Blunkall-Technologies/Olympus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

back to compose

Browse Source
This commit is contained in:
Nathan
2024-11-21 20:32:36 -06:00
parent e127cd0c0a
commit 7f72059966
6 changed files with 217 additions and 218 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
flake.lock generated
View File

@@ -1210,11 +1210,11 @@
"locked": { "locked": {
"lastModified": 1, "lastModified": 1,
"narHash": "sha256-Hripi5dnBGegbRPwCt1+a3oH6b1AQxEoJXodiLE8KKw=", "narHash": "sha256-Hripi5dnBGegbRPwCt1+a3oH6b1AQxEoJXodiLE8KKw=",
"path": "/nix/store/32h16ywb0xb37hvimz74apw471i7c7jq-source/home-manager", "path": "/nix/store/c03d0p3h8ip9fsk8c48m8saawwyl9skk-source/home-manager",
"type": "path" "type": "path"
}, },
"original": { "original": {
"path": "/nix/store/32h16ywb0xb37hvimz74apw471i7c7jq-source/home-manager", "path": "/nix/store/c03d0p3h8ip9fsk8c48m8saawwyl9skk-source/home-manager",
"type": "path" "type": "path"
} }
}, },
@@ -1766,11 +1766,11 @@
"locked": { "locked": {
"lastModified": 1, "lastModified": 1,
"narHash": "sha256-QahOuoQdXshu38W5uO7hLhG/yFkT7S2l8Dxicq0wdGk=", "narHash": "sha256-QahOuoQdXshu38W5uO7hLhG/yFkT7S2l8Dxicq0wdGk=",
"path": "/nix/store/2k345pz1g04x3zhhqdh4pbn81zsaiijn-source/programs", "path": "/nix/store/51g3y0jm8d2gb5v3qsx2qybyxfn2hgvm-source/programs",
"type": "path" "type": "path"
}, },
"original": { "original": {
"path": "/nix/store/2k345pz1g04x3zhhqdh4pbn81zsaiijn-source/programs", "path": "/nix/store/51g3y0jm8d2gb5v3qsx2qybyxfn2hgvm-source/programs",
"type": "path" "type": "path"
} }
}, },
@@ -1838,11 +1838,11 @@
"locked": { "locked": {
"lastModified": 1, "lastModified": 1,
"narHash": "sha256-0Ztx5DVQ2I7hvCK/qjGa4XTdRgbzM8rhf19m0al8lVM=", "narHash": "sha256-0Ztx5DVQ2I7hvCK/qjGa4XTdRgbzM8rhf19m0al8lVM=",
"path": "/nix/store/2k345pz1g04x3zhhqdh4pbn81zsaiijn-source/services/sddm", "path": "/nix/store/51g3y0jm8d2gb5v3qsx2qybyxfn2hgvm-source/services/sddm",
"type": "path" "type": "path"
}, },
"original": { "original": {
"path": "/nix/store/2k345pz1g04x3zhhqdh4pbn81zsaiijn-source/services/sddm", "path": "/nix/store/51g3y0jm8d2gb5v3qsx2qybyxfn2hgvm-source/services/sddm",
"type": "path" "type": "path"
} }
}, },
@@ -1873,12 +1873,12 @@
}, },
"locked": { "locked": {
"lastModified": 1, "lastModified": 1,
"narHash": "sha256-VI/PphvaiElKATCFaBzInEqU7WnoCmItIy8wfzcD9U8=", "narHash": "sha256-E9AQdp838eaLX++tzBDDN7d6nrfuLaasX03PtLUurN8=",
"path": "/nix/store/32h16ywb0xb37hvimz74apw471i7c7jq-source/system-config", "path": "/nix/store/c03d0p3h8ip9fsk8c48m8saawwyl9skk-source/system-config",
"type": "path" "type": "path"
}, },
"original": { "original": {
"path": "/nix/store/32h16ywb0xb37hvimz74apw471i7c7jq-source/system-config", "path": "/nix/store/c03d0p3h8ip9fsk8c48m8saawwyl9skk-source/system-config",
"type": "path" "type": "path"
} }
}, },

