This repository has no description
3.0 kB
96 lines
1{ config, lib, pkgs, ... }:
2let
3
4 cname = "green";
5
6in {
7 imports = [
8 <stockholm/lass/2configs/container-networking.nix>
9 <stockholm/lass/2configs/syncthing.nix>
10 ];
11
12 programs.fuse.userAllowOther = true;
13
14 services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/ecryptfs" = {
15 devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
16 ignorePerms = false;
17 };
18
19 krebs.permown."/var/lib/sync-containers/${cname}/ecryptfs" = {
20 file-mode = "u+rw";
21 directory-mode = "u+rwx";
22 owner = "syncthing";
23 keepGoing = false;
24 };
25
26 systemd.services."container@${cname}".reloadIfChanged = mkForce false;
27 containers.${cname} = {
28 config = { ... }: {
29 environment.systemPackages = [
30 pkgs.git
31 pkgs.rxvt-unicode-unwrapped.terminfo
32 ];
33 services.openssh.enable = true;
34 users.users.root.openssh.authorizedKeys.keys = [
35 config.krebs.users.lass.pubkey
36 ];
37 system.activationScripts.fuse = {
38 text = ''
39 ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
40 '';
41 deps = [];
42 };
43 };
44 allowedDevices = [
45 { modifier = "rwm"; node = "/dev/fuse"; }
46 ];
47 autoStart = false;
48 enableTun = true;
49 privateNetwork = true;
50 hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
51 localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
52 };
53
54 environment.systemPackages = [
55 pkgs.ecryptfs
56 pkgs.keyutils
57 (pkgs.writeDashBin "start-${cname}" ''
58 set -euf
59 set -x
60
61 mkdir -p /var/lib/containers/${cname}/var/state
62
63 if ! mount | grep -q '/var/lib/sync-containers/${cname}/ecryptfs on /var/lib/containers/${cname}/var/state type ecryptfs'; then
64 if [ -e /var/lib/sync-containers/${cname}/ecryptfs/.cfg.json ]; then
65 ${pkgs.ecrypt}/bin/ecrypt mount /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
66 else
67 ${pkgs.ecrypt}/bin/ecrypt init /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
68 fi
69 fi
70
71 STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
72 if [ "$STATE" = 'down' ]; then
73 ${pkgs.nixos-container}/bin/nixos-container start ${cname}
74 fi
75
76 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
77 set -x
78
79 mkdir -p /var/state/var_src
80 ln -sfTr /var/state/var_src /var/src
81 touch /etc/NIXOS
82 ''}
83
84 if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
85 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
86 fi
87 '')
88 (pkgs.writeDashBin "stop-${cname}" ''
89 set -euf
90
91 ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
92 ${pkgs.ecrypt}/bin/ecrypt unmount /var/lib/sync-containers/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
93 '')
94 ];
95}
96