SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 22:11:33 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Configure tailscale docker sidecars for all containers at once

Browse source
This commit is contained in:
SebastianStork 2024-09-17 23:37:13 +02:00
parent 4db060800b
commit 490056a0d7
3 changed files with 52 additions and 71 deletions
Download patch file Download diff file Expand all files Collapse all files

42
hosts/stratus/containers/docker/actualbudget/default.nix
View file

@ -2,45 +2,23 @@
let
serviceName = "actualbudget";
subdomain = "budget";
serveConfig = builtins.toJSON {
TCP."443".HTTPS = true;
Web."${subdomain}.${config.networking.domain}:443".Handlers."/".Proxy = "http://127.0.0.1:5006";
};
configPath = pkgs.writeTextDir "tailscale-serve.json" serveConfig;
in
{
sops.secrets."container/${serviceName}/tailscale-auth-key" = { };
virtualisation.oci-containers.containers = {
${serviceName} = {
image = "ghcr.io/actualbudget/actual-server:latest";
volumes = [ "/data/${serviceName}:/data" ];
};
"tailscale-${serviceName}" =
let
configPath = pkgs.writeTextFile {
name = "config";
destination = "/tailscale-serve.json";
text = builtins.toJSON {
TCP."443".HTTPS = true;
Web."${subdomain}.${config.networking.domain}:443".Handlers."/".Proxy = "http://127.0.0.1:5006";
};
};
in
{
image = "ghcr.io/tailscale/tailscale:latest";
environment = {
TS_HOSTNAME = subdomain;
TS_STATE_DIR = "/var/lib/tailscale";
TS_SERVE_CONFIG = "/config/tailscale-serve.json";
TS_USERSPACE = "true"; # https://github.com/tailscale/tailscale/issues/11372
};
environmentFiles = [
# Contains "TS_AUTHKEY=<token>"
config.sops.secrets."container/${serviceName}/tailscale-auth-key".path
];
volumes = [
"/var/lib/tailscale-${serviceName}:/var/lib/tailscale"
"${configPath}:/config"
];
extraOptions = [ "--network=container:${serviceName}" ];
dependsOn = [ serviceName ];
};
"tailscale-${serviceName}" = {
environment.TS_HOSTNAME = subdomain;
volumes = [ "${configPath}:/config" ];
};
};
}

36
hosts/stratus/containers/docker/default.nix
View file

@ -1,8 +1,34 @@
{ lib, ... }:
{ config, lib, ... }:
let
containers = lib.filterAttrs (_: v: v == "directory") (builtins.readDir ./.);
in
{
imports = lib.mapAttrsToList (name: _: ./${name}) (
lib.filterAttrs (_: value: value == "directory") (builtins.readDir ./.)
);
imports = lib.mapAttrsToList (name: _: ./${name}) containers;
virtualisation.oci-containers.backend = "docker";
sops.secrets = lib.mapAttrs' (
name: _: lib.nameValuePair "container/${name}/tailscale-auth-key" { }
) containers;
virtualisation.oci-containers = {
backend = "docker";
containers = lib.mapAttrs' (
name: _:
lib.nameValuePair "tailscale-${name}" {
image = "ghcr.io/tailscale/tailscale:latest";
environment = {
TS_STATE_DIR = "/var/lib/tailscale";
TS_SERVE_CONFIG = "/config/tailscale-serve.json";
TS_USERSPACE = "true"; # https://github.com/tailscale/tailscale/issues/11372
};
environmentFiles = [
# Contains "TS_AUTHKEY=<token>"
config.sops.secrets."container/${name}/tailscale-auth-key".path
];
volumes = [ "/var/lib/tailscale-${name}:/var/lib/tailscale" ];
extraOptions = [ "--network=container:${name}" ];
dependsOn = [ name ];
}
) containers;
};
}

45
hosts/stratus/containers/docker/onlyoffice/default.nix
View file

@ -2,12 +2,15 @@
let
serviceName = "onlyoffice";
subdomain = "office";
serveConfig = builtins.toJSON {
TCP."443".HTTPS = true;
Web."${subdomain}.${config.networking.domain}:443".Handlers."/".Proxy = "http://127.0.0.1:80";
};
configPath = pkgs.writeTextDir "tailscale-serve.json" serveConfig;
in
{
sops.secrets = {
"container/${serviceName}/tailscale-auth-key" = { };
"container/${serviceName}/jwt-secret" = { };
};
sops.secrets."container/${serviceName}/jwt-secret" = { };
virtualisation.oci-containers.containers = {
${serviceName} = {
@ -18,35 +21,9 @@ in
];
};
"tailscale-${serviceName}" =
let
configPath = pkgs.writeTextFile {
name = "config";
destination = "/tailscale-serve.json";
text = builtins.toJSON {
TCP."443".HTTPS = true;
Web."${subdomain}.${config.networking.domain}:443".Handlers."/".Proxy = "http://127.0.0.1:80";
};
};
in
{
image = "ghcr.io/tailscale/tailscale:latest";
environment = {
TS_HOSTNAME = subdomain;
TS_STATE_DIR = "/var/lib/tailscale";
TS_SERVE_CONFIG = "/config/tailscale-serve.json";
TS_USERSPACE = "true"; # https://github.com/tailscale/tailscale/issues/11372
};
environmentFiles = [
# Contains "TS_AUTHKEY=<token>"
config.sops.secrets."container/${serviceName}/tailscale-auth-key".path
];
volumes = [
"/var/lib/tailscale-${serviceName}:/var/lib/tailscale"
"${configPath}:/config"
];
extraOptions = [ "--network=container:${serviceName}" ];
dependsOn = [ serviceName ];
};
"tailscale-${serviceName}" = {
environment.TS_HOSTNAME = subdomain;
volumes = [ "${configPath}:/config" ];
};
};
}