3
system-config/configuration/homebox/default.nix
View File

@@ -132,7 +132,6 @@
docker-compose docker-compose
]; ];
#virtualisation.oci-containers.backend = "podman";
boot.initrd.postDeviceCommands = lib.mkAfter '' boot.initrd.postDeviceCommands = lib.mkAfter ''
mkdir /btrfs_tmp mkdir /btrfs_tmp
@@ -194,8 +193,6 @@
"authentik/pass" = {}; "authentik/pass" = {};
"authentik/secret_key" = {}; "authentik/secret_key" = {};
"pihole/pass" = {};
"nextcloud/pass" = {}; "nextcloud/pass" = {};
}; };
}; };

31
system-config/services/containers/authentik-nix/default.nix
View File

@@ -5,20 +5,23 @@
default = false; default = false;
}; };
config = lib.mkIf config.sysconfig.opts.virtualization.authentik.enable (lib.mkMerge [ imports = [
./docker-compose.nix
];
(import ./docker-compose.nix) config = lib.mkIf config.sysconfig.opts.virtualization.authentik.enable {
{ sops.templates."authentik.env" = {
sops.templates."authentik.env" = { content = ''
content = '' POSTGRES_DB=authentik-db
POSTGRES_DB=authentik-db POSTGRES_USER=authentik-admin
POSTGRES_USER=authentik-admin POSTGRES_PASSWORD=${config.sops.placeholder."authentik/pass"}
POSTGRES_PASSWORD=${config.sops.placeholder."authentik/pass"} AUTHENTIK_SECRET_KEY=${config.sops.placeholder."authentik/secret_key"}
AUTHENTIK_SECRET_KEY=${config.sops.placeholder."authentik/secret_key"} AUTHENTIK_POSTGRESQL__NAME=authentik-db
''; AUTHENTIK_POSTGRESQL__USER=authentik-admin
AUTHENTIK_POSTGRESQL__PASSWORD=${config.sops.placeholder."authentik/pass"}
'';
path = "/ssd1/Authentik/.env"; path = "/ssd1/Authentik/.env";
}; };
} };
]);
} }

