219 lines
4.2 KiB
Nix
219 lines
4.2 KiB
Nix
{
|
|
pkgs,
|
|
hostInfo,
|
|
dsl,
|
|
self,
|
|
lib,
|
|
customPkgs,
|
|
...
|
|
}:
|
|
let
|
|
inherit (dsl) mkContainer;
|
|
inherit (hostInfo.paths) server data;
|
|
|
|
sshTrait = {
|
|
resources.fs."/etc/ssh/authorized_keys" = {
|
|
hostPath = "${server}/keypair/id_ed25519.pub";
|
|
isReadOnly = true;
|
|
};
|
|
users = [
|
|
{
|
|
name = "runner";
|
|
uid = 1000;
|
|
}
|
|
];
|
|
containerConfig =
|
|
{
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
lib.mkMerge [
|
|
{
|
|
services.openssh = {
|
|
enable = true;
|
|
authorizedKeysFiles = [ "/etc/ssh/authorized_keys" ];
|
|
settings = {
|
|
PasswordAuthentication = false;
|
|
UseDns = false;
|
|
PrintMotd = false;
|
|
};
|
|
};
|
|
systemd.services.sshd.serviceConfig.FailureAction = "exit-force";
|
|
}
|
|
{
|
|
environment.systemPackages = [
|
|
customPkgs.kitty-terminfo
|
|
pkgs.wezterm.terminfo
|
|
];
|
|
}
|
|
];
|
|
};
|
|
|
|
mkSsh =
|
|
{
|
|
name,
|
|
packages ? [ ],
|
|
nixDaemon ? true,
|
|
routingInfo ? {
|
|
username = lib.strings.removePrefix "ssh-" name;
|
|
},
|
|
net ? { },
|
|
resources ? { },
|
|
traits ? [ ],
|
|
isolation ? { },
|
|
}:
|
|
mkContainer {
|
|
inherit name;
|
|
inherit net resources;
|
|
svc.autoStart = true;
|
|
isolation = {
|
|
inherit nixDaemon;
|
|
}
|
|
// isolation;
|
|
traits = [ sshTrait ] ++ traits;
|
|
packages = with pkgs; [ tmux ] ++ packages;
|
|
miscProperties = self._sshpiperRegister routingInfo;
|
|
};
|
|
|
|
kvmTrait = {
|
|
containerConfig =
|
|
{ pkgs, ... }:
|
|
{
|
|
users.users.runner.extraGroups = [ "kvm" ];
|
|
environment.systemPackages = [ pkgs.qemu_kvm ];
|
|
};
|
|
};
|
|
in
|
|
{
|
|
ssh-admin = mkSsh {
|
|
name = "ssh-admin";
|
|
net.access = [
|
|
{
|
|
to = "overseer";
|
|
tcp = [ 80 ];
|
|
}
|
|
];
|
|
resources.fs = {
|
|
"/home/runner/data" = {
|
|
hostPath = server;
|
|
isReadOnly = false;
|
|
};
|
|
"/run/dbus/system_bus_socket" = {
|
|
hostPath = "/run/dbus/system_bus_socket";
|
|
isReadOnly = false;
|
|
};
|
|
};
|
|
packages = with pkgs; [
|
|
git
|
|
systemd
|
|
];
|
|
};
|
|
|
|
ssh-botm = mkSsh {
|
|
name = "ssh-botm";
|
|
resources.fs."/home/runner/botm" = {
|
|
hostPath = "${data}/mc/botm";
|
|
isReadOnly = false;
|
|
};
|
|
packages = with pkgs; [
|
|
python3
|
|
jdk17
|
|
tmux
|
|
];
|
|
};
|
|
|
|
ssh-generic = mkSsh {
|
|
name = "ssh-generic";
|
|
net.access = [ { to = "@internet"; } ];
|
|
resources = {
|
|
fs."/home/runner/data" = {
|
|
hostPath = "${data}/ssh/generic";
|
|
isReadOnly = false;
|
|
};
|
|
mem = "16G";
|
|
cpu = 65;
|
|
};
|
|
traits = [ kvmTrait ];
|
|
isolation.allowedDevices = [
|
|
{
|
|
node = "/dev/kvm";
|
|
modifier = "rw";
|
|
}
|
|
{
|
|
node = "/dev/vhost-net";
|
|
modifier = "rw";
|
|
}
|
|
{
|
|
node = "/dev/net/tun";
|
|
modifier = "rwm";
|
|
}
|
|
];
|
|
isolation.additionalCapabilities = [
|
|
"CAP_NET_ADMIN"
|
|
"CAP_MKNOD"
|
|
];
|
|
routingInfo = [
|
|
{
|
|
username = "autumn";
|
|
keysName = "generic";
|
|
}
|
|
];
|
|
};
|
|
|
|
ssh-proxy = mkSsh {
|
|
name = "ssh-proxy";
|
|
resources.fs."/home/runner/data" = {
|
|
hostPath = "${data}/ssh/nyaa";
|
|
isReadOnly = true;
|
|
};
|
|
packages = with pkgs; [ python3 ];
|
|
routingInfo = [
|
|
{
|
|
username = "nyaa";
|
|
keysName = "nyaa";
|
|
}
|
|
];
|
|
};
|
|
|
|
ssh-rogule = mkSsh {
|
|
name = "ssh-rogule";
|
|
resources.fs = {
|
|
"/home/runner/rogule-dev" = {
|
|
hostPath = "${data}/mc/rogule-dev";
|
|
isReadOnly = false;
|
|
};
|
|
"/home/runner/rogule-build" = {
|
|
hostPath = "${data}/mc/rogule-build";
|
|
isReadOnly = false;
|
|
};
|
|
};
|
|
packages = with pkgs; [
|
|
python3
|
|
jdk21
|
|
];
|
|
};
|
|
|
|
ssh-starwalker = mkSsh {
|
|
name = "ssh-starwalker";
|
|
resources.fs."/home/runner/starwalker" = {
|
|
hostPath = "${data}/mc/starwalker";
|
|
isReadOnly = false;
|
|
};
|
|
packages = with pkgs; [
|
|
jdk21
|
|
];
|
|
};
|
|
|
|
ssh-tl = mkSsh {
|
|
name = "ssh-tl";
|
|
resources.fs."/home/runner/tl" = {
|
|
hostPath = "${data}/mc/tl";
|
|
isReadOnly = false;
|
|
};
|
|
packages = with pkgs; [
|
|
jdk21
|
|
];
|
|
};
|
|
}
|