don/NixOS-Configs
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Activity

fred | testing podman control

Browse source
This commit is contained in:
Don Harper 2024-01-28 19:57:37 -06:00
parent 4374ca570e
commit 320a2c1545
3 changed files with 167 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

10
home/common/files/bash/bash_motd
View file

@ -447,7 +447,7 @@ print_docker() {
printf "\\n"
printf " \\033[1;37mDocker:\\033[0m\\n"
docker_info=$(sudo curl -sf --unix-socket /var/run/docker.sock http:/v1.40/info)
docker_info=$(doas curl -sf --unix-socket /var/run/docker.sock http:/v1.40/info)
docker_version=$(echo "$docker_info" | jq -r '.ServerVersion')
@ -457,7 +457,7 @@ print_docker() {
printf " %s Version %s%s%s %s Images\\n\\n" "$DOCKER_VERSION_ICON" "$docker_version" "$docker_space" "$DOCKER_IMAGES_ICON" "$docker_images"
docker_list=$(sudo curl -sf --unix-socket /var/run/docker.sock "http://v1.40/containers/json?all=true" | jq -c ' .[]')
docker_list=$(doas curl -sf --unix-socket /var/run/docker.sock "http://v1.40/containers/json?all=true" | jq -c ' .[]')
echo "$docker_list" | while read -r line; do
container_name="$(echo "$line" | jq -r '.Names[]' | sed 's/\///')"
@ -533,10 +533,10 @@ print_letsencrypt() {
printf "\\n"
printf " \\033[1;37mSSL / let’s encrypt:\\033[0m\\n"
cert_list=$(sudo find $LETSENCRYPT_CERTPATH -name cert.pem)
cert_list=$(doas find $LETSENCRYPT_CERTPATH -name cert.pem)
for cert_file in $cert_list; do
sudo openssl x509 -checkend $((25 * 86400)) -noout -in "$cert_file" >> /dev/null
doas openssl x509 -checkend $((25 * 86400)) -noout -in "$cert_file" >> /dev/null
result=$?
cert_name=$(echo "$cert_file" | rev | cut -d '/' -f 2 | rev)
@ -544,7 +544,7 @@ print_letsencrypt() {
if [ "$result" -eq 0 ]; then
printf " \\033[%sm%s\\033[0m %s\\n" "$LETSENCRYPT_VALID_COLOR" "$LETSENCRYPT_VALID_ICON" "$cert_name"
else
sudo openssl x509 -checkend $((0 * 86400)) -noout -in "$cert_file" >> /dev/null
doas openssl x509 -checkend $((0 * 86400)) -noout -in "$cert_file" >> /dev/null
result=$?
if [ "$result" -eq 0 ]; then

2
hosts/fred/default.nix
View file

@ -4,6 +4,6 @@
imports =
[
./hardware-configuration.nix
#./disko.nix
./podman.nix
];
}

161
hosts/fred/podman.nix Normal file
View file

@ -0,0 +1,161 @@
# Auto-generated using compose2nix v0.1.6.
{ pkgs, lib, ... }:
{
# Runtime
virtualisation.podman = {
enable = true;
autoPrune.enable = true;
dockerCompat = true;
defaultNetwork.settings = {
# Required for container networking to be able to use names.
dns_enabled = true;
};
};
virtualisation.oci-containers.backend = "podman";
# Containers
virtualisation.oci-containers.containers."bandwidth" = {
image = "ghcr.io/alexjustesen/speedtest-tracker:latest";
environment = {
DB_CONNECTION = "mysql";
DB_DATABASE = "speedtest_tracker";
DB_HOST = "bandwidth-db";
DB_PASSWORD = "password";
DB_PORT = "3306";
DB_USERNAME = "speedy";
PGID = "1000";
PUID = "1000";
TZ = "America/Chicago";
};
volumes = [
"/etc/localtime:/etc/localtime:ro"
"/home/don/docker/speedtest/config:/config:rw"
"/home/don/docker/speedtest/web:/etc/ssl/web:rw"
];
dependsOn = [
"bandwidth-db"
"bandwidth-ts"
];
log-driver = "journald";
extraOptions = [
"--network=container:bandwidth-ts"
];
};
systemd.services."podman-bandwidth" = {
serviceConfig = {
Restart = lib.mkOverride 500 "always";
};
partOf = [
"podman-compose-tstest-root.target"
];
unitConfig.UpheldBy = [
"podman-bandwidth-db.service"
"podman-bandwidth-ts.service"
];
wantedBy = [
"podman-compose-tstest-root.target"
];
};
virtualisation.oci-containers.containers."bandwidth-db" = {
image = "mariadb:10";
environment = {
MARIADB_DATABASE = "speedtest_tracker";
MARIADB_PASSWORD = "password";
MARIADB_RANDOM_ROOT_PASSWORD = "true";
MARIADB_USER = "speedy";
PGID = "1000";
PUID = "1000";
};
volumes = [
"/home/don/docker/speedtest-db:/var/lib/mysql:rw"
];
dependsOn = [
"bandwidth-ts"
];
log-driver = "journald";
extraOptions = [
"--network=container:bandwidth-ts"
];
};
systemd.services."podman-bandwidth-db" = {
serviceConfig = {
Restart = lib.mkOverride 500 "always";
};
partOf = [
"podman-compose-tstest-root.target"
];
unitConfig.UpheldBy = [
"podman-bandwidth-ts.service"
];
wantedBy = [
"podman-compose-tstest-root.target"
];
};
virtualisation.oci-containers.containers."bandwidth-ts" = {
image = "tailscale/tailscale";
environment = {
PGID = "1000";
PUID = "1000";
TS_ACCEPT_DNS = "true";
TS_AUTHKEY = "tskey-auth-kt22J52CNTRL-iT7CCqfci73sWvVy6Dyi83DWzwLnNyknF";
TS_HOSTNAME = "fred-bw";
TS_STATE_DIR = "/var/lib/tailscale";
};
volumes = [
"/dev/net/tun:/dev/net/tun:rw"
"/home/don/docker/tailscale/var_lib:/var/lib:rw"
];
cmd = [ "tailscaled" ];
log-driver = "journald";
extraOptions = [
"--cap-add=net_admin"
"--cap-add=sys_module"
"--network-alias=bandwidth-ts"
"--network=tstest-default"
"--privileged"
];
};
systemd.services."podman-bandwidth-ts" = {
serviceConfig = {
Restart = lib.mkOverride 500 "no";
};
after = [
"podman-network-tstest-default.service"
];
requires = [
"podman-network-tstest-default.service"
];
partOf = [
"podman-compose-tstest-root.target"
];
wantedBy = [
"podman-compose-tstest-root.target"
];
};
# Networks
systemd.services."podman-network-tstest-default" = {
path = [ pkgs.podman ];
serviceConfig = {
Type = "oneshot";
RemainAfterExit = true;
ExecStop = "${pkgs.podman}/bin/podman network rm -f tstest-default";
};
script = ''
podman network inspect tstest-default || podman network create tstest-default --opt isolate=true
'';
partOf = [ "podman-compose-tstest-root.target" ];
wantedBy = [ "podman-compose-tstest-root.target" ];
};
# Root service
# When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources.
systemd.targets."podman-compose-tstest-root" = {
unitConfig = {
Description = "Root target generated by compose2nix.";
};
wantedBy = [ "multi-user.target" ];
};
}