sora/nixconfig
1
0
Fork 1
Code Issues 2 Pull Requests Actions Releases Activity

Improvements to server

Browse Source
This commit is contained in:
soraefir
2026-05-06 22:48:09 +02:00
parent d73bbd8b18
commit c457867440
6 changed files with 85 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
modules/server/containers/default.nix
View File

@@ -8,6 +8,7 @@ let
}
) enabledConfigs;
mergedContainers = lib.attrsets.mergeAttrsList (lib.map(e: e.containers) containerSetsList);
allPathConfigs = lib.flatten (lib.map (e: e.paths or []) containerSetsList);
in
{
config = lib.mkIf ( enabledConfigs != {} ) {
@@ -17,5 +18,23 @@ in
containers = mergedContainers;
};
systemd.services.podman-gc = {
description = "Podman garbage collection";
serviceConfig.Type = "oneshot";
script = ''
${pkgs.podman}/bin/podman container prune -f
${pkgs.podman}/bin/podman image prune -f
'';
startAt = "weekly";
};
system.activationScripts.container-setup-dirs = {
deps = [ "users" "groups" ];
text = lib.concatStringsSep "\n" (map (cfg: ''
mkdir -p "${cfg.path}"
chown ${cfg.owner} "${cfg.path}"
chmod ${cfg.mode} "${cfg.path}"
'') allPathConfigs);
};
};
}

29
modules/server/containers/defs/authentik.nix
View File

@@ -1,10 +1,17 @@
{ config, containerCfg, pkgs, lib, ... }:
let serverCfg = config.syscfg.server;
let
serverCfg = config.syscfg.server;
in {
systemd.tmfiles.rules = [
"d ${serverCfg.dataPath}/authentik/media 0755 root root -"
"d ${serverCfg.dataPath}/authentik/template 0755 root root -"
];
paths = [{
path="${serverCfg.dataPath}/authentik/media";
owner = "1000:1000";
mode = "0755";
}{
path="${serverCfg.dataPath}/authentik/templates";
owner = "1000:1000";
mode = "0755";
}];
containers = {
auth_server = {
@@ -18,7 +25,8 @@ in {
config.sops.secrets."AUTHENTIK".path
];
environment = {
"AUTHENTIK_POSTGRESQL__HOST" = "10.88.0.1";
"AUTHENTIK_REDIS__HOST" = "host.containers.internal";
"AUTHENTIK_POSTGRESQL__HOST" = "host.containers.internal";
"AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
"AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
"AUTHENTIK_EMAIL__HOST" = "${serverCfg.mailDomain}";
@@ -38,6 +46,9 @@ in {
};
cmd = [ "server" ];
extraOptions = [
"--add-host=host.containers.internal:host-gateway"
"--replace"
"--rm"
"--ip=${containerCfg.ip}"
];
ports = [
@@ -57,11 +68,15 @@ in {
config.sops.secrets."AUTHENTIK".path
];
environment = {
"AUTHENTIK_POSTGRESQL__HOST" = "10.88.0.1";
"AUTHENTIK_REDIS__HOST" = "host.containers.internal";
"AUTHENTIK_POSTGRESQL__HOST" = "host.containers.internal";
"AUTHENTIK_POSTGRESQL__USER" = "authentik_user";
"AUTHENTIK_POSTGRESQL__NAME" = "authentik_db";
};
extraOptions = [
"--add-host=host.containers.internal:host-gateway"
"--replace"
"--rm"
];
cmd = [ "worker" ];
};