45 lines
1.2 KiB
Nix
45 lines
1.2 KiB
Nix
{ pkgs, lib, config, ... }: {
|
|
virtualisation = {
|
|
containers.enable = true;
|
|
oci-containers.backend = "podman";
|
|
podman = {
|
|
enable = true;
|
|
autoPrune = {
|
|
enable = true;
|
|
flags = [ "--all" "--filter 'until=24h'" "--force" ];
|
|
};
|
|
dockerCompat = true;
|
|
};
|
|
};
|
|
|
|
networking.firewall.interfaces = let
|
|
matchAll =
|
|
if !config.networking.nftables.enable then "podman+" else "podman*";
|
|
in { "${matchAll}".allowedUDPPorts = [ 53 ]; };
|
|
|
|
# If you want to trigger this service manually, run sudo systemctl restart update-containers.service.
|
|
systemd.services.updatecontainers = {
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = "portainer";
|
|
ExecStart = lib.getExe (pkgs.writeShellScriptBin "update-containers" ''
|
|
images=$(${pkgs.podman}/bin/podman ps -a --format="{{.Image}}" | sort -u)
|
|
|
|
for image in $images; do
|
|
${pkgs.podman}/bin/podman pull "$image"
|
|
done
|
|
'');
|
|
};
|
|
};
|
|
|
|
systemd.user.timers = {
|
|
updatecontainers = {
|
|
unitConfig.ConditionUser = "portainer";
|
|
timerConfig = {
|
|
Unit = "updatecontainers.service";
|
|
OnCalendar = "Sun 02:03";
|
|
};
|
|
wantedBy = [ "timers.target" ];
|
|
};
|
|
};
|
|
}
|