From f0b572c6ed257010d7155ae698dc207a904d83a0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Patrick=20Gro=C3=9Fmann?= <patrickdgro@gmail.com>
Date: Mon, 18 Dec 2023 02:11:24 +0100
Subject: [PATCH] feat: more nextcloud/container config

---
 flake.nix                                     |   3 +-
 hosts/desktopnix/default.nix                  |   1 +
 .../nextcloud/generated/dhparams.pem.age      | Bin 0 -> 1331 bytes
 lib/containers.nix                            |  25 ++++++++----
 modules/config/boot.nix                       |   2 +-
 modules/config/impermanence/default.nix       |  38 +++++++-----------
 modules/config/system.nix                     |   2 -
 modules/config/users.nix                      |   2 +
 modules/hardware/bluetooth.nix                |   3 ++
 modules/services/acme.nix                     |   8 ++++
 modules/services/containers.nix               |   2 +-
 modules/services/nextcloud.nix                |  23 ++++++-----
 nix/hosts.nix                                 |   7 ++--
 13 files changed, 67 insertions(+), 49 deletions(-)
 create mode 100644 hosts/testienix/secrets/guests/nextcloud/generated/dhparams.pem.age

diff --git a/flake.nix b/flake.nix
index 485b432..e3d94ae 100644
--- a/flake.nix
+++ b/flake.nix
@@ -124,8 +124,9 @@
         hosts
         nixosConfigurations
         minimalConfigurations
+        guestConfigurations
         ;
-      nodes = self.nixosConfigurations;
+      nodes = self.nixosConfigurations // self.guestConfigurations;
 
