l green-host: use cryfs & nixos-containers
This commit is contained in:
lassulus
parent
5a8aa6b843
commit
d554acc068
|
|
@ -1,38 +1,44 @@
|
|||
{ config, lib, pkgs, ... }:
|
||||
with import <stockholm/lib>;
|
||||
|
||||
{
|
||||
let
|
||||
|
||||
cname = "green";
|
||||
cryfs = pkgs.cryfs.overrideAttrs (old: {
|
||||
patches = [
|
||||
(pkgs.writeText "file_mode.patch" ''
|
||||
--- a/src/cryfs/filesystem/CryNode.cpp
|
||||
+++ b/src/cryfs/filesystem/CryNode.cpp
|
||||
@@ -171,7 +171,7 @@ CryNode::stat_info CryNode::stat() const {
|
||||
result.uid = fspp::uid_t(getuid());
|
||||
result.gid = fspp::gid_t(getgid());
|
||||
#endif
|
||||
- result.mode = fspp::mode_t().addDirFlag().addUserReadFlag().addUserWriteFlag().addUserExecFlag();
|
||||
+ result.mode = fspp::mode_t().addDirFlag().addUserReadFlag().addUserWriteFlag().addUserExecFlag().addGroupReadFlag().addGroupExecFlag().addOtherReadFlag().addOtherExecFlag();;
|
||||
result.size = fsblobstore::DirBlob::DIR_LSTAT_SIZE;
|
||||
//TODO If possible without performance loss, then for a directory, st_nlink should return number of dir entries (including "." and "..")
|
||||
result.nlink = 1;
|
||||
'')
|
||||
] ++ old.patches;
|
||||
});
|
||||
|
||||
in {
|
||||
imports = [
|
||||
<stockholm/lass/2configs/container-networking.nix>
|
||||
<stockholm/lass/2configs/syncthing.nix>
|
||||
{ #hack for already defined
|
||||
systemd.services."container@green".reloadIfChanged = mkForce false;
|
||||
systemd.services."container@green".preStart = ''
|
||||
${pkgs.mount}/bin/mount | ${pkgs.gnugrep}/bin/grep -q ' on /var/lib/containers/green '
|
||||
'';
|
||||
systemd.services."container@green".postStop = ''
|
||||
set -x
|
||||
${pkgs.umount}/bin/umount /var/lib/containers/green
|
||||
ls -la /dev/mapper/control
|
||||
${pkgs.devicemapper}/bin/dmsetup ls
|
||||
${pkgs.cryptsetup}/bin/cryptsetup -v luksClose /var/lib/sync-containers/green.img
|
||||
'';
|
||||
}
|
||||
];
|
||||
|
||||
services.syncthing.declarative.folders."/var/lib/sync-containers".devices = [ "icarus" "skynet" "littleT" "shodan" ];
|
||||
krebs.permown."/var/lib/sync-containers" = {
|
||||
owner = "root";
|
||||
group = "syncthing";
|
||||
umask = "0007";
|
||||
};
|
||||
programs.fuse.userAllowOther = true;
|
||||
|
||||
system.activationScripts.containerPermissions = ''
|
||||
mkdir -p /var/lib/containers
|
||||
chmod 711 /var/lib/containers
|
||||
'';
|
||||
services.syncthing.declarative.folders."/var/lib/sync-containers/${cname}".devices = [ "icarus" "skynet" "littleT" "shodan" ];
|
||||
# krebs.permown."/var/lib/sync-containers/${cname}" = {
|
||||
# owner = "root";
|
||||
# group = "syncthing";
|
||||
# umask = "0007";
|
||||
# };
|
||||
|
||||
containers.green = {
|
||||
systemd.services."container@green".reloadIfChanged = mkForce false;
|
||||
containers.${cname} = {
|
||||
config = { ... }: {
|
||||
environment.systemPackages = [
|
||||
pkgs.git
|
||||
|
|
@ -42,41 +48,52 @@ with import <stockholm/lib>;
|
|||
