Initial Setups for Nix, Komodo and Cloud LXC, not yet tested to work.
This commit is contained in:
parent
f8a2e4415d
commit
ac2c25b1e7
12 changed files with 910 additions and 0 deletions
24
home/toph/komodo/default.nix
Normal file
24
home/toph/komodo/default.nix
Normal file
|
|
@ -0,0 +1,24 @@
|
||||||
|
{
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
## Required Configs ##
|
||||||
|
../common/core # required
|
||||||
|
|
||||||
|
## Host-specific Optional Configs ##
|
||||||
|
];
|
||||||
|
|
||||||
|
# Useful for this host
|
||||||
|
home.file = {
|
||||||
|
Pool.source = config.lib.file.mkOutOfStoreSymlink "/pool";
|
||||||
|
DockerStorage.source = config.lib.file.mkOutOfStoreSymlink "/mnt/DockerStorage";
|
||||||
|
};
|
||||||
|
|
||||||
|
## Packages with no needed configs ##
|
||||||
|
# home.packages = builtins.attrValues {
|
||||||
|
# inherit (pkgs)
|
||||||
|
# ;
|
||||||
|
# };
|
||||||
|
}
|
||||||
23
home/toph/nix/default.nix
Normal file
23
home/toph/nix/default.nix
Normal file
|
|
@ -0,0 +1,23 @@
|
||||||
|
{
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
{
|
||||||
|
imports = [
|
||||||
|
## Required Configs ##
|
||||||
|
../common/core # required
|
||||||
|
|
||||||
|
## Host-specific Optional Configs ##
|
||||||
|
../common/optional/vscode-server.nix
|
||||||
|
];
|
||||||
|
|
||||||
|
## Packages with no needed configs ##
|
||||||
|
home.packages = builtins.attrValues {
|
||||||
|
inherit (pkgs)
|
||||||
|
chafa
|
||||||
|
nodejs
|
||||||
|
pnpm
|
||||||
|
# x2goserver
|
||||||
|
;
|
||||||
|
};
|
||||||
|
}
|
||||||
83
hosts/common/optional/containers/authentik/compose.yaml
Normal file
83
hosts/common/optional/containers/authentik/compose.yaml
Normal file
|
|
@ -0,0 +1,83 @@
|
||||||
|
name: authentik
|
||||||
|
services:
|
||||||
|
postgresql:
|
||||||
|
image: docker.io/library/postgres:16-alpine
|
||||||
|
restart: unless-stopped
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD-SHELL", "pg_isready -d $${POSTGRES_DB} -U $${POSTGRES_USER}"]
|
||||||
|
start_period: 20s
|
||||||
|
interval: 30s
|
||||||
|
retries: 5
|
||||||
|
timeout: 5s
|
||||||
|
volumes:
|
||||||
|
- ./database:/var/lib/postgresql/data
|
||||||
|
environment:
|
||||||
|
POSTGRES_PASSWORD: ${PG_PASS}
|
||||||
|
POSTGRES_USER: ${PG_USER:-authentik}
|
||||||
|
POSTGRES_DB: ${PG_DB:-authentik}
|
||||||
|
env_file:
|
||||||
|
- .env
|
||||||
|
redis:
|
||||||
|
image: docker.io/library/redis:alpine
|
||||||
|
command: --save 60 1 --loglevel warning
|
||||||
|
restart: unless-stopped
|
||||||
|
healthcheck:
|
||||||
|
test: ["CMD-SHELL", "redis-cli ping | grep PONG"]
|
||||||
|
start_period: 20s
|
||||||
|
interval: 30s
|
||||||
|
retries: 5
|
||||||
|
timeout: 3s
|
||||||
|
volumes:
|
||||||
|
- ./redis:/data
|
||||||
|
server:
|
||||||
|
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.12.2}
|
||||||
|
restart: unless-stopped
|
||||||
|
command: server
|
||||||
|
environment:
|
||||||
|
AUTHENTIK_REDIS__HOST: redis
|
||||||
|
AUTHENTIK_POSTGRESQL__HOST: postgresql
|
||||||
|
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
|
||||||
|
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
|
||||||
|
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
|
||||||
|
volumes:
|
||||||
|
- ./media:/media
|
||||||
|
- ./custom-templates:/templates
|
||||||
|
env_file:
|
||||||
|
- .env
|
||||||
|
ports:
|
||||||
|
- "${COMPOSE_PORT_HTTP:-9000}:9000"
|
||||||
|
- "${COMPOSE_PORT_HTTPS:-9443}:9443"
|
||||||
|
depends_on:
|
||||||
|
postgresql:
|
||||||
|
condition: service_healthy
|
||||||
|
redis:
|
||||||
|
condition: service_healthy
|
||||||
|
worker:
|
||||||
|
image: ${AUTHENTIK_IMAGE:-ghcr.io/goauthentik/server}:${AUTHENTIK_TAG:-2024.12.2}
|
||||||
|
restart: unless-stopped
|
||||||
|
command: worker
|
||||||
|
environment:
