Initial commit

virtualization/nebula-sync-oci.nix

@@ -0,0 +1,40 @@
+{ config, lib, pkgs, ... }:
+
+{
+  
+  users.users.nebula = {
+    isSystemUser = true;
+    group = "podman";
+    home = "/var/lib/nebula";
+    linger = false;
+    createHome = true;
+    autoSubUidGidRange = true;
+  };
+  
+  sops = {
+    secrets = {
+      nebula-sync-env = {
+        sopsFile = ../secrets/nebula-sync.env;
+        format = "dotenv";
+        owner = config.users.users.nebula.name;
+      };
+    };
+  };
+  
+
+  virtualisation.oci-containers.containers.nebula-sync = {
+    autoRemoveOnStop = false;
+    autoStart = false;
+    image = "ghcr.io/lovelaze/nebula-sync:0.11.2";
+    environment = {
+      FULL_SYNC = "false";
+      RUN_GRAVITY = "true";
+      CRON = "23 * * * *";
+      CLIENT_SKIP_TLS_VERIFICATION = "true";
+    };
+    environmentFiles = [ config.sops.secrets.nebula-sync-env.path ];
+    podman = { user = "nebula"; };
+    log-driver = "journald";
+  };
+
+}

virtualization/nebula-sync-ocinix.bak

@@ -0,0 +1,38 @@
+{ config, lib, pkgs, ... }:
+
+{
+  users.users.nebula = {
+    isSystemUser = true;
+    group = "podman";
+    home = "/var/lib/nebula";
+    linger = false;
+    createHome = true;
+    autoSubUidGidRange = true;
+  };
+
+  sops = {
+    secrets = {
+      nebula-sync-env = {
+        sopsFile = ../secrets/nebula-sync.env;
+        format = "dotenv";
+        owner = config.users.users.nebula.name;
+      };
+    };
+  };
+
+  virtualisation.oci-containers.containers.nebula-sync = {
+    autoRemoveOnStop = false;
+    autoStart = false;
+    image = "ghcr.io/lovelaze/nebula-sync:0.11.2";
+    environment = {
+      FULL_SYNC = "false";
+      RUN_GRAVITY = "true";
+      CRON = "23 * * * *";
+      CLIENT_SKIP_TLS_VERIFICATION = "true";
+    };
+    environmentFiles = [ config.sops.secrets.nebula-sync-env.path ];
+    podman = { user = "nebula"; };
+    log-driver = "journald";
+  };
+
+}

virtualization/podman-utils.nix

@@ -0,0 +1,45 @@
+{ pkgs, lib, config, ... }: {
+  virtualisation = {
+    containers.enable = true;
+    oci-containers.backend = "podman";
+    podman = {
+      enable = true;
+      autoPrune = {
+        enable = true;
+        flags = [ "--all" "--filter 'until=24h'" "--force" ];
+      };
+      dockerCompat = true;
+    };
+  };
+
+  networking.firewall.interfaces = let
+    matchAll =
+      if !config.networking.nftables.enable then "podman+" else "podman*";
+  in { "${matchAll}".allowedUDPPorts = [ 53 ]; };
+
+  # If you want to trigger this service manually, run sudo systemctl restart update-containers.service.
+  systemd.services.updatecontainers = {
+    serviceConfig = {
+      Type = "oneshot";
+      User = "portainer";
+      ExecStart = lib.getExe (pkgs.writeShellScriptBin "update-containers" ''
+        images=$(${pkgs.podman}/bin/podman ps -a --format="{{.Image}}" | sort -u)
+
+        for image in $images; do
+          ${pkgs.podman}/bin/podman pull "$image"
+        done
+      '');
+    };
+  };
+
+  systemd.user.timers = {
+    updatecontainers = {
+      unitConfig.ConditionUser = "portainer";
+      timerConfig = {
+        Unit = "updatecontainers.service";
+        OnCalendar = "Sun 02:03";
+      };
+      wantedBy = [ "timers.target" ];
+    };
+  };
+}

virtualization/portainer-old.nix

@@ -0,0 +1,77 @@
+# Auto-generated using compose2nix v0.3.2-pre.
+# nix run github:aksiksi/compose2nix -- -project=portainer -output=/home/shawnb/.dotfiles/virtualization/portainer-composer.nix
+{ pkgs, lib, config, ... }:
+
+{
+  # Create portainer user and add to docker group
+  users.users.portainer = {
+    isSystemUser = true;
+    group = "podman";
+    home = "/var/lib/portainer";
+    createHome = true;
+  };
+
+  # Containers
+  virtualisation.oci-containers.containers."portainer" = {
+    podman.user = "portainer";
+    image = "portainer/portainer-ce:lts";
+    volumes = [
+      "/var/run/docker.sock:/var/run/docker.sock:rw"
+      "portainer_portainer_data:/data:rw"
+    ];
+    ports = [ "8000:8000/tcp" "9443:9443/tcp" "9000:9000/tcp" ];
+    log-driver = "journald";
+    extraOptions =
+      [ "--network-alias=portainer" "--network=portainer_default" ];
+  };
+  systemd.services."podman-portainer" = {
+    serviceConfig = { Restart = lib.mkOverride 90 "always"; };
+    after = [
+      "podman-network-portainer_default.service"
+      "podman-volume-portainer_portainer_data.service"
+    ];
+    requires = [
+      "podman-network-portainer_default.service"
+      "podman-volume-portainer_portainer_data.service"
+    ];
+    partOf = [ "podman-compose-portainer-root.target" ];
+    wantedBy = [ "podman-compose-portainer-root.target" ];
+  };
+
+  # Networks
+  systemd.services."podman-network-portainer_default" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "podman network rm -f portainer_default";
+    };
+    script = ''
+      podman network inspect portainer_default || podman network create portainer_default
+    '';
+    partOf = [ "podman-compose-portainer-root.target" ];
+    wantedBy = [ "podman-compose-portainer-root.target" ];
+  };
+
+  # Volumes
+  systemd.services."podman-volume-portainer_portainer_data" = {
+    path = [ pkgs.podman ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      podman volume inspect portainer_portainer_data || podman volume create portainer_portainer_data
+    '';
+    partOf = [ "podman-compose-portainer-root.target" ];
+    wantedBy = [ "podman-compose-portainer-root.target" ];
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."podman-compose-portainer-root" = {
+    unitConfig = { Description = "Root target generated by compose2nix."; };
+    wantedBy = [ "multi-user.target" ];
+  };
+}