       inherit
         (lib.foldl' lib.recursiveUpdate {}
diff --git a/hosts/desktopnix/default.nix b/hosts/desktopnix/default.nix
index f985a45..7e38c8b 100644
--- a/hosts/desktopnix/default.nix
+++ b/hosts/desktopnix/default.nix
@@ -50,4 +50,5 @@
   system.activationScripts.decryptKey.text = ''
     ln -f -s ${../../keys/PatC.key} /run/decrypt.key.pub
   '';
+  boot.binfmt.emulatedSystems = ["aarch64-linux"];
 }
diff --git a/hosts/testienix/secrets/guests/nextcloud/generated/dhparams.pem.age b/hosts/testienix/secrets/guests/nextcloud/generated/dhparams.pem.age
new file mode 100644
index 0000000000000000000000000000000000000000..1e96e67f08932fd6aeaeee076e1b37eaf869cb0d
GIT binary patch
literal 1331
zcmZwA`B%~h008jvr6tR>tSp;K`m&Uv9D*{_jZ-cK6$DI7?k^yxz!%UwvsX(ywAQlL
zvQqP5tvu>Aon6+ZGjdb%%DI_V>PlB;`Lwmyk9%*Qf8Zlh$lx-q#Awr-lsavM&ZvmA
zAR+L0C?AEvAaPKlz^qBvb7UwLf`!r}aRv>5WsnVg7}r2j0#psnuBPJDc9ejCfEdI$
zyv%GcSgb^TB%W_cp$N#DWOEXpK~J?%tT-D^%_j0VV0L=)$3d^O!1X8$7Ru)&tGRe6
z9tn#{lhGyA9F-2RlhSlNrcp{HCreWp@+g*`Yyr_}DwF`H<ng!=xyr7Pr$h<lf>fNI
zWrp$7Y$O1%VTmL%n#}|BN-9B&RY?FfTJoPOouW|EKq%g#6=8`g89@z3M_Q9PQj5(V
zMIj@s7@Lf3)S*%p2(d;Ng&`vuAVe-s<;i(OCQJ`fvuy^k3?%SWIgye?Hp-;Mu>~TS
zR7XW|Ni;0te=ks(q|Oo30Ga|M$`N2TK1Hs?;eZ%~gdQmpB(OzNtul%Nq@qk52#AfA
z(xnoqnS-OzO*W%GNgNfOBju`+kR(7ajs);%0yTl5HlVp5FRsuCR~TiY92qoyXDp0m
zRnj2|NGXB?i!sPxI*S~Hz~OLcWCDytAanGB=tK>UATYBe3^ZAiZsBnhXeq^-AmdB$
zJU)S<x5YrTL!P2KfCBJCT3bt&=_)$=zn1uI2|m&l$ho&{O-9@Y;g62NA@>B>qTge3
zez`74nA$)oIn@G&S1+)0@3k-0PBt-PC-|3BDn<{P%?Xt!CKua2$A%S-o$Q??BVSgv
zEY**5re_PXtd6%KYM33JMPK2emP}_p+kj78&R#h?QqvH09rY@3aSv+nd5Jj>EMEYa
z@l%1l?~V*q+iwS)zjXJG=@MkZbnx~{Z{Hcl`nsiK@jac21~p%{p{kW}cU{@Os@Fw%
z;Mt)A=X%|$k)}eoJ==Z7`x6h(Z@c(sZg_st;3Wgrb*lMG;>DdARr?Ez?%bSQx9A;E
zpGfKZCrmZBr0~cM(gZq@!x0NTdr$~OpTpHyu*)#J_1yWnjNA<igyz8gH{5_9##?`u
zIPJtl;#D)W^E2u2c8_eV^Zv4ptls=D8nhip)4%ffdi@MdIrxrPrs8b*&da&_Lif^&
z;lRMgS9ue~ZH-CSYd^g2pRafR(J>nn;=bu=^Nzai2ZmdPd5^aqm;5%c(zN^A{Na!r
z;n#n67Ojn`%epz#jhOHO;ggh(<HN2gSMx#2$%m%co#DIK!YgfK_lcI^;^GStl^wad
zt1kU4bOif^+G(r{r-w4*g4fN?QLmLB_nVmUe%o?OSjl>J_>J!TgUQ>>l5JB)@A!Zd
zQ0VvQ7uCc@sP9?K#jeMh-Id%AutAnCX7tST_)lG#m)rAtYEoLC|7G%nMLcSEg(c=9
zeR{@s%-YK*rgBU7j(Sa1cpln}`Slk?*Yf(f#=VXTm;XbWaLfnwUKDiS7|`TgD1Gxh
z9q0ebQM`JvY~#eBVDic85?y)bT!w2@?Kgt04V8!S2ZVpa(ws-HM$;Y&OEYW63$nFb
z>&Ogw{)xlAamKSetjh-gTegoa&`SH7Tyg!i%%rx0H{~<L=(07`_D_A^kzO<&xRw<#
z>~;E+@kbg?@V4Do+`eRbdi5`rtZLoVeRO63x*oHZA4>k_bYI?9$U;q<kZiicZ0J#H
k95Qx6(9)sJO|knLLLKu3FBOaas^XjOtDbrsJ9cLJUy8a$X#fBK

literal 0
HcmV?d00001

diff --git a/lib/containers.nix b/lib/containers.nix
index e1b12e8..d74f32e 100644
--- a/lib/containers.nix
+++ b/lib/containers.nix
@@ -2,19 +2,32 @@ inputs: _self: super: {
   lib =
     super.lib
     // {
-      containers.mkConfig = name: config:
+      containers.mkConfig = name: attrs: config:
         super.lib.mkMerge [
           {
             config = {
               imports = [
-                ../modules/config/impermanence
-                ../modules/config/net.nix
+                ../modules/services/nginx.nix
+                ../modules/config
                 ../modules/interface-naming.nix
-
-                inputs.impermanence.nixosModules.impermanence
               ];
+              node.name = name;
+              node.secretsDir = "${attrs.config.node.secretsDir}/guests/${name}";
+              nixpkgs = {
+                hostPlatform = attrs.config.nixpkgs.hostPlatform;
+                overlays = attrs.pkgs.overlays;
+                config = attrs.pkgs.config;
+              };
+              boot.initrd.systemd.enable = super.lib.mkForce false;
+            };
+            specialArgs = {
+              inherit (attrs) lib inputs minimal stateVersion;
             };
 