128
system-config/services/containers/authentik-nix/docker-compose.nix
View File

@@ -3,28 +3,17 @@
{ {
# Runtime # Runtime
virtualisation.podman = { virtualisation.docker = {
enable = true; enable = true;
autoPrune.enable = true; autoPrune.enable = true;
dockerCompat = true;
defaultNetwork.settings = {
# Required for container networking to be able to use names.
dns_enabled = true;
};
}; };
virtualisation.oci-containers.backend = "docker";
# Enable container name DNS for non-default Podman networks.
# https://github.com/NixOS/nixpkgs/issues/226365
networking.firewall.interfaces."podman+".allowedUDPPorts = [ 53 ];
virtualisation.oci-containers.backend = "podman";
# Containers # Containers
virtualisation.oci-containers.containers."authentik-postgresql" = { virtualisation.oci-containers.containers."authentik-postgresql" = {
image = "docker.io/library/postgres:16-alpine"; image = "docker.io/library/postgres:16-alpine";
environmentFiles = [
"/ssd1/Authentik/.env" environmentFiles = [ "/ssd1/Authentik/.env" ];
];
volumes = [ volumes = [
"authentik_database:/var/lib/postgresql/data:rw" "authentik_database:/var/lib/postgresql/data:rw"
]; ];
@@ -39,23 +28,26 @@
"--network=authentik_backend" "--network=authentik_backend"
]; ];
}; };
systemd.services."podman-authentik-postgresql" = { systemd.services."docker-authentik-postgresql" = {
serviceConfig = { serviceConfig = {
Restart = lib.mkOverride 90 "always"; Restart = lib.mkOverride 90 "always";
RestartMaxDelaySec = lib.mkOverride 90 "1m";
RestartSec = lib.mkOverride 90 "100ms";
RestartSteps = lib.mkOverride 90 9;
}; };
after = [ after = [
"podman-network-authentik_backend.service" "docker-network-authentik_backend.service"
"podman-volume-authentik_database.service" "docker-volume-authentik_database.service"
]; ];
requires = [ requires = [
"podman-network-authentik_backend.service" "docker-network-authentik_backend.service"
"podman-volume-authentik_database.service" "docker-volume-authentik_database.service"
]; ];
partOf = [ partOf = [
"podman-compose-authentik-root.target" "docker-compose-authentik-root.target"
]; ];
wantedBy = [ wantedBy = [
"podman-compose-authentik-root.target" "docker-compose-authentik-root.target"
]; ];
}; };
virtualisation.oci-containers.containers."authentik-redis" = { virtualisation.oci-containers.containers."authentik-redis" = {
@@ -75,36 +67,35 @@
"--network=authentik_backend" "--network=authentik_backend"
]; ];
}; };
systemd.services."podman-authentik-redis" = { systemd.services."docker-authentik-redis" = {
serviceConfig = { serviceConfig = {
Restart = lib.mkOverride 90 "always"; Restart = lib.mkOverride 90 "always";
RestartMaxDelaySec = lib.mkOverride 90 "1m";
RestartSec = lib.mkOverride 90 "100ms";
RestartSteps = lib.mkOverride 90 9;
}; };
after = [ after = [
"podman-network-authentik_backend.service" "docker-network-authentik_backend.service"
"podman-volume-authentik_redis.service" "docker-volume-authentik_redis.service"
]; ];
requires = [ requires = [
"podman-network-authentik_backend.service" "docker-network-authentik_backend.service"
"podman-volume-authentik_redis.service" "docker-volume-authentik_redis.service"
]; ];
partOf = [ partOf = [
"podman-compose-authentik-root.target" "docker-compose-authentik-root.target"
]; ];
wantedBy = [ wantedBy = [
"podman-compose-authentik-root.target" "docker-compose-authentik-root.target"
]; ];
}; };
virtualisation.oci-containers.containers."authentik-server" = { virtualisation.oci-containers.containers."authentik-server" = {
image = "ghcr.io/goauthentik/server:2024.10.2"; image = "ghcr.io/goauthentik/server:2024.10.4";
environment = { environment = {
"AUTHENTIK_ERROR_REPORTING__ENABLED" = "true"; "AUTHENTIK_ERROR_REPORTING__ENABLED" = "true";
"AUTHENTIK_POSTGRESQL__HOST" = "postgresql";
"AUTHENTIK_POSTGRESQL__NAME" = "";
"AUTHENTIK_POSTGRESQL__PASSWORD" = "";
"AUTHENTIK_POSTGRESQL__USER" = "";
"AUTHENTIK_REDIS__HOST" = "redis"; "AUTHENTIK_REDIS__HOST" = "redis";
"AUTHENTIK_SECRET_KEY" = "";
}; };
environmentFiles = [ "/ssd1/Authentik/.env" ];
volumes = [ volumes = [
"/ssd1/Authentik/custom-templates:/templates:rw" "/ssd1/Authentik/custom-templates:/templates:rw"
"/ssd1/Authentik/media:/media:rw" "/ssd1/Authentik/media:/media:rw"
@@ -124,34 +115,34 @@
"--network=authentik_backend" "--network=authentik_backend"
]; ];
}; };
systemd.services."podman-authentik-server" = { systemd.services."docker-authentik-server" = {
serviceConfig = { serviceConfig = {
Restart = lib.mkOverride 90 "always"; Restart = lib.mkOverride 90 "always";
RestartMaxDelaySec = lib.mkOverride 90 "1m";
RestartSec = lib.mkOverride 90 "100ms";
RestartSteps = lib.mkOverride 90 9;
}; };
after = [ after = [
"podman-network-authentik_backend.service" "docker-network-authentik_backend.service"
]; ];
requires = [ requires = [
"podman-network-authentik_backend.service" "docker-network-authentik_backend.service"
