This repository has no description
3.1 kB
108 lines
1{ config, pkgs, ... }:
2let
3
4 cname = "green";
5
6in
7{
8 imports = [
9 <stockholm/lass/2configs/container-networking.nix>
10 <stockholm/lass/2configs/syncthing.nix>
11 ];
12
13 programs.fuse.userAllowOther = true;
14
15 services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/ecryptfs" = {
16 devices = [
17 "icarus"
18 "skynet"
19 "littleT"
20 "shodan"
21 "mors"
22 "morpheus"
23 ];
24 ignorePerms = false;
25 };
26
27 krebs.permown."/var/lib/sync-containers/${cname}/ecryptfs" = {
28 file-mode = "u+rw";
29 directory-mode = "u+rwx";
30 owner = "syncthing";
31 keepGoing = false;
32 };
33
34 systemd.services."container@${cname}".reloadIfChanged = mkForce false;
35 containers.${cname} = {
36 config =
37 { ... }:
38 {
39 environment.systemPackages = [
40 pkgs.git
41 pkgs.rxvt-unicode-unwrapped.terminfo
42 ];
43 services.openssh.enable = true;
44 users.users.root.openssh.authorizedKeys.keys = [
45 config.krebs.users.lass.pubkey
46 ];
47 system.activationScripts.fuse = {
48 text = ''
49 ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
50 '';
51 deps = [ ];
52 };
53 };
54 allowedDevices = [
55 {
56 modifier = "rwm";
57 node = "/dev/fuse";
58 }
59 ];
60 autoStart = false;
61 enableTun = true;
62 privateNetwork = true;
63 hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
64 localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
65 };
66
67 environment.systemPackages = [
68 pkgs.ecryptfs
69 pkgs.keyutils
70 (pkgs.writeDashBin "start-${cname}" ''
71 set -euf
72 set -x
73
74 mkdir -p /var/lib/containers/${cname}/var/state
75
76 if ! mount | grep -q '/var/lib/sync-containers/${cname}/ecryptfs on /var/lib/containers/${cname}/var/state type ecryptfs'; then
77 if [ -e /var/lib/sync-containers/${cname}/ecryptfs/.cfg.json ]; then
78 ${pkgs.ecrypt}/bin/ecrypt mount /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
79 else
80 ${pkgs.ecrypt}/bin/ecrypt init /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
81 fi
82 fi
83
84 STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
85 if [ "$STATE" = 'down' ]; then
86 ${pkgs.nixos-container}/bin/nixos-container start ${cname}
87 fi
88
89 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
90 set -x
91
92 mkdir -p /var/state/var_src
93 ln -sfTr /var/state/var_src /var/src
94 touch /etc/NIXOS
95 ''}
96
97 if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
98 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
99 fi
100 '')
101 (pkgs.writeDashBin "stop-${cname}" ''
102 set -euf
103
104 ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
105 ${pkgs.ecrypt}/bin/ecrypt unmount /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
106 '')
107 ];
108}