Blunkall-Technologies/Olympus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

no sandbox

Browse Source
This commit is contained in:
Nathan
2025-12-31 16:18:29 -06:00
parent f34031285b
commit 112782fa91
3 changed files with 0 additions and 94 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
system/services/containers/default.nix
View File

@@ -20,6 +20,5 @@
./code-server ./code-server
./novnc ./novnc
./minecraft ./minecraft
./sandbox
]; ];
} }

4
system/services/containers/keycloak/default.nix
View File

@@ -5,10 +5,6 @@
default = false; default = false;
}; };
imports = [
inputs.sops-nix.nixosModules.sops
];
config = lib.mkIf config.sysconfig.virtualization.keycloak.enable { config = lib.mkIf config.sysconfig.virtualization.keycloak.enable {
sops.secrets."keycloak/dbpass" = {}; sops.secrets."keycloak/dbpass" = {};

89
system/services/containers/sandbox/default.nix
View File

@@ -1,89 +0,0 @@
{ config, lib, inputs, ... }: {
options.sysconfig.virtualization.sandbox.enable = lib.mkOption {
type = lib.types.bool;
default = false;
};
disabledModules = [
"virtualisation/nixos-containers.nix"
];
imports = [
(import "${inputs.nixpkgs-us}/nixos/modules/virtualisation/nixos-containers.nix" {
inherit config lib;
pkgs = (import inputs.nixpkgs-us {
system = "x86_64-linux";
});
})
];
config = lib.mkIf config.sysconfig.virtualization.sandbox.enable {
networking = {
nat.internalInterfaces = [ "ve-sandbox" ];
};
containers.sandbox = {
autoStart = true;
privateNetwork = true;
hostAddress = "192.168.100.10";
localAddress = "192.168.100.32";
ephemeral = true;
timeoutStartSec = "3min";
flake = "${inputs.self}";
bindMounts = {
"/dev/nvidia0" = {
hostPath = "/dev/nvidia0";
isReadOnly = false;
};
"/dev/nvidiactl" = {
hostPath = "/dev/nvidiactl";
isReadOnly = false;
};
"/dev/nvidia-uvm" = {
hostPath = "/dev/nvidia-uvm";
isReadOnly = false;
};
"/dev/nvidia-modeset" = {
hostPath = "/dev/nvidia-modeset";
isReadOnly = false;
};
"/dev/nvidia-uvm-tools" = {
hostPath = "/dev/nvidia-uvm-tools";
isReadOnly = false;
};
};
allowedDevices = [
{
node = "/dev/nvidia0";
modifier = "rw";
}
{
node = "/dev/nvidiactl";
modifier = "rw";
}
{
node = "/dev/nvidia-uvm";
modifier = "rw";
}
{
node = "/dev/nvidia-modeset";
modifier = "rw";
}
{
node = "/dev/nvidia-uvm-tools";
modifier = "rw";
}
];
};
};
}