SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 23:11:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Refactor container configuration

Browse source
This commit is contained in:
SebastianStork 2024-09-02 13:33:44 +02:00
parent 8af96429ff
commit 380d8202ff
15 changed files with 288 additions and 241 deletions
Download patch file Download diff file Expand all files Collapse all files

95
hosts/stratus/containers/default.nix Normal file
View file

@ -0,0 +1,95 @@
{
config,
inputs,
self,
lib,
...
}:
let
containers = lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./.);
interface = "eno1";
dataDirOf = name: "/data/${name}";
in
{
imports = [
./nextcloud
./paperless
];
sops.secrets = lib.mapAttrs' (
name: _: lib.nameValuePair "container/${name}/ssh-key" { }
) containers;
systemd.tmpfiles.rules = lib.flatten (
lib.mapAttrsToList (name: _: [
"d ${dataDirOf name} - - -"
"d /var/lib/tailscale-${name} - - -"
]) containers
);
containers = lib.mapAttrs (name: _: {
autoStart = true;
ephemeral = true;
macvlans = [ interface ];
bindMounts = {
"/etc/ssh/ssh_host_ed25519_key".hostPath = config.sops.secrets."container/${name}/ssh-key".path;
${dataDirOf name}.isReadOnly = false;
"/var/lib/tailscale" = {
hostPath = "/var/lib/tailscale-${name}";
isReadOnly = false;
};
};
specialArgs = {
inherit inputs self;
inherit (config.system) stateVersion;
inherit (config.networking) domain;
dataDir = dataDirOf name;
};
config =
{
self,
stateVersion,
domain,
...
}:
{
imports = [
"${self}/modules/system/sops.nix"
"${self}/modules/system/tailscale.nix"
];
system = {
inherit stateVersion;
};
networking = {
inherit domain;
useNetworkd = true;
useHostResolvConf = false;
};
systemd.network = {
enable = true;
networks."10-mv-${interface}" = {
matchConfig.Name = "mv-${interface}";
networkConfig.DHCP = "yes";
dhcpV4Config.ClientIdentifier = "mac";
};
};
myConfig.sops = {
enable = true;
defaultSopsFile = ./${name}/secrets.yaml;
};
sops.secrets."tailscale-auth-key" = { };
services.tailscale.interfaceName = "userspace-networking";
myConfig.tailscale = {
enable = true;
ssh.enable = true;
};
};
}) containers;
}

103
hosts/stratus/containers/nextcloud/default.nix
View file

@ -1,61 +1,62 @@
{ config, ... }:
{
sops.secrets = {
"nextcloud/admin-password" = { };
"nextcloud/gmail-password" = { };
tailscale-auth-key = { };
};
containers.nextcloud.config =
{
config,
pkgs,
dataDir,
...
}:
{
imports = [ ./email-server.nix ];
systemd.tmpfiles.rules = [
"d /data/nextcloud - - -"
"d /var/lib/tailscale-nextcloud - - -"
];
containers.nextcloud = {
autoStart = true;
ephemeral = true;
macvlans = [ "eno1" ];
bindMounts = {
# Secrets
"/run/secrets/nextcloud".isReadOnly = false;
"/run/secrets/tailscale-auth-key" = { };
# State
"/data/nextcloud".isReadOnly = false;
"/var/lib/tailscale" = {
hostPath = "/var/lib/tailscale-nextcloud";
isReadOnly = false;
sops.secrets."nextcloud/admin-password" = {
owner = config.users.users.nextcloud.name;
inherit (config.users.users.nextcloud) group;
};
};
specialArgs = {
inherit (config.networking) domain;
};
config =
{ domain, ... }:
{
system.stateVersion = "24.05";
systemd.tmpfiles.rules = [
"d ${dataDir}/home 750 nextcloud nextcloud -"
"d ${dataDir}/postgresql 700 postgres postgres -"
];
networking = {
inherit domain;
useNetworkd = true;
useHostResolvConf = false;
services.postgresql.dataDir = "${dataDir}/postgresql";
services.nextcloud = {
enable = true;
package = pkgs.nextcloud29;
home = "${dataDir}/home";
hostName = config.networking.fqdn;
database.createLocally = true;
config = {
dbtype = "pgsql";
adminuser = "admin";
adminpassFile = config.sops.secrets."nextcloud/admin-password".path;
};
systemd.network = {
https = true;
settings = {
overwriteProtocol = "https";
trusted_proxies = [ "127.0.0.1" ];
log_type = "file";
default_phone_region = "DE";
maintenance_window_start = "2"; # UTC
};
configureRedis = true;
maxUploadSize = "4G";
phpOptions."opcache.interned_strings_buffer" = "16";
autoUpdateApps = {
enable = true;
networks."40-mv-eno1" = {
matchConfig.Name = "mv-eno1";
networkConfig.DHCP = "yes";
dhcpV4Config.ClientIdentifier = "mac";
};
startAt = "04:00:00";
};
extraApps = {
inherit (config.services.nextcloud.package.packages.apps) contacts calendar;
};
imports = [
./nextcloud.nix
./email-server.nix
./tailscale.nix
];
};
};
myConfig.tailscale.serve = "80";
};
}

