blob: 1421eede7b2ef478f689480b699b3ccd600656a2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
|
{ config, lib, pkgs, ... }:
with import <stockholm/lib>;
{
imports = [
<stockholm/lass/2configs/container-networking.nix>
<stockholm/lass/2configs/syncthing.nix>
{ #hack for already defined
systemd.services."container@green".reloadIfChanged = mkForce false;
systemd.services."container@green".preStart = ''
${pkgs.mount}/bin/mount | ${pkgs.gnugrep}/bin/grep -q ' on /var/lib/containers/green '
'';
systemd.services."container@green".postStop = ''
set -x
${pkgs.umount}/bin/umount /var/lib/containers/green
ls -la /dev/mapper/control
${pkgs.devicemapper}/bin/dmsetup ls
${pkgs.cryptsetup}/bin/cryptsetup -v luksClose /var/lib/sync-containers/green.img
'';
}
];
krebs.syncthing.folders."/var/lib/sync-containers".peers = [ "icarus" "skynet" "littleT" "shodan" ];
krebs.permown."/var/lib/sync-containers" = {
owner = "root";
group = "syncthing";
umask = "0007";
};
system.activationScripts.containerPermissions = ''
mkdir -p /var/lib/containers
chmod 711 /var/lib/containers
'';
containers.green = {
config = { ... }: {
environment.systemPackages = [
pkgs.git
pkgs.rxvt_unicode.terminfo
];
services.openssh.enable = true;
users.users.root.openssh.authorizedKeys.keys = [
config.krebs.users.lass.pubkey
];
};
autoStart = false;
enableTun = true;
privateNetwork = true;
hostAddress = "10.233.2.15";
localAddress = "10.233.2.16";
};
environment.systemPackages = [
(pkgs.writeDashBin "start-green" ''
set -fu
CONTAINER='green'
IMAGE='/var/lib/sync-containers/green.img'
${pkgs.cryptsetup}/bin/cryptsetup status "$CONTAINER" >/dev/null
if [ "$?" -ne 0 ]; then
${pkgs.cryptsetup}/bin/cryptsetup luksOpen "$IMAGE" "$CONTAINER"
fi
mkdir -p /var/lib/containers/"$CONTAINER"
${pkgs.mount}/bin/mount | grep -q " on /var/lib/containers/"$CONTAINER" "
if [ "$?" -ne 0 ]; then
${pkgs.mount}/bin/mount -o sync /dev/mapper/"$CONTAINER" /var/lib/containers/"$CONTAINER"
fi
STATE=$(${pkgs.nixos-container}/bin/nixos-container status "$CONTAINER")
if [ "$STATE" = 'down' ]; then
${pkgs.nixos-container}/bin/nixos-container start "$CONTAINER"
fi
ping -c1 green.r
if [ "$?" -ne 0 ]; then
${pkgs.nixos-container}/bin/nixos-container run green -- nixos-rebuild -I /var/src switch
fi
'')
];
}
|
