Resolve cyberchef and radicale images using nix-snapshotter
Increase inotify max user instances to 256 Disable tailscale by default
This commit is contained in:
parent
52efd614fe
commit
e9899c0d0f
11 changed files with 129 additions and 81 deletions
|
|
@ -1,22 +1,6 @@
|
|||
{ inputs, pkgs, lib, config, ... }:
|
||||
{ self, inputs, pkgs, lib, config, ... }:
|
||||
let
|
||||
cfg = config.lab.k3s;
|
||||
|
||||
k3s-cni-plugins = pkgs.buildEnv {
|
||||
name = "k3s-cni-plugins";
|
||||
paths = with pkgs; [
|
||||
cni-plugins
|
||||
cni-plugin-flannel
|
||||
];
|
||||
};
|
||||
|
||||
image = pkgs.nix-snapshotter.buildImage {
|
||||
name = "redis";
|
||||
resolvedByNix = true;
|
||||
config = {
|
||||
entrypoint = [ "${pkgs.redis}/bin/redis-server" ];
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
options.lab.k3s = {
|
||||
|
|
@ -78,30 +62,40 @@ in
|
|||
address = "/run/nix-snapshotter/nix-snapshotter.sock";
|
||||
};
|
||||
|
||||
plugins = {
|
||||
"io.containerd.grpc.v1.cri" = {
|
||||
stream_server_address = "127.0.0.1";
|
||||
stream_server_port = "10010";
|
||||
enable_selinux = false;
|
||||
enable_unprivileged_ports = true;
|
||||
enable_unprivileged_icmp = true;
|
||||
disable_apparmor = true;
|
||||
disable_cgroup = true;
|
||||
restrict_oom_score_adj = true;
|
||||
sandbox_image = "rancher/mirrored-pause:3.6";
|
||||
containerd.snapshotter = "nix";
|
||||
|
||||
cni = {
|
||||
conf_dir = "/var/lib/rancher/k3s/agent/etc/cni/net.d/";
|
||||
bin_dir = "${k3s-cni-plugins}/bin";
|
||||
plugins =
|
||||
let
|
||||
k3s-cni-plugins = pkgs.buildEnv {
|
||||
name = "k3s-cni-plugins";
|
||||
paths = with pkgs; [
|
||||
cni-plugins
|
||||
cni-plugin-flannel
|
||||
];
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
"io.containerd.grpc.v1.cri" = {
|
||||
stream_server_address = "127.0.0.1";
|
||||
stream_server_port = "10010";
|
||||
enable_selinux = false;
|
||||
enable_unprivileged_ports = true;
|
||||
enable_unprivileged_icmp = true;
|
||||
disable_apparmor = true;
|
||||
disable_cgroup = true;
|
||||
restrict_oom_score_adj = true;
|
||||
sandbox_image = "rancher/mirrored-pause:3.6";
|
||||
containerd.snapshotter = "nix";
|
||||
|
||||
"io.containerd.transfer.v1.local".unpack_config = [{
|
||||
platform = "linux/amd64";
|
||||
snapshotter = "nix";
|
||||
}];
|
||||
};
|
||||
cni = {
|
||||
conf_dir = "/var/lib/rancher/k3s/agent/etc/cni/net.d/";
|
||||
bin_dir = "${k3s-cni-plugins}/bin";
|
||||
};
|
||||
};
|
||||
|
||||
"io.containerd.transfer.v1.local".unpack_config = [{
|
||||
platform = "linux/amd64";
|
||||
snapshotter = "nix";
|
||||
}];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -145,9 +139,9 @@ in
|
|||
"L+ /usr/local/bin - - - - /run/current-system/sw/bin/"
|
||||
];
|
||||
|
||||
system = lib.mkIf (cfg.role == "server") {
|
||||
activationScripts = {
|
||||
k3s-bootstrap.text = (
|
||||
system.activationScripts = {
|
||||
k3s-bootstrap = lib.mkIf (cfg.role == "server") {
|
||||
text = (
|
||||
let