virtualization/portainer-quadlet.nix

@@ -0,0 +1,47 @@
+{
+  config,
+  inputs,
+  lib,
+  ...
+}:
+{
+  # to enable podman & podman systemd generator
+  virtualisation.quadlet.enable = true;
+  users.users.portainer = {
+    autoSubUidGidRange = true;
+    isSystemUser = true;
+    group = "podman";
+    home = "/var/lib/portainer";
+    linger = true;
+    createHome = true;
+  };
+  home-manager.users.portainer = { pkgs, config, ... }: {
+    imports = [ inputs.quadlet-nix.homeManagerModules.quadlet ];
+    virtualisation.quadlet.containers = {
+      portainer = {
+        autoStart = true;
+        serviceConfig = {
+          RestartSec = "10";
+          Restart = "always";
+          User = "portainer";
+        };
+        containerConfig = {
+          cgroupsMode = "disable";
+          image = "docker.io/portainer/portainer-ce:lts";
+          logDriver = "journald";
+          publishPorts = [
+            "0.0.0.0:8080:8080"
+            "0.0.0.0:9000:9000"
+            "0.0.0.0:9443:9443"
+          ];
+          userns = "keep-id";
+          volumes = [
+            "/var/run/docker.sock:/var/run/docker.sock:rw"
+            "portainer_portainer_data:/data:rw"
+          ];
+        };
+      };
+    };
+    home.stateVersion = "25.05";
+  };
+}

virtualization/portainer.nix

@@ -0,0 +1,81 @@
+{ pkgs, lib, config, ... }: {
+  users.users.portainer = {
+    autoSubUidGidRange = true;
+    isSystemUser = true;
+    group = "podman";
+    home = "/var/lib/portainer";
+    # linger = true;
+    createHome = true;
+  };
+
+  virtualisation.oci-containers.containers.portainer = {
+    autoStart = true;
+    image = "portainer/portainer-ce:lts";
+    #privileged = true;
+    volumes = [
+      #"/var/run/docker.sock:/var/run/docker.sock:rw"
+      "/run/podman/podman.sock:/var/run/docker.sock"
+      "portainer_portainer_data:/data:rw"
+    ];
+    ports = [ "8000:8000" "9443:9443" "9000:9000" ];
+    log-driver = "journald";
+    # extraOptions =
+    #   [ "--network-alias=portainer" "--network=portainer_default" ];
+    environment = {
+      PUID = "997";
+      PGID = "997";
+      TZ = "America/Chicago";
+    };
+  };
+
+#   systemd.services."podman-portainer" = {
+#     serviceConfig = { Restart = lib.mkOverride 90 "always"; };
+#     after = [
+#       "podman-network-portainer_default.service"
+#       "podman-volume-portainer_portainer_data.service"
+#     ];
+#     requires = [
+#       "podman-network-portainer_default.service"
+#       "podman-volume-portainer_portainer_data.service"
+#     ];
+#     partOf = [ "podman-compose-portainer-root.target" ];
+#     wantedBy = [ "podman-compose-portainer-root.target" ];
+#   };
+
+#   # Networks
+#   systemd.services."podman-network-portainer_default" = {
+#     path = [ pkgs.podman ];
+#     serviceConfig = {
+#       Type = "oneshot";
+#       RemainAfterExit = true;
+#       ExecStop = "podman network rm -f portainer_default";
+#     };
+#     script = ''
+#       podman network inspect portainer_default || podman network create portainer_default
+#     '';
+#     partOf = [ "podman-compose-portainer-root.target" ];
+#     wantedBy = [ "podman-compose-portainer-root.target" ];
+#   };
+
+#   # Volumes
+#   systemd.services."podman-volume-portainer_portainer_data" = {
+#     path = [ pkgs.podman ];
+#     serviceConfig = {
+#       Type = "oneshot";
+#       RemainAfterExit = true;
+#     };
+#     script = ''
+#       podman volume inspect portainer_portainer_data || podman volume create portainer_portainer_data
+#     '';
+#     partOf = [ "podman-compose-portainer-root.target" ];
+#     wantedBy = [ "podman-compose-portainer-root.target" ];
+#   };
+
+#   # Root service
+#   # When started, this will automatically create all resources and start
+#   # the containers. When stopped, this will teardown all resources.
+#   systemd.targets."podman-compose-portainer-root" = {
+#     unitConfig = { Description = "Root target generated by compose2nix."; };
+#     wantedBy = [ "multi-user.target" ];
+#   };
+}