]; ];
partOf = [ partOf = [
"podman-compose-authentik-root.target" "docker-compose-authentik-root.target"
]; ];
wantedBy = [ wantedBy = [
"podman-compose-authentik-root.target" "docker-compose-authentik-root.target"
]; ];
}; };
virtualisation.oci-containers.containers."authentik-worker" = { virtualisation.oci-containers.containers."authentik-worker" = {
image = "ghcr.io/goauthentik/server:2024.10.2"; image = "ghcr.io/goauthentik/server:2024.10.4";
environment = { environment = {
"AUTHENTIK_ERROR_REPORTING__ENABLED" = "true"; "AUTHENTIK_ERROR_REPORTING__ENABLED" = "true";
"AUTHENTIK_POSTGRESQL__HOST" = "postgresql"; "AUTHENTIK_POSTGRESQL__HOST" = "postgresql";
"AUTHENTIK_POSTGRESQL__NAME" = "";
"AUTHENTIK_POSTGRESQL__PASSWORD" = "";
"AUTHENTIK_POSTGRESQL__USER" = "";
"AUTHENTIK_REDIS__HOST" = "redis"; "AUTHENTIK_REDIS__HOST" = "redis";
"AUTHENTIK_SECRET_KEY" = "";
}; };
environmentFiles = [ "/ssd1/Authentik/.env" ];
volumes = [ volumes = [
"/ssd1/Authentik/certs:/certs:rw" "/ssd1/Authentik/certs:/certs:rw"
"/ssd1/Authentik/custom-templates:/templates:rw" "/ssd1/Authentik/custom-templates:/templates:rw"
@@ -170,69 +161,72 @@
"--network=authentik_backend" "--network=authentik_backend"
]; ];
}; };
systemd.services."podman-authentik-worker" = { systemd.services."docker-authentik-worker" = {
serviceConfig = { serviceConfig = {
Restart = lib.mkOverride 90 "always"; Restart = lib.mkOverride 90 "always";
RestartMaxDelaySec = lib.mkOverride 90 "1m";
RestartSec = lib.mkOverride 90 "100ms";
RestartSteps = lib.mkOverride 90 9;
}; };
after = [ after = [
"podman-network-authentik_backend.service" "docker-network-authentik_backend.service"
]; ];
requires = [ requires = [
"podman-network-authentik_backend.service" "docker-network-authentik_backend.service"
]; ];
partOf = [ partOf = [
"podman-compose-authentik-root.target" "docker-compose-authentik-root.target"
]; ];
wantedBy = [ wantedBy = [
"podman-compose-authentik-root.target" "docker-compose-authentik-root.target"
]; ];
}; };
# Networks # Networks
systemd.services."podman-network-authentik_backend" = { systemd.services."docker-network-authentik_backend" = {
path = [ pkgs.podman ]; path = [ pkgs.docker ];
serviceConfig = { serviceConfig = {
Type = "oneshot"; Type = "oneshot";
RemainAfterExit = true; RemainAfterExit = true;
ExecStop = "podman network rm -f authentik_backend"; ExecStop = "docker network rm -f authentik_backend";
}; };
script = '' script = ''
podman network inspect authentik_backend || podman network create authentik_backend docker network inspect authentik_backend || docker network create authentik_backend
''; '';
partOf = [ "podman-compose-authentik-root.target" ]; partOf = [ "docker-compose-authentik-root.target" ];
wantedBy = [ "podman-compose-authentik-root.target" ]; wantedBy = [ "docker-compose-authentik-root.target" ];
}; };
# Volumes # Volumes
systemd.services."podman-volume-authentik_database" = { systemd.services."docker-volume-authentik_database" = {
path = [ pkgs.podman ]; path = [ pkgs.docker ];
serviceConfig = { serviceConfig = {
Type = "oneshot"; Type = "oneshot";
RemainAfterExit = true; RemainAfterExit = true;
}; };
script = '' script = ''
podman volume inspect authentik_database || podman volume create authentik_database --driver=local docker volume inspect authentik_database || docker volume create authentik_database --driver=local
''; '';
partOf = [ "podman-compose-authentik-root.target" ]; partOf = [ "docker-compose-authentik-root.target" ];
wantedBy = [ "podman-compose-authentik-root.target" ]; wantedBy = [ "docker-compose-authentik-root.target" ];
}; };
systemd.services."podman-volume-authentik_redis" = { systemd.services."docker-volume-authentik_redis" = {
path = [ pkgs.podman ]; path = [ pkgs.docker ];
serviceConfig = { serviceConfig = {
Type = "oneshot"; Type = "oneshot";
RemainAfterExit = true; RemainAfterExit = true;
}; };
script = '' script = ''
podman volume inspect authentik_redis || podman volume create authentik_redis --driver=local docker volume inspect authentik_redis || docker volume create authentik_redis --driver=local
''; '';
partOf = [ "podman-compose-authentik-root.target" ]; partOf = [ "docker-compose-authentik-root.target" ];
wantedBy = [ "podman-compose-authentik-root.target" ]; wantedBy = [ "docker-compose-authentik-root.target" ];
}; };
# Root service # Root service
# When started, this will automatically create all resources and start # When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources. # the containers. When stopped, this will teardown all resources.
systemd.targets."podman-compose-authentik-root" = { systemd.targets."docker-compose-authentik-root" = {
unitConfig = { unitConfig = {
Description = "Root target generated by compose2nix."; Description = "Root target generated by compose2nix.";
}; };

