shared-public-infra/modules/bagel-container.nix

47 lines
1.2 KiB
Nix

# Stateful/mutable container used for Bagel (tm) related infra (mostly
# rebuilding nixpkgs a lot).
#
# System image is stored at /var/lib/machines/bagel.
{
systemd.nspawn.bagel = {
execConfig = {
Boot = true;
Ephemeral = false;
PrivateUsers = true;
NotifyReady = true;
LinkJournal = "try-guest";
};
networkConfig = {
Bridge = "wan-br";
VirtualEthernetExtra = "vb-bagel-v4:host1";
};
};
systemd.services."systemd-nspawn@bagel" = {
wantedBy = [ "machines.target" ];
wants = [ "network.target" ];
after = [ "network.target" ];
overrideStrategy = "asDropin";
};
systemd.network.networks."20-vb-bagel-v4" = {
matchConfig.Name = "vb-bagel-v4";
networkConfig.Address = [ "172.16.100.1/24" ];
networkConfig.IPMasquerade = true;
};
# Configure a local Nix builder account, since getting sandboxing and KVM
# working inside the container will be tricky.
users.users.bagel-builder = {
isSystemUser = true;
group = "nogroup";
home = "/var/empty";
shell = "/bin/sh";
openssh.authorizedKeys.keys = [
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAvUT9YBig9LQPHgypIBHQuC32XqDKxlFZ2CfgDi0ZKx"
];
};
nix.settings.trusted-users = [ "bagel-builder" ];
}