blob: 6cccab4b3b9609a033b5c3a51f512387544a7215 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
|
{ config, lib, pkgs, ... }:
with import <stockholm/lib>;
let
cname = "green";
cryfs = pkgs.cryfs.overrideAttrs (old: {
patches = [
(pkgs.writeText "file_mode.patch" ''
--- a/src/cryfs/filesystem/CryNode.cpp
+++ b/src/cryfs/filesystem/CryNode.cpp
@@ -171,7 +171,7 @@ CryNode::stat_info CryNode::stat() const {
result.uid = fspp::uid_t(getuid());
result.gid = fspp::gid_t(getgid());
#endif
- result.mode = fspp::mode_t().addDirFlag().addUserReadFlag().addUserWriteFlag().addUserExecFlag();
+ result.mode = fspp::mode_t().addDirFlag().addUserReadFlag().addUserWriteFlag().addUserExecFlag().addGroupReadFlag().addGroupExecFlag().addOtherReadFlag().addOtherExecFlag();;
result.size = fsblobstore::DirBlob::DIR_LSTAT_SIZE;
//TODO If possible without performance loss, then for a directory, st_nlink should return number of dir entries (including "." and "..")
result.nlink = 1;
'')
] ++ old.patches;
});
in {
imports = [
<stockholm/lass/2configs/container-networking.nix>
<stockholm/lass/2configs/syncthing.nix>
];
programs.fuse.userAllowOther = true;
services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}".devices = [ "icarus" "skynet" "littleT" "shodan" ];
# krebs.permown."/var/lib/sync-containers/${cname}" = {
# owner = "root";
# group = "syncthing";
# umask = "0007";
# };
systemd.services."container@green".reloadIfChanged = mkForce false;
containers.${cname} = {
config = { ... }: {
environment.systemPackages = [
pkgs.git
pkgs.rxvt_unicode.terminfo
];
services.openssh.enable = true;
users.users.root.openssh.authorizedKeys.keys = [
config.krebs.users.lass.pubkey
];
system.activationScripts.fuse = {
text = ''
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
'';
deps = [];
};
};
allowedDevices = [
{ modifier = "rwm"; node = "/dev/fuse"; }
];
autoStart = false;
enableTun = true;
privateNetwork = true;
hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
};
environment.systemPackages = [
(pkgs.writeDashBin "start-${cname}" ''
set -euf
mkdir -p /var/lib/containers/${cname}/var/state
chown ${config.services.syncthing.user}: /var/lib/containers/${cname}/var/state
if ! ${pkgs.mount}/bin/mount | grep -q '^cryfs@/var/lib/sync-containers/${cname} on /var/lib/containers/${cname}/var/state '; then
/run/wrappers/bin/sudo -u "${config.services.syncthing.user}" \
${cryfs}/bin/cryfs /var/lib/sync-containers/${cname} /var/lib/containers/${cname}/var/state -o allow_other -o default_permissions
fi
STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
if [ "$STATE" = 'down' ]; then
${pkgs.nixos-container}/bin/nixos-container start ${cname}
fi
if ! ping -c1 -q -w5 ${cname}.r && [ -d /var/lib/containers/${cname}/var/src ]; then
${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
mkdir -p /var/state/var_src
ln -sf state/var_Src /var/src
nixos-rebuild -I /var/src switch
''}
fi
'')
(pkgs.writeDashBin "stop-${cname}" ''
set -euf
${pkgs.nixos-container}/bin/nixos-container stop ${cname}
${cryfs}/bin/cryfs-unmount /var/lib/containers/${cname}/var/state
'')
];
}
|