25
system-config/services/containers/pihole/default.nix
View File

@@ -5,17 +5,20 @@
default = false; default = false;
}; };
config = lib.mkIf config.sysconfig.opts.virtualization.pihole.enable (lib.mkMerge [ imports = [
./docker-compose.nix
];
(import ./docker-compose.nix) config = lib.mkIf config.sysconfig.opts.virtualization.pihole.enable {
{ sops.secrets."pihole/pass" = {};
sops.templates."pihole.env" = {
content = '' sops.templates."pihole.env" = {
WEBPASSWORD=${config.sops.placeholder."pihole/pass"} content = ''
''; WEBPASSWORD=${config.sops.placeholder."pihole/pass"}
'';
path = "/ssd1/Pihole/.env";
};
};
path = "/ssd1/Pihole/.env";
};
}
]);
} }

228
system-config/services/containers/pihole/docker-compose.nix
View File

@@ -1,123 +1,125 @@
# Auto-generated using compose2nix v0.3.2-pre. # Auto-generated using compose2nix v0.3.2-pre.
{ pkgs, lib, ... }: { config, pkgs, lib, ... }:
{ {
# Runtime config = lib.mkIf config.sysconfig.opts.virtualization.pihole.enable {
virtualisation.podman = { # Runtime
enable = true; virtualisation.podman = {
autoPrune.enable = true; enable = true;
dockerCompat = true; autoPrune.enable = true;
defaultNetwork.settings = { dockerCompat = true;
# Required for container networking to be able to use names. defaultNetwork.settings = {
dns_enabled = true; # Required for container networking to be able to use names.
}; dns_enabled = true;
}; };
};
# Enable container name DNS for non-default Podman networks. # Enable container name DNS for non-default Podman networks.
# https://github.com/NixOS/nixpkgs/issues/226365 # https://github.com/NixOS/nixpkgs/issues/226365
networking.firewall.interfaces."podman+".allowedUDPPorts = [ 53 ]; networking.firewall.interfaces."podman+".allowedUDPPorts = [ 53 ];
virtualisation.oci-containers.backend = "podman"; virtualisation.oci-containers.backend = "podman";
# Containers # Containers
virtualisation.oci-containers.containers."pihole" = { virtualisation.oci-containers.containers."pihole" = {
image = "pihole/pihole:latest"; image = "pihole/pihole:latest";
environment = { environment = {
"PIHOLE_DNS" = "'192.168.101.2#5335'"; "PIHOLE_DNS" = "'192.169.101.2#5335'";
"TZ" = "'America/Chicago'"; "TZ" = "'America/Chicago'";
}; };
environmentFiles = [ environmentFiles = [
"/ssd1/Pihole/.env" "/ssd1/Pihole/.env"
]; ];
volumes = [ volumes = [
"/ssd1/Pihole/etc-dnsmasq.d:/etc/dnsmasq.d:rw" "/ssd1/Pihole/etc-dnsmasq.d:/etc/dnsmasq.d:rw"
"/ssd1/Pihole/etc-pihole:/etc/pihole:rw" "/ssd1/Pihole/etc-pihole:/etc/pihole:rw"
]; ];
ports = [ ports = [
"53:53/tcp" "53:53/tcp"
"53:53/udp" "53:53/udp"
"8080:80/tcp" "8080:80/tcp"
]; ];
log-driver = "journald"; log-driver = "journald";
extraOptions = [ extraOptions = [
"--ip=192.168.101.1" "--ip=192.169.101.1"
"--network-alias=pihole" "--network-alias=pihole"
"--network=pihole_dns_net" "--network=pihole_dns_net"
]; ];
}; };
systemd.services."podman-pihole" = { systemd.services."podman-pihole" = {
serviceConfig = { serviceConfig = {
Restart = lib.mkOverride 90 "always"; Restart = lib.mkOverride 90 "always";
}; };
after = [ after = [
"podman-network-pihole_dns_net.service" "podman-network-pihole_dns_net.service"
