This repository has no description
2.4 kB
74 lines
1{ config, pkgs, ... }:
2{
3 krebs.sync-containers3.containers.yellow = {
4 sshKey = "${config.krebs.secret.directory}/yellow.sync.key";
5 startCommand = ''
6 export PATH=$PATH:${pkgs.git}/bin
7 until ${pkgs.dig.host}/bin/host github.com; do sleep 1; done
8 ${pkgs.nixos-rebuild}/bin/nixos-rebuild --refresh --flake github:lassulus/superconfig#yellow switch --no-write-lock-file
9 '';
10 };
11 containers.yellow.bindMounts."/var/lib" = {
12 hostPath = "/var/lib/sync-containers3/yellow/state";
13 isReadOnly = false;
14 };
15 containers.yellow.bindMounts."/var/download" = {
16 hostPath = "/var/download";
17 isReadOnly = false;
18 };
19 # krebs.iptables.tables.filter.FORWARD.rules = [
20 # { predicate = "-d ${config.krebs.hosts.yellow.nets.retiolum.ip4.addr} -p tcp --dport 8000 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; v6 = false; }
21 # { predicate = "-d ${config.krebs.hosts.yellow.nets.retiolum.ip6.addr} -p tcp --dport 8000 -m state --state NEW,ESTABLISHED,RELATED"; target = "ACCEPT"; v4 = false; }
22 # ];
23 # krebs.iptables.tables.nat.PREROUTING.rules = [
24 # { predicate = "-p tcp --dport 2"; target = "DNAT --to-destination ${config.krebs.hosts.radio.nets.retiolum.ip4.addr}:8000"; v6 = false; }
25 # { predicate = "-p tcp --dport 2"; target = "DNAT --to-destination ${config.krebs.hosts.radio.nets.retiolum.ip6.addr}:8000"; v4 = false; }
26 # ];
27 networking.firewall.allowedTCPPorts = [
28 8096
29 8920
30 ];
31 networking.firewall.allowedUDPPorts = [
32 1900
33 7359
34 ];
35 containers.yellow.forwardPorts = [
36 {
37 hostPort = 8096;
38 containerPort = 8096;
39 protocol = "tcp";
40 }
41 {
42 hostPort = 8920;
43 containerPort = 8920;
44 protocol = "tcp";
45 }
46 {
47 hostPort = 1900;
48 containerPort = 1900;
49 protocol = "udp";
50 }
51 {
52 hostPort = 7359;
53 containerPort = 7359;
54 protocol = "udp";
55 }
56 ];
57
58 services.nginx.virtualHosts."flix.lassul.us" = {
59 # forceSSL = true;
60 # enableACME = true;
61 locations."/" = {
62 proxyPass = "http://yellow.r:8096";
63 proxyWebsockets = true;
64 recommendedProxySettings = true;
65 };
66 };
67 clanCore.facts.services.yellow-container = {
68 secret."yellow.sync.key" = { };
69 generator.script = ";";
70 generator.prompt = ''
71 copy or reference the secret key from the container into here, so we can actually start/sync the container
72 '';
73 };
74}