This repository has no description
2.6 kB
98 lines
1# this seems to work fine, downsides are, all state is owned by syncthing and could be read by the guests syncthing
2
3{ config, pkgs, ... }:
4
5let
6
7 cname = "green-plain";
8
9in
10{
11 imports = [
12 <stockholm/lass/2configs/container-networking.nix>
13 <stockholm/lass/2configs/syncthing.nix>
14 ];
15
16 services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = {
17 devices = [
18 "icarus"
19 "skynet"
20 "littleT"
21 "shodan"
22 "mors"
23 "morpheus"
24 ];
25 ignorePerms = false;
26 };
27
28 krebs.permown."/var/lib/containers/${cname}/var/state" = {
29 file-mode = "u+rw";
30 directory-mode = "u+rwx";
31 owner = "syncthing";
32 keepGoing = true;
33 };
34
35 systemd.services."container@${cname}".reloadIfChanged = mkForce false;
36 containers.${cname} = {
37 config =
38 { ... }:
39 {
40 environment.systemPackages = [
41 pkgs.git
42 pkgs.rxvt-unicode-unwrapped.terminfo
43 ];
44 services.openssh.enable = true;
45 users.users.root.openssh.authorizedKeys.keys = [
46 config.krebs.users.lass.pubkey
47 ];
48 system.activationScripts.fuse = {
49 text = ''
50 ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
51 '';
52 deps = [ ];
53 };
54 };
55 allowedDevices = [
56 {
57 modifier = "rwm";
58 node = "/dev/fuse";
59 }
60 ];
61 autoStart = false;
62 enableTun = true;
63 privateNetwork = true;
64 hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
65 localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
66 };
67
68 environment.systemPackages = [
69 (pkgs.writeDashBin "start-${cname}" ''
70 set -euf
71 set -x
72
73 mkdir -p /var/lib/containers/${cname}/var/state
74
75 STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
76 if [ "$STATE" = 'down' ]; then
77 ${pkgs.nixos-container}/bin/nixos-container start ${cname}
78 fi
79
80 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
81 set -x
82
83 mkdir -p /var/state/var_src
84 ln -sfTr /var/state/var_src /var/src
85 touch /etc/NIXOS
86 ''}
87
88 if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
89 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
90 fi
91 '')
92 (pkgs.writeDashBin "stop-${cname}" ''
93 set -euf
94
95 ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
96 '')
97 ];
98}