5
hosts/stratus/containers/nextcloud/email-server.nix
View file

@ -1,5 +1,6 @@
{ config, ... }:
{
systemd.tmpfiles.rules = [ "z /run/secrets/nextcloud/gmail-password 400 nextcloud nextcloud -" ];
sops.secrets."nextcloud/gmail-password" = { };
services.nextcloud.settings = {
mail_smtpmode = "sendmail";
@ -15,7 +16,7 @@
port = "587";
user = "nextcloud.stork";
from = "nextcloud.stork@gmail.com";
passwordeval = "cat /run/secrets/nextcloud/gmail-password";
passwordeval = "cat ${config.sops.secrets."nextcloud/gmail-password".path}";
};
};
}

49
hosts/stratus/containers/nextcloud/nextcloud.nix
View file

@ -1,49 +0,0 @@
{
config,
pkgs,
...
}:
{
systemd.tmpfiles.rules = [
"z /run/secrets/nextcloud/admin-password 400 nextcloud nextcloud -"
"d /data/nextcloud/home 750 nextcloud nextcloud -"
"d /data/nextcloud/postgresql 700 postgres postgres -"
];
services.postgresql.dataDir = "/data/nextcloud/postgresql";
services.nextcloud = {
enable = true;
package = pkgs.nextcloud29;
home = "/data/nextcloud/home";
hostName = config.networking.fqdn;
database.createLocally = true;
config = {
dbtype = "pgsql";
adminuser = "admin";
adminpassFile = "/run/secrets/nextcloud/admin-password";
};
https = true;
settings = {
overwriteProtocol = "https";
trusted_proxies = [ "127.0.0.1" ];
log_type = "file";
default_phone_region = "DE";
maintenance_window_start = "2"; # UTC
};
configureRedis = true;
maxUploadSize = "4G";
phpOptions."opcache.interned_strings_buffer" = "16";
autoUpdateApps = {
enable = true;
startAt = "04:00:00";
};
extraApps = {
inherit (config.services.nextcloud.package.packages.apps) contacts calendar;
};
};
}

