This repository has no description
2.6 kB
100 lines
1# this seems to work, sadly there are no inotify events on the state directory because bindfs hides them,
2
3{ config, pkgs, ... }:
4
5let
6
7 cname = "green-plain";
8
9in
10{
11 imports = [
12 <stockholm/lass/2configs/container-networking.nix>
13 <stockholm/lass/2configs/syncthing.nix>
14 ];
15
16 programs.fuse.userAllowOther = true;
17
18 services.syncthing.declarative.folders."/var/lib/containers/${cname}/var/state" = {
19 devices = [
20 "icarus"
21 "skynet"
22 "littleT"
23 "shodan"
24 "mors"
25 "morpheus"
26 ];
27 ignorePerms = false;
28 };
29
30 lass.bindfs."/var/lib/containers/${cname}/var/state" = {
31 source = "/var/lib/containers/${cname}/var/state";
32 options = [
33 "-M ${toString config.users.users.syncthing.uid} -u root -g root"
34 ];
35 };
36
37 systemd.services."container@${cname}".reloadIfChanged = mkForce false;
38 containers.${cname} = {
39 config =
40 { ... }:
41 {
42 environment.systemPackages = [
43 pkgs.git
44 pkgs.rxvt-unicode-unwrapped.terminfo
45 ];
46 services.openssh.enable = true;
47 users.users.root.openssh.authorizedKeys.keys = [
48 config.krebs.users.lass.pubkey
49 ];
50 system.activationScripts.fuse = {
51 text = ''
52 ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
53 '';
54 deps = [ ];
55 };
56 };
57 allowedDevices = [
58 {
59 modifier = "rwm";
60 node = "/dev/fuse";
61 }
62 ];
63 autoStart = false;
64 enableTun = true;
65 privateNetwork = true;
66 hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
67 localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
68 };
69
70 environment.systemPackages = [
71 (pkgs.writeDashBin "start-${cname}" ''
72 set -euf
73 set -x
74
75 mkdir -p /var/lib/containers/${cname}/var/state
76
77 STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
78 if [ "$STATE" = 'down' ]; then
79 ${pkgs.nixos-container}/bin/nixos-container start ${cname}
80 fi
81
82 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
83 set -x
84
85 mkdir -p /var/state/var_src
86 ln -sfTr /var/state/var_src /var/src
87 touch /etc/NIXOS
88 ''}
89
90 if [ -h /var/lib/containers/${cname}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${cname}.r); then
91 ${pkgs.nixos-container}/bin/nixos-container run ${cname} -- nixos-rebuild -I /var/src switch
92 fi
93 '')
94 (pkgs.writeDashBin "stop-${cname}" ''
95 set -euf
96
97 ${pkgs.nixos-container}/bin/nixos-container stop ${cname}
98 '')
99 ];
100}