]; ];
requires = [ requires = [
"podman-network-pihole_dns_net.service" "podman-network-pihole_dns_net.service"
]; ];
partOf = [ partOf = [
"podman-compose-pihole-root.target" "podman-compose-pihole-root.target"
]; ];
wantedBy = [ wantedBy = [
"podman-compose-pihole-root.target" "podman-compose-pihole-root.target"
]; ];
}; };
virtualisation.oci-containers.containers."unbound" = { virtualisation.oci-containers.containers."unbound" = {
image = "mvance/unbound:latest"; image = "mvance/unbound:latest";
volumes = [ volumes = [
"/ssd1/Pihole/unbound:/opt/unbound/etc/unbound:rw" "/ssd1/Pihole/unbound:/opt/unbound/etc/unbound:rw"
]; ];
ports = [ ports = [
"5335:53/tcp" "5335:53/tcp"
"5335:53/udp" "5335:53/udp"
]; ];
log-driver = "journald"; log-driver = "journald";
extraOptions = [ extraOptions = [
"--ip=192.168.101.2" "--ip=192.169.101.2"
"--network-alias=unbound" "--network-alias=unbound"
"--network=pihole_dns_net" "--network=pihole_dns_net"
]; ];
}; };
systemd.services."podman-unbound" = { systemd.services."podman-unbound" = {
serviceConfig = { serviceConfig = {
Restart = lib.mkOverride 90 "always"; Restart = lib.mkOverride 90 "always";
}; };
after = [ after = [
"podman-network-pihole_dns_net.service" "podman-network-pihole_dns_net.service"
]; ];
requires = [ requires = [
"podman-network-pihole_dns_net.service" "podman-network-pihole_dns_net.service"
]; ];
partOf = [ partOf = [
"podman-compose-pihole-root.target" "podman-compose-pihole-root.target"
]; ];
wantedBy = [ wantedBy = [
"podman-compose-pihole-root.target" "podman-compose-pihole-root.target"
]; ];
}; };
# Networks # Networks
systemd.services."podman-network-pihole_dns_net" = { systemd.services."podman-network-pihole_dns_net" = {
path = [ pkgs.podman ]; path = [ pkgs.podman ];
serviceConfig = { serviceConfig = {
Type = "oneshot"; Type = "oneshot";
RemainAfterExit = true; RemainAfterExit = true;
ExecStop = "podman network rm -f pihole_dns_net"; ExecStop = "podman network rm -f pihole_dns_net";
}; };
script = '' script = ''
podman network inspect pihole_dns_net || podman network create pihole_dns_net --driver=bridge --subnet=192.168.0.0/16 podman network inspect pihole_dns_net || podman network create pihole_dns_net --driver=bridge --subnet=192.169.0.0/16
''; '';
partOf = [ "podman-compose-pihole-root.target" ]; partOf = [ "podman-compose-pihole-root.target" ];
wantedBy = [ "podman-compose-pihole-root.target" ]; wantedBy = [ "podman-compose-pihole-root.target" ];
}; };
# Root service # Root service
# When started, this will automatically create all resources and start # When started, this will automatically create all resources and start
# the containers. When stopped, this will teardown all resources. # the containers. When stopped, this will teardown all resources.
systemd.targets."podman-compose-pihole-root" = { systemd.targets."podman-compose-pihole-root" = {
unitConfig = { unitConfig = {
Description = "Root target generated by compose2nix."; Description = "Root target generated by compose2nix.";
};
wantedBy = [ "multi-user.target" ];
};
}; };
wantedBy = [ "multi-user.target" ];
};
} }