|
||||||
|
AUTHENTIK_REDIS__HOST: redis
|
||||||
|
AUTHENTIK_POSTGRESQL__HOST: postgresql
|
||||||
|
AUTHENTIK_POSTGRESQL__USER: ${PG_USER:-authentik}
|
||||||
|
AUTHENTIK_POSTGRESQL__NAME: ${PG_DB:-authentik}
|
||||||
|
AUTHENTIK_POSTGRESQL__PASSWORD: ${PG_PASS}
|
||||||
|
# `user: root` and the docker socket volume are optional.
|
||||||
|
# See more for the docker socket integration here:
|
||||||
|
# https://goauthentik.io/docs/outposts/integrations/docker
|
||||||
|
# Removing `user: root` also prevents the worker from fixing the permissions
|
||||||
|
# on the mounted folders, so when removing this make sure the folders have the correct UID/GID
|
||||||
|
# (1000:1000 by default)
|
||||||
|
user: root
|
||||||
|
volumes:
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
|
- ./media:/media
|
||||||
|
- ./certs:/certs
|
||||||
|
- ./templates:/templates
|
||||||
|
env_file:
|
||||||
|
- .env
|
||||||
|
depends_on:
|
||||||
|
postgresql:
|
||||||
|
condition: service_healthy
|
||||||
|
redis:
|
||||||
|
condition: service_healthy
|
||||||
210
hosts/common/optional/containers/authentik/default.nix
Normal file
210
hosts/common/optional/containers/authentik/default.nix
Normal file
|
|
@ -0,0 +1,210 @@
|
||||||
|
# Auto-generated using compose2nix v0.3.1.
|
||||||
|
{ pkgs, lib, ... }:
|
||||||
|
|
||||||
|
let
|
||||||
|
# Only available in the Komodo LXC
|
||||||
|
DockerStorage = "/mnt/DockerStorage/komodo/stacks/authentik";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
# Containers
|
||||||
|
virtualisation.oci-containers.containers."authentik-postgresql" = {
|
||||||
|
image = "docker.io/library/postgres:16-alpine";
|
||||||
|
environmentFiles = [
|
||||||
|
./authentik.env
|
||||||
|
];
|
||||||
|
volumes = [
|
||||||
|
"${DockerStorage}/database:/var/lib/postgresql/data:rw"
|
||||||
|
];
|
||||||
|
log-driver = "journald";
|
||||||
|
extraOptions = [
|
||||||
|
"--health-cmd=pg_isready -d \${POSTGRES_DB} -U \${POSTGRES_USER}"
|
||||||
|
"--health-interval=30s"
|
||||||
|
"--health-retries=5"
|
||||||
|
"--health-start-period=20s"
|
||||||
|
"--health-timeout=5s"
|
||||||
|
"--network-alias=postgresql"
|
||||||
|
"--network=authentik_default"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
systemd.services."docker-authentik-postgresql" = {
|
||||||
|
serviceConfig = {
|
||||||
|
Restart = lib.mkOverride 90 "always";
|
||||||
|
RestartMaxDelaySec = lib.mkOverride 90 "1m";
|
||||||
|
RestartSec = lib.mkOverride 90 "100ms";
|
||||||
|
RestartSteps = lib.mkOverride 90 9;
|
||||||
|
};
|
||||||
|
after = [
|
||||||
|
"docker-network-authentik_default.service"
|
||||||
|
];
|
||||||
|
requires = [
|
||||||
|
"docker-network-authentik_default.service"
|
||||||
|
];
|
||||||
|
partOf = [
|
||||||
|
"docker-compose-authentik-root.target"
|
||||||
|
];
|
||||||
|
wantedBy = [
|
||||||
|
"docker-compose-authentik-root.target"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
virtualisation.oci-containers.containers."authentik-redis" = {
|
||||||
|
image = "docker.io/library/redis:alpine";
|
||||||
|
environmentFiles = [
|
||||||
|
./authentik.env
|
||||||
|
];
|
||||||
|
volumes = [
|
||||||
|
"${DockerStorage}/redis:/data:rw"
|
||||||
|
];
|
||||||
|
cmd = [
|
||||||
|
"--save"
|
||||||
|
"60"
|
||||||
|
"1"
|
||||||
|
"--loglevel"
|
||||||
|
"warning"
|
||||||
|
];
|
||||||
|
log-driver = "journald";
|
||||||
|
extraOptions = [
|
||||||
|
"--health-cmd=redis-cli ping | grep PONG"
|
||||||
|
"--health-interval=30s"
|
||||||
|
"--health-retries=5"
|
||||||
|
"--health-start-period=20s"
|
||||||
|
"--health-timeout=3s"
|
||||||
|
"--network-alias=redis"
|
||||||
|
"--network=authentik_default"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
systemd.services."docker-authentik-redis" = {
|
||||||
|
serviceConfig = {
|
||||||
|
Restart = lib.mkOverride 90 "always";
|
||||||
|
RestartMaxDelaySec = lib.mkOverride 90 "1m";
|
||||||
|
RestartSec = lib.mkOverride 90 "100ms";
|
||||||
|
