cleanup
This commit is contained in:
mjallen18
@@ -17,12 +17,9 @@ let
|
||||
in
|
||||
rec {
|
||||
|
||||
# Conditionally enable modules based on system
|
||||
enableForSystem =
|
||||
system: modules:
|
||||
builtins.filter (
|
||||
mod: mod.systems or [ ] == [ ] || builtins.elem system (mod.systems or [ ])
|
||||
) modules;
|
||||
# ---------------------------------------------------------------------------
|
||||
# NixOS service module helpers
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
# Create a NixOS module with standard options (enable, port, reverseProxy,
|
||||
# firewall, user, postgresql, redis) and optional caller-supplied options and
|
||||
@@ -61,7 +58,6 @@ rec {
|
||||
'';
|
||||
};
|
||||
|
||||
# Open firewall
|
||||
networking.firewall = lib.mkIf cfg.openFirewall {
|
||||
allowedTCPPorts = [ cfg.port ];
|
||||
allowedUDPPorts = [ cfg.port ];
|
||||
@@ -76,11 +72,8 @@ rec {
|
||||
groups.${name} = { };
|
||||
};
|
||||
|
||||
# Ensure the service waits for the filesystem that hosts configDir and
|
||||
# dataDir to be mounted before starting. RequiresMountsFor is the
|
||||
# idiomatic systemd way to express this: if the paths live on the root
|
||||
# filesystem the directive is silently ignored, so it is safe on every
|
||||
# host — not just the NAS.
|
||||
# RequiresMountsFor is silently ignored when the paths live on the root
|
||||
# filesystem, so this is safe on non-NAS hosts too.
|
||||
systemd.services.${serviceName}.unitConfig.RequiresMountsFor = [
|
||||
cfg.configDir
|
||||
cfg.dataDir
|
||||
@@ -107,10 +100,6 @@ rec {
|
||||
{ lib, ... }:
|
||||
{
|
||||
imports = [
|
||||
# defaultConfig and moduleConfig are kept as separate inline modules so
|
||||
# the NixOS module system handles all merging (mkIf, mkForce, mkMerge,
|
||||
# etc.) correctly, rather than merging raw attrsets with // or
|
||||
# recursiveUpdate which can silently clobber mkIf wrappers.
|
||||
{ config = lib.mkIf cfg.enable defaultConfig; }
|
||||
{ config = lib.mkIf cfg.enable moduleConfig; }
|
||||
];
|
||||
@@ -165,6 +154,147 @@ rec {
|
||||
};
|
||||
};
|
||||
|
||||
# Wraps mkModule for Podman/OCI container services. Generates all the
|
||||
# standard mkModule options plus the container definition. The serviceName
|
||||
# is set to "podman-<name>" automatically.
|
||||
#
|
||||
# Required args:
|
||||
# config — the NixOS config attrset (pass through from the module args)
|
||||
# name — service name (used for the container name and option path)
|
||||
# image — OCI image reference string
|
||||
# internalPort — port the container listens on internally
|
||||
#
|
||||
# Optional args:
|
||||
# description — human-readable description (defaults to name)
|
||||
# options — extra mkModule options attrset
|
||||
# volumes — extra volume strings (in addition to none)
|
||||
# environment — extra environment variables (merged with PUID/PGID/TZ)
|
||||
# environmentFiles — list of paths to env-files (e.g. sops template paths)
|
||||
# extraOptions — list of extra --opt strings passed to the container runtime
|
||||
# devices — list of device mappings
|
||||
# extraConfig — extra NixOS config merged into moduleConfig
|
||||
mkContainerService =
|
||||
{
|
||||
config,
|
||||
name,
|
||||
image,
|
||||
internalPort,
|
||||
description ? name,
|
||||
options ? { },
|
||||
volumes ? [ ],
|
||||
environment ? { },
|
||||
environmentFiles ? [ ],
|
||||
extraOptions ? [ ],
|
||||
devices ? [ ],
|
||||
extraConfig ? { },
|
||||
}:
|
||||
let
|
||||
cfg = config.${namespace}.services.${name};
|
||||
in
|
||||
mkModule {
|
||||
inherit
|
||||
config
|
||||
name
|
||||
description
|
||||
options
|
||||
;
|
||||
serviceName = "podman-${name}";
|
||||
moduleConfig = lib.recursiveUpdate {
|
||||
virtualisation.oci-containers.containers.${name} = {
|
||||
autoStart = true;
|
||||
inherit
|
||||
image
|
||||
volumes
|
||||
environmentFiles
|
||||
extraOptions
|
||||
devices
|
||||
;
|
||||
ports = [ "${toString cfg.port}:${toString internalPort}" ];
|
||||
environment = {
|
||||
PUID = cfg.puid;
|
||||
PGID = cfg.pgid;
|
||||
TZ = cfg.timeZone;
|
||||
}
|
||||
// environment;
|
||||
};
|
||||
} extraConfig;
|
||||
};
|
||||
|
||||
# Generates a sops secrets block + a sops template env-file in a single call.
|
||||
#
|
||||
# secrets — attrset of sops secret keys → extra attrs (e.g. owner/group).
|
||||
# The sopsFile is set automatically to nas-secrets.yaml unless
|
||||
# overridden per-secret via { sopsFile = ...; }.
|
||||
# name — template file name, e.g. "glance.env"
|
||||
# content — the template body string (use config.sops.placeholder."key")
|
||||
# restartUnit — systemd unit to restart when the secret changes
|
||||
# owner, group, mode — file ownership/permissions (defaults match NAS convention)
|
||||
# sopsFile — default sops file for all secrets (can be overridden per-secret)
|
||||
mkSopsEnvFile =
|
||||
{
|
||||
secrets,
|
||||
name,
|
||||
content,
|
||||
restartUnit,
|
||||
owner ? "nix-apps",
|
||||
group ? "jallen-nas",
|
||||
mode ? "660",
|
||||
sopsFile ? (lib.snowfall.fs.get-file "secrets/nas-secrets.yaml"),
|
||||
}:
|
||||
{
|
||||
sops.secrets = mapAttrs (_key: extra: { inherit sopsFile; } // extra) secrets;
|
||||
|
||||
sops.templates.${name} = {
|
||||
inherit
|
||||
mode
|
||||
owner
|
||||
group
|
||||
content
|
||||
;
|
||||
restartUnits = [ restartUnit ];
|
||||
};
|
||||
};
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Home Manager module helper
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
# Create a Home Manager module with a standard enable option and optional
|
||||
# extra options, gating all config behind `cfg.enable`.
|
||||
#
|
||||
# domain — option namespace domain, e.g. "programs" or "desktop"
|
||||
# name — module name, e.g. "btop"
|
||||
# description — text for mkEnableOption (defaults to name)
|
||||
# options — attrset of extra options merged into the submodule
|
||||
# config — the NixOS/HM config attrset passed through from module args
|
||||
# moduleConfig — the Home Manager config body (already gated behind cfg.enable)
|
||||
mkHomeModule =
|
||||
{
|
||||
config,
|
||||
domain,
|
||||
name,
|
||||
description ? name,
|
||||
options ? { },
|
||||
moduleConfig,
|
||||
}:
|
||||
let
|
||||
cfg = config.${namespace}.${domain}.${name};
|
||||
in
|
||||
{ lib, ... }:
|
||||
{
|
||||
options.${namespace}.${domain}.${name} = lib.mkOption {
|
||||
type = lib.types.submodule {
|
||||
options = {
|
||||
enable = lib.mkEnableOption description;
|
||||
}
|
||||
// options;
|
||||
};
|
||||
default = { };
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable moduleConfig;
|
||||
};
|
||||
|
||||
# ---------------------------------------------------------------------------
|
||||
# Option creation helpers
|
||||
# ---------------------------------------------------------------------------
|
||||
|
||||
Reference in New Issue
Block a user