mirror of
https://github.com/srid/nixos-config.git
synced 2026-07-16 22:01:33 +08:00
cc95849e4e
Phase 1 of the incus-pet design. Adds the deployment infrastructure under modules/nixos/linux/incus/ — a CLI, a container-essentials NixOS module, a SKILL.md for agent-driven adoption — and deletes the webapps/ tree (nspawn-based, weaker isolation defaults, no live consumers). Pairs with srid/anywhen#15 (nixosModules.incus on the anywhen flake) for end-to-end deployment of anywhen as an incus container. Surface added: - modules/nixos/linux/incus/container.nix container essentials (sshd, hostname, flakes, firewall, base packages); imported by the marshaling flake incus-pet generates per app - modules/nixos/linux/incus/incus-pet/ CLI tree: default.nix writeShellApplication; subcommands deploy/list/rm SKILL.md 3-branch agent recipe (deploy / wrapper / add contract upstream) README.md human docs with the full network-model section - modules/flake-parts/incus-pet.nix exposes packages.incus-pet Surface removed: - modules/nixos/linux/anywhen.nix anywhen runs as a container now, not as a host-installed service - configurations/nixos/pureintent drops the anywhen import and the services.anywhen.host wiring - webapps/ deleted entirely Port convention: every containerized service binds 8080 inside its own netns. The host-side <listen-ip>:<host-port> is unique per app, chosen at first deploy via --port + --listen (or INCUS_PET_LISTEN env), and recorded in container metadata so re-deploys are flagless. Run: nix run .#incus-pet -- deploy github:srid/anywhen \ --port 7700 --listen 100.122.32.106 See modules/nixos/linux/incus/incus-pet/README.md for the operator flow and the network model in full.
96 lines
3 KiB
Nix
96 lines
3 KiB
Nix
{ config, flake, lib, ... }:
|
|
|
|
let
|
|
inherit (flake) inputs;
|
|
inherit (inputs) self;
|
|
homeMod = self + /modules/home;
|
|
in
|
|
{
|
|
nixos-unified.sshTarget = "srid@pureintent";
|
|
# nixos-unified.sshTarget = "srid@192.168.2.134";
|
|
nixos-unified.localPrivilegeMode = "sudo-nixos-rebuild";
|
|
|
|
security.sudo.extraRules = [
|
|
{
|
|
users = [ flake.config.me.username ];
|
|
commands = [
|
|
{
|
|
command = "/run/current-system/sw/bin/nixos-rebuild switch *";
|
|
options = [ "NOPASSWD" ];
|
|
}
|
|
];
|
|
}
|
|
];
|
|
|
|
imports = [
|
|
self.nixosModules.default
|
|
./configuration.nix
|
|
./devbox.nix
|
|
(self + /modules/nixos/linux/beszel.nix)
|
|
(self + /modules/nixos/linux/incus)
|
|
];
|
|
|
|
# anywhen runs as an incus-pet container now (see modules/nixos/linux/incus/incus-pet);
|
|
# deploy with: incus-pet deploy github:srid/anywhen --port 7700 --listen 100.122.32.106
|
|
|
|
# Expose the incus UI on the Tailscale interface only.
|
|
virtualisation.incus.preseed.config."core.https_address" = "100.122.32.106:8443";
|
|
|
|
users.users.${flake.config.me.username}.linger = true;
|
|
home-manager.sharedModules = [
|
|
"${homeMod}/cli/ssh-agent-forwarding.nix"
|
|
"${homeMod}/cli/controlpersist.nix"
|
|
"${homeMod}/claude-code"
|
|
"${homeMod}/work/juspay.nix"
|
|
"${homeMod}/services/vira.nix"
|
|
"${homeMod}/services/kolu.nix"
|
|
{
|
|
services.kolu.host = "100.122.32.106"; # Tailscale IP of pureintent
|
|
}
|
|
|
|
# "${homeMod}/services/dropbox.nix"
|
|
# "${homeMod}/services/obsidian.nix"
|
|
|
|
# Remote builders
|
|
"${homeMod}/nix/buildMachines"
|
|
"${homeMod}/nix/buildMachines/sincereintent.nix"
|
|
|
|
"${homeMod}/nix/gc.nix"
|
|
];
|
|
|
|
nix.settings = {
|
|
sandbox = "relaxed";
|
|
extra-experimental-features = [ "impure-derivations" "ca-derivations" ];
|
|
};
|
|
# GC is handled via home-manager (modules/home/nix/gc.nix)
|
|
|
|
zramSwap.enable = true;
|
|
swapDevices = [{
|
|
device = "/var/lib/swapfile";
|
|
size = 32 * 1024; # 32GB in megabytes
|
|
}];
|
|
|
|
services.openssh.enable = true;
|
|
services.tailscale.enable = true;
|
|
# tailscaled installs its rules via iptables-nft, which live in a different
|
|
# table from the nftables firewall that incus requires. Adding tailscale0 here
|
|
# gets it into the nftables trusted-interfaces set too.
|
|
networking.firewall.trustedInterfaces = [ "tailscale0" ];
|
|
networking.firewall.allowedTCPPorts = [
|
|
80
|
|
443
|
|
];
|
|
|
|
programs.nix-ld.enable = true; # for vscode server
|
|
|
|
# Workaround the annoying `Failed to start Network Manager Wait Online` error on switch.
|
|
# https://github.com/NixOS/nixpkgs/issues/180175
|
|
systemd.services.NetworkManager-wait-online.enable = false;
|
|
|
|
# Workaround `nixos-rebuild switch` hanging at "reloading the following units:
|
|
# dbus-broker.service". The reload step stalls (broker has long-lived clients
|
|
# holding the bus); skip reload/restart during activation. Bus policy changes
|
|
# land on next boot instead.
|
|
systemd.services.dbus-broker.reloadIfChanged = lib.mkForce false;
|
|
systemd.services.dbus-broker.restartIfChanged = lib.mkForce false;
|
|
}
|