RestartSteps = lib.mkOverride 90 9;
|
||||||
|
};
|
||||||
|
after = [
|
||||||
|
"docker-network-authentik_default.service"
|
||||||
|
];
|
||||||
|
requires = [
|
||||||
|
"docker-network-authentik_default.service"
|
||||||
|
];
|
||||||
|
partOf = [
|
||||||
|
"docker-compose-authentik-root.target"
|
||||||
|
];
|
||||||
|
wantedBy = [
|
||||||
|
"docker-compose-authentik-root.target"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
virtualisation.oci-containers.containers."authentik-server" = {
|
||||||
|
image = "ghcr.io/goauthentik/server:2024.12.2";
|
||||||
|
environmentFiles = [
|
||||||
|
./authentik.env
|
||||||
|
];
|
||||||
|
volumes = [
|
||||||
|
"${DockerStorage}/custom-templates:/templates:rw"
|
||||||
|
"${DockerStorage}/media:/media:rw"
|
||||||
|
];
|
||||||
|
ports = [
|
||||||
|
"9000:9000/tcp"
|
||||||
|
"9443:9443/tcp"
|
||||||
|
];
|
||||||
|
cmd = [ "server" ];
|
||||||
|
dependsOn = [
|
||||||
|
"authentik-postgresql"
|
||||||
|
"authentik-redis"
|
||||||
|
];
|
||||||
|
log-driver = "journald";
|
||||||
|
extraOptions = [
|
||||||
|
"--network-alias=server"
|
||||||
|
"--network=authentik_default"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
systemd.services."docker-authentik-server" = {
|
||||||
|
serviceConfig = {
|
||||||
|
Restart = lib.mkOverride 90 "always";
|
||||||
|
RestartMaxDelaySec = lib.mkOverride 90 "1m";
|
||||||
|
RestartSec = lib.mkOverride 90 "100ms";
|
||||||
|
RestartSteps = lib.mkOverride 90 9;
|
||||||
|
};
|
||||||
|
after = [
|
||||||
|
"docker-network-authentik_default.service"
|
||||||
|
];
|
||||||
|
requires = [
|
||||||
|
"docker-network-authentik_default.service"
|
||||||
|
];
|
||||||
|
partOf = [
|
||||||
|
"docker-compose-authentik-root.target"
|
||||||
|
];
|
||||||
|
wantedBy = [
|
||||||
|
"docker-compose-authentik-root.target"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
virtualisation.oci-containers.containers."authentik-worker" = {
|
||||||
|
image = "ghcr.io/goauthentik/server:2024.12.2";
|
||||||
|
environmentFiles = [
|
||||||
|
./authentik.env
|
||||||
|
];
|
||||||
|
volumes = [
|
||||||
|
"${DockerStorage}/certs:/certs:rw"
|
||||||
|
"${DockerStorage}/media:/media:rw"
|
||||||
|
"${DockerStorage}/templates:/templates:rw"
|
||||||
|
"/var/run/docker.sock:/var/run/docker.sock:rw"
|
||||||
|
];
|
||||||
|
cmd = [ "worker" ];
|
||||||
|
dependsOn = [
|
||||||
|
"authentik-postgresql"
|
||||||
|
"authentik-redis"
|
||||||
|
];
|
||||||
|
user = "root";
|
||||||
|
log-driver = "journald";
|
||||||
|
extraOptions = [
|
||||||
|
"--network-alias=worker"
|
||||||
|
"--network=authentik_default"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
systemd.services."docker-authentik-worker" = {
|
||||||
|
serviceConfig = {
|
||||||
|
Restart = lib.mkOverride 90 "always";
|
||||||
|
RestartMaxDelaySec = lib.mkOverride 90 "1m";
|
||||||
|
RestartSec = lib.mkOverride 90 "100ms";
|
||||||
|
RestartSteps = lib.mkOverride 90 9;
|
||||||
|
};
|
||||||
|
after = [
|
||||||
|
"docker-network-authentik_default.service"
|
||||||
|
];
|
||||||
|
requires = [
|
||||||
|
"docker-network-authentik_default.service"
|
||||||
|
];
|
||||||
|
partOf = [
|
||||||
|
"docker-compose-authentik-root.target"
|
||||||
|
];
|
||||||
|
wantedBy = [
|
||||||
|
"docker-compose-authentik-root.target"
|
||||||
|
"docker-compose-komodo-root.target"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
# Networks
|
||||||
|
systemd.services."docker-network-authentik_default" = {
|
||||||
|
path = [ pkgs.docker ];
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = true;
|
||||||
|
ExecStop = "docker network rm -f authentik_default";
|
||||||
|
};
|
||||||
|
script = ''
|
||||||
|
docker network inspect authentik_default || docker network create authentik_default
|
||||||
|
'';
|
||||||
|
partOf = [ "docker-compose-authentik-root.target" ];
|
||||||
|
wantedBy = [ "docker-compose-authentik-root.target" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
# Root service
|
||||||
|
# When started, this will automatically create all resources and start
|
||||||
|
# the containers. When stopped, this will teardown all resources.
|
||||||
|
systemd.targets."docker-compose-authentik-root" = {
|
||||||
|
unitConfig = {
|
||||||
|
Description = "Root target generated by compose2nix.";
|
||||||
|
};
|
||||||
|
wantedBy = [
|
||||||
|
"multi-user.target"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
}
|
||||||
102
hosts/common/optional/containers/komodo/compose.yaml
Normal file
102
hosts/common/optional/containers/komodo/compose.yaml
Normal file
|
|
@ -0,0 +1,102 @@
|
||||||
|
################################
|
||||||
|
# 🦎 KOMODO COMPOSE - MONGO 🦎 #
|
||||||
|
################################
|
||||||
|
|
||||||
|
## This compose file will deploy:
|
||||||
|
## 1. MongoDB
|
||||||
|
## 2. Komodo Core
|
||||||
|
## 3. Komodo Periphery
|
||||||
|
name: komodo
|
||||||
|
services:
|
||||||
|
mongo:
|
||||||
|
image: mongo
|
||||||
|
labels:
|
||||||
|
komodo.skip: # Prevent Komodo from stopping with StopAllContainers
|
||||||
|
command: --quiet --wiredTigerCacheSizeGB 0.25
|
||||||
|
restart: unless-stopped
|
||||||
|
logging:
|
||||||
|
driver: ${COMPOSE_LOGGING_DRIVER:-local}
|
||||||
|
networks:
|
||||||
|
- default
|
||||||
|
# ports:
|
||||||
|
# - 27017:27017
|
||||||
|
volumes:
|
||||||
|
- /mnt/DockerStorage/komodo/mongo/data:/data/db:rw
|
||||||
|
- /mnt/DockerStorage/komodo/mongo/config:/data/configdb:rw
|
||||||
|
environment:
|
||||||
|
MONGO_INITDB_ROOT_USERNAME: ${DB_USERNAME}
|
||||||
|
MONGO_INITDB_ROOT_PASSWORD: ${DB_PASSWORD}
|
||||||
|
|
||||||
|
core:
|
||||||
|
image: ghcr.io/mbecker20/komodo:${COMPOSE_KOMODO_IMAGE_TAG:-latest}
|
||||||
|
labels:
|
||||||
|
komodo.skip: # Prevent Komodo from stopping with StopAllContainers
|
||||||
|
restart: unless-stopped
|
||||||
|
depends_on:
|
||||||
|
- mongo
|
||||||
|
logging:
|
||||||
|
driver: ${COMPOSE_LOGGING_DRIVER:-local}
|
||||||
|
networks:
|
||||||
|
- default
|
||||||
|
ports:
|
||||||
|
- 9120:9120
|
||||||
|
env_file: ./komodo.env
|
||||||
|
environment:
|
||||||
|
KOMODO_DATABASE_ADDRESS: mongo:27017
|
||||||
|
KOMODO_DATABASE_USERNAME: ${DB_USERNAME}
|
||||||
|
KOMODO_DATABASE_PASSWORD: ${DB_PASSWORD}
|
||||||
|
volumes:
|
||||||
|
## Core cache for repos for latest commit hash / contents
|
||||||
|
- /mnt/DockerStorage/komodo/cache:/repo-cache:rw
|
||||||
|
## Store sync files on server
|
||||||
|
- /mnt/DockerStorage/komodo/syncs:/syncs
|
||||||
|
## Optionally mount a custom core.config.toml
|
||||||
|
- /mnt/DockerStorage/komodo/core.config.toml:/config/config.toml
|
||||||
|
## Allows for systemd Periphery connection at
|
||||||
|
## "http://host.docker.internal:8120"
|
||||||
|
# extra_hosts:
|
||||||
|
# - host.docker.internal:host-gateway
|
||||||
|
|
||||||
|
## Deploy Periphery container using this block,
|
||||||
|
## or deploy the Periphery binary with systemd using
|
||||||
|
## https://github.com/mbecker20/komodo/tree/main/scripts
|
||||||
|
periphery:
|
||||||
|
image: ghcr.io/mbecker20/periphery:${COMPOSE_KOMODO_IMAGE_TAG:-latest}
|
||||||
|
labels:
|
||||||
|
komodo.skip: # Prevent Komodo from stopping with StopAllContainers
|
||||||
|
restart: unless-stopped
|
||||||
|
logging:
|
||||||
|
driver: ${COMPOSE_LOGGING_DRIVER:-local}
|
||||||
|
networks:
|
||||||
|
- default
|
||||||
|
env_file: ./komodo.env
|
||||||
|
volumes:
|
||||||
|
## Mount external docker socket
|
||||||
|
- /var/run/docker.sock:/var/run/docker.sock
|
||||||
|
## Allow Periphery to see processes outside of container
|
||||||
|
- /proc:/proc
|
||||||
|
## use self signed certs in docker volume,
|
||||||
|
## or mount your own signed certs.
|
||||||
|
- /mnt/DockerStorage/komodo/ssl:/etc/komodo/ssl:rw
|
||||||
|
## manage repos in a docker volume,
|
||||||
|
## or change it to an accessible host directory.
|
||||||
|
- /mnt/DockerStorage/komodo/repos:/etc/komodo/repos:rw
|
||||||
|
## manage stack files in a docker volume,
|
||||||
|
## or change it to an accessible host directory.
|
||||||
|
- /mnt/DockerStorage/komodo/stacks:/etc/komodo/stacks:rw
|
||||||
|
## Optionally mount a path to store compose files
|
||||||
|
# - /path/to/compose:/host/compose
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
# Mongo
|
||||||
|
mongo-data:
|
||||||
|
mongo-config:
|
||||||
|
# Core
|
||||||
|
repo-cache:
|
||||||
|
# Periphery
|
||||||
|
ssl-certs:
|
||||||
|
repos:
|
||||||
|
stacks:
|
||||||
|
|
||||||
|
networks:
|
||||||
|
default: {}
|
||||||
191
hosts/common/optional/containers/komodo/default.nix
Normal file
191
hosts/common/optional/containers/komodo/default.nix
Normal file
|
|
@ -0,0 +1,191 @@
|
||||||
|
# Auto-generated using compose2nix v0.3.1.
|
||||||
|
{
|
||||||
|
pkgs,
|
||||||
|
lib,
|
||||||
|
admin,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
let
|
||||||
|
# Only available in the Komodo LXC
|
||||||
|
DockerStorage = "/mnt/DockerStorage/komodo";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
# Containers
|
||||||
|
virtualisation.oci-containers.containers."komodo-core" = {
|
||||||
|
image = "ghcr.io/moghtech/komodo-core:latest";
|
||||||
|
environmentFiles = [
|
||||||
|
./komodo.env
|
||||||
|
];
|
||||||
|
volumes = [
|
||||||
|
"${DockerStorage}/cache:/repo-cache:rw"
|
||||||
|
];
|
||||||
|
ports = [
|
||||||
|
"9120:9120/tcp"
|
||||||
|
];
|
||||||
|
labels = {
|
||||||
|
"komodo.skip" = "";
|
||||||
|
};
|
||||||
|
dependsOn = [
|
||||||
|
"komodo-mongo"
|
||||||
|
];
|
||||||
|
log-driver = "local";
|
||||||
|
extraOptions = [
|
||||||
|
"--network-alias=core"
|
||||||
|
"--network=komodo_default"
|
||||||
|
"--pull=always"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services."docker-komodo-core" = {
|
||||||
|
serviceConfig = {
|
||||||
|
Restart = lib.mkOverride 90 "always";
|
||||||
|
RestartMaxDelaySec = lib.mkOverride 90 "1m";
|
||||||
|
RestartSec = lib.mkOverride 90 "100ms";
|
||||||
|
RestartSteps = lib.mkOverride 90 9;
|
||||||
|
};
|
||||||
|
after = [
|
||||||
|
"docker-network-komodo_default.service"
|
||||||
|
# "docker-volume-komodo_repo-cache.service"
|
||||||
|
];
|
||||||
|
requires = [
|
||||||
|
"docker-network-komodo_default.service"
|
||||||
|
# "docker-volume-komodo_repo-cache.service"
|
||||||
|
];
|
||||||
|
partOf = [
|
||||||
|
"docker-compose-komodo-root.target"
|
||||||
|
];
|
||||||
|
wantedBy = [
|
||||||
|
"docker-compose-komodo-root.target"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
virtualisation.oci-containers.containers."komodo-mongo" = {
|
||||||
|
image = "mongo";
|
||||||
|
environmentFiles = [
|
||||||
|
./komodo.env
|
||||||
|
];
|
||||||
|
volumes = [
|
||||||
|
"${DockerStorage}/mongo/config:/data/configdb:rw"
|
||||||
|
"${DockerStorage}/mongo/data:/data/db:rw"
|
||||||
|
];
|
||||||
|
cmd = [
|
||||||
|
"--quiet"
|
||||||
|
"--wiredTigerCacheSizeGB"
|
||||||
|
"0.25"
|
||||||
|
];
|
||||||
|
labels = {
|
||||||
|
"komodo.skip" = "";
|
||||||
|
};
|
||||||
|
log-driver = "local";
|
||||||
|
extraOptions = [
|
||||||
|
"--network-alias=mongo"
|
||||||
|
"--network=komodo_default"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services."docker-komodo-mongo" = {
|
||||||
|
serviceConfig = {
|
||||||
|
Restart = lib.mkOverride 90 "always";
|
||||||
|
RestartMaxDelaySec = lib.mkOverride 90 "1m";
|
||||||
|
RestartSec = lib.mkOverride 90 "100ms";
|
||||||
|
RestartSteps = lib.mkOverride 90 9;
|
||||||
|
};
|
||||||
|
after = [
|
||||||
|
"docker-network-komodo_default.service"
|
||||||
|
# "docker-volume-komodo_mongo-config.service"
|
||||||
|
# "docker-volume-komodo_mongo-data.service"
|
||||||
|
];
|
||||||
|
requires = [
|
||||||
|
"docker-network-komodo_default.service"
|
||||||
|
# "docker-volume-komodo_mongo-config.service"
|
||||||
|
# "docker-volume-komodo_mongo-data.service"
|
||||||
|
];
|
||||||
|
partOf = [
|
||||||
|
"docker-compose-komodo-root.target"
|
||||||
|
];
|
||||||
|
wantedBy = [
|
||||||
|
"docker-compose-komodo-root.target"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
virtualisation.oci-containers.containers."komodo-periphery" = {
|
||||||
|
image = "ghcr.io/moghtech/komodo-periphery:latest";
|
||||||
|
environmentFiles = [
|
||||||
|
./komodo.env
|
||||||
|
];
|
||||||
|
volumes = [
|
||||||
|
"/proc:/proc:rw"
|
||||||
|
"/var/run/docker.sock:/var/run/docker.sock:rw"
|
||||||
|
"${DockerStorage}/repos:/etc/komodo/repos:rw"
|
||||||
|
"${DockerStorage}/ssl:/etc/komodo/ssl:rw"
|
||||||
|
"${DockerStorage}/stacks:${DockerStorage}/stacks:rw"
|
||||||
|
];
|
||||||
|
labels = {
|
||||||
|
"komodo.skip" = "";
|
||||||
|
};
|
||||||
|
log-driver = "local";
|
||||||
|
extraOptions = [
|
||||||
|
"--network-alias=periphery"
|
||||||
|
"--network=komodo_default"
|
||||||
|
"--pull=always"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services."docker-komodo-periphery" = {
|
||||||
|
serviceConfig = {
|
||||||
|
Restart = lib.mkOverride 90 "always";
|
||||||
|
RestartMaxDelaySec = lib.mkOverride 90 "1m";
|
||||||
|
RestartSec = lib.mkOverride 90 "100ms";
|
||||||
|
RestartSteps = lib.mkOverride 90 9;
|
||||||
|
};
|
||||||
|
after = [
|
||||||
|
"docker-network-komodo_default.service"
|
||||||
|
# "docker-volume-komodo_repos.service"
|
||||||
|
# "docker-volume-komodo_ssl-certs.service"
|
||||||
|
# "docker-volume-komodo_stacks.service"
|
||||||
|
];
|
||||||
|
requires = [
|
||||||
|
"docker-network-komodo_default.service"
|
||||||
|
# "docker-volume-komodo_repos.service"
|
||||||
|
# "docker-volume-komodo_ssl-certs.service"
|
||||||
|
# "docker-volume-komodo_stacks.service"
|
||||||
|
];
|
||||||
|
partOf = [
|
||||||
|
"docker-compose-komodo-root.target"
|
||||||
|
];
|
||||||
|
wantedBy = [
|
||||||
|
"docker-compose-komodo-root.target"
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
# Networks
|
||||||
|
systemd.services."docker-network-komodo_default" = {
|
||||||
|
path = [ pkgs.docker ];
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = true;
|
||||||
|
ExecStop = "docker network rm -f komodo_default";
|
||||||
|
};
|
||||||
|
script = ''
|
||||||
|
docker network inspect komodo_default || docker network create komodo_default
|
||||||
|
'';
|
||||||
|
partOf = [ "docker-compose-komodo-root.target" ];
|
||||||
|
wantedBy = [ "docker-compose-komodo-root.target" ];
|
||||||
|
};
