stockholm/lass/2configs/blue-host.nix

117 lines
3.4 KiB
Nix
Raw Normal View History

2018-05-20 08:04:05 +00:00
{ config, lib, pkgs, ... }:
with import <stockholm/lib>;
let
all_hosts = [
"icarus"
"shodan"
"daedalus"
"skynet"
"prism"
2018-12-16 15:31:57 +00:00
"littleT"
];
remote_hosts = filter (h: h != config.networking.hostName) all_hosts;
2018-05-20 08:04:05 +00:00
in {
2018-05-20 08:04:05 +00:00
imports = [
<stockholm/lass/2configs/container-networking.nix>
{ #hack for already defined
systemd.services."container@blue".reloadIfChanged = mkForce false;
systemd.services."container@blue".preStart = ''
${pkgs.mount}/bin/mount | ${pkgs.gnugrep}/bin/grep -q '^encfs on /var/lib/containers/blue'
'';
systemd.services."container@blue".preStop = ''
/run/wrappers/bin/fusermount -u /var/lib/containers/blue
'';
}
2018-05-20 08:04:05 +00:00
];
2018-11-26 23:59:40 +00:00
system.activationScripts.containerPermissions = ''
mkdir -p /var/lib/containers
chmod 711 /var/lib/containers
'';
2018-05-20 08:04:05 +00:00
containers.blue = {
config = { ... }: {
2018-11-20 00:14:08 +00:00
environment.systemPackages = [
pkgs.git
2022-11-01 11:40:36 +00:00
pkgs.rxvt-unicode-unwrapped.terminfo
2018-11-20 00:14:08 +00:00
];
2018-05-20 08:04:05 +00:00
services.openssh.enable = true;
users.users.root.openssh.authorizedKeys.keys = [
config.krebs.users.lass.pubkey
];
};
2018-11-20 00:14:21 +00:00
autoStart = false;
2018-05-20 08:04:05 +00:00
enableTun = true;
privateNetwork = true;
hostAddress = "10.233.2.9";
localAddress = "10.233.2.10";
};
2020-09-27 13:32:38 +00:00
#systemd.services = builtins.listToAttrs (map (host:
# let
# in nameValuePair "sync-blue-${host}" {
# bindsTo = [ "container@blue.service" ];
# wantedBy = [ "container@blue.service" ];
# # ssh needed for rsync
# path = [ pkgs.openssh ];
# serviceConfig = {
# Restart = "always";
# RestartSec = 10;
# ExecStart = pkgs.writeDash "sync-blue-${host}" ''
# set -efu
# #make sure blue is running
# /run/wrappers/bin/ping -c1 blue.r > /dev/null
2020-09-27 13:32:38 +00:00
# #make sure the container is unlocked
# ${pkgs.mount}/bin/mount | ${pkgs.gnugrep}/bin/grep -q '^encfs on /var/lib/containers/blue'
2020-09-27 13:32:38 +00:00
# #make sure our target is reachable
# ${pkgs.untilport}/bin/untilport ${host}.r 22 2>/dev/null
2020-09-27 13:32:38 +00:00
# #start sync
# ${pkgs.lsyncd}/bin/lsyncd -log scarce ${pkgs.writeText "lsyncd-config.lua" ''
# settings {
# nodaemon = true,
# inotifyMode = "CloseWrite or Modify",
# }
# sync {
# default.rsyncssh,
# source = "/var/lib/containers/.blue",
# host = "${host}.r",
# targetdir = "/var/lib/containers/.blue",
# rsync = {
# archive = true,
# owner = true,
# group = true,
# };
# ssh = {
# binary = "${pkgs.openssh}/bin/ssh";
# identityFile = "/var/lib/containers/blue/home/lass/.ssh/id_rsa",
# },
# }
# ''}
# '';
# };
# unitConfig.ConditionPathExists = "!/var/run/ppp0.pid";
# }
#) remote_hosts);
2018-11-20 00:13:48 +00:00
environment.systemPackages = [
(pkgs.writeDashBin "start-blue" ''
set -ef
if ! $(mount | ${pkgs.gnugrep}/bin/grep -qi '^encfs on /var/lib/containers/blue'); then
${pkgs.encfs}/bin/encfs --public /var/lib/containers/.blue /var/lib/containers/blue
fi
nixos-container start blue
2018-11-27 00:00:59 +00:00
nixos-container run blue -- nixos-rebuild -I /var/src dry-build
if ping -c1 blue.r >/dev/null; then
echo 'blue is already running. bailing out'
exit 23
fi
2018-11-20 00:13:48 +00:00
nixos-container run blue -- nixos-rebuild -I /var/src switch
'')
];
2018-05-20 08:04:05 +00:00
}