Update TPM configuration. Added systemD pi-hole.service priority.

templates/nix-config/configuration.nix

@@ -10,7 +10,7 @@
     ./misc/mail.nix
     ./misc/networking.nix
     ./misc/smart.nix
-##    ./disks/pcr-check.nix
+#    ./disks/pcr-check.nix
 #    ./disks/snapraid.nix
 #    ./pcie-coral/coral.nix
   ];
@@ -48,8 +48,8 @@
 #  boot.initrd.systemd.tpm2.enable = true;
 
 #  # TPM2 PCR check
-##  systemIdentity.enable = true;
-##  systemIdentity.pcr15 = "PCR_HASH"; 
+#  systemIdentity.enable = true;
+#  systemIdentity.pcr15 = "PCR_HASH"; 
 
   # Timezone
   time.timeZone = "Europe/Paris";

templates/nix-config/podman/adguard.coming

@@ -15,27 +15,45 @@ in
       ''
       '';
 
-    systemd.services.${container_name} = {
+    systemd.services."${container_name}" = {
       description = "Podman container : ${container_name}";
-      after = [ "network.target" "traefik.service" ];
+      after = [ "network.target" ];
+      requires = [ "traefik.service" ];
       wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.podman-compose pkgs.podman ];
+      path = [ pkgs.podman pkgs.coreutils ];
 
       serviceConfig = {
         User = "numbus-admin";
         Environment = [ "XDG_RUNTIME_DIR=/run/user/1000" ];
         Type = "exec";
-        # Pull the latest image before running
-        ExecStartPre = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull";
-        # Bring the service up
+        TimeoutStartSec = "600";
+        ExecStartPre = [
+          "${pkgs.bash}/bin/bash -c 'sleep $((RANDOM % 180))'"
+          "-${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} pull"
+        ];
         ExecStart = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} up --remove-orphans";
-        # Take it down gracefully
         ExecStop = "${pkgs.podman-compose}/bin/podman-compose -f /etc/${compose_file} down";
         Restart = "on-failure";
-        RestartSec = "10m";
+        RestartSec = "5m";
         StartLimitBurst = "3";
-        StartLimitIntervalSec = "30s";
       };
     };
+
+    systemd.services."update-${container_name}" = {
+      description = "Update ${container_name} container";
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = "${pkgs.systemd}/bin/systemctl restart ${container_name}.service";
+      };
+    };
+
+    systemd.timers."update-${container_name}" = {
+      timerConfig = {
+        OnCalendar = "02:00";
+        RandomizedDelaySec = "60m";
+        Unit = "update-${container_name}.service";
+      };
+      wantedBy = [ "timers.target" ];
+    };
   };
 }

templates/nix-config/podman/frigate.nix

@@ -55,7 +55,7 @@ in
 
     systemd.services."${container_name}" = {
       description = "Podman container : ${container_name}";
-      after = [ "network.target" ];
+      after = [ "traefik.service" "home-assistant.service" "pi-hole.service" ];
       requires = [ "traefik.service" "home-assistant.service" ];
       wantedBy = [ "multi-user.target" ];
       path = [ pkgs.podman pkgs.coreutils ];

templates/nix-config/podman/gitea.nix

@@ -68,7 +68,7 @@ in
 
     systemd.services."${container_name}" = {
       description = "Podman container : ${container_name}";
-      after = [ "network.target" ];
+      after = [ "network.target" "traefik.service" "pi-hole.service" ];
       requires = [ "traefik.service" ];
       wantedBy = [ "multi-user.target" ];
       path = [ pkgs.podman pkgs.coreutils ];

templates/nix-config/podman/home-assistant.nix

@@ -55,7 +55,7 @@ in
       '';
     systemd.services.${container_name} = {
       description = "Podman container : ${container_name}";
-      after = [ "network.target" ];
+      after = [ "network.target" "traefik.service" "pi-hole.service" ];
       requires = [ "traefik.service" ];
       wantedBy = [ "multi-user.target" ];
       path = [ pkgs.podman pkgs.coreutils ];

templates/nix-config/podman/immich.nix

@@ -92,7 +92,7 @@ in
 
     systemd.services."${container_name}" = {
       description = "Podman container : ${container_name}";
-      after = [ "network.target" ];
+      after = [ "network.target" "traefik.service" "pi-hole.service" ];
       requires = [ "traefik.service" ];
       wantedBy = [ "multi-user.target" ];
       path = [ pkgs.podman pkgs.coreutils ];

templates/nix-config/podman/it-tools.nix

@@ -35,7 +35,7 @@ in
 
     systemd.services."${container_name}" = {
       description = "Podman container : ${container_name}";
-      after = [ "network.target" ];
+      after = [ "network.target" "traefik.service" "pi-hole.service" ];
       requires = [ "traefik.service" ];
       wantedBy = [ "multi-user.target" ];
       path = [ pkgs.podman pkgs.coreutils ];

templates/nix-config/podman/nextcloud.nix

@@ -58,7 +58,7 @@ in
 
     systemd.services."${container_name}" = {
       description = "Podman container : ${container_name}";
-      after = [ "network.target" ];
+      after = [ "network.target" "traefik.service" "pi-hole.service" ];
       requires = [ "traefik.service" ];
       wantedBy = [ "multi-user.target" ];
       path = [ pkgs.podman pkgs.coreutils ];

templates/nix-config/podman/passbolt.nix

@@ -87,7 +87,7 @@ in
 
     systemd.services."${container_name}" = {
       description = "Podman container : ${container_name}";
-      after = [ "network.target" ];
+      after = [ "network.target" "traefik.service" "pi-hole.service" ];
       requires = [ "traefik.service" ];
       wantedBy = [ "multi-user.target" ];
       path = [ pkgs.podman pkgs.coreutils ];

templates/nix-config/podman/pi-hole.nix

@@ -64,7 +64,7 @@ in
 
     systemd.services."${container_name}" = {
       description = "Podman container : ${container_name}";
-      after = [ "network.target" ];
+      after = [ "network.target" "traefik.service" "pi-hole.service" ];
       requires = [ "traefik.service" ];
       wantedBy = [ "multi-user.target" ];
       path = [ pkgs.podman pkgs.coreutils ];