This repository has no description
2.3 kB
52 lines
1{ config, pkgs, ... }:
2{
3 krebs.sync-containers3.containers.yellow = {
4 sshKey = "${config.krebs.secret.directory}/yellow.sync.key";
5 startCommand = ''
6 export PATH=$PATH:${pkgs.git}/bin
7 until ${pkgs.dig.host}/bin/host github.com; do sleep 1; done
8 ${pkgs.nixos-rebuild}/bin/nixos-rebuild --refresh --flake github:lassulus/superconfig#yellow switch --no-write-lock-file
9 '';
10 };
11 containers.yellow.bindMounts."/var/lib" = {
12 hostPath = "/var/lib/sync-containers3/yellow/state";
13 isReadOnly = false;
14 };
15 containers.yellow.bindMounts."/var/download" = {
16 hostPath = "/var/download";
17 isReadOnly = false;
18 };
19 # krebs.iptables.tables.filter.FORWARD.rules = [
20 # { predicate = "-d ${config.krebs.hosts.yellow.nets.retiolum.ip4.addr} -p tcp --dport 8000 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; v6 = false; }
21 # { predicate = "-d ${config.krebs.hosts.yellow.nets.retiolum.ip6.addr} -p tcp --dport 8000 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; v4 = false; }
22 # ];
23 # krebs.iptables.tables.nat.PREROUTING.rules = [
24 # { predicate = "-p tcp --dport 2"; target = "DNAT --to-destination ${config.krebs.hosts.radio.nets.retiolum.ip4.addr}:8000"; v6 = false; }
25 # { predicate = "-p tcp --dport 2"; target = "DNAT --to-destination ${config.krebs.hosts.radio.nets.retiolum.ip6.addr}:8000"; v4 = false; }
26 # ];
27 networking.firewall.allowedTCPPorts = [ 8096 8920 ];
28 networking.firewall.allowedUDPPorts = [ 1900 7359 ];
29 containers.yellow.forwardPorts = [
30 { hostPort = 8096; containerPort = 8096; protocol = "tcp"; }
31 { hostPort = 8920; containerPort = 8920; protocol = "tcp"; }
32 { hostPort = 1900; containerPort = 1900; protocol = "udp"; }
33 { hostPort = 7359; containerPort = 7359; protocol = "udp"; }
34 ];
35
36 services.nginx.virtualHosts."flix.lassul.us" = {
37 # forceSSL = true;
38 # enableACME = true;
39 locations."/" = {
40 proxyPass = "http://yellow.r:8096";
41 proxyWebsockets = true;
42 recommendedProxySettings = true;
43 };
44 };
45 clanCore.facts.services.yellow-container = {
46 secret."yellow.sync.key" = { };
47 generator.script = ";";
48 generator.prompt = ''
49 copy or reference the secret key from the container into here, so we can actually start/sync the container
50 '';
51 };
52}