This repository has no description
2.5 kB
89 lines
1# this seems to work, sadly there are no inotify events on the state directory because bindfs hides them,
2
3{ config, lib, pkgs, ... }:
4
5let
6
7 cname = "green-plain";
8
9in {
10 imports = [
11 <stockholm/lass/2configs/container-networking.nix>
12 <stockholm/lass/2configs/syncthing.nix>
13 ];
14
15 programs.fuse.userAllowOther = true;
16
17 services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = {
18 devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
19 ignorePerms = false;
20 };
21
22 lass.bindfs."/var/lib/containers/${cname}/var/state" = {
23 source = "/var/lib/containers/${cname}/var/state";
24 options = [
25 "-M ${toString config.users.users.syncthing.uid} -u root -g root"
26 ];
27 };
28
29
30 systemd.services."container@${cname}".reloadIfChanged = mkForce false;
31 containers.${cname} = {
32 config = { ... }: {
33 environment.systemPackages = [
34 pkgs.git
35 pkgs.rxvt-unicode-unwrapped.terminfo
36 ];
37 services.openssh.enable = true;
38 users.users.root.openssh.authorizedKeys.keys = [
39 config.krebs.users.lass.pubkey
40 ];
41 system.activationScripts.fuse = {
42 text = ''
43 ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
44 '';
45 deps = [];
46 };
47 };
48 allowedDevices = [
49 { modifier = "rwm"; node = "/dev/fuse"; }
50 ];
51 autoStart = false;
52 enableTun = true;
53 privateNetwork = true;
54 hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
55 localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
56 };
57
58 environment.systemPackages = [
59 (pkgs.writeDashBin "start-${cname}" ''
60 set -euf
61 set -x
62
63 mkdir -p /var/lib/containers/${cname}/var/state
64
65 STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
66 if [ "$STATE" = 'down' ]; then
67 ${pkgs.nixos-container}/bin/nixos-container start ${cname}
68 fi
69
70 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
71 set -x
72
73 mkdir -p /var/state/var_src
74 ln -sfTr /var/state/var_src /var/src
75 touch /etc/NIXOS
76 ''}
77
78 if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
79 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
80 fi
81 '')
82 (pkgs.writeDashBin "stop-${cname}" ''
83 set -euf
84
85 ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
86 '')
87 ];
88}
89