fix containers

modules/server/containers/default.nix

@@ -1,27 +1,20 @@
 { config, pkgs, lib, ... }:
 let
-  # enabledContainers = lib.filterAttrs (name: cfg: cfg.enable) config.syscfg.server.containers;
+  cfg = config.syscfg.server.containers;
-  # containerImports = {
+  enabledConfigs = lib.filterAttrs (name: c: c.enable) cfg;
-  #   cloud = import ./defs/cloud.nix;
+  containerSetsList = lib.mapAttrsToList (name: containerCfg:
-  #   authentik = import ./defs/authentik.nix;
+    import (./defs + "/${name}.nix") {
-  # };
+      inherit config pkgs lib ;
-  containerDir = ./defs;
+      inherit (containerCfg) port special_param;
-  allFiles = builtins.readDir containerDir;
+    }
-  enabledNames = lib.filterAttrs (name: cfg: cfg.enable) config.syscfg.server.containers;
+  ) enabledConfigs;
-  activeContainers = lib.mapAttrs (name: cfg: 
+  mergedContainers = lib.attrsets.mergeAttrsList containerSetsList;
-    let 
-      fileName = "${name}.nix";
-    in
-    if builtins.hasAttr fileName allFiles 
-    then import (containerDir + "/${fileName}")
-    else throw "Container config for '${name}' enabled, but ${containerDir}/${fileName} does not exist!"
-  ) enabledNames;
 in
 {
-  config = lib.mkIf ( enabledNames != {} ) {
+  config = lib.mkIf ( enabledConfigs != {} ) {
     virtualisation.oci-containers = {
       backend = "podman";
-      containers = activeContainers;
+      containers = mergedContainers;
     };
   };
 }

modules/server/containers/defs/authentik.nix

@@ -1,49 +1,29 @@
 { config, pkgs, lib, ... }:
 let serverCfg = config.syscfg.server;
 in {
-  project.name = "authentik";
+  auth_postgresql = {
-
-  networks = {
-    internal = {
-      name = lib.mkForce "internal";
-      internal = true;
-    };
-    external = {
-      name = lib.mkForce "external";
-      internal = false;
-    };
-  };
-
-  services = {
-
-    auth_postgresql.service = {
     image = "postgres:14-alpine";
-      container_name = "auth_postgresql";
+    hostname = "auth_postgresql";
-      restart = "unless-stopped";
-      networks = [ "internal" ];
     volumes = [ ];
     environment = {
       POSTGRES_PASSWORD = "/run/secrets/AUTHENTIK_POSTGRESQL__PASSWORD";
       POSTGRES_USER = "authentik";
       POSTGRES_DB = "authentik";
     };
+    labels = { "traefik.enable" = "false"; };
   };
 
-    auth_redis.service = {
+  auth_redis = {
     image = "redis:alpine";
-      container_name = "auth_redis";
+    hostname = "auth_redis";
-      restart = "unless-stopped";
-      networks = [ "internal" ];
     volumes = [ ];
     environment = { };
     labels = { "traefik.enable" = "false"; };
   };
 
-    auth_server.service = {
+  auth_server = {
     image = "ghcr.io/goauthentik/server:latest";
-      container_name = "auth_server";
+    hostname = "auth_server";
-      restart = "unless-stopped";
-      networks = [ "internal" "external" ];
     volumes = [
       "${serverCfg.dataPath}/authentik/media:/media"
       "${serverCfg.dataPath}/authentik/templates:/templates"
@@ -70,19 +50,16 @@ in {
       "traefik.http.routers.sso.rule" = "Host(`sso.${serverCfg.hostDomain}`)";
       "traefik.http.routers.sso.tls" = "true";
       "traefik.http.services.sso.loadbalancer.server.port" = "9000";
-        "traefik.docker.network" = "external";
     };
-      command = "server";
+    cmd = [ "server" ];
     ports = [
-        "9999:9000" # host:container
+      "9999:9000"
     ];
   };
 
-    auth_worker.service = {
+  auth_worker = {
     image = "ghcr.io/goauthentik/server:latest";
-      container_name = "auth_worker";
+    hostname = "auth_worker";
-      restart = "unless-stopped";
-      networks = [ "internal" ];
     volumes = [
       "${serverCfg.dataPath}/authentik/media:/media"
       "${serverCfg.dataPath}/authentik/templates:/templates"
@@ -97,8 +74,6 @@ in {
       "AUTHENTIK_SECRET_KEY" = "AUTHENTIK_SECRET_KEY";
     };
     labels = { "traefik.enable" = "false"; };
-      command = "worker";
+    cmd = [ "worker" ];
-      user = "root";
-    };
   };
 }

systems/sandbox/cfg.nix

@@ -30,7 +30,7 @@
       dbHost = "localhost";
       
       containers = {
-        cloud = {enable = true;};
+        #cloud = {enable = true;};
         authentik = {enable = true;};
       };
     };