removing docker from lio, and other cleanup
This commit is contained in:
RingOfStorms (Joshua Bell)
parent
c007bb72d2
commit
405576ee63
10 changed files with 45 additions and 423 deletions
|
|
@ -1,166 +0,0 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
name = "inventory";
|
||||
app = "pg-${name}";
|
||||
|
||||
hostDataDir = "/var/lib/${name}";
|
||||
|
||||
localAddress = "192.168.100.110";
|
||||
pg_port = 54433;
|
||||
pg_dataDir = "/var/lib/postgres";
|
||||
# pgadmin_port = 5050;
|
||||
# pgadmin_dataDir = "/var/lib/pgadmin";
|
||||
|
||||
binds = [
|
||||
{
|
||||
host = "${hostDataDir}/postgres";
|
||||
container = pg_dataDir;
|
||||
user = "postgres";
|
||||
uid = config.ids.uids.postgres;
|
||||
}
|
||||
# {
|
||||
# host = "${hostDataDir}/pgadmin";
|
||||
# container = pgadmin_dataDir;
|
||||
# user = "pgadmin";
|
||||
# uid = 1020;
|
||||
# }
|
||||
];
|
||||
in
|
||||
{
|
||||
|
||||
users = lib.foldl (
|
||||
acc: bind:
|
||||
{
|
||||
users.${bind.user} = {
|
||||
isSystemUser = true;
|
||||
home = bind.host;
|
||||
createHome = true;
|
||||
uid = bind.uid;
|
||||
group = bind.user;
|
||||
};
|
||||
groups.${bind.user}.gid = bind.uid;
|
||||
}
|
||||
// acc
|
||||
) { } binds;
|
||||
|
||||
containers.${app} = {
|
||||
ephemeral = true;
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = "192.168.100.2";
|
||||
localAddress = localAddress;
|
||||
bindMounts = lib.foldl (
|
||||
acc: bind:
|
||||
{
|
||||
"${bind.container}" = {
|
||||
hostPath = bind.host;
|
||||
isReadOnly = false;
|
||||
};
|
||||
}
|
||||
// acc
|
||||
) { } binds;
|
||||
config =
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
system.stateVersion = "24.11";
|
||||
|
||||
users = lib.foldl (
|
||||
acc: bind:
|
||||
{
|
||||
users.${bind.user} = {
|
||||
isSystemUser = true;
|
||||
home = bind.container;
|
||||
uid = bind.uid;
|
||||
group = bind.user;
|
||||
};
|
||||
groups.${bind.user}.gid = bind.uid;
|
||||
}
|
||||
// acc
|
||||
) { } binds;
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_17.withJIT;
|
||||
enableJIT = true;
|
||||
extensions = with pkgs.postgresql17Packages; [
|
||||
# NOTE add extensions here
|
||||
pgvector
|
||||
postgis
|
||||
];
|
||||
settings.port = pg_port;
|
||||
enableTCPIP = true;
|
||||
authentication = ''
|
||||
local all all trust
|
||||
host all all 127.0.0.1/8 trust
|
||||
host all all ::1/128 trust
|
||||
host all all 192.168.100.0/24 trust
|
||||
'';
|
||||
identMap = ''
|
||||
# ArbitraryMapName systemUser dbUser
|
||||
superuser_map root ${name}
|
||||
|
||||
# Let other names login as themselves
|
||||
superuser_map /^(.*)$ \1
|
||||
'';
|
||||
ensureDatabases = [ name ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = name;
|
||||
ensureDBOwnership = true;
|
||||
ensureClauses = {
|
||||
login = true;
|
||||
superuser = true;
|
||||
};
|
||||
}
|
||||
];
|
||||
dataDir =
|
||||
(lib.findFirst (bind: bind.user == "postgres") (throw "No postgres bind found") binds).container;
|
||||
};
|
||||
|
||||
# services.pgadmin = {
|
||||
# enable = true;
|
||||
# port = pgadmin_port;
|
||||
# openFirewall = true;
|
||||
# initialEmail = "admin@test.com";
|
||||
# initialPasswordFile = (builtins.toFile "password" "password");
|
||||
# };
|
||||
|
||||
# TODO set this up, had issues since it shares users with postgres service and my bind mounts relys on createhome in that exact directory.
