This repository has no description
5.5 kB
163 lines
1{ config, lib, pkgs, ... }:
2let
3 ctr.name = "red";
4in
5{
6
7 krebs.sync-containers3.containers.red = {
8 sshKey = "${config.krebs.secret.directory}/containers/red/sync.key";
9 ephemeral = true;
10 };
11
12 # containers.${ctr.name} = {
13 # config = {
14 # environment.systemPackages = [
15 # pkgs.dhcpcd
16 # pkgs.git
17 # pkgs.jq
18 # ];
19 # networking.useDHCP = lib.mkForce true;
20 # systemd.services.autoswitch = {
21 # environment = {
22 # NIX_REMOTE = "daemon";
23 # };
24 # wantedBy = [ "multi-user.target" ];
25 # serviceConfig.ExecStart = pkgs.writers.writeDash "autoswitch" ''
26 # if test -e /var/src/nixos-config; then
27 # /run/current-system/sw/bin/nixos-rebuild -I /var/src switch || :
28 # fi
29 # '';
30 # unitConfig.X-StopOnRemoval = false;
31 # };
32 # };
33 # autoStart = false;
34 # enableTun = true;
35 # privateNetwork = true;
36 # hostBridge = "ctr0";
37 # bindMounts = {
38 # "/etc/resolv.conf".hostPath = "/etc/resolv.conf";
39 # "/var/lib/self-state/disk-image" = {
40 # hostPath = "/var/lib/sync-containers3/${ctr.name}";
41 # isReadOnly = true;
42 # };
43 # };
44 # };
45
46 # systemd.services."${ctr.name}_scheduler" = {
47 # wantedBy = [ "multi-user.target" ];
48 # path = with pkgs; [
49 # coreutils
50 # consul
51 # cryptsetup
52 # mount
53 # util-linux
54 # systemd
55 # untilport
56 # ];
57 # serviceConfig = {
58 # Restart = "always";
59 # RestartSec = "15s";
60 # ExecStart = "${pkgs.consul}/bin/consul lock container_${ctr.name} ${pkgs.writers.writeDash "${ctr.name}-start" ''
61 # set -efux
62 # trap ${pkgs.writers.writeDash "stop-${ctr.name}" ''
63 # set -efux
64 # /run/current-system/sw/bin/nixos-container stop ${ctr.name} || :
65 # umount /var/lib/nixos-containers/${ctr.name}/var/state || :
66 # cryptsetup luksClose ${ctr.name} || :
67 # ''} INT TERM EXIT
68 # consul kv put containers/${ctr.name}/host ${config.networking.hostName}
69 # cryptsetup luksOpen --key-file /var/src/secrets/containers/${ctr.name}/luks /var/lib/sync-containers3/${ctr.name}/disk ${ctr.name}
70 # mkdir -p /var/lib/nixos-containers/${ctr.name}/var/state
71 # mount /dev/mapper/${ctr.name} /var/lib/nixos-containers/${ctr.name}/var/state
72 # ln -frs /var/lib/nixos-containers/${ctr.name}/var/state/var_src /var/lib/nixos-containers/${ctr.name}/var/src
73 # /run/current-system/sw/bin/nixos-container start ${ctr.name}
74 # set +x
75 # until /run/wrappers/bin/ping -q -c 1 ${ctr.name}.r > /dev/null; do sleep 5; done
76 # while /run/wrappers/bin/ping -q -c 1 ${ctr.name}.r > /dev/null; do sleep 5; done
77 # ''}";
78 # };
79 # };
80
81 # users.groups."container_${ctr.name}" = {};
82 # users.users."container_${ctr.name}" = {
83 # group = "container_${ctr.name}";
84 # isSystemUser = true;
85 # home = "/var/lib/sync-containers3/${ctr.name}";
86 # createHome = true;
87 # homeMode = "705";
88 # openssh.authorizedKeys.keys = [
89 # config.krebs.users.lass.pubkey
90 # ];
91 # };
92
93 # systemd.timers."${ctr.name}_syncer" = {
94 # timerConfig = {
95 # RandomizedDelaySec = 300;
96 # };
97 # };
98 # systemd.services."${ctr.name}_syncer" = {
99 # path = with pkgs; [
100 # coreutils
101 # rsync
102 # openssh
103 # systemd
104 # ];
105 # startAt = "*:0/1";
106 # serviceConfig = {
107 # User = "container_${ctr.name}";
108 # LoadCredential = [
109 # "ssh_key:${toString <secrets>}/containers/${ctr.name}/sync.key"
110 # ];
111 # ExecCondition = pkgs.writers.writeDash "${ctr.name}_checker" ''
112 # set -efu
113 # ! systemctl is-active --quiet container@${ctr.name}.service
114 # '';
115 # ExecStart = pkgs.writers.writeDash "${ctr.name}_syncer" ''
116 # set -efu
117 # rsync -a -e "ssh -i $CREDENTIALS_DIRECTORY/ssh_key" --inplace container_sync@${ctr.name}.r:disk-image/disk $HOME/disk
118 # '';
119 # };
120 # };
121
122 # # networking
123 # networking.networkmanager.unmanaged = [ "ctr0" ];
124 # networking.interfaces.dummy0.virtual = true;
125 # networking.bridges.ctr0.interfaces = [ "dummy0" ];
126 # networking.interfaces.ctr0.ipv4.addresses = [{
127 # address = "10.233.0.1";
128 # prefixLength = 24;
129 # }];
130 # systemd.services."dhcpd-ctr0" = {
131 # wantedBy = [ "multi-user.target" ];
132 # after = [ "network.target" ];
133 # serviceConfig = {
134 # Type = "forking";
135 # Restart = "always";
136 # DynamicUser = true;
137 # StateDirectory = "dhcpd-ctr0";
138 # User = "dhcpd-ctr0";
139 # Group = "dhcpd-ctr0";
140 # AmbientCapabilities = [
141 # "CAP_NET_RAW" # to send ICMP messages
142 # "CAP_NET_BIND_SERVICE" # to bind on DHCP port (67)
143 # ];
144 # ExecStartPre = "${pkgs.coreutils}/bin/touch /var/lib/dhcpd-ctr0/dhcpd.leases";
145 # ExecStart = "${pkgs.dhcp}/bin/dhcpd -4 -lf /var/lib/dhcpd-ctr0/dhcpd.leases -cf ${pkgs.writeText "dhpd.conf" ''
146 # default-lease-time 600;
147 # max-lease-time 7200;
148 # authoritative;
149 # ddns-update-style interim;
150 # log-facility local1; # see dhcpd.nix
151
152 # option subnet-mask 255.255.255.0;
153 # option routers 10.233.0.1;
154 # # option domain-name-servers 8.8.8.8; # TODO configure dns server
155 # subnet 10.233.0.0 netmask 255.255.255.0 {
156 # range 10.233.0.10 10.233.0.250;
157 # }
158 # ''} ctr0";
159 # };
160 # };
161
162}
163