+            autoStart = true;
+            macvlans = [
+              "lan01:lan01-${name}"
+            ];
             ephemeral = true;
             bindMounts = {
               "state" = {
@@ -29,8 +42,6 @@ inputs: _self: super: {
               };
             };
             zfs.mountpoint = super.lib.mkDefault "/containers/${name}";
-            #config = {...}: {
-            #};
           }
           config
         ];
diff --git a/modules/config/boot.nix b/modules/config/boot.nix
index 51cadfe..6cad41e 100644
--- a/modules/config/boot.nix
+++ b/modules/config/boot.nix
@@ -4,7 +4,7 @@
   pkgs,
   ...
 }: {
-  boot = {
+  boot = lib.mkIf (!config.boot.isContainer) {
     initrd.systemd = {
       enable = true;
       emergencyAccess = config.secrets.secrets.global.users.root.passwordHash;
diff --git a/modules/config/impermanence/default.nix b/modules/config/impermanence/default.nix
index 1b31708..9ac0150 100644
--- a/modules/config/impermanence/default.nix
+++ b/modules/config/impermanence/default.nix
@@ -12,32 +12,24 @@ in {
   environment.persistence."/state" = {
     hideMounts = true;
 
-    files = onlyHost [
-      "/etc/machine-id"
-      "/etc/ssh/ssh_host_ed25519_key"
-      "/etc/ssh/ssh_host_ed25519_key.pub"
-    ];
-    directories =
+    files =
       [
-        "/var/log"
-        "/var/lib/systemd"
-        "/var/lib/nixos"
-        {
-          directory = "/var/tmp/agenix-rekey";
-          mode = "0777";
-        }
+        "/etc/ssh/ssh_host_ed25519_key"
+        "/etc/ssh/ssh_host_ed25519_key.pub"
       ]
-      ++ lib.lists.optionals config.security.acme.acceptTerms [
-        {
-          directory = "/var/lib/acme";
-          user = "acme";
-          group = "acme";
-          mode = "0755";
-        }
-      ]
-      ++ lib.lists.optionals config.hardware.bluetooth.enable [
-        "/var/lib/bluetooth"
+      ++ lib.lists.optionals (!config.boot.isContainer)
+      [
+        "/etc/machine-id"
       ];
+    directories = [
+      "/var/log"
+      "/var/lib/systemd"
+      "/var/lib/nixos"
+      {
+        directory = "/var/tmp/agenix-rekey";
+        mode = "0777";
+      }
+    ];
   };
   environment.persistence."/persist" = {
     hideMounts = true;
diff --git a/modules/config/system.nix b/modules/config/system.nix
index 083121a..97c5ead 100644
--- a/modules/config/system.nix
+++ b/modules/config/system.nix
@@ -60,8 +60,6 @@
     nvd
   ];
 
-  boot.binfmt.emulatedSystems = ["aarch64-linux" "mips-linux"];
-
   powerManagement.cpuFreqGovernor = lib.mkDefault "powersave";
 
   secrets.secretFiles = let
diff --git a/modules/config/users.nix b/modules/config/users.nix
index d636936..38b53ae 100644
--- a/modules/config/users.nix
+++ b/modules/config/users.nix
@@ -19,6 +19,8 @@
     fwupd-refresh = uidGid 210;
     podman = uidGid 211;
     acme = uidGid 212;
+    nextcloud = uidGid 213;
+    redis-nextcloud = uidGid 214;
     systemd-oom = uidGid 300;
     systemd-coredump = uidGid 301;
   };
diff --git a/modules/hardware/bluetooth.nix b/modules/hardware/bluetooth.nix
index e6fd94b..cd44af8 100644
--- a/modules/hardware/bluetooth.nix
+++ b/modules/hardware/bluetooth.nix
@@ -24,4 +24,7 @@
     '';
     extraModules = with pkgs; [pulseaudio-modules-bt];
   };
+  environment.persistence."/state".directories = [
+    "/var/lib/bluetooth"
+  ];
 }
diff --git a/modules/services/acme.nix b/modules/services/acme.nix
index 62e9adf..47b78ef 100644
--- a/modules/services/acme.nix
+++ b/modules/services/acme.nix
@@ -26,4 +26,12 @@
     extraDomainNames = ["*.${value}"];
   });
   users.groups.acme.members = ["nginx"];
+  environment.persistence."/state".directories = [
+    {
+      directory = "/var/lib/acme";
+      user = "acme";
+      group = "acme";
+      mode = "0755";
+    }
+  ];
 }
diff --git a/modules/services/containers.nix b/modules/services/containers.nix
index e407e0d..19a541f 100644
--- a/modules/services/containers.nix
+++ b/modules/services/containers.nix
@@ -38,7 +38,7 @@ in {
             dataset = mkOption {
               type = types.str;
               default = "safe/containers/${name}";
-              description = mdDoc "The host's dataset that should be used for this containers persistent data (will automatically be created, parent dataset must exist)";
+              description = mdDoc "The host's dataset that should be used for this containers persistent data (will automatically be created)";
             };
 
