sora/nixconfig
1
0
Fork 1
Code Issues 2 Pull Requests Actions Releases Activity

container builder

Browse Source
This commit is contained in:
soraefir
2026-05-06 23:28:49 +02:00
parent 1c0cfd1afe
commit 093497367a
3 changed files with 66 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
modules/server/containers/builder.nix Normal file
View File

@@ -0,0 +1,28 @@
{ config, lib, serverCfg }:
{ image, secret ? ""
, subdomain ? "", ip ? "", port ? 0
, extraEnv ? { }, extraLabels ? { }
, overrides ? { }
}:
let base = {
inherit image;
environmentFiles = if secret !="" then [ config.sops.secrets."${lib.toUpper secret}".path ] else [];
environment = {} // extraEnv;
labels = if subdomain!="" then ({
"traefik.enable" = "true";
"traefik.http.routers.${subdomain}.entrypoints" = "web-secure";
"traefik.http.routers.${subdomain}.rule" = "Host(`${subdomain}.${serverCfg.hostDomain}`)";
"traefik.http.routers.${subdomain}.tls" = "true";
} // lib.optionalAttrs (port != 0) {
"traefik.http.services.${subdomain}.loadbalancer.server.port" = toString port;
}) else {
"traefik.enable" = "false";
} // extraLabels;
extraOptions = [
"--add-host=host.containers.internal:host-gateway"
] ++ lib.optional (ip != "") "--ip=${ip}";
};
in lib.recursiveUpdate base overrides // { host = "host.containers.internal"; }

3
modules/server/containers/default.nix
View File

@@ -1,9 +1,10 @@
{ config, pkgs, lib, ... }: { config, pkgs, lib, ... }:
let let
mkContainer = import ./mkContainer.nix { inherit config lib serverCfg; };
cfg = config.syscfg.server.containers; cfg = config.syscfg.server.containers;
enabledConfigs = lib.filterAttrs (name: c: c.enable) cfg; enabledConfigs = lib.filterAttrs (name: c: c.enable) cfg;
containerSetsList = lib.mapAttrsToList (name: containerCfg: containerSetsList = lib.mapAttrsToList (name: containerCfg:
let defs = import (./defs + "/${name}.nix") {inherit config pkgs lib containerCfg;}; let defs = import (./defs + "/${name}.nix") {inherit config pkgs lib containerCfg mkContainer;};
in{ in{
containers = lib.mapAttrs' (cName: cValue: containers = lib.mapAttrs' (cName: cValue:
lib.nameValuePair "${name}-${cName}" cValue lib.nameValuePair "${name}-${cName}" cValue

71
modules/server/containers/defs/authentik.nix
View File

@@ -1,4 +1,4 @@
{ config, containerCfg, pkgs, lib, ... }: { config, containerCfg, pkgs, lib, mkContainer, ... }:
let let
serverCfg = config.syscfg.server; serverCfg = config.syscfg.server;
in { in {
@@ -14,21 +14,18 @@ in {
containers = { containers = {
server = { server = mkContainer {
subdomain = "sso";
image = "ghcr.io/goauthentik/server:latest"; image = "ghcr.io/goauthentik/server:latest";
volumes = [ port = containerCfg.port;
"${serverCfg.dataPath}/authentik/media:/media" ip = containerCfg.ip;
"${serverCfg.dataPath}/authentik/templates:/templates" secret = "authentik";
]; extraEnv = {
environmentFiles = [ "AUTHENTIK_REDIS__HOST" = mkContainer.host;
config.sops.secrets."AUTHENTIK".path "AUTHENTIK_POSTGRESQL__HOST" = mkContainer.host;
];
environment = {
"AUTHENTIK_REDIS__HOST" = "host.containers.internal";
"AUTHENTIK_POSTGRESQL__HOST" = "host.containers.internal";
"AUTHENTIK_POSTGRESQL__USER" = "authentik_user"; "AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
"AUTHENTIK_POSTGRESQL__NAME" = "authentik_db"; "AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
"AUTHENTIK_EMAIL__HOST" = "${serverCfg.mailDomain}"; "AUTHENTIK_EMAIL__HOST" = serverCfg.mailDomain;
"AUTHENTIK_EMAIL__PORT" = "587"; "AUTHENTIK_EMAIL__PORT" = "587";
"AUTHENTIK_EMAIL__USERNAME" = "noreply@${serverCfg.hostDomain}"; "AUTHENTIK_EMAIL__USERNAME" = "noreply@${serverCfg.hostDomain}";
"AUTHENTIK_EMAIL__USE_TLS" = "true"; "AUTHENTIK_EMAIL__USE_TLS" = "true";
@@ -36,43 +33,39 @@ in {
"AUTHENTIK_EMAIL__TIMEOUT" = "10"; "AUTHENTIK_EMAIL__TIMEOUT" = "10";
"AUTHENTIK_EMAIL__FROM" = "sso@noreply.${serverCfg.hostDomain}"; "AUTHENTIK_EMAIL__FROM" = "sso@noreply.${serverCfg.hostDomain}";
}; };
labels = {
"traefik.enable" = "true"; overrides = {
"traefik.http.routers.sso.entrypoints" = "web-secure";
"traefik.http.routers.sso.rule" = "Host(`sso.${serverCfg.hostDomain}`)";
"traefik.http.routers.sso.tls" = "true";
"traefik.http.services.sso.loadbalancer.server.port" = "${toString containerCfg.port}";
};
cmd = [ "server" ]; cmd = [ "server" ];
extraOptions = [ ports = [ "9999:${toString containerCfg.port}" ];
"--add-host=host.containers.internal:host-gateway" volumes = [
"--ip=${containerCfg.ip}" "${serverCfg.dataPath}/authentik/media:/media"
]; "${serverCfg.dataPath}/authentik/templates:/templates"
ports = [
"9999:${toString containerCfg.port}"
]; ];
}; };
};
worker = { worker = mkContainer {
subdomain = "sso";
image = "ghcr.io/goauthentik/server:latest"; image = "ghcr.io/goauthentik/server:latest";
port = containerCfg.port;
ip = containerCfg.ip;
secret = "authentik";
extraEnv = {
"AUTHENTIK_REDIS__HOST" = mkContainer.host;
"AUTHENTIK_POSTGRESQL__HOST" = mkContainer.host;
"AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
"AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
};
overrides = {
cmd = [ "worker" ];
ports = [ "9999:${toString containerCfg.port}" ];
volumes = [ volumes = [
"${serverCfg.dataPath}/authentik/media:/media" "${serverCfg.dataPath}/authentik/media:/media"
"${serverCfg.dataPath}/authentik/templates:/templates" "${serverCfg.dataPath}/authentik/templates:/templates"
"/var/run/docker.sock:/var/run/docker.sock" "/var/run/docker.sock:/var/run/docker.sock"
]; ];
environmentFiles = [
config.sops.secrets."AUTHENTIK".path
];
environment = {
"AUTHENTIK_REDIS__HOST" = "host.containers.internal";
"AUTHENTIK_POSTGRESQL__HOST" = "host.containers.internal";
"AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
"AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
}; };
extraOptions = [
"--add-host=host.containers.internal:host-gateway"
];
cmd = [ "worker" ];
}; };
}; };
} }