diff options
Diffstat (limited to 'modules/nixos')
| -rw-r--r-- | modules/nixos/default.nix | 2 | ||||
| -rw-r--r-- | modules/nixos/incus.nix | 62 | ||||
| -rw-r--r-- | modules/nixos/lxc.nix | 18 | ||||
| -rw-r--r-- | modules/nixos/matrix/default.nix | 1 | ||||
| -rw-r--r-- | modules/nixos/matrix/synapse.nix | 92 | ||||
| -rw-r--r-- | modules/nixos/podman.nix | 26 |
6 files changed, 70 insertions, 131 deletions
diff --git a/modules/nixos/default.nix b/modules/nixos/default.nix index ee63ba1..93f0974 100644 --- a/modules/nixos/default.nix +++ b/modules/nixos/default.nix @@ -29,7 +29,7 @@ _: { ./libvirtd.nix ./lidarr.nix ./loki.nix - ./lxc.nix + ./incus.nix ./matrix ./monitoring ./mpd.nix diff --git a/modules/nixos/incus.nix b/modules/nixos/incus.nix new file mode 100644 index 0000000..ada113f --- /dev/null +++ b/modules/nixos/incus.nix @@ -0,0 +1,62 @@ +{ + config, + lib, + ... +}: +with lib; let + cfg = config.nixfiles.modules.incus; +in { + options.nixfiles.modules.incus.enable = mkEnableOption "Incus"; + + config = mkIf cfg.enable { + ark.directories = ["/var/lib/incus"]; + + virtualisation.incus = { + enable = true; + + preseed = mkDefault { + networks = [ + { + name = "incusbr0"; + type = "bridge"; + config = { + "ipv4.address" = "10.0.30.1/24"; + "ipv4.nat" = true; + "ipv6.address" = "fc30::1/64"; + "ipv6.nat" = true; + }; + } + ]; + storage_pools = [ + { + name = "default"; + driver = "dir"; + config.source = "/var/lib/incus/storage-pools/default"; + } + ]; + profiles = [ + { + name = "default"; + devices = { + eth0 = { + type = "nic"; + name = "eth0"; + network = "incusbr0"; + }; + root = { + type = "disk"; + pool = "default"; + size = "15GiB"; + path = "/"; + }; + }; + } + ]; + }; + }; + + networking.firewall.trustedInterfaces = ["incusbr0"]; + + my.extraGroups = ["incus-admin"]; + }; +} diff --git a/modules/nixos/lxc.nix b/modules/nixos/lxc.nix deleted file mode 100644 index 1306497..0000000 --- a/modules/nixos/lxc.nix +++ /dev/null @@ -1,18 +0,0 @@ -{ - config, - lib, - ... -}: -with lib; let - cfg = config.nixfiles.modules.lxc; -in { - options.nixfiles.modules.lxc.enable = mkEnableOption "LXC/Incus"; - - config = mkIf cfg.enable { - ark.directories = ["/var/lib/incus"]; - - virtualisation.incus.enable = true; - - my.extraGroups = ["incus-admin"]; - }; -} diff --git a/modules/nixos/matrix/default.nix b/modules/nixos/matrix/default.nix index 879243e..e7d5a02 100644 --- a/modules/nixos/matrix/default.nix +++ b/modules/nixos/matrix/default.nix @@ -2,6 +2,5 @@ _: { imports = [ ./dendrite.nix ./element.nix - ./synapse.nix ]; } diff --git a/modules/nixos/matrix/synapse.nix b/modules/nixos/matrix/synapse.nix deleted file mode 100644 index 02592de..0000000 --- a/modules/nixos/matrix/synapse.nix +++ /dev/null @@ -1,92 +0,0 @@ -{ - config, - lib, - ... -}: -with lib; let - cfg = config.nixfiles.modules.matrix.synapse; -in { - options.nixfiles.modules.matrix.synapse = { - enable = mkEnableOption "Synapse Matrix server"; - - domain = mkOption { - description = "Domain name sans protocol scheme."; - type = with types; str; - default = config.networking.domain; - }; - }; - - config = let - bind_address = "127.0.0.1"; - port = 8448; - in - mkIf cfg.enable { - ark.directories = ["/var/lib/matrix-synapse"]; - - nixfiles.modules = { - nginx = { - enable = true; - upstreams.synapse.servers."${bind_address}:${toString port}" = {}; - virtualHosts.${cfg.domain}.locations = { - "~ ^(/_matrix|/_synapse/client)".proxyPass = "http://synapse"; - "= /.well-known/matrix/server" = { - extraConfig = '' - add_header Content-Type application/json; - ''; - return = "200 '${generators.toJSON {} { - "m.server" = "${cfg.domain}:443"; - }}'"; - }; - "= /.well-known/matrix/client" = { - extraConfig = '' - add_header Content-Type application/json; - add_header Access-Control-Allow-Origin *; - ''; - return = "200 '${generators.toJSON {} { - "m.homeserver".base_url = "https://${cfg.domain}"; - }}'"; - }; - }; - }; - postgresql.enable = true; - }; - - services = let - db = "synapse"; - in { - matrix-synapse = { - enable = true; - server_name = config.networking.domain; - - database_type = "psycopg2"; - database_name = db; - database_user = db; - - listeners = [ - { - inherit bind_address port; - type = "http"; - tls = false; - x_forwarded = true; - resources = [ - { - names = ["client" "federation"]; - compress = false; - } - ]; - } - ]; - }; - - postgresql = { - ensureDatabases = [db]; - ensureUsers = [ - { - name = db; - ensureDBOwnership = true; - } - ]; - }; - }; - }; -} diff --git a/modules/nixos/podman.nix b/modules/nixos/podman.nix index f6ee6bf..60f208e 100644 --- a/modules/nixos/podman.nix +++ b/modules/nixos/podman.nix @@ -34,25 +34,13 @@ in { my.extraGroups = ["podman"]; hm.xdg.configFile = { - # This removes a really annoying registry search. 100% of the time I - # would need to look up stuff from the Docker and not Quay! - "containers/registries.conf".text = '' - [registries.search] - registries = ["docker.io"] - ''; - - # As for plain OverlayFS in Podman over ZFS[1]... I guess we are waiting - # for Podman to catch up now. - # - # [1]: https://github.com/openzfs/zfs/pull/14070#issuecomment-1309116666 - "containers/storage.conf".text = optionalString config.boot.zfs.enabled '' - [storage] - driver = "overlay" - - [storage.options] - mount_program = "${getExe' pkgs.fuse-overlayfs "fuse-overlayfs"}" - mountopt = "noatime,nodev,nosuid" - ''; + "containers/registries.conf".source = pkgs.writers.writeTOML "containers-registries.toml" { + registries.search.registries = ["docker.io"]; + }; + + "containers/storage.conf".source = pkgs.writers.writeTOML "containers-storage.toml" { + storage.driver = "overlay"; + }; }; }; } |