2024-02-20

6 files changed, 70 insertions, 131 deletions

diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix
index ee63ba1..93f0974 100644
--- a/modules/nixos/default.nix
+++ b/modules/nixos/default.nix
@@ -29,7 +29,7 @@ _: {
     ./libvirtd.nix
     ./lidarr.nix
     ./loki.nix
-    ./lxc.nix
+    ./incus.nix
     ./matrix
     ./monitoring
     ./mpd.nix
diff --git a/modules/nixos/incus.nix b/modules/nixos/incus.nix
new file mode 100644
index 0000000..ada113f
--- /dev/null
+++ b/modules/nixos/incus.nix
@@ -0,0 +1,62 @@
+{
+  config,
+  lib,
+  ...
+}:
+with lib; let
+  cfg = config.nixfiles.modules.incus;
+in {
+  options.nixfiles.modules.incus.enable = mkEnableOption "Incus";
+
+  config = mkIf cfg.enable {
+    ark.directories = ["/var/lib/incus"];
+
+    virtualisation.incus = {
+      enable = true;
+
+      preseed = mkDefault {
+        networks = [
+          {
+            name = "incusbr0";
+            type = "bridge";
+            config = {
+              "ipv4.address" = "10.0.30.1/24";
+              "ipv4.nat" = true;
+              "ipv6.address" = "fc30::1/64";
+              "ipv6.nat" = true;
+            };
+          }
+        ];
+        storage_pools = [
+          {
+            name = "default";
+            driver = "dir";
+            config.source = "/var/lib/incus/storage-pools/default";
+          }
+        ];
+        profiles = [
+          {
+            name = "default";
+            devices = {
+              eth0 = {
+                type = "nic";
+                name = "eth0";
+                network = "incusbr0";
+              };
+              root = {
+                type = "disk";
+                pool = "default";
+                size = "15GiB";
+                path = "/";
+              };
+            };
+          }
+        ];
+      };
+    };
+
+    networking.firewall.trustedInterfaces = ["incusbr0"];
+
+    my.extraGroups = ["incus-admin"];
+  };
+}
diff --git a/modules/nixos/lxc.nix b/modules/nixos/lxc.nix
deleted file mode 100644
index 1306497..0000000
--- a/modules/nixos/lxc.nix
+++ /dev/null
@@ -1,18 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.nixfiles.modules.lxc;
-in {
-  options.nixfiles.modules.lxc.enable = mkEnableOption "LXC/Incus";
-
-  config = mkIf cfg.enable {
-    ark.directories = ["/var/lib/incus"];
-
-    virtualisation.incus.enable = true;
-
-    my.extraGroups = ["incus-admin"];
-  };
-}
diff --git a/modules/nixos/matrix/default.nix b/modules/nixos/matrix/default.nix
index 879243e..e7d5a02 100644
--- a/modules/nixos/matrix/default.nix
+++ b/modules/nixos/matrix/default.nix
@@ -2,6 +2,5 @@ _: {
   imports = [
     ./dendrite.nix
     ./element.nix
-    ./synapse.nix
   ];
 }
diff --git a/modules/nixos/matrix/synapse.nix b/modules/nixos/matrix/synapse.nix
deleted file mode 100644
index 02592de..0000000
--- a/modules/nixos/matrix/synapse.nix
+++ /dev/null
@@ -1,92 +0,0 @@
-{
-  config,
-  lib,
-  ...
-}:
-with lib; let
-  cfg = config.nixfiles.modules.matrix.synapse;
-in {
-  options.nixfiles.modules.matrix.synapse = {
-    enable = mkEnableOption "Synapse Matrix server";
-
-    domain = mkOption {
-      description = "Domain name sans protocol scheme.";
-      type = with types; str;
-      default = config.networking.domain;
-    };
-  };
-
-  config = let
-    bind_address = "127.0.0.1";
-    port = 8448;
-  in
-    mkIf cfg.enable {
-      ark.directories = ["/var/lib/matrix-synapse"];
-
-      nixfiles.modules = {
-        nginx = {
-          enable = true;
-          upstreams.synapse.servers."${bind_address}:${toString port}" = {};
-          virtualHosts.${cfg.domain}.locations = {
-            "~ ^(/_matrix|/_synapse/client)".proxyPass = "http://synapse";
-            "= /.well-known/matrix/server" = {
-              extraConfig = ''
-                add_header Content-Type application/json;
-              '';
-              return = "200 '${generators.toJSON {} {
-                "m.server" = "${cfg.domain}:443";
-              }}'";
-            };
-            "= /.well-known/matrix/client" = {
-              extraConfig = ''
-                add_header Content-Type application/json;
-                add_header Access-Control-Allow-Origin *;
-              '';
-              return = "200 '${generators.toJSON {} {
-                "m.homeserver".base_url = "https://${cfg.domain}";
-              }}'";
-            };
-          };
-        };
-        postgresql.enable = true;
-      };
-
-      services = let
-        db = "synapse";
-      in {
-        matrix-synapse = {
-          enable = true;
-          server_name = config.networking.domain;
-
-          database_type = "psycopg2";
-          database_name = db;
-          database_user = db;
-
-          listeners = [
-            {
-              inherit bind_address port;
-              type = "http";
-              tls = false;
-              x_forwarded = true;
-              resources = [
-                {
-                  names = ["client" "federation"];
-                  compress = false;
-                }
-              ];
-            }
-          ];
-        };
-
-        postgresql = {
-          ensureDatabases = [db];
-          ensureUsers = [
-            {
-              name = db;
-              ensureDBOwnership = true;
-            }
-          ];
-        };
-      };
-    };
-}
diff --git a/modules/nixos/podman.nix b/modules/nixos/podman.nix
index f6ee6bf..60f208e 100644
--- a/modules/nixos/podman.nix
+++ b/modules/nixos/podman.nix
@@ -34,25 +34,13 @@ in {
     my.extraGroups = ["podman"];
 
     hm.xdg.configFile = {
-      # This removes a really annoying registry search. 100% of the time I
-      # would need to look up stuff from the Docker and not Quay!
-      "containers/registries.conf".text = ''
-        [registries.search]
-        registries = ["docker.io"]
-      '';
-
-      # As for plain OverlayFS in Podman over ZFS[1]... I guess we are waiting
-      # for Podman to catch up now.
-      #
-      # [1]: https://github.com/openzfs/zfs/pull/14070#issuecomment-1309116666
-      "containers/storage.conf".text = optionalString config.boot.zfs.enabled ''
-        [storage]
-        driver = "overlay"
-
-        [storage.options]
-        mount_program = "${getExe' pkgs.fuse-overlayfs "fuse-overlayfs"}"
-        mountopt = "noatime,nodev,nosuid"
-      '';
+      "containers/registries.conf".source = pkgs.writers.writeTOML "containers-registries.toml" {
+        registries.search.registries = ["docker.io"];
+      };
+
+      "containers/storage.conf".source = pkgs.writers.writeTOML "containers-storage.toml" {
+        storage.driver = "overlay";
+      };
     };
   };
 }