             mountpoint = mkOption {
diff --git a/modules/services/nextcloud.nix b/modules/services/nextcloud.nix
index 1226443..e68f20d 100644
--- a/modules/services/nextcloud.nix
+++ b/modules/services/nextcloud.nix
@@ -2,8 +2,9 @@
   lib,
   stateVersion,
   config,
+  pkgs, # not unused neede for the usage of attrs later to contains pkgs
   ...
-}: let
+} @ attrs: let
   hostName = "nc.${config.secrets.secrets.global.domains.mail}";
 in {
   imports = [./containers.nix ./nginx.nix ./ddclient.nix ./acme.nix];
@@ -11,6 +12,7 @@ in {
     enable = true;
     upstreams.nextcloud = {
       servers."192.168.178.33:80" = {};
+
       extraConfig = ''
         zone nextcloud 64k ;
         keepalive 5 ;
@@ -22,15 +24,11 @@ in {
       locations."/".proxyPass = "http://nextcloud";
     };
   };
-  containers.nextcloud = lib.containers.mkConfig "nextcloud" {
-    autoStart = true;
+  containers.nextcloud = lib.containers.mkConfig "nextcloud" attrs {
     zfs = {
       enable = true;
       pool = "panzer";
     };
-    macvlans = [
-      "lan01:lan01-nextcloud"
-    ];
     config = {
       config,
       pkgs,
@@ -48,6 +46,14 @@ in {
           };
         };
       };
+      environment.persistence."/persist".directories = [
+        {
+          directory = config.services.nextcloud.home;
+          user = "nextcloud";
+          group = "nextcloud";
+          mode = "750";
+        }
+      ];
       services.nextcloud = {
         inherit hostName;
         enable = true;
@@ -95,13 +101,8 @@ in {
 #wireguard
 #samba/printer finding
 #vaultwarden
-#nextcloud
-#acme
-#nginx
 #maddy
 #kanidm
-#xdg portals
-#zfs snapshots
 #remote backups
 #immich
 
diff --git a/nix/hosts.nix b/nix/hosts.nix
index f069a7b..79b56b2 100644
--- a/nix/hosts.nix
+++ b/nix/hosts.nix
@@ -51,14 +51,15 @@ inputs: let
   # True NixOS nodes can define additional microvms (guest nodes) that are built
   # together with the true host. We collect all defined microvm nodes
   # from each node here to allow accessing any node via the unified attribute `nodes`.
-  microvmConfigurations = flip concatMapAttrs self.nixosConfigurations (_: node:
+  guestConfigurations = flip concatMapAttrs self.nixosConfigurations (_: node:
     mapAttrs'
-    (vm: def: nameValuePair def.nodeName node.config.microvm.vms.${vm}.config)
-    (node.config.meta.microvms.vms or {}));
+    (vm: def: nameValuePair vm {config = node.config.containers.${vm}.config;})
+    (node.config.containers or {}));
 in {
   inherit
     hosts
     nixosConfigurations
     minimalConfigurations
+    guestConfigurations
     ;
 }