Migrated from multi repos to monorepo architecture.
This commit is contained in:
Raphaël Numbus
@@ -0,0 +1,181 @@
|
||||
{ lib, config, pkgs }:
|
||||
|
||||
with lib;
|
||||
|
||||
{
|
||||
mkPodmanService = {
|
||||
name,
|
||||
description,
|
||||
defaultPort ? "0",
|
||||
defaultSubdomain ? name,
|
||||
pod ? "false",
|
||||
reverseProxied ? true,
|
||||
composeText,
|
||||
scheme ? "http",
|
||||
middlewares ? null,
|
||||
dependencies ? [ "sops-install-secrets.service" "traefik.service" "authelia.service" "${config.numbus-server.services.dns}.service" ],
|
||||
extraOptions ? {},
|
||||
extraConfig ? {},
|
||||
configDirEnabled ? true,
|
||||
dataDirEnabled ? true,
|
||||
startDelay ? 180,
|
||||
dirPermissions ? [],
|
||||
secrets ? [],
|
||||
envFile ? null,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.numbus-server.services.${name};
|
||||
in
|
||||
|
||||
{
|
||||
options.numbus-server.services.${name} = recursiveUpdate ({
|
||||
enable = mkEnableOption description;
|
||||
|
||||
subdomain = mkOption {
|
||||
type = types.str;
|
||||
default = defaultSubdomain;
|
||||
example = defaultSubdomain;
|
||||
description = "The subdomain that ${name} will use";
|
||||
};
|
||||
|
||||
port = mkOption {
|
||||
type = types.str;
|
||||
default = defaultPort;
|
||||
example = defaultPort;
|
||||
description = "The port that ${name} will use.";
|
||||
};
|
||||
|
||||
reverseProxied = mkOption {
|
||||
type = types.bool;
|
||||
default = reverseProxied;
|
||||
example = reverseProxied;
|
||||
description = "Whether to create a basic Traefik reverse proxy configuration for this service. You might need to set it to false for custom configurations or services that don't need to be reverse proxied.";
|
||||
};
|
||||
} // (optionalAttrs configDirEnabled {
|
||||
configDir = mkOption {
|
||||
type = types.str;
|
||||
default = "/mnt/config/${name}";
|
||||
example = "/mnt/config/${name}";
|
||||
description = "The directory where ${name}'s configuration files will be stored";
|
||||
};
|
||||
}) // (optionalAttrs dataDirEnabled {
|
||||
dataDir = mkOption {
|
||||
type = types.str;
|
||||
default = "/mnt/data/${name}";
|
||||
example = "/mnt/data/${name}";
|
||||
description = "The directory where ${name}'s data will be stored";
|
||||
};
|
||||
})) extraOptions;
|
||||
|
||||
config = mkIf cfg.enable (mkMerge [
|
||||
{
|
||||
# Compose file
|
||||
sops.templates."podman/${name}" = {
|
||||
gid = "100";
|
||||
uid = "1000";
|
||||
mode = "0400";
|
||||
content = composeText;
|
||||
path = "/etc/podman/${name}/compose.yaml";
|
||||
};
|
||||
|
||||
# Traefik config
|
||||
sops.templates."traefik/rules/${name}" = mkIf cfg.reverseProxied {
|
||||
gid = "100";
|
||||
uid = "100999";
|
||||
mode = "0400";
|
||||
content = ''
|
||||
http:
|
||||
routers:
|
||||
${name}:
|
||||
rule: "Host(`${cfg.subdomain}.${config.numbus-server.services.domain}`)"
|
||||
entrypoints:
|
||||
- "websecure"
|
||||
service: ${name}
|
||||
middlewares:
|
||||
${concatStringsSep "\n" (map (m: " - ${m}") middlewares)}
