress = "10.233.2.10";
45 };
46
47 #systemd.services = builtins.listToAttrs (map (host:
48 # let
49 # in nameValuePair "sync-blue-${host}" {
50 # bindsTo = [ "container@blue.service" ];
51 # wantedBy = [ "container@blue.service" ];
52 # # ssh needed for rsync
53 # path = [ pkgs.openssh ];
54 # serviceConfig = {
55 # Restart = "always";
56 # RestartSec = 10;
57 # ExecStart = pkgs.writeDash "sync-blue-${host}" ''
58 # set -efu
59 # #make sure blue is running
60 # /run/wrappers/bin/ping -c1 blue.r > /dev/null
61
62 # #make sure the container is unlocked
63 # ${pkgs.mount}/bin/mount | ${pkgs.gnugrep}/bin/grep -q '^encfs on /var/lib/containers/blue'
64
65 # #make sure our target is reachable
66 # ${pkgs.untilport}/bin/untilport ${host}.r 22 2>/dev/null
67
68 # #start sync
69 # ${pkgs.lsyncd}/bin/lsyncd -log scarce ${pkgs.writeText "lsyncd-config.lua" ''
70 # settings {
71 # nodaemon = true,
72 # inotifyMode = "CloseWrite or Modify",
73 # }
74 # sync {
75 # default.rsyncssh,
76 # source = "/var/lib/containers/.blue",
77 # host = "${host}.r",
78 # targetdir = "/var/lib/containers/.blue",
79 # rsync = {
80 # archive = true,
81 # owner = true,
82 # group = true,
83 # };
84 # ssh = {
85 # binary = "${pkgs.openssh}/bin/ssh";
86 # identityFile = "/var/lib/containers/blue/home/lass/.ssh/id_rsa",
87 # },
88 # }
89 # ''}
90 # '';
91 # };
92 # unitConfig.ConditionPathExists = "!/var/run/ppp0.pid";
93 # }
94 #) remote_hosts);
95
96 environment.systemPackages = [
97 (pkgs.writeDashBin "start-blue" ''
98 set -ef
99 if ! $(mount | ${pkgs.gnugrep}/bin/grep -qi '^encfs on /var/lib/containers/blue'); then
100 ${pkgs.encfs}/bin/encfs --public /var/lib/containers/.blue /var/lib/containers/blue
101 fi
102 nixos-container start blue
103 nixos-container run blue -- nixos-rebuild -I /var/src dry-build
104 if ping -c1 blue.r >/dev/null; then
105 echo 'blue is already running. bailing out'
106 exit 23
107 fi
108 nixos-container run blue -- nixos-rebuild -I /var/src switch
109 '')
110 ];
111}