33
hosts/stratus/containers/nextcloud/secrets.yaml Normal file
View file

@ -0,0 +1,33 @@
tailscale-auth-key: ENC[AES256_GCM,data:KshGpoyKTQQgshWFSwhGWPtwPfP3S2fLkJBxqfu1Mgs/6aexXRo0jMyzvnonxB/HsxFSRCffUuxwQNF8XJY=,iv:8MtERXmpwqgGZxIPmXAcj0KymWvRXKV5svOLZSfWdOU=,tag:refC9jmVzSrLuClo8+J7DA==,type:str]
nextcloud:
admin-password: ENC[AES256_GCM,data:RaFNoEJj2flmwIu2Q/5UgRbITve7CzFg8udQclJO,iv:d95Vo9HMRzmoSU3gcQqO5uP7yW6n7PF6Nx3s6A9bgmc=,tag:ruIW8Ov+wQPOPBWV61MnWw==,type:str]
gmail-password: ENC[AES256_GCM,data:RJXg4KYYwjg2CyzQM9wovDSqB8M=,iv:Tf8egrzoG3rRbzufJGHCTr6W+nCEnJJaSe6hpvr1AmM=,tag:GjlgIEqQDUtjn3mm1QT1uw==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1mpq8m4p7dnxh5ze3fh7etd2k6sp85zdnmp9te3e9chcw4pw07pcq960zh5
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKWFVKV0IzbVVTV1g1c3o1
ZnpwMTFyZ0RhcmhhNk8vd1dYWGdWZHZhNFVRCjE3MG9Wd0ZXNEtrRS84M3hMRVdk
T1BOczN0VmoybUs3dXJUR3FNc2swdlkKLS0tIEFXam96UGlJWnphVzVpRittSXNS
SDU0U0IwTTh6NHI2enZZTEwwd2lkQXMKsHAwayLHW3GfRc90sq0xhN1rF4RkvXSS
+WGyhmI0fik6NPyVN7DNaYhte2IoVJe3RTH2vJigpTLIIziMgTPgFQ==
-----END AGE ENCRYPTED FILE-----
- recipient: age1jutruntzdaqs26mpe68pafje23m9n4klm04fva05fcdyvyqnaamsvqf3jr
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwSExmaW9CUGo0WWloZDha
c3ZUNy9xVXgvVkdzRHRjWFZERllycG41RENzCnZuazR2RW41VlJNWk9TZjcwcGpM
dnZQQTNSbDBieGhmOW5xU24xeVhpYjQKLS0tIHAzTDV2dHdDNnQ4ZC9ielM3Qyt1
aWFqYXYrMmJBbEQwQWxza1lrdmU4bmMKm0QbJP1QiNVOA7slpocaPxkq9orE8jrP
xxrDtRUZhvEOEZuCD61wWTfgdeI7SFWaSJkN6MgPlvRyuYQ+3TZh3Q==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-09-02T11:38:31Z"
mac: ENC[AES256_GCM,data:E2L8j21dhHLQ/OCIZNMqlH1C5XX0uSGmuQIjetiE8s/LX4fZSR9s4sPzub3gLI5h3EVJKzMU2UFXZATMUfe/1t4PP5nIuggUtxD+VWxtHNaVHJMs+wEWKYE+nITyZ7HGvwBr0sMQ3Sb2DuiQ729nr9hLn1Mbn7uc5o+Z2RJg5Cc=,iv:jEaBwYsO3hW5NtmmZrL6H23qDcTSAGuBLjPRi60Lzco=,tag:pGpL80onRUVQfIYChaBxSg==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.9.0

31
hosts/stratus/containers/nextcloud/tailscale.nix
View file

@ -1,31 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
services.tailscale = {
enable = true;
authKeyFile = "/run/secrets/tailscale-auth-key";
useRoutingFeatures = "server";
openFirewall = true;
interfaceName = "userspace-networking";
extraUpFlags = [ "--ssh" ];
};
systemd.services.nextcloud-serve = {
after = [
"tailscaled.service"
"tailscaled-autoconnect.service"
];
wants = [ "tailscaled.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot";
script = ''
${lib.getExe pkgs.tailscale} cert ${config.networking.fqdn}
${lib.getExe pkgs.tailscale} serve reset
${lib.getExe pkgs.tailscale} serve --bg 80
'';
};
}

69
hosts/stratus/containers/paperless/default.nix
View file

@ -1,59 +1,20 @@
{ config, ... }:
{
sops.secrets = {
"paperless-admin-password" = { };
tailscale-auth-key = { };
};
containers.paperless.config =
{
config,
dataDir,
...
}:
{
sops.secrets."paperless-admin-password" = { };
systemd.tmpfiles.rules = [
"d /data/paperless - - -"
"d /var/lib/tailscale-paperless - - -"
];
containers.paperless = {
autoStart = true;
ephemeral = true;
macvlans = [ "eno1" ];
bindMounts = {
# Secrets
"/run/secrets/paperless-admin-password" = { };
"/run/secrets/tailscale-auth-key" = { };
# State
"/data/paperless".isReadOnly = false;
"/var/lib/tailscale" = {
hostPath = "/var/lib/tailscale-paperless";
isReadOnly = false;
services.paperless = {
enable = true;
inherit dataDir;
passwordFile = config.sops.secrets."paperless-admin-password".path;
settings.PAPERLESS_OCR_LANGUAGE = "deu+eng";
};
myConfig.tailscale.serve = "28981";
};
specialArgs = {
inherit (config.networking) domain;
};
config =
{ domain, ... }:
{
system.stateVersion = "24.05";
networking = {
inherit domain;
useNetworkd = true;
useHostResolvConf = false;
};
systemd.network = {
enable = true;
networks."40-mv-eno1" = {
matchConfig.Name = "mv-eno1";
networkConfig.DHCP = "yes";
dhcpV4Config.ClientIdentifier = "mac";
};
};
imports = [
./paperless.nix
./tailscale.nix
];
};
};
}

8
hosts/stratus/containers/paperless/paperless.nix
View file

@ -1,8 +0,0 @@
{
services.paperless = {
enable = true;
dataDir = "/data/paperless";
passwordFile = "/run/secrets/paperless-admin-password";
settings.PAPERLESS_OCR_LANGUAGE = "deu+eng";
};
}

31
hosts/stratus/containers/paperless/secrets.yaml Normal file
View file

@ -0,0 +1,31 @@
tailscale-auth-key: ENC[AES256_GCM,data:2vJoEaMZE1s2cVL20A7JCaZ525YkSXqCasKcCLwbYX+W8BVczEDThPqXm2PyKzo6zcdkZkbwONWIeLKEhyE=,iv:Z/B0tUMn+ACLT5is+TRjLOT16FpdWhTuDC1llvNZ7Ms=,tag:pwzlgMkuNYEhmZ/uiRJy4Q==,type:str]
paperless-admin-password: ENC[AES256_GCM,data:7xjn0fXEFZCYDvzjP7P5R5reZR8=,iv:jMIJNbqEo7IcHDYwvTmQnArYdt2PR9tp8coOXCZHkQw=,tag:kCejUFStTuosRblkbQMdew==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1mpq8m4p7dnxh5ze3fh7etd2k6sp85zdnmp9te3e9chcw4pw07pcq960zh5
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWTmZLR2JOM1p2S2lxYkts
WTE2OFlRUXJ0a01EOUd3Mythc3R1d3llTTNrCkJQWVY1bGlFbThaL0plTWhwYUJK
WDlQNjFzZGhIS3ZlaHZiYytQdFo5WWMKLS0tIGZ3VDRTQlFHT2IwVkFIb0lwOXhT
dm9QRndWZXE0L0drS3JzMGF0c2x1S1kKXuxMaVAcbRwR4/QZnIUdb3wyRujYAy2I
8/FYL5r9PuNwhEv1Ene+dj8nkx1G+stTZmgepOS9Z0AyIvfDW6FS8g==
-----END AGE ENCRYPTED FILE-----
- recipient: age1y82j460w5fh0fpquatqar0zqet0vzzfzjnegrp686na3gejapdtsc37vuh
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMVVzZUl5WVc3VVZudmVj
UkVDd2pYUU50MDBHRnZ4Sis5K28wV1RwNlQ4CmhONVd3Wkh5ZHlYSDYzeHlLMGdF
VUxiS2JWS2lwQVY2OHYwSk1UdGNSeUkKLS0tIGRSZVJ2U1J6azQveHJkRmViVnNs
cmFJeFpHdnRzMFA2a1NML1A1RFB6clEK+FH8x1dccz8TnUuEFc0EkTSzG6Ody0IF
tCNrHN2h3AzqYxKFYucquMmnE9WGJuzShijIXAv1W7JE2JZw9XnS4w==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2024-09-02T11:38:42Z"
mac: ENC[AES256_GCM,data:IkUwDpVTUboAHQzFMaHhcGkNtW1eGUNrGDDEq9Zegwrwu6Xx5yFuxlmFMWIM7oX3voWjCx4A1u4sxfT4JHauhnJER7rXeF5qYuGSiIj8o2rMZYm7C6zkWumJ7kvt5nBML5+Jkd8n9fhbh9wSND1IbzsWwuURugeNLhYvUaCJA+Y=,iv:8aoHhE/rZYEf6vtvQvuuG1CDnCniarxxIC0ysH6Hemo=,tag:93B38zvR3Qx8rawO9CuJ4w==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.9.0

31
hosts/stratus/containers/paperless/tailscale.nix
View file

@ -1,31 +0,0 @@
{
config,
pkgs,
lib,
...
}:
{
services.tailscale = {
enable = true;
authKeyFile = "/run/secrets/tailscale-auth-key";
useRoutingFeatures = "server";
openFirewall = true;
interfaceName = "userspace-networking";
extraUpFlags = [ "--ssh" ];
};
systemd.services.nextcloud-serve = {
after = [
"tailscaled.service"
"tailscaled-autoconnect.service"
];
wants = [ "tailscaled.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig.Type = "oneshot";
script = ''
${lib.getExe pkgs.tailscale} cert ${config.networking.fqdn}
${lib.getExe pkgs.tailscale} serve reset
${lib.getExe pkgs.tailscale} serve --bg 28981
'';
};
}