This repository has no description
3.2 kB
99 lines
1# broken, muchsync cant sync into the folders which should be handles by bindfs
2# ls -la also does not show the full directory permissions
3{ config, lib, pkgs, ... }:
4let
5
6 cname = "green";
7
8in {
9 imports = [
10 <stockholm/lass/2configs/container-networking.nix>
11 <stockholm/lass/2configs/syncthing.nix>
12 ];
13
14 programs.fuse.userAllowOther = true;
15
16 services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/securefs" = {
17 devices = [ "icarus" "skynet" "littleT" "shodan" "mors" "morpheus" ];
18 ignorePerms = false;
19 };
20
21 krebs.permown."/var/lib/sync-containers/${cname}/securefs" = {
22 file-mode = "u+rw";
23 directory-mode = "u+rwx";
24 owner = "syncthing";
25 keepGoing = false;
26 };
27
28 systemd.services."container@${cname}".reloadIfChanged = mkForce false;
29 containers.${cname} = {
30 config = { ... }: {
31 environment.systemPackages = [
32 pkgs.git
33 pkgs.rxvt-unicode-unwrapped.terminfo
34 ];
35 services.openssh.enable = true;
36 users.users.root.openssh.authorizedKeys.keys = [
37 config.krebs.users.lass.pubkey
38 ];
39 system.activationScripts.fuse = {
40 text = ''
41 ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
42 '';
43 deps = [];
44 };
45 };
46 allowedDevices = [
47 { modifier = "rwm"; node = "/dev/fuse"; }
48 ];
49 autoStart = false;
50 enableTun = true;
51 privateNetwork = true;
52 hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
53 localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
54 };
55
56 environment.systemPackages = [
57 (pkgs.writeDashBin "start-${cname}" ''
58 set -euf
59 set -x
60
61 mkdir -p /var/lib/containers/${cname}/var/state
62
63 if ! mount | grep -q 'securefs on /var/lib/containers/${cname}/var/state type fuse.securefs'; then
64 if ! ${pkgs.securefs}/bin/securefs info /var/lib/sync-containers/${cname}/securefs; then
65 ${pkgs.securefs}/bin/securefs create --format 4 /var/lib/sync-containers/${cname}/securefs
66 fi
67
68 ${pkgs.securefs}/bin/securefs mount -b \
69 -o allow_other -o default_permissions \
70 --log /var/lib/sync-containers/${cname}/securefs.log \
71 /var/lib/sync-containers/${cname}/securefs /var/lib/containers/${cname}/var/state
72 fi
73
74 STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
75 if [ "$STATE" = 'down' ]; then
76 ${pkgs.nixos-container}/bin/nixos-container start ${cname}
77 fi
78
79 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
80 set -x
81
82 mkdir -p /var/state/var_src
83 ln -sfTr /var/state/var_src /var/src
84 touch /etc/NIXOS
85 ''}
86
87 if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
88 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
89 fi
90 '')
91 (pkgs.writeDashBin "stop-${cname}" ''
92 set -euf
93
94 ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
95 umount /var/lib/containers/${cname}/var/state
96 '')
97 ];
98}
99