This repository has no description
3.3 kB
111 lines
1# broken, muchsync cant sync into the folders which should be handles by bindfs
2# ls -la also does not show the full directory permissions
3{ config, pkgs, ... }:
4let
5
6 cname = "green";
7
8in
9{
10 imports = [
11 <stockholm/lass/2configs/container-networking.nix>
12 <stockholm/lass/2configs/syncthing.nix>
13 ];
14
15 programs.fuse.userAllowOther = true;
16
17 services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/securefs" = {
18 devices = [
19 "icarus"
20 "skynet"
21 "littleT"
22 "shodan"
23 "mors"
24 "morpheus"
25 ];
26 ignorePerms = false;
27 };
28
29 krebs.permown."/var/lib/sync-containers/${cname}/securefs" = {
30 file-mode = "u+rw";
31 directory-mode = "u+rwx";
32 owner = "syncthing";
33 keepGoing = false;
34 };
35
36 systemd.services."container@${cname}".reloadIfChanged = mkForce false;
37 containers.${cname} = {
38 config =
39 { ... }:
40 {
41 environment.systemPackages = [
42 pkgs.git
43 pkgs.rxvt-unicode-unwrapped.terminfo
44 ];
45 services.openssh.enable = true;
46 users.users.root.openssh.authorizedKeys.keys = [
47 config.krebs.users.lass.pubkey
48 ];
49 system.activationScripts.fuse = {
50 text = ''
51 ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
52 '';
53 deps = [ ];
54 };
55 };
56 allowedDevices = [
57 {
58 modifier = "rwm";
59 node = "/dev/fuse";
60 }
61 ];
62 autoStart = false;
63 enableTun = true;
64 privateNetwork = true;
65 hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
66 localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
67 };
68
69 environment.systemPackages = [
70 (pkgs.writeDashBin "start-${cname}" ''
71 set -euf
72 set -x
73
74 mkdir -p /var/lib/containers/${cname}/var/state
75
76 if ! mount | grep -q 'securefs on /var/lib/containers/${cname}/var/state type fuse.securefs'; then
77 if ! ${pkgs.securefs}/bin/securefs info /var/lib/sync-containers/${cname}/securefs; then
78 ${pkgs.securefs}/bin/securefs create --format 4 /var/lib/sync-containers/${cname}/securefs
79 fi
80
81 ${pkgs.securefs}/bin/securefs mount -b \
82 -o allow_other -o default_permissions \
83 --log /var/lib/sync-containers/${cname}/securefs.log \
84 /var/lib/sync-containers/${cname}/securefs /var/lib/containers/${cname}/var/state
85 fi
86
87 STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
88 if [ "$STATE" = 'down' ]; then
89 ${pkgs.nixos-container}/bin/nixos-container start ${cname}
90 fi
91
92 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
93 set -x
94
95 mkdir -p /var/state/var_src
96 ln -sfTr /var/state/var_src /var/src
97 touch /etc/NIXOS
98 ''}
99
100 if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
101 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
102 fi
103 '')
104 (pkgs.writeDashBin "stop-${cname}" ''
105 set -euf
106
107 ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
108 umount /var/lib/containers/${cname}/var/state
109 '')
110 ];
111}