This repository has no description
3.5 kB
115 lines
1{ config, lib, pkgs, ... }:
2let
3 all_hosts = [
4 "icarus"
5 "shodan"
6 "daedalus"
7 "skynet"
8 "prism"
9 "littleT"
10 ];
11 remote_hosts = lib.filter (h: h != config.networking.hostName) all_hosts;
12
13in {
14 imports = [
15 <stockholm/lass/2configs/container-networking.nix>
16 { #hack for already defined
17 systemd.services."container@blue".reloadIfChanged = lib.mkForce false;
18 systemd.services."container@blue".preStart = ''
19 ${pkgs.mount}/bin/mount | ${pkgs.gnugrep}/bin/grep -q '^encfs on /var/lib/containers/blue'
20 '';
21 systemd.services."container@blue".preStop = ''
22 /run/wrappers/bin/fusermount -u /var/lib/containers/blue
23 '';
24 }
25 ];
26
27 system.activationScripts.containerPermissions = ''
28 mkdir -p /var/lib/containers
29 chmod 711 /var/lib/containers
30 '';
31
32 containers.blue = {
33 config = { ... }: {
34 environment.systemPackages = [
35 pkgs.git
36 pkgs.rxvt-unicode-unwrapped.terminfo
37 ];
38 services.openssh.enable = true;
39 users.users.root.openssh.authorizedKeys.keys = [
40 config.krebs.users.lass.pubkey
41 ];
42 };
43 autoStart = false;
44 enableTun = true;
45 privateNetwork = true;
46 hostAddress = "10.233.2.9";
47 localAddress = "10.233.2.10";
48 };
49
50
51 #systemd.services = builtins.listToAttrs (map (host:
52 # let
53 # in nameValuePair "sync-blue-${host}" {
54 # bindsTo = [ "container@blue.service" ];
55 # wantedBy = [ "container@blue.service" ];
56 # # ssh needed for rsync
57 # path = [ pkgs.openssh ];
58 # serviceConfig = {
59 # Restart = "always";
60 # RestartSec = 10;
61 # ExecStart = pkgs.writeDash "sync-blue-${host}" ''
62 # set -efu
63 # #make sure blue is running
64 # /run/wrappers/bin/ping -c1 blue.r > /dev/null
65
66 # #make sure the container is unlocked
67 # ${pkgs.mount}/bin/mount | ${pkgs.gnugrep}/bin/grep -q '^encfs on /var/lib/containers/blue'
68
69 # #make sure our target is reachable
70 # ${pkgs.untilport}/bin/untilport ${host}.r 22 2>/dev/null
71
72 # #start sync
73 # ${pkgs.lsyncd}/bin/lsyncd -log scarce ${pkgs.writeText "lsyncd-config.lua" ''
74 # settings {
75 # nodaemon = true,
76 # inotifyMode = "CloseWrite or Modify",
77 # }
78 # sync {
79 # default.rsyncssh,
80 # source = "/var/lib/containers/.blue",
81 # host = "${host}.r",
82 # targetdir = "/var/lib/containers/.blue",
83 # rsync = {
84 # archive = true,
85 # owner = true,
86 # group = true,
87 # };
88 # ssh = {
89 # binary = "${pkgs.openssh}/bin/ssh";
90 # identityFile = "/var/lib/containers/blue/home/lass/.ssh/id_rsa",
91 # },
92 # }
93 # ''}
94 # '';
95 # };
96 # unitConfig.ConditionPathExists = "!/var/run/ppp0.pid";
97 # }
98 #) remote_hosts);
99
100 environment.systemPackages = [
101 (pkgs.writeDashBin "start-blue" ''
102 set -ef
103 if ! $(mount | ${pkgs.gnugrep}/bin/grep -qi '^encfs on /var/lib/containers/blue'); then
104 ${pkgs.encfs}/bin/encfs --public /var/lib/containers/.blue /var/lib/containers/blue
105 fi
106 nixos-container start blue
107 nixos-container run blue -- nixos-rebuild -I /var/src dry-build
108 if ping -c1 blue.r >/dev/null; then
109 echo 'blue is already running. bailing out'
110 exit 23
111 fi
112 nixos-container run blue -- nixos-rebuild -I /var/src switch
113 '')
114 ];
115}