|
||||||
|
|
||||||
|
# Root service
|
||||||
|
# When started, this will automatically create all resources and start
|
||||||
|
# the containers. When stopped, this will teardown all resources.
|
||||||
|
systemd.targets."docker-compose-komodo-root" = {
|
||||||
|
unitConfig = {
|
||||||
|
Description = "Root target generated by compose2nix.";
|
||||||
|
};
|
||||||
|
after = [
|
||||||
|
"docker-authentik-worker.service"
|
||||||
|
];
|
||||||
|
requires = [
|
||||||
|
"docker-authentik-worker.service"
|
||||||
|
];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
};
|
||||||
|
}
|
||||||
74
hosts/nixos/cloud/default.nix
Normal file
74
hosts/nixos/cloud/default.nix
Normal file
|
|
@ -0,0 +1,74 @@
|
||||||
|
###############################################################
|
||||||
|
#
|
||||||
|
# Prozy - LXC Container
|
||||||
|
# NixOS container, Ryzen 5 5600G (3 Cores), 2GB/2GB RAM/SWAP
|
||||||
|
#
|
||||||
|
###############################################################
|
||||||
|
|
||||||
|
{
|
||||||
|
inputs,
|
||||||
|
lib,
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
let
|
||||||
|
username = "toph";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
imports = lib.flatten [
|
||||||
|
## Hardware ##
|
||||||
|
./hardware.nix
|
||||||
|
|
||||||
|
(map lib.custom.relativeToRoot [
|
||||||
|
## Required Configs ##
|
||||||
|
"hosts/common/core"
|
||||||
|
|
||||||
|
## Optional Configs ##
|
||||||
|
"hosts/common/optional/acme"
|
||||||
|
"hosts/common/optional/caddy"
|
||||||
|
"hosts/common/optional/docker.nix"
|
||||||
|
"hosts/common/optional/containers/cloudflared.nix"
|
||||||
|
|
||||||
|
## Cloud Specific ##
|
||||||
|
"hosts/users/${username}" # # Not the best solution but I always have one user so ¯\_(ツ)_/¯
|
||||||
|
])
|
||||||
|
];
|
||||||
|
|
||||||
|
## Host Specifications ##
|
||||||
|
hostSpec = {
|
||||||
|
hostName = "cloud";
|
||||||
|
username = username;
|
||||||
|
handle = "tophC7";
|
||||||
|
password = "[REDACTED]";
|
||||||
|
[REDACTED];
|
||||||
|
email = "[REDACTED]";
|
||||||
|
userFullName = "[REDACTED]";
|
||||||
|
isARM = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
networking = {
|
||||||
|
enableIPv6 = false;
|
||||||
|
# Container Ports
|
||||||
|
[REDACTED]
|
||||||
|
80 # Caddy
|
||||||
|
443 # Caddy
|
||||||
|
[REDACTED]
|
||||||
|
];
|
||||||
|
};
|
||||||
|
|
||||||
|
## System-wide packages ##
|
||||||
|
programs.nix-ld.enable = true;
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
lazydocker
|
||||||
|
];
|
||||||
|
|
||||||
|
environment.etc = {
|
||||||
|
"cloudflared/.keep" = {
|
||||||
|
text = "This directory is used to store cloudflared configuration files.";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
# https://wiki.nixos.org/wiki/FAQ/When_do_I_update_stateVersion
|
||||||
|
system.stateVersion = "24.11";
|
||||||
|
}
|
||||||
12
hosts/nixos/cloud/hardware.nix
Normal file
12
hosts/nixos/cloud/hardware.nix
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
{
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
{
|
||||||
|
imports = lib.flatten [
|
||||||
|
(map lib.custom.relativeToRoot [
|
||||||
|
"hosts/common/optional/system/lxc.nix"
|
||||||
|
"hosts/common/optional/system/pool.nix"
|
||||||
|
])
|
||||||
|
];
|
||||||
|
}
|
||||||
102
hosts/nixos/komodo/default.nix
Normal file
102
hosts/nixos/komodo/default.nix
Normal file
|
|
@ -0,0 +1,102 @@
|
||||||
|
###############################################################
|
||||||
|
#
|
||||||
|
# Komodo - LXC Container
|
||||||
|
# NixOS container, Ryzen 5 5600G (12 Cores), 30GB/2GB RAM/SWAP
|
||||||
|
#
|
||||||
|
###############################################################
|
||||||
|
|
||||||
|
{
|
||||||
|
inputs,
|
||||||
|
lib,
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
let
|
||||||
|
username = "toph";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
imports = lib.flatten [
|
||||||
|
## Hardware ##
|
||||||
|
./hardware.nix
|
||||||
|
|
||||||
|
(map lib.custom.relativeToRoot [
|
||||||
|
## Required Configs ##
|
||||||
|
"hosts/common/core"
|
||||||
|
|
||||||
|
## Optional Configs ##
|
||||||
|
"hosts/common/optional/acme"
|
||||||
|
"hosts/common/optional/caddy"
|
||||||
|
"hosts/common/optional/docker.nix"
|
||||||
|
"hosts/common/containers/authentik"
|
||||||
|
"hosts/common/containers/komodo"
|
||||||
|
|
||||||
|
## Komodo Specific ##
|
||||||
|
"hosts/users/${username}" # # Not the best solution but I always have one user so ¯\_(ツ)_/¯
|
||||||
|
])
|
||||||
|
];
|
||||||
|
|
||||||
|
