137 lines
4.9 KiB
Nix
137 lines
4.9 KiB
Nix
{ config, lib, pkgs, serverCfg }:
|
|
let
|
|
contBuilder =
|
|
{ image ? null, imageStream ? null, imageFile ? null
|
|
, secret ? null
|
|
, subdomain ? null, subpath?null, port ? null
|
|
, extraEnv ? { }, extraLabels ? { }, extraOptions ? [ ]
|
|
, overrides ? { }
|
|
}:
|
|
let
|
|
routerName = if subpath != null
|
|
then "${subdomain}-${lib.strings.sanitizeDerivationName subpath}"
|
|
else subdomain;
|
|
base = {
|
|
image = if imageStream != null then "${imageStream.imageName}:${imageStream.imageTag}"
|
|
else if imageFile != null then "${imageFile.imageName}:${imageFile.imageTag}" else image;
|
|
imageStream = imageStream;
|
|
imageFile = imageFile;
|
|
|
|
environmentFiles = if secret!=null then [ config.sops.secrets."${lib.toUpper secret}".path ] else [];
|
|
environment = {
|
|
TZ = config.time.timeZone;
|
|
} // extraEnv;
|
|
|
|
labels = (if subdomain!=null then ({
|
|
"traefik.enable" = "true";
|
|
"traefik.http.routers.${routerName}.entrypoints" = "web-secure";
|
|
"traefik.http.routers.${routerName}.rule" = if subpath != null
|
|
then "Host(`${subdomain}.${serverCfg.domain}`) && PathPrefix(`/${subpath}`)"
|
|
else "Host(`${subdomain}.${serverCfg.domain}`)";
|
|
"traefik.http.routers.${routerName}.tls" = "true";
|
|
} // lib.optionalAttrs (port!=null) {
|
|
"traefik.http.services.${routerName}.loadbalancer.server.port" = toString port;
|
|
}) else {
|
|
"traefik.enable" = "false";
|
|
}) // extraLabels;
|
|
|
|
extraOptions = [
|
|
"--add-host=host.containers.internal:host-gateway"
|
|
] ++ extraOptions;
|
|
};
|
|
in lib.recursiveUpdate base overrides;
|
|
vmBuilder = { name, vm }: ((import "${pkgs.path}/nixos/lib/eval-config.nix" {
|
|
system = "x86_64-linux";
|
|
modules = [ vm.cfg
|
|
({ config, lib, modulesPath, ... }: {
|
|
imports = [
|
|
"${modulesPath}/profiles/qemu-guest.nix"
|
|
"${modulesPath}/virtualisation/qemu-vm.nix"
|
|
];
|
|
networking.hostName = name;
|
|
networking.useDHCP = true;
|
|
networking.firewall.enable = false;
|
|
services.qemuGuest.enable = true;
|
|
system.stateVersion = "26.05";
|
|
virtualisation = {
|
|
memorySize = vm.memory or 2048;
|
|
cores = vm.cores or 2;
|
|
forwardPorts = let
|
|
parsePortString = port: {
|
|
from = "host";
|
|
host.port = port;
|
|
guest.port = port;
|
|
};
|
|
in if (vm ? portForward && vm.portForward != null) then map parsePortString vm.portForward else [];
|
|
};})
|
|
];
|
|
}).config.system.build.vm);
|
|
in {
|
|
mkContainer = contBuilder;
|
|
mkVm = vmBuilder;
|
|
mkApp = name: app:
|
|
let
|
|
# Keep legacy app modules working while storing a stricter internal contract.
|
|
legacySetup =
|
|
if app ? setup then app.setup else null;
|
|
in {
|
|
inherit name;
|
|
requires = {
|
|
secrets =
|
|
if app ? requires && app.requires ? secrets then app.requires.secrets
|
|
else if app ? sops && app.sops then [ name ]
|
|
else [ ];
|
|
databases =
|
|
if app ? requires && app.requires ? databases then app.requires.databases
|
|
else if app ? db && app.db then [ name ]
|
|
else [ ];
|
|
};
|
|
exports = {
|
|
authentik = {
|
|
blueprints =
|
|
if app ? exports && app.exports ? authentik && app.exports.authentik ? blueprints
|
|
then app.exports.authentik.blueprints
|
|
else [ ];
|
|
};
|
|
};
|
|
runtime = {
|
|
paths =
|
|
if app ? runtime && app.runtime ? paths then app.runtime.paths
|
|
else if app ? paths then app.paths
|
|
else [ ];
|
|
containers =
|
|
if app ? runtime && app.runtime ? containers then app.runtime.containers
|
|
else if app ? containers then app.containers
|
|
else { };
|
|
vm =
|
|
if app ? runtime && app.runtime ? vm then app.runtime.vm
|
|
else if app ? vm then app.vm
|
|
else null;
|
|
cron =
|
|
if app ? runtime && app.runtime ? cron then app.runtime.cron
|
|
else if app ? cron then app.cron
|
|
else [ ];
|
|
setup =
|
|
if app ? runtime && app.runtime ? setup then app.runtime.setup
|
|
else ({
|
|
trigger = "";
|
|
script = null;
|
|
envFile = [ ];
|
|
} // (if legacySetup != null then legacySetup else { }));
|
|
};
|
|
};
|
|
mkData = { name, dir, vars?{} }: pkgs.runCommand name vars ''
|
|
mkdir -p $out
|
|
cp -r ${./data + "/${dir}"}/. $out/
|
|
find $out -type f | while read file; do
|
|
${lib.concatStringsSep "\n" (lib.mapAttrsToList (n: v: ''
|
|
substituteInPlace "$file" --replace "@${n}@" "${toString v}"
|
|
'') vars)}
|
|
done
|
|
'';
|
|
host = "host.containers.internal";
|
|
hostIp = if (config.virtualisation.podman.defaultNetwork.settings ? subnets)
|
|
then (builtins.elemAt config.virtualisation.podman.defaultNetwork.settings.subnets 0).gateway
|
|
else "10.88.0.1";
|
|
}
|