|
||||
# services.postgresqlBackup = {
|
||||
# enable = true;
|
||||
# compression = "gzip";
|
||||
# compressionLevel = 9;
|
||||
# databases = [ cfg.database ];
|
||||
# location = "${cfg.dataDir}/backup";
|
||||
# startAt = "02:30"; # Adjust the backup time as needed
|
||||
# };
|
||||
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ pg_port ];
|
||||
};
|
||||
|
||||
# Health check to ensure database is ready
|
||||
systemd.services.postgresql-healthcheck = {
|
||||
description = "PostgreSQL Health Check";
|
||||
after = [ "postgresql.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = ''
|
||||
${pkgs.postgresql_17}/bin/pg_isready \
|
||||
-U ${name} \
|
||||
-d ${name} \
|
||||
-h localhost \
|
||||
-p ${toString pg_port}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,154 +0,0 @@
|
|||
{ name }:
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
# name = "UNIQUE_NAME_ON_HOST";
|
||||
|
||||
hostDataDir = "/var/lib/${name}";
|
||||
hostAddress = "192.168.100.2";
|
||||
containerAddress = "192.168.100.10";
|
||||
|
||||
binds = [
|
||||
# Postgres data, must use postgres user in container and host
|
||||
{
|
||||
host = "${hostDataDir}/postgres";
|
||||
# Adjust based on container postgres data dir
|
||||
container = "/var/lib/postgresql/17";
|
||||
user = "postgres";
|
||||
uid = config.ids.uids.postgres;
|
||||
gid = config.ids.gids.postgres;
|
||||
}
|
||||
# Postgres backups
|
||||
{
|
||||
host = "${hostDataDir}/backups/postgres";
|
||||
container = "/var/backup/postgresql";
|
||||
user = "postgres";
|
||||
uid = config.ids.uids.postgres;
|
||||
gid = config.ids.gids.postgres;
|
||||
}
|
||||
# App data, uses custom user
|
||||
# {
|
||||
# host = "${hostDataDir}/data";
|
||||
# container = "/var/lib/forgejo";
|
||||
# user = "forgejo";
|
||||
# uid = 115;
|
||||
# gid = 115;
|
||||
# }
|
||||
];
|
||||
uniqueUsers = lib.foldl' (
|
||||
acc: bind: if lib.lists.any (item: item.user == bind.user) acc then acc else acc ++ [ bind ]
|
||||
) [ ] binds;
|
||||
users = {
|
||||
users = lib.listToAttrs (
|
||||
lib.map (u: {
|
||||
name = u.user;
|
||||
value = {
|
||||
isSystemUser = true;
|
||||
name = u.user;
|
||||
uid = u.uid;
|
||||
group = u.user;
|
||||
};
|
||||
}) uniqueUsers
|
||||
);
|
||||
|
||||
groups = lib.listToAttrs (
|
||||
lib.map (g: {
|
||||
name = g.user;
|
||||
value.gid = g.gid;
|
||||
}) uniqueUsers
|
||||
);
|
||||
};
|
||||
in
|
||||
{
|
||||
# Ensure users exists on host machine with same IDs as container
|
||||
inherit users;
|
||||
|
||||
# Ensure directories exist on host machine
|
||||
system.activationScripts.createMediaServerDirs = ''
|
||||
${lib.concatStringsSep "\n" (
|
||||
lib.map (bind: ''
|
||||
mkdir -p ${bind.host}
|
||||
chown -R ${toString bind.user}:${toString bind.gid} ${bind.host}
|
||||
chmod -R 750 ${bind.host}
|
||||
'') binds
|
||||
)}
|
||||
'';
|
||||
|
||||
containers.${name} = {
|
||||
ephemeral = true;
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = hostAddress;
|
||||
localAddress = containerAddress;
|
||||
bindMounts = lib.foldl (
|
||||
acc: bind:
|
||||
{
|
||||
"${bind.container}" = {
|
||||
hostPath = bind.host;
|
||||
isReadOnly = false;
|
||||
};
|
||||
}
|
||||
// acc
|
||||
) { } binds;
|
||||
config =
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
system.stateVersion = "24.11";
|
||||
|
||||
# Ensure users exist on container
|
||||
inherit users;
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
package = pkgs.postgresql_17.withJIT;
|
||||
enableJIT = true;
|
||||
extensions = with pkgs.postgresql17Packages; [
|
||||
# NOTE add extensions here
|
||||
pgvector
|
||||
postgis
|
||||
];
|
||||
enableTCPIP = true;
|
||||
authentication = ''
|
||||
local all all trust
|
||||
host all all 127.0.0.1/8 trust
|
||||
host all all ::1/128 trust
|
||||
host all all 192.168.100.0/24 trust
|
||||
'';
|
||||
# identMap = ''
|
||||
# # ArbitraryMapName systemUser dbUser
|
||||
# superuser_map root ${name}
|
||||
#
|
||||
# # Let other names login as themselves
|
||||
# superuser_map /^(.*)$ \1
|
||||
# '';
|
||||
# ensureDatabases = [ name ];
|
||||
# ensureUsers = [
|
||||
# {
|
||||
# name = name;
|
||||
# ensureDBOwnership = true;
|
||||
# ensureClauses = {
|
||||
# login = true;
|
||||
# superuser = true;
|
||||
# };
|
||||
# }
|
||||
# ];
|
||||
};
|
||||
|
||||
# Backup database
|
||||
services.postgresqlBackup = {
|
||||
enable = true;
|
||||
};
|
||||
|
||||
# APP TODO REPLACE THIS WITH SOMETHING
|
||||
services.pgadmin = {
|
||||
enable = true;
|
||||
openFirewall = true;
|
||||
initialEmail = "admin@test.com";
|
||||
initialPasswordFile = (builtins.toFile "password" "password");
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,39 +0,0 @@
|
|||
{
|
||||
...
|
||||
}:
|
||||
{
|
||||
options = { };
|
||||
|
||||
config = {
|
||||
# Random test, visit http://192.168.100.11/
|
||||
containers.wasabi = {
|
||||
ephemeral = true;
|
||||
autoStart = true;
|
||||
privateNetwork = true;
|
||||
hostAddress = "192.168.100.2";
|
||||
localAddress = "192.168.100.11";
|
||||
config =
|
||||
{ config, pkgs, ... }:
|
||||
{
|
||||
system.stateVersion = "24.11";
|
||||
services.httpd.enable = true;
|
||||
services.httpd.adminAddr = "foo@example.org";
|
||||
networking.firewall = {
|
||||
enable = true;
|
||||
allowedTCPPorts = [ 80 ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.oci-containers.containers = {
|
||||
# Example of defining a container, visit http://localhost:8085/
|
||||
"nginx_simple" = {
|
||||
# autoStart = true; this is default true
|
||||
image = "nginx:latest";
|
||||
ports = [
|
||||
"127.0.0.1:8085:80"
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue