Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

sync-containers(1): use dhcpcd, support luksfile

Browse Source
This commit is contained in:
lassulus 2022-11-22 09:08:20 +01:00
parent 52fcac4630
commit e185a086eb
1 changed files with 104 additions and 36 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

140
krebs/3modules/sync-containers.nix
View File

@ -5,27 +5,55 @@ with import <stockholm/lib>;
plain = "/var/lib/containers/${cname}/var/state"; plain = "/var/lib/containers/${cname}/var/state";
ecryptfs = "${cfg.dataLocation}/${cname}/ecryptfs"; ecryptfs = "${cfg.dataLocation}/${cname}/ecryptfs";
securefs = "${cfg.dataLocation}/${cname}/securefs"; securefs = "${cfg.dataLocation}/${cname}/securefs";
luksfile = "${cfg.dataLocation}/${cname}/luksfile";
};
init = cname: {
plain = ''
echo 'no need for init'
'';
ecryptfs = ''
${pkgs.ecrypt}/bin/ecrypt init ${cfg.dataLocation}/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
'';
securefs = ''
${pkgs.securefs}/bin/securefs create --format 3 ${cfg.dataLocation}/${cname}/securefs
'';
luksfile = ''
${pkgs.coreutils}/bin/truncate -s 10G '${(paths cname).luksfile}/fs.luks'
${pkgs.cryptsetup}/bin/cryptsetup luksFormat '${(paths cname).luksfile}/fs.luks'
${pkgs.cryptsetup}/bin/cryptsetup luksOpen '${(paths cname).luksfile}/fs.luks' 'luksfile-${cname}'
${pkgs.xfsprogs}/bin/mkfs.xfs '/dev/mapper/luksfile-${cname}'
'';
}; };
start = cname: { start = cname: {
plain = '' plain = ''
: :
''; '';
ecryptfs = '' ecryptfs = ''
if ! mount | grep -q '${cfg.dataLocation}/${cname}/ecryptfs on /var/lib/containers/${cname}/var/state type ecryptfs'; then
if [ -e ${cfg.dataLocation}/${cname}/ecryptfs/.cfg.json ]; then if [ -e ${cfg.dataLocation}/${cname}/ecryptfs/.cfg.json ]; then
if ! mount | grep -q '${cfg.dataLocation}/${cname}/ecryptfs on /var/lib/containers/${cname}/var/state type ecryptfs'; then
${pkgs.ecrypt}/bin/ecrypt mount ${cfg.dataLocation}/${cname}/ecryptfs /var/lib/containers/${cname}/var/state ${pkgs.ecrypt}/bin/ecrypt mount ${cfg.dataLocation}/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
else
${pkgs.ecrypt}/bin/ecrypt init ${cfg.dataLocation}/${cname}/ecryptfs /var/lib/containers/${cname}/var/state
fi fi
else
echo 'please run init-${cname} first'
exit 1
fi fi
''; '';
securefs = '' securefs = ''
## TODO init file systems if it does not exist ## check if FS was initialized first
# ${pkgs.securefs}/bin/securefs create --format 3 ${cfg.dataLocation}/${cname}/securefs
if ! ${pkgs.mount}/bin/mount | grep -q '^securefs on /var/lib/containers/${cname}/var/state type fuse.securefs'; then if ! ${pkgs.mount}/bin/mount | grep -q '^securefs on /var/lib/containers/${cname}/var/state type fuse.securefs'; then
${pkgs.securefs}/bin/securefs mount ${cfg.dataLocation}/${cname}/securefs /var/lib/containers/${cname}/var/state -b -o allow_other -o default_permissions ${pkgs.securefs}/bin/securefs mount ${cfg.dataLocation}/${cname}/securefs /var/lib/containers/${cname}/var/state -b -o allow_other -o default_permissions
fi fi
''; '';
luksfile = ''
mkdir -p /var/lib/containers/${cname}/var/state
if ! test -e /dev/mapper/luksfile-${cname}; then
${pkgs.cryptsetup}/bin/cryptsetup luksOpen '${(paths cname).luksfile}/fs.luks' 'luksfile-${cname}'
fi
if ! ${pkgs.mount}/bin/mount | grep -q '^/dev/mapper/luksfile-${cname} on /var/lib/containers/${cname}/var/state'; then
mount '/dev/mapper/luksfile-${cname}' '/var/lib/containers/${cname}/var/state'
fi
'';
}; };
stop = cname: { stop = cname: {
plain = '' plain = ''
@ -37,12 +65,16 @@ with import <stockholm/lib>;
securefs = '' securefs = ''
umount /var/lib/containers/${cname}/var/state umount /var/lib/containers/${cname}/var/state
''; '';
luksfile = ''
umount /var/lib/containers/${cname}/var/state
${pkgs.cryptsetup}/bin/cryptsetup luksClose luksfile-${cname}
'';
}; };
in { in {
options.krebs.sync-containers = { options.krebs.sync-containers = {
dataLocation = mkOption { dataLocation = mkOption {
description = '' description = ''
location where the encrypted sync-container lie around location where the encrypted sync-containers lie around
''; '';
default = "/var/lib/sync-containers"; default = "/var/lib/sync-containers";
type = types.absolute-pathname; type = types.absolute-pathname;
@ -64,25 +96,11 @@ in {
default = []; default = [];
type = types.listOf types.str; type = types.listOf types.str;
}; };
hostIp = mkOption { # TODO find this automatically
description = ''
hostAddress of the privateNetwork
'';
example = "10.233.2.15";
type = types.str;
};
localIp = mkOption { # TODO find this automatically
description = ''
localAddress of the privateNetwork
'';
example = "10.233.2.16";
type = types.str;
};
format = mkOption { format = mkOption {
description = '' description = ''
file system encrption format of the container file system encrption format of the container
''; '';
type = types.enum [ "plain" "ecryptfs" "securefs" ]; type = types.enum [ "plain" "ecryptfs" "securefs" "luksfile" ];
}; };
}; };
})); }));
@ -102,12 +120,11 @@ in {
ignorePerms = false; ignorePerms = false;
})) cfg.containers); })) cfg.containers);
krebs.permown = (mapAttrs' (_: ctr: nameValuePair "${(paths ctr.name).${ctr.format}}" ({ krebs.acl = mapAttrs' (_: ctr: nameValuePair "${(paths ctr.name).${ctr.format}}" {
file-mode = "u+rw"; "u:syncthing:rX".parents = true;
directory-mode = "u+rwx"; "u:syncthing:rwX" = {};
owner = "syncthing"; }) cfg.containers;
keepGoing = false;
})) cfg.containers);
systemd.services = mapAttrs' (n: ctr: nameValuePair "containers@${ctr.name}" ({ systemd.services = mapAttrs' (n: ctr: nameValuePair "containers@${ctr.name}" ({
reloadIfChanged = mkForce false; reloadIfChanged = mkForce false;
@ -116,8 +133,11 @@ in {
containers = mapAttrs' (n: ctr: nameValuePair ctr.name ({ containers = mapAttrs' (n: ctr: nameValuePair ctr.name ({
config = { ... }: { config = { ... }: {
environment.systemPackages = [ environment.systemPackages = [
pkgs.dhcpcd
pkgs.git pkgs.git
pkgs.jq
]; ];
networking.useDHCP = mkForce true;
system.activationScripts.fuse = { system.activationScripts.fuse = {
text = '' text = ''
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229 ${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
@ -131,11 +151,57 @@ in {
autoStart = false; autoStart = false;
enableTun = true; enableTun = true;
privateNetwork = true; privateNetwork = true;
hostAddress = ctr.hostIp; hostBridge = "ctr0";
localAddress = ctr.localIp;
})) cfg.containers; })) cfg.containers;
environment.systemPackages = flatten (mapAttrsToList (n: ctr: [ networking.networkmanager.unmanaged = [ "ctr0" ];
networking.bridges.ctr0.interfaces = [];
networking.interfaces.ctr0.ipv4.addresses = [{
address = "10.233.0.1";
prefixLength = 24;
}];
# networking.nat = {
# enable = true;
# externalInterface = lib.mkDefault "et0";
# internalInterfaces = [ "ctr0" ];
# };
services.dhcpd4 = {
enable = true;
interfaces = [ "ctr0" ];
extraConfig = ''
option subnet-mask 255.255.255.0;
option routers 10.233.0.1;
# option domain-name-servers 8.8.8.8; # TODO configure dns server
subnet 10.233.0.0 netmask 255.255.255.0 {
range 10.233.0.10 10.233.0.250;
}
'';
};
users.users.root.packages = flatten (mapAttrsToList (n: ctr: [
(pkgs.writeDashBin "init-${ctr.name}" ''
set -euf
set -x
mkdir -p /var/lib/containers/${ctr.name}/var/state
STATE=$(/run/current-system/sw/bin/nixos-container status ${ctr.name})
if [ "$STATE" = 'up' ]; then
/run/current-system/sw/bin/nixos-container stop ${ctr.name}
fi
${(init ctr.name).${ctr.format}}
${(start ctr.name).${ctr.format}}
/run/current-system/sw/bin/nixos-container start ${ctr.name}
/run/current-system/sw/bin/nixos-container run ${ctr.name} -- ${pkgs.writeDash "deploy-${ctr.name}" ''
set -x
mkdir -p /var/state/var_src
ln -sfTr /var/state/var_src /var/src
touch /etc/NIXOS
''}
target_ip=$(/run/current-system/sw/bin/nixos-container run ${ctr.name} -- ip -j a s eth0 | jq -r '.[].addr_info[] | select(.family=="inet") | .local')
echo "deploy to $target_ip"
'')
(pkgs.writeDashBin "start-${ctr.name}" '' (pkgs.writeDashBin "start-${ctr.name}" ''
set -euf set -euf
set -x set -x
@ -144,12 +210,12 @@ in {
${(start ctr.name).${ctr.format}} ${(start ctr.name).${ctr.format}}
STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${ctr.name}) STATE=$(/run/current-system/sw/bin/nixos-container status ${ctr.name})
if [ "$STATE" = 'down' ]; then if [ "$STATE" = 'down' ]; then
${pkgs.nixos-container}/bin/nixos-container start ${ctr.name} /run/current-system/sw/bin/nixos-container start ${ctr.name}
fi fi
${pkgs.nixos-container}/bin/nixos-container run ${ctr.name} -- ${pkgs.writeDash "deploy-${ctr.name}" '' /run/current-system/sw/bin/nixos-container run ${ctr.name} -- ${pkgs.writeDash "deploy-${ctr.name}" ''
set -x set -x
mkdir -p /var/state/var_src mkdir -p /var/state/var_src
@ -158,15 +224,17 @@ in {
''} ''}
if [ -h /var/lib/containers/${ctr.name}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${ctr.name}.r); then if [ -h /var/lib/containers/${ctr.name}/var/src/nixos-config ] && (! ping -c1 -q -w5 ${ctr.name}.r); then
${pkgs.nixos-container}/bin/nixos-container run ${ctr.name} -- nixos-rebuild -I /var/src switch /run/current-system/sw/bin/nixos-container run ${ctr.name} -- nixos-rebuild -I /var/src switch
else else
echo 'no nixos config, or target already online, bailing out'
${(stop ctr.name).${ctr.format}} ${(stop ctr.name).${ctr.format}}
/run/current-system/sw/bin/nixos-container stop ${ctr.name}
fi fi
'') '')
(pkgs.writeDashBin "stop-${ctr.name}" '' (pkgs.writeDashBin "stop-${ctr.name}" ''
set -euf set -euf
${pkgs.nixos-container}/bin/nixos-container stop ${ctr.name} /run/current-system/sw/bin/nixos-container stop ${ctr.name}
${(stop ctr.name).${ctr.format}} ${(stop ctr.name).${ctr.format}}
'') '')
]) cfg.containers); ]) cfg.containers);