This repository has no description
2.7 kB
105 lines
1# seems to work, very slow though
2
3{ config, pkgs, ... }:
4let
5
6 cname = "green-cryfs";
7
8in
9{
10 imports = [
11 <stockholm/lass/2configs/container-networking.nix>
12 <stockholm/lass/2configs/syncthing.nix>
13 ];
14
15 programs.fuse.userAllowOther = true;
16
17 services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}/cryfs" = {
18 devices = [
19 "icarus"
20 "skynet"
21 "littleT"
22 "shodan"
23 "mors"
24 "morpheus"
25 ];
26 ignorePerms = false;
27 };
28
29 lass.bindfs."/var/lib/sync-containers/${cname}/cryfs" = {
30 source = "/var/lib/sync-containers/${cname}/cryfs";
31 options = [
32 "-M ${toString config.users.users.syncthing.uid} -u root -g root"
33 ];
34 };
35
36 systemd.services."container@${cname}".reloadIfChanged = mkForce false;
37 containers.${cname} = {
38 config =
39 { ... }:
40 {
41 environment.systemPackages = [
42 pkgs.git
43 pkgs.rxvt-unicode-unwrapped.terminfo
44 ];
45 services.openssh.enable = true;
46 users.users.root.openssh.authorizedKeys.keys = [
47 config.krebs.users.lass.pubkey
48 ];
49 system.activationScripts.fuse = {
50 text = ''
51 ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
52 '';
53 deps = [ ];
54 };
55 };
56 allowedDevices = [
57 {
58 modifier = "rwm";
59 node = "/dev/fuse";
60 }
61 ];
62 autoStart = false;
63 enableTun = true;
64 privateNetwork = true;
65 hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
66 localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
67 };
68
69 environment.systemPackages = [
70 (pkgs.writeDashBin "init-${cname}" ''
71 set -euf
72 set -x
73
74 mkdir -p /var/lib/sync-containers/${cname}/cryfs
75 '')
76 (pkgs.writeDashBin "start-${cname}" ''
77 set -euf
78 set -x
79
80 mkdir -p /var/lib/containers/${cname}/var/state
81
82 STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
83 if [ "$STATE" = 'down' ]; then
84 ${pkgs.nixos-container}/bin/nixos-container start ${cname}
85 fi
86
87 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
88 set -x
89
90 mkdir -p /var/state/var_src
91 ln -sfTr /var/state/var_src /var/src
92 touch /etc/NIXOS
93 ''}
94
95 if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
96 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
97 fi
98 '')
99 (pkgs.writeDashBin "stop-${cname}" ''
100 set -euf
101
102 ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
103 '')
104 ];
105}