Refactor container configuration

hosts/stratus/containers/paperless/default.nix

@@ -1,59 +1,20 @@
-{ config, ... }:
 {
-  sops.secrets = {
-    "paperless-admin-password" = { };
-    tailscale-auth-key = { };
-  };
+  containers.paperless.config =
+    {
+      config,
+      dataDir,
+      ...
+    }:
+    {
+      sops.secrets."paperless-admin-password" = { };
 
-  systemd.tmpfiles.rules = [
-    "d /data/paperless - - -"
-    "d /var/lib/tailscale-paperless - - -"
-  ];
-
-  containers.paperless = {
-    autoStart = true;
-    ephemeral = true;
-    macvlans = [ "eno1" ];
-
-    bindMounts = {
-      # Secrets
-      "/run/secrets/paperless-admin-password" = { };
-      "/run/secrets/tailscale-auth-key" = { };
-
-      # State
-      "/data/paperless".isReadOnly = false;
-      "/var/lib/tailscale" = {
-        hostPath = "/var/lib/tailscale-paperless";
-        isReadOnly = false;
+      services.paperless = {
+        enable = true;
+        inherit dataDir;
+        passwordFile = config.sops.secrets."paperless-admin-password".path;
+        settings.PAPERLESS_OCR_LANGUAGE = "deu+eng";
       };
+
+      myConfig.tailscale.serve = "28981";
     };
-
-    specialArgs = {
-      inherit (config.networking) domain;
-    };
-    config =
-      { domain, ... }:
-      {
-        system.stateVersion = "24.05";
-
-        networking = {
-          inherit domain;
-          useNetworkd = true;
-          useHostResolvConf = false;
-        };
-        systemd.network = {
-          enable = true;
-          networks."40-mv-eno1" = {
-            matchConfig.Name = "mv-eno1";
-            networkConfig.DHCP = "yes";
-            dhcpV4Config.ClientIdentifier = "mac";
-          };
-        };
-
-        imports = [
-          ./paperless.nix
-          ./tailscale.nix
-        ];
-      };
-  };
 }

hosts/stratus/containers/paperless/paperless.nix

@@ -1,8 +0,0 @@
-{
-  services.paperless = {
-    enable = true;
-    dataDir = "/data/paperless";
-    passwordFile = "/run/secrets/paperless-admin-password";
-    settings.PAPERLESS_OCR_LANGUAGE = "deu+eng";
-  };
-}

hosts/stratus/containers/paperless/secrets.yaml

@@ -0,0 +1,31 @@
+tailscale-auth-key: ENC[AES256_GCM,data:2vJoEaMZE1s2cVL20A7JCaZ525YkSXqCasKcCLwbYX+W8BVczEDThPqXm2PyKzo6zcdkZkbwONWIeLKEhyE=,iv:Z/B0tUMn+ACLT5is+TRjLOT16FpdWhTuDC1llvNZ7Ms=,tag:pwzlgMkuNYEhmZ/uiRJy4Q==,type:str]
+paperless-admin-password: ENC[AES256_GCM,data:7xjn0fXEFZCYDvzjP7P5R5reZR8=,iv:jMIJNbqEo7IcHDYwvTmQnArYdt2PR9tp8coOXCZHkQw=,tag:kCejUFStTuosRblkbQMdew==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1mpq8m4p7dnxh5ze3fh7etd2k6sp85zdnmp9te3e9chcw4pw07pcq960zh5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWTmZLR2JOM1p2S2lxYkts
+            WTE2OFlRUXJ0a01EOUd3Mythc3R1d3llTTNrCkJQWVY1bGlFbThaL0plTWhwYUJK
+            WDlQNjFzZGhIS3ZlaHZiYytQdFo5WWMKLS0tIGZ3VDRTQlFHT2IwVkFIb0lwOXhT
+            dm9QRndWZXE0L0drS3JzMGF0c2x1S1kKXuxMaVAcbRwR4/QZnIUdb3wyRujYAy2I
+            8/FYL5r9PuNwhEv1Ene+dj8nkx1G+stTZmgepOS9Z0AyIvfDW6FS8g==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1y82j460w5fh0fpquatqar0zqet0vzzfzjnegrp686na3gejapdtsc37vuh
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNMVVzZUl5WVc3VVZudmVj
+            UkVDd2pYUU50MDBHRnZ4Sis5K28wV1RwNlQ4CmhONVd3Wkh5ZHlYSDYzeHlLMGdF
+            VUxiS2JWS2lwQVY2OHYwSk1UdGNSeUkKLS0tIGRSZVJ2U1J6azQveHJkRmViVnNs
+            cmFJeFpHdnRzMFA2a1NML1A1RFB6clEK+FH8x1dccz8TnUuEFc0EkTSzG6Ody0IF
+            tCNrHN2h3AzqYxKFYucquMmnE9WGJuzShijIXAv1W7JE2JZw9XnS4w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-09-02T11:38:42Z"
+    mac: ENC[AES256_GCM,data:IkUwDpVTUboAHQzFMaHhcGkNtW1eGUNrGDDEq9Zegwrwu6Xx5yFuxlmFMWIM7oX3voWjCx4A1u4sxfT4JHauhnJER7rXeF5qYuGSiIj8o2rMZYm7C6zkWumJ7kvt5nBML5+Jkd8n9fhbh9wSND1IbzsWwuURugeNLhYvUaCJA+Y=,iv:8aoHhE/rZYEf6vtvQvuuG1CDnCniarxxIC0ysH6Hemo=,tag:93B38zvR3Qx8rawO9CuJ4w==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.0

hosts/stratus/containers/paperless/tailscale.nix

@@ -1,31 +0,0 @@
-{
-  config,
-  pkgs,
-  lib,
-  ...
-}:
-{
-  services.tailscale = {
-    enable = true;
-    authKeyFile = "/run/secrets/tailscale-auth-key";
-    useRoutingFeatures = "server";
-    openFirewall = true;
-    interfaceName = "userspace-networking";
-    extraUpFlags = [ "--ssh" ];
-  };
-
-  systemd.services.nextcloud-serve = {
-    after = [
-      "tailscaled.service"
-      "tailscaled-autoconnect.service"
-    ];
-    wants = [ "tailscaled.service" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig.Type = "oneshot";
-    script = ''
-      ${lib.getExe pkgs.tailscale} cert ${config.networking.fqdn}
-      ${lib.getExe pkgs.tailscale} serve reset
-      ${lib.getExe pkgs.tailscale} serve --bg 28981
-    '';
-  };
-}