From 490056a0d7fe4b0662487998a069606c3daa284f Mon Sep 17 00:00:00 2001
From: SebastianStork <sebastian.stork@pm.me>
Date: Tue, 17 Sep 2024 23:37:13 +0200
Subject: [PATCH] Configure tailscale docker sidecars for all containers at
 once

---
 .../docker/actualbudget/default.nix           | 42 +++++------------
 hosts/stratus/containers/docker/default.nix   | 36 ++++++++++++---
 .../containers/docker/onlyoffice/default.nix  | 45 +++++--------------
 3 files changed, 52 insertions(+), 71 deletions(-)

diff --git a/hosts/stratus/containers/docker/actualbudget/default.nix b/hosts/stratus/containers/docker/actualbudget/default.nix
index 1f36bb6..3715936 100644
--- a/hosts/stratus/containers/docker/actualbudget/default.nix
+++ b/hosts/stratus/containers/docker/actualbudget/default.nix
@@ -2,45 +2,23 @@
 let
   serviceName = "actualbudget";
   subdomain = "budget";
+
+  serveConfig = builtins.toJSON {
+    TCP."443".HTTPS = true;
+    Web."${subdomain}.${config.networking.domain}:443".Handlers."/".Proxy = "http://127.0.0.1:5006";
+  };
+  configPath = pkgs.writeTextDir "tailscale-serve.json" serveConfig;
 in
 {
-  sops.secrets."container/${serviceName}/tailscale-auth-key" = { };
-
   virtualisation.oci-containers.containers = {
     ${serviceName} = {
       image = "ghcr.io/actualbudget/actual-server:latest";
       volumes = [ "/data/${serviceName}:/data" ];
     };
 
-    "tailscale-${serviceName}" =
-      let
-        configPath = pkgs.writeTextFile {
-          name = "config";
-          destination = "/tailscale-serve.json";
-          text = builtins.toJSON {
-            TCP."443".HTTPS = true;
-            Web."${subdomain}.${config.networking.domain}:443".Handlers."/".Proxy = "http://127.0.0.1:5006";
-          };
-        };
-      in
-      {
-        image = "ghcr.io/tailscale/tailscale:latest";
-        environment = {
-          TS_HOSTNAME = subdomain;
-          TS_STATE_DIR = "/var/lib/tailscale";
-          TS_SERVE_CONFIG = "/config/tailscale-serve.json";
-          TS_USERSPACE = "true"; # https://github.com/tailscale/tailscale/issues/11372
-        };
-        environmentFiles = [
-          # Contains "TS_AUTHKEY=<token>"
-          config.sops.secrets."container/${serviceName}/tailscale-auth-key".path
-        ];
-        volumes = [
-          "/var/lib/tailscale-${serviceName}:/var/lib/tailscale"
-          "${configPath}:/config"
-        ];
-        extraOptions = [ "--network=container:${serviceName}" ];
-        dependsOn = [ serviceName ];
-      };
+    "tailscale-${serviceName}" = {
+      environment.TS_HOSTNAME = subdomain;
+      volumes = [ "${configPath}:/config" ];
+    };
   };
 }
diff --git a/hosts/stratus/containers/docker/default.nix b/hosts/stratus/containers/docker/default.nix
index 6194c35..cb795ce 100644
--- a/hosts/stratus/containers/docker/default.nix
+++ b/hosts/stratus/containers/docker/default.nix
@@ -1,8 +1,34 @@
-{ lib, ... }:
+{ config, lib, ... }:
+let
+  containers = lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./.);
+in
 {
-  imports = lib.mapAttrsToList (name: _: ./${name}) (
-    lib.filterAttrs (_: value: value == "directory") (builtins.readDir ./.)
-  );
+  imports = lib.mapAttrsToList (name: _: ./${name}) containers;
 
-  virtualisation.oci-containers.backend = "docker";
+  sops.secrets = lib.mapAttrs' (
+    name: _: lib.nameValuePair "container/${name}/tailscale-auth-key" { }
+  ) containers;
+
+  virtualisation.oci-containers = {
+    backend = "docker";
+
+    containers = lib.mapAttrs' (
+      name: _:
+      lib.nameValuePair "tailscale-${name}" {
+        image = "ghcr.io/tailscale/tailscale:latest";
+        environment = {
+          TS_STATE_DIR = "/var/lib/tailscale";
+          TS_SERVE_CONFIG = "/config/tailscale-serve.json";
+          TS_USERSPACE = "true"; # https://github.com/tailscale/tailscale/issues/11372
+        };
+        environmentFiles = [
+          # Contains "TS_AUTHKEY=<token>"
+          config.sops.secrets."container/${name}/tailscale-auth-key".path
+        ];
+        volumes = [ "/var/lib/tailscale-${name}:/var/lib/tailscale" ];
+        extraOptions = [ "--network=container:${name}" ];
+        dependsOn = [ name ];
+      }
+    ) containers;
+  };
 }
diff --git a/hosts/stratus/containers/docker/onlyoffice/default.nix b/hosts/stratus/containers/docker/onlyoffice/default.nix
index 998f5ea..f23c895 100644
--- a/hosts/stratus/containers/docker/onlyoffice/default.nix
+++ b/hosts/stratus/containers/docker/onlyoffice/default.nix
@@ -2,12 +2,15 @@
 let
   serviceName = "onlyoffice";
   subdomain = "office";
+
+  serveConfig = builtins.toJSON {
+    TCP."443".HTTPS = true;
+    Web."${subdomain}.${config.networking.domain}:443".Handlers."/".Proxy = "http://127.0.0.1:80";
+  };
+  configPath = pkgs.writeTextDir "tailscale-serve.json" serveConfig;
 in
 {
-  sops.secrets = {
-    "container/${serviceName}/tailscale-auth-key" = { };
-    "container/${serviceName}/jwt-secret" = { };
-  };
+  sops.secrets."container/${serviceName}/jwt-secret" = { };
 
   virtualisation.oci-containers.containers = {
     ${serviceName} = {
@@ -18,35 +21,9 @@ in
       ];
     };
 
-    "tailscale-${serviceName}" =
-      let
-        configPath = pkgs.writeTextFile {
-          name = "config";
-          destination = "/tailscale-serve.json";
-          text = builtins.toJSON {
-            TCP."443".HTTPS = true;
-            Web."${subdomain}.${config.networking.domain}:443".Handlers."/".Proxy = "http://127.0.0.1:80";
-          };
-        };
-      in
-      {
-        image = "ghcr.io/tailscale/tailscale:latest";
-        environment = {
-          TS_HOSTNAME = subdomain;
-          TS_STATE_DIR = "/var/lib/tailscale";
-          TS_SERVE_CONFIG = "/config/tailscale-serve.json";
-          TS_USERSPACE = "true"; # https://github.com/tailscale/tailscale/issues/11372
-        };
-        environmentFiles = [
-          # Contains "TS_AUTHKEY=<token>"
-          config.sops.secrets."container/${serviceName}/tailscale-auth-key".path
-        ];
-        volumes = [
-          "/var/lib/tailscale-${serviceName}:/var/lib/tailscale"
-          "${configPath}:/config"
-        ];
-        extraOptions = [ "--network=container:${serviceName}" ];
-        dependsOn = [ serviceName ];
-      };
+    "tailscale-${serviceName}" = {
+      environment.TS_HOSTNAME = subdomain;
+      volumes = [ "${configPath}:/config" ];
+    };
   };
 }