## Host Specifications ##
|
||||||
|
hostSpec = {
|
||||||
|
hostName = "komodo";
|
||||||
|
username = username;
|
||||||
|
handle = "tophC7";
|
||||||
|
password = "[REDACTED]";
|
||||||
|
[REDACTED];
|
||||||
|
email = "[REDACTED]";
|
||||||
|
userFullName = "[REDACTED]";
|
||||||
|
isARM = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
networking = {
|
||||||
|
enableIPv6 = false;
|
||||||
|
# Container Ports
|
||||||
|
firewall = {
|
||||||
|
allowedTCPPorts = [
|
||||||
|
[REDACTED]
|
||||||
|
[REDACTED]
|
||||||
|
[REDACTED]
|
||||||
|
222 # Forgejo SSH
|
||||||
|
[REDACTED]
|
||||||
|
[REDACTED]
|
||||||
|
[REDACTED]
|
||||||
|
[REDACTED]
|
||||||
|
[REDACTED]
|
||||||
|
8080 # File Browser
|
||||||
|
[REDACTED]
|
||||||
|
[REDACTED]
|
||||||
|
[REDACTED]
|
||||||
|
[REDACTED]
|
||||||
|
[REDACTED]
|
||||||
|
];
|
||||||
|
|
||||||
|
# Game Server Ports
|
||||||
|
allowedTCPPortRanges = [
|
||||||
|
{
|
||||||
|
[REDACTED]
|
||||||
|
[REDACTED]
|
||||||
|
}
|
||||||
|
];
|
||||||
|
|
||||||
|
allowedUDPPorts = [
|
||||||
|
8089 # Grafana
|
||||||
|
];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
## System-wide packages ##
|
||||||
|
programs.nix-ld.enable = true;
|
||||||
|
environment.systemPackages = with pkgs; [
|
||||||
|
lazydocker
|
||||||
|
compose2nix
|
||||||
|
];
|
||||||
|
|
||||||
|
# environment.etc = {
|
||||||
|
# "cloudflared/.keep" = {
|
||||||
|
# text = "This directory is used to store cloudflared configuration files.";
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
|
||||||
|
# https://wiki.nixos.org/wiki/FAQ/When_do_I_update_stateVersion
|
||||||
|
system.stateVersion = "24.11";
|
||||||
|
}
|
||||||
12
hosts/nixos/komodo/hardware.nix
Normal file
12
hosts/nixos/komodo/hardware.nix
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
{
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
{
|
||||||
|
imports = lib.flatten [
|
||||||
|
(map lib.custom.relativeToRoot [
|
||||||
|
"hosts/common/optional/system/lxc.nix"
|
||||||
|
"hosts/common/optional/system/pool.nix"
|
||||||
|
])
|
||||||
|
];
|
||||||
|
}
|
||||||
65
hosts/nixos/nix/default.nix
Normal file
65
hosts/nixos/nix/default.nix
Normal file
|
|
@ -0,0 +1,65 @@
|
||||||
|
###############################################################
|
||||||
|
#
|
||||||
|
# Nix - LXC Container
|
||||||
|
# NixOS container, Ryzen 5 5600G (10 Cores), 12GB/6GB RAM/SWAP
|
||||||
|
#
|
||||||
|
###############################################################
|
||||||
|
|
||||||
|
# TODO: x2go server for remote access
|
||||||
|
|
||||||
|
{
|
||||||
|
inputs,
|
||||||
|
lib,
|
||||||
|
config,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
let
|
||||||
|
username = "toph";
|
||||||
|
in
|
||||||
|
{
|
||||||
|
imports = lib.flatten [
|
||||||
|
## Hardware ##
|
||||||
|
./hardware.nix
|
||||||
|
|
||||||
|
(map lib.custom.relativeToRoot [
|
||||||
|
## Required Configs ##
|
||||||
|
"hosts/common/core"
|
||||||
|
|
||||||
|
## Optional Configs ##
|
||||||
|
|
||||||
|
## Nix Specific ##
|
||||||
|
"hosts/users/${username}" # # Not the best solution but I always have one user so ¯\_(ツ)_/¯
|
||||||
|
])
|
||||||
|
];
|
||||||
|
|
||||||
|
## Host Specifications ##
|
||||||
|
hostSpec = {
|
||||||
|
hostName = "nix";
|
||||||
|
username = username;
|
||||||
|
handle = "tophC7";
|
||||||
|
password = "[REDACTED]";
|
||||||
|
[REDACTED];
|
||||||
|
email = "[REDACTED]";
|
||||||
|
userFullName = "[REDACTED]";
|
||||||
|
isARM = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
networking = {
|
||||||
|
enableIPv6 = false;
|
||||||
|
};
|
||||||
|
|
||||||
|
## System-wide packages ##
|
||||||
|
programs.nix-ld.enable = true;
|
||||||
|
# environment.systemPackages = with pkgs; [
|
||||||
|
# ];
|
||||||
|
|
||||||
|
# environment.etc = {
|
||||||
|
# "cloudflared/.keep" = {
|
||||||
|
# text = "This directory is used to store cloudflared configuration files.";
|
||||||
|
# };
|
||||||
|
# };
|
||||||
|
|
||||||
|
# https://wiki.nixos.org/wiki/FAQ/When_do_I_update_stateVersion
|
||||||
|
system.stateVersion = "24.11";
|
||||||
|
}
|
||||||
12
hosts/nixos/nix/hardware.nix
Normal file
12
hosts/nixos/nix/hardware.nix
Normal file
|
|
@ -0,0 +1,12 @@
|
||||||
|
{
|
||||||
|
lib,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
{
|
||||||
|
imports = lib.flatten [
|
||||||
|
(map lib.custom.relativeToRoot [
|
||||||
|
"hosts/common/optional/system/lxc.nix"
|
||||||
|
"hosts/common/optional/system/pool.nix"
|
||||||
|
])
|
||||||
|
];
|
||||||
|
}
|
||||||
Loading…
Add table
Reference in a new issue