|
||||
tls:
|
||||
certresolver: "cloudflare"
|
||||
options: "secureTLS"
|
||||
services:
|
||||
${name}:
|
||||
loadBalancer:
|
||||
servers:
|
||||
- url: "${scheme}://host.containers.internal:${cfg.port}"
|
||||
'';
|
||||
path = "/etc/traefik/rules/${name}.yaml";
|
||||
};
|
||||
|
||||
# Secrets config
|
||||
sops.secrets = genAttrs secrets (secretPath: {
|
||||
sopsFile = "/etc/nixos/secrets/podman/${name}.yaml";
|
||||
gid = "100";
|
||||
uid = "1000";
|
||||
mode = "0400";
|
||||
});
|
||||
|
||||
# SystemD config
|
||||
systemd.services."${name}" = {
|
||||
description = "Podman container : ${name}";
|
||||
after = dependencies;
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
onFailure = [ "service-failure-notify@%n.service" ];
|
||||
startLimitBurst = 5;
|
||||
startLimitIntervalSec = 600;
|
||||
path = [ pkgs.podman pkgs.podman-compose pkgs.slirp4netns pkgs.su pkgs.sudo pkgs.coreutils ];
|
||||
serviceConfig = {
|
||||
Type = "exec";
|
||||
TimeoutStartSec = "1000";
|
||||
ExecStartPre = [
|
||||
"${pkgs.bash}/bin/bash -c 'sleep $((RANDOM % ${toString startDelay}))'"
|
||||
"${pkgs.bash}/bin/bash -c 'export PATH=/run/wrappers/bin:$PATH; exec ${pkgs.sudo}/bin/sudo -u numbus-admin podman-compose -f /etc/podman/${name}/compose.yaml pull'"
|
||||
];
|
||||
ExecStart = "${pkgs.bash}/bin/bash -c 'export PATH=/run/wrappers/bin:$PATH; exec ${pkgs.sudo}/bin/sudo -u numbus-admin podman-compose --in-pod ${toString pod} -f /etc/podman/${name}/compose.yaml up --remove-orphans'";
|
||||
ExecStop = "${pkgs.bash}/bin/bash -c 'export PATH=/run/wrappers/bin:$PATH; exec ${pkgs.sudo}/bin/sudo -u numbus-admin podman-compose --in-pod ${toString pod} -f /etc/podman/${name}/compose.yaml down'";
|
||||
Restart = "on-failure";
|
||||
RestartSec = "3m";
|
||||
};
|
||||
};
|
||||
|
||||
# Permissions config
|
||||
systemd.services."${name}-permissions" = mkIf (dirPermissions != []) {
|
||||
description = "Podman container : ${name} : check and fix permissions";
|
||||
before = [ "${name}.service" ];
|
||||
wantedBy = [ "multi-user.target" "${name}.service" ];
|
||||
onFailure = [ "service-failure-notify@%n.service" ];
|
||||
startLimitBurst = 5;
|
||||
startLimitIntervalSec = 600;
|
||||
path = [ pkgs.coreutils ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
Restart = "on-failure";
|
||||
RestartSec = "5m";
|
||||
};
|
||||
script = ''
|
||||
${concatStringsSep "\n" (map (perm: ''
|
||||
set -- ${perm}
|
||||
WANTED_PERMISSIONS=$1
|
||||
FOLDER_PATH=$2
|
||||
|
||||
if [[ ! -e "$FOLDER_PATH" ]]; then
|
||||
mkdir -p "$FOLDER_PATH"
|
||||
elif [[ ! -d "$FOLDER_PATH" ]]; then
|
||||
rm "$FOLDER_PATH"
|
||||
mkdir -p "$FOLDER_PATH"
|
||||
fi
|
||||
|
||||
ACTUAL_PERMISSIONS=$(stat -c '%u:%g' "$FOLDER_PATH")
|
||||
if [[ "$ACTUAL_PERMISSIONS" != "$WANTED_PERMISSIONS" ]]; then
|
||||
chown -R "$WANTED_PERMISSIONS" "$FOLDER_PATH"
|
||||
fi
|
||||
'') dirPermissions)}
|
||||
exit 0
|
||||
'';
|
||||
};
|
||||
}
|
||||
extraConfig
|
||||
]);
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user