This repository has no description
configs.red-host: remove, red container no longer needed
author
lassulus
date
(Oct 12, 2026, 8:37 PM CEST)
commit
6524eccd
6524eccd66cd73109bcf74f4980aca8c6da84567
parent
00e4abde
00e4abde2f59c0e59317e8bf3c494798f037e2f6
-160
-159
configs/red-host.nix
-159
configs/red-host.nix
···
1
-
{ config, ... }:
2
-
{
3
-
4
-
lass.sync-containers3.containers.red = {
5
-
sshKey = "${config.clan.core.vars.password-store.secretLocation}/containers/red/sync.key";
6
-
ephemeral = true;
7
-
};
8
-
9
-
# containers.${ctr.name} = {
10
-
# config = {
11
-
# environment.systemPackages = [
12
-
# pkgs.dhcpcd
13
-
# pkgs.git
14
-
# pkgs.jq
15
-
# ];
16
-
# networking.useDHCP = lib.mkForce true;
17
-
# systemd.services.autoswitch = {
18
-
# environment = {
19
-
# NIX_REMOTE = "daemon";
20
-
# };
21
-
# wantedBy = [ "multi-user.target" ];
22
-
# serviceConfig.ExecStart = pkgs.writers.writeDash "autoswitch" ''
23
-
# if test -e /var/src/nixos-config; then
24
-
# /run/current-system/sw/bin/nixos-rebuild -I /var/src switch || :
25
-
# fi
26
-
# '';
27
-
# unitConfig.X-StopOnRemoval = false;
28
-
# };
29
-
# };
30
-
# autoStart = false;
31
-
# enableTun = true;
32
-
# privateNetwork = true;
33
-
# hostBridge = "ctr0";
34
-
# bindMounts = {
35
-
# "/etc/resolv.conf".hostPath = "/etc/resolv.conf";
36
-
# "/var/lib/self-state/disk-image" = {
37
-
# hostPath = "/var/lib/sync-containers3/${ctr.name}";
38
-
# isReadOnly = true;
39
-
# };
40
-
# };
41
-
# };
42
-
43
-
# systemd.services."${ctr.name}_scheduler" = {
44
-
# wantedBy = [ "multi-user.target" ];
45
-
# path = with pkgs; [
46
-
# coreutils
47
-
# consul
48
-
# cryptsetup
49
-
# mount
50
-
# util-linux
51
-
# systemd
52
-
# untilport
53
-
# ];
54
-
# serviceConfig = {
55
-
# Restart = "always";
56
-
# RestartSec = "15s";
57
-
# ExecStart = "${pkgs.consul}/bin/consul lock container_${ctr.name} ${pkgs.writers.writeDash "${ctr.name}-start" ''
58
-
# set -efux
59
-
# trap ${pkgs.writers.writeDash "stop-${ctr.name}" ''
60
-
# set -efux
61
-
# /run/current-system/sw/bin/nixos-container stop ${ctr.name} || :
62
-
# umount /var/lib/nixos-containers/${ctr.name}/var/state || :
63
-
# cryptsetup luksClose ${ctr.name} || :
64
-
# ''} INT TERM EXIT
65
-
# consul kv put containers/${ctr.name}/host ${config.networking.hostName}
66
-
# cryptsetup luksOpen --key-file /var/src/secrets/containers/${ctr.name}/luks /var/lib/sync-containers3/${ctr.name}/disk ${ctr.name}
67
-
# mkdir -p /var/lib/nixos-containers/${ctr.name}/var/state
68
-
# mount /dev/mapper/${ctr.name} /var/lib/nixos-containers/${ctr.name}/var/state
69
-
# ln -frs /var/lib/nixos-containers/${ctr.name}/var/state/var_src /var/lib/nixos-containers/${ctr.name}/var/src
70
-
# /run/current-system/sw/bin/nixos-container start ${ctr.name}
71
-
# set +x
72
-
# until /run/wrappers/bin/ping -q -c 1 ${ctr.name}.r > /dev/null; do sleep 5; done
73