users.users.root.openssh.authorizedKeys.keys = [
|
||||
config.krebs.users.lass.pubkey
|
||||
];
|
||||
system.activationScripts.fuse = {
|
||||
text = ''
|
||||
${pkgs.coreutils}/bin/mknod /dev/fuse c 10 229
|
||||
'';
|
||||
deps = [];
|
||||
};
|
||||
};
|
||||
allowedDevices = [
|
||||
{ modifier = "rwm"; node = "/dev/fuse"; }
|
||||
];
|
||||
autoStart = false;
|
||||
enableTun = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = "10.233.2.15";
|
||||
localAddress = "10.233.2.16";
|
||||
hostAddress = "10.233.2.15"; # TODO find way to automatically calculate IPs
|
||||
localAddress = "10.233.2.16"; # TODO find way to automatically calculate IPs
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
(pkgs.writeDashBin "start-green" ''
|
||||
set -fu
|
||||
CONTAINER='green'
|
||||
IMAGE='/var/lib/sync-containers/green.img'
|
||||
(pkgs.writeDashBin "start-${cname}" ''
|
||||
set -euf
|
||||
|
||||
${pkgs.cryptsetup}/bin/cryptsetup status "$CONTAINER" >/dev/null
|
||||
if [ "$?" -ne 0 ]; then
|
||||
${pkgs.cryptsetup}/bin/cryptsetup luksOpen "$IMAGE" "$CONTAINER"
|
||||
mkdir -p /var/lib/containers/${cname}/var/state
|
||||
chown ${config.services.syncthing.user}: /var/lib/containers/${cname}/var/state
|
||||
if ! ${pkgs.mount}/bin/mount | grep -q '^cryfs@/var/lib/sync-containers/${cname} on /var/lib/containers/${cname}/var/state '; then
|
||||
/run/wrappers/bin/sudo -u "${config.services.syncthing.user}" \
|
||||
${cryfs}/bin/cryfs /var/lib/sync-containers/${cname} /var/lib/containers/${cname}/var/state -o allow_other -o default_permissions
|
||||
fi
|
||||
|
||||
mkdir -p /var/lib/containers/"$CONTAINER"
|
||||
|
||||
${pkgs.mount}/bin/mount | grep -q " on /var/lib/containers/"$CONTAINER" "
|
||||
if [ "$?" -ne 0 ]; then
|
||||
${pkgs.mount}/bin/mount -o sync /dev/mapper/"$CONTAINER" /var/lib/containers/"$CONTAINER"
|
||||
fi
|
||||
|
||||
STATE=$(${pkgs.nixos-container}/bin/nixos-container status "$CONTAINER")
|
||||
STATE=$(${pkgs.nixos-container}/bin/nixos-container status ${cname})
|
||||
if [ "$STATE" = 'down' ]; then
|
||||
${pkgs.nixos-container}/bin/nixos-container start "$CONTAINER"
|
||||
fi
|
||||
ping -c1 green.r
|
||||
if [ "$?" -ne 0 ]; then
|
||||
${pkgs.nixos-container}/bin/nixos-container run green -- nixos-rebuild -I /var/src switch
|
||||
${pkgs.nixos-container}/bin/nixos-container start ${cname}
|
||||
fi
|
||||
|
||||
if ! ping -c1 -q -w5 ${cname}.r && [ -d /var/lib/containers/${cname}/var/src ]; then
|
||||
${pkgs.nixos-container}/bin/nixos-container run ${cname} -- ${pkgs.writeDash "deploy-${cname}" ''
|
||||
mkdir -p /var/state/var_src
|
||||
ln -sf state/var_Src /var/src
|
||||
nixos-rebuild -I /var/src switch
|
||||
''}
|
||||
fi
|
||||
'')
|
||||
(pkgs.writeDashBin "stop-${cname}" ''
|
||||
set -euf
|
||||
|
||||
${pkgs.nixos-container}/bin/nixos-container stop ${cname}
|
||||
${cryfs}/bin/cryfs-unmount /var/lib/containers/${cname}/var/state
|
||||
'')
|
||||
];
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue