Archived
beatzaplentyandClaude Sonnet 4.6
fe7fc55c04
Check NixOS configurations / eval-hosts (push) Failing after 12m13s
Grants the domain wayne account docker socket access on docker.sweet.home without needing sudo, alongside the existing nixos local user membership. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
48 lines
1.3 KiB
Nix
48 lines
1.3 KiB
Nix
{ pkgs, vars, ... }:
|
|
|
|
{
|
|
# Pins the Docker Engine version, carried forward from the pre-refactor
|
|
# `docker` target's inline pkgs overlay.
|
|
nixpkgs.overlays = [
|
|
(final: prev: {
|
|
docker = prev.docker_29;
|
|
docker_cli = prev.docker_29;
|
|
})
|
|
];
|
|
|
|
imports = [
|
|
../docker/mount-data.nix
|
|
../docker/enable-service.nix
|
|
../docker/nextcloud-cron-job.nix
|
|
../docker/docker-health-to-gotify.nix
|
|
../traefik/rotate-logs.nix
|
|
../raspi/mount-data.nix
|
|
../services/enable-rpcbind.nix
|
|
];
|
|
|
|
environment.systemPackages = with pkgs; [
|
|
nfs-utils
|
|
];
|
|
|
|
boot.supportedFilesystems = [ "nfs" ];
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"L+ /home/${vars.primaryUser}/docker - - - - ${vars.nfsShares.dockerConfig.mountpoint}"
|
|
"d /mnt/docker 0755 ${vars.primaryUser} users -"
|
|
"d ${vars.nfsShares.raspiVolumes.mountpoint} 0755 ${vars.primaryUser} users -"
|
|
];
|
|
|
|
users.users.${vars.primaryUser}.extraGroups = [ "docker" ];
|
|
# Grant the IPA domain user docker access via the local group so that
|
|
# `wayne` can manage containers without sudo.
|
|
users.groups.docker.members = [ "wayne" ];
|
|
services.openssh.settings.PermitRootLogin = "yes";
|
|
|
|
networking.firewall.allowedTCPPorts = [
|
|
vars.ports.dockerHttp
|
|
vars.ports.dockerExtra
|
|
vars.ports.dockerHttps
|
|
vars.ports.beszelHub
|
|
];
|
|
}
|