|
||||
k3sBootstrapFile = (inputs.kubenix.evalModules.x86_64-linux {
|
||||
module = import ./bootstrap.nix;
|
||||
|
|
@ -158,8 +152,10 @@ in
|
|||
ln -sf ${k3sBootstrapFile} /var/lib/rancher/k3s/server/manifests/k3s-bootstrap.json
|
||||
''
|
||||
);
|
||||
};
|
||||
|
||||
k3s-certs.text = ''
|
||||
k3s-certs = lib.mkIf (cfg.role == "server") {
|
||||
text = ''
|
||||
mkdir -p /var/lib/rancher/k3s/server/tls/etcd
|
||||
cp -f ${./k3s-ca/server-ca.crt} /var/lib/rancher/k3s/server/tls/server-ca.crt
|
||||
cp -f ${./k3s-ca/client-ca.crt} /var/lib/rancher/k3s/server/tls/client-ca.crt
|
||||
|
|
@ -167,11 +163,47 @@ in
|
|||
cp -f ${./k3s-ca/etcd/peer-ca.crt} /var/lib/rancher/k3s/server/tls/etcd/peer-ca.crt
|
||||
cp -f ${./k3s-ca/etcd/server-ca.crt} /var/lib/rancher/k3s/server/tls/etcd/server-ca.crt
|
||||
'';
|
||||
|
||||
nix-snapshotter-image = ''
|
||||
ln -sf ${image} /root/image.tar
|
||||
'';
|
||||
};
|
||||
|
||||
docker-images.text =
|
||||
let
|
||||
imageLinkDir = "/var/docker_images";
|
||||
imageDefs = import "${self}/container-images.nix";
|
||||
|
||||
setupCommands = [
|
||||
"rm -rf ${imageLinkDir}"
|
||||
"mkdir -p ${imageLinkDir}"
|
||||
];
|
||||
|
||||
getDockerImageConfig = dockerImage:
|
||||
let
|
||||
configJson = pkgs.runCommand "config.json"
|
||||
{
|
||||
nativeBuildInputs = [ pkgs.skopeo pkgs.jq ];
|
||||
}
|
||||
''
|
||||
skopeo --tmpdir $TMPDIR --insecure-policy inspect docker-archive:${dockerImage} --config | jq '.config' > $out
|
||||
'';
|
||||
in
|
||||
builtins.fromJSON (builtins.readFile configJson);
|
||||
|
||||
imageDefToLinkCommand = name: imageDef:
|
||||
let
|
||||
dockerImage = pkgs.dockerTools.pullImage imageDef;
|
||||
nixSnapshotterImage = pkgs.nix-snapshotter.buildImage {
|
||||
inherit name;
|
||||
resolvedByNix = true;
|
||||
fromImage = dockerImage;
|
||||
config = getDockerImageConfig dockerImage;
|
||||
};
|
||||
imageLinkPath = "${imageLinkDir}/${name}.tar";
|
||||
in
|
||||
"ln -sf ${nixSnapshotterImage} ${imageLinkPath}";
|
||||
|
||||
linkCommandList = lib.attrsets.mapAttrsToList imageDefToLinkCommand imageDefs;
|
||||
commandList = setupCommands ++ linkCommandList;
|
||||
in
|
||||
builtins.concatStringsSep "\n" commandList;
|
||||
};
|
||||
|
||||
sops.secrets =
|
||||
|
|
|
|||
|
|
@ -4,13 +4,17 @@ let
|
|||
in
|
||||
{
|
||||
options = {
|
||||
lab.tailscale.advertiseExitNode = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
lab.tailscale = {
|
||||
enable = lib.mkEnableOption "tailscale";
|
||||
|
||||
advertiseExitNode = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = {
|
||||
config = lib.mkIf cfg.enable {
|
||||
services.tailscale = {
|
||||
enable = true;
|
||||
authKeyFile = config.sops.secrets."tailscale/authKey".path;
|
||||
|
|
@ -25,5 +29,7 @@ in
|
|||
};
|
||||
|
||||
sops.secrets."tailscale/authKey" = { };
|
||||
|
||||
systemd.network.wait-online.ignoredInterfaces = [ "tailscale0" ];
|
||||
};
|
||||
}
|
||||
|
|
|
|||
Reference in a new issue