Dominik Polakovics
53d73142ae
- Introduced a new module for a11ywatch with Podman support, creating a bridge network and defining backend and frontend containers. - Configured Nginx to serve the a11ywatch application with SSL and ACME support. - Added user and group configurations for a11ywatch. - Created a systemd service to ensure the Podman network exists on boot. Implement Firefox Container Controller extension and host - Added a module for the Firefox Container Controller extension, allowing installation via Nix. - Created a native messaging host for the extension to communicate with the container controller. - Included CLI helpers to enqueue commands for showing and hiding containers. Enable fingerprint authentication in PAM - Configured fingerprint authentication for login, sudo, and swaylock services. Setup Raspberry Pi OS image creation script - Developed a script to create a read-only Raspberry Pi OS Lite image with Snapcast client. - Included configuration for Wi-Fi, hostname, and Snapcast server. - Implemented user and group setup for Snapcast client and ensured necessary services are enabled. Document Raspberry Pi Zero W setup instructions - Added detailed instructions for configuring Raspberry Pi OS on Zero W, including disabling unused services and setting up Snapcast client. Create test configuration script for NixOS - Implemented a script to perform dry-builds for NixOS configurations, allowing for easy validation of host configurations.
95 lines
2.8 KiB
Nix
95 lines
2.8 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
let
|
|
domain = "a11ywatch.cloonar.com";
|
|
confDir = "/var/lib/a11ywatch";
|
|
|
|
json = pkgs.formats.json { };
|
|
in {
|
|
# 1) Enable Podman (daemonless, drop-in for docker)
|
|
virtualisation.podman.enable = true; # :contentReference[oaicite:0]{index=0}
|
|
virtualisation.podman.dockerCompat = true; # :contentReference[oaicite:1]{index=1}
|
|
virtualisation.podman.defaultNetwork.settings.dns_enabled = true;# :contentReference[oaicite:2]{index=2}
|
|
|
|
services.nginx.virtualHosts."${domain}" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:3000/";
|
|
};
|
|
};
|
|
|
|
environment.etc."containers/networks/a11ywatch-net.json" = {
|
|
source = json.generate "a11ywatch-net.json" ({
|
|
name = "a11ywatch-net";
|
|
id = "ccb4b7fb90d2df26db27ef0995765b04f52d318db752c9474b470c5ef4d7978d";
|
|
driver = "bridge";
|
|
network_interface = "podman1";
|
|
subnets = [
|
|
{
|
|
subnet = "10.89.0.0/24";
|
|
gateway = "10.89.0.1";
|
|
}
|
|
];
|
|
ipv6_enabled = false;
|
|
internal = false;
|
|
dns_enabled = true;
|
|
ipam_options = {
|
|
driver = "host-local";
|
|
};
|
|
});
|
|
};
|
|
|
|
users.users.a11ywatch = {
|
|
isSystemUser = true;
|
|
group = "a11ywatch";
|
|
home = "/var/lib/a11ywatch";
|
|
createHome = true;
|
|
};
|
|
users.groups.a11ywatch = { };
|
|
users.groups.docker.members = [ "a11ywatch" ];
|
|
|
|
# 2) Create the bridge network on boot via a oneshot systemd service
|
|
systemd.services.a11ywatch-net = {
|
|
description = "Ensure a11ywatch-net Podman network exists";
|
|
wants = [ "podman.service" ];
|
|
after = [ "podman.service" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = ''
|
|
${pkgs.podman}/bin/podman network inspect a11ywatch-net >/dev/null 2>&1 \
|
|
|| ${pkgs.podman}/bin/podman network create a11ywatch-net
|
|
'';
|
|
RemainAfterExit = true;
|
|
};
|
|
wantedBy = [
|
|
"multi-user.target"
|
|
];
|
|
};
|
|
|
|
# 3) Declare your two containers using the podman backend
|
|
virtualisation.oci-containers = {
|
|
backend = "podman"; # :contentReference[oaicite:3]{index=3}
|
|
containers = {
|
|
a11ywatch-backend = {
|
|
image = "docker.io/a11ywatch/a11ywatch:latest";
|
|
autoStart = true;
|
|
ports = [ "3280:3280" ];
|
|
volumes = [ "${confDir}:/a11ywatch/conf" ];
|
|
environment = { SUPER_MODE = "true"; };
|
|
extraOptions = [ "--network=a11ywatch-net" ];
|
|
};
|
|
a11ywatch-frontend = {
|
|
image = "docker.io/a11ywatch/web:latest";
|
|
autoStart = true;
|
|
ports = [ "3000:3000" ];
|
|
volumes = [ "${confDir}:/a11ywatch/conf" ];
|
|
environment = { SUPER_MODE = "true"; };
|
|
extraOptions = [
|
|
"--network=a11ywatch-net"
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|