-
# while /run/wrappers/bin/ping -q -c 1 ${ctr.name}.r > /dev/null; do sleep 5; done
74
-
# ''}";
75
-
# };
76
-
# };
77
-
78
-
# users.groups."container_${ctr.name}" = {};
79
-
# users.users."container_${ctr.name}" = {
80
-
# group = "container_${ctr.name}";
81
-
# isSystemUser = true;
82
-
# home = "/var/lib/sync-containers3/${ctr.name}";
83
-
# createHome = true;
84
-
# homeMode = "705";
85
-
# openssh.authorizedKeys.keys = [
86
-
# self.keys.ssh.yubi_pgp.public
87
-
# ];
88
-
# };
89
-
90
-
# systemd.timers."${ctr.name}_syncer" = {
91
-
# timerConfig = {
92
-
# RandomizedDelaySec = 300;
93
-
# };
94
-
# };
95
-
# systemd.services."${ctr.name}_syncer" = {
96
-
# path = with pkgs; [
97
-
# coreutils
98
-
# rsync
99
-
# openssh
100
-
# systemd
101
-
# ];
102
-
# startAt = "*:0/1";
103
-
# serviceConfig = {
104
-
# User = "container_${ctr.name}";
105
-
# LoadCredential = [
106
-
# "ssh_key:${toString <secrets>}/containers/${ctr.name}/sync.key"
107
-
# ];
108
-
# ExecCondition = pkgs.writers.writeDash "${ctr.name}_checker" ''
109
-
# set -efu
110
-
# ! systemctl is-active --quiet container@${ctr.name}.service
111
-
# '';
112
-
# ExecStart = pkgs.writers.writeDash "${ctr.name}_syncer" ''
113
-
# set -efu
114
-
# rsync -a -e "ssh -i $CREDENTIALS_DIRECTORY/ssh_key" --inplace container_sync@${ctr.name}.r:disk-image/disk $HOME/disk
115
-
# '';
116
-
# };
117
-
# };
118
-
119
-
# # networking
120
-
# networking.networkmanager.unmanaged = [ "ctr0" ];
121
-
# networking.interfaces.dummy0.virtual = true;
122
-
# networking.bridges.ctr0.interfaces = [ "dummy0" ];
123
-
# networking.interfaces.ctr0.ipv4.addresses = [{
124
-
# address = "10.233.0.1";
125
-
# prefixLength = 24;
126
-
# }];
127
-
# systemd.services."dhcpd-ctr0" = {
128
-
# wantedBy = [ "multi-user.target" ];
129
-
# after = [ "network.target" ];
130
-
# serviceConfig = {
131
-
# Type = "forking";
132
-
# Restart = "always";
133
-
# DynamicUser = true;
134
-
# StateDirectory = "dhcpd-ctr0";
135
-
# User = "dhcpd-ctr0";
136
-
# Group = "dhcpd-ctr0";
137
-
# AmbientCapabilities = [
138
-
# "CAP_NET_RAW" # to send ICMP messages
139
-
# "CAP_NET_BIND_SERVICE" # to bind on DHCP port (67)
140
-
# ];
141
-
# ExecStartPre = "${pkgs.coreutils}/bin/touch /var/lib/dhcpd-ctr0/dhcpd.leases";
142
-
# ExecStart = "${pkgs.dhcp}/bin/dhcpd -4 -lf /var/lib/dhcpd-ctr0/dhcpd.leases -cf ${pkgs.writeText "dhpd.conf" ''
143
-
# default-lease-time 600;
144
-
# max-lease-time 7200;
145
-
# authoritative;
146
-
# ddns-update-style interim;
147
-
# log-facility local1; # see dhcpd.nix
148
-
149
-
# option subnet-mask 255.255.255.0;
150
-
# option routers 10.233.0.1;
151
-
# # option domain-name-servers 8.8.8.8; # TODO configure dns server
152
-
# subnet 10.233.0.0 netmask 255.255.255.0 {
153
-
# range 10.233.0.10 10.233.0.250;
154
-
# }
155
-
# ''} ctr0";
156
-
# };
157
-
# };
158
-
159
-
}