Initial commit

virtualization/podman-utils.nix

@@ -0,0 +1,45 @@
+{ pkgs, lib, config, ... }: {
+  virtualisation = {
+    containers.enable = true;
+    oci-containers.backend = "podman";
+    podman = {
+      enable = true;
+      autoPrune = {
+        enable = true;
+        flags = [ "--all" "--filter 'until=24h'" "--force" ];
+      };
+      dockerCompat = true;
+    };
+  };
+
+  networking.firewall.interfaces = let
+    matchAll =
+      if !config.networking.nftables.enable then "podman+" else "podman*";
+  in { "${matchAll}".allowedUDPPorts = [ 53 ]; };
+
+  # If you want to trigger this service manually, run sudo systemctl restart update-containers.service.
+  systemd.services.updatecontainers = {
+    serviceConfig = {
+      Type = "oneshot";
+      User = "portainer";
+      ExecStart = lib.getExe (pkgs.writeShellScriptBin "update-containers" ''
+        images=$(${pkgs.podman}/bin/podman ps -a --format="{{.Image}}" | sort -u)
+
+        for image in $images; do
+          ${pkgs.podman}/bin/podman pull "$image"
+        done
+      '');
+    };
+  };
+
+  systemd.user.timers = {
+    updatecontainers = {
+      unitConfig.ConditionUser = "portainer";
+      timerConfig = {
+        Unit = "updatecontainers.service";
+        OnCalendar = "Sun 02:03";
+      };
+      wantedBy = [ "timers.target" ];
+    };
+  };
+}