Merge branch 'staging-next' into staging
Conflicts: pkgs/development/python-modules/panel/default.nix pkgs/os-specific/linux/kernel/generic.nix pkgs/servers/home-assistant/default.nix
This commit is contained in:
Dmitry Kalinkin
@@ -4,15 +4,7 @@ let
|
||||
|
||||
inherit (lib) mkOption types;
|
||||
|
||||
# Once https://github.com/NixOS/nixpkgs/pull/75584 is merged we can use the TOML generator
|
||||
toTOML = name: value: pkgs.runCommandNoCC name {
|
||||
nativeBuildInputs = [ pkgs.remarshal ];
|
||||
value = builtins.toJSON value;
|
||||
passAsFile = [ "value" ];
|
||||
} ''
|
||||
json2toml "$valuePath" "$out"
|
||||
'';
|
||||
|
||||
toml = pkgs.formats.toml { };
|
||||
in
|
||||
{
|
||||
meta = {
|
||||
@@ -26,6 +18,11 @@ in
|
||||
[ "virtualisation" "containers" "users" ]
|
||||
"All users with `isNormalUser = true` set now get appropriate subuid/subgid mappings."
|
||||
)
|
||||
(
|
||||
lib.mkRemovedOptionModule
|
||||
[ "virtualisation" "containers" "containersConf" "extraConfig" ]
|
||||
"Use virtualisation.containers.containersConf.settings instead."
|
||||
)
|
||||
];
|
||||
|
||||
options.virtualisation.containers = {
|
||||
@@ -45,23 +42,10 @@ in
|
||||
description = "Enable the OCI seccomp BPF hook";
|
||||
};
|
||||
|
||||
containersConf = mkOption {
|
||||
default = {};
|
||||
containersConf.settings = mkOption {
|
||||
type = toml.type;
|
||||
default = { };
|
||||
description = "containers.conf configuration";
|
||||
type = types.submodule {
|
||||
options = {
|
||||
|
||||
extraConfig = mkOption {
|
||||
type = types.lines;
|
||||
default = "";
|
||||
description = ''
|
||||
Extra configuration that should be put in the containers.conf
|
||||
configuration file
|
||||
'';
|
||||
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
registries = {
|
||||
@@ -113,21 +97,19 @@ in
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
virtualisation.containers.containersConf.settings = {
|
||||
network.cni_plugin_dirs = [ "${pkgs.cni-plugins}/bin/" ];
|
||||
engine = {
|
||||
init_path = "${pkgs.catatonit}/bin/catatonit";
|
||||
} // lib.optionalAttrs cfg.ociSeccompBpfHook.enable {
|
||||
hooks_dir = [ config.boot.kernelPackages.oci-seccomp-bpf-hook ];
|
||||
};
|
||||
};
|
||||
|
||||
environment.etc."containers/containers.conf".text = ''
|
||||
[network]
|
||||
cni_plugin_dirs = ["${pkgs.cni-plugins}/bin/"]
|
||||
environment.etc."containers/containers.conf".source =
|
||||
toml.generate "containers.conf" cfg.containersConf.settings;
|
||||
|
||||
[engine]
|
||||
init_path = "${pkgs.catatonit}/bin/catatonit"
|
||||
${lib.optionalString (cfg.ociSeccompBpfHook.enable) ''
|
||||
hooks_dir = [
|
||||
"${config.boot.kernelPackages.oci-seccomp-bpf-hook}",
|
||||
]
|
||||
''}
|
||||
'' + cfg.containersConf.extraConfig;
|
||||
|
||||
environment.etc."containers/registries.conf".source = toTOML "registries.conf" {
|
||||
environment.etc."containers/registries.conf".source = toml.generate "registries.conf" {
|
||||
registries = lib.mapAttrs (n: v: { registries = v; }) cfg.registries;
|
||||
};
|
||||
|
||||
|
||||
@@ -46,6 +46,15 @@ in {
|
||||
'';
|
||||
};
|
||||
|
||||
package = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.libvirt;
|
||||
defaultText = "pkgs.libvirt";
|
||||
description = ''
|
||||
libvirt package to use.
|
||||
'';
|
||||
};
|
||||
|
||||
qemuPackage = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.qemu;
|
||||
@@ -149,7 +158,7 @@ in {
|
||||
# this file is expected in /etc/qemu and not sysconfdir (/var/lib)
|
||||
etc."qemu/bridge.conf".text = lib.concatMapStringsSep "\n" (e:
|
||||
"allow ${e}") cfg.allowedBridges;
|
||||
systemPackages = with pkgs; [ libvirt libressl.nc iptables cfg.qemuPackage ];
|
||||
systemPackages = with pkgs; [ libressl.nc iptables cfg.package cfg.qemuPackage ];
|
||||
etc.ethertypes.source = "${pkgs.iptables}/etc/ethertypes";
|
||||
};
|
||||
|
||||
@@ -169,26 +178,26 @@ in {
|
||||
source = "/run/${dirName}/nix-helpers/qemu-bridge-helper";
|
||||
};
|
||||
|
||||
systemd.packages = [ pkgs.libvirt ];
|
||||
systemd.packages = [ cfg.package ];
|
||||
|
||||
systemd.services.libvirtd-config = {
|
||||
description = "Libvirt Virtual Machine Management Daemon - configuration";
|
||||
script = ''
|
||||
# Copy default libvirt network config .xml files to /var/lib
|
||||
# Files modified by the user will not be overwritten
|
||||
for i in $(cd ${pkgs.libvirt}/var/lib && echo \
|
||||
for i in $(cd ${cfg.package}/var/lib && echo \
|
||||
libvirt/qemu/networks/*.xml libvirt/qemu/networks/autostart/*.xml \
|
||||
libvirt/nwfilter/*.xml );
|
||||
do
|
||||
mkdir -p /var/lib/$(dirname $i) -m 755
|
||||
cp -npd ${pkgs.libvirt}/var/lib/$i /var/lib/$i
|
||||
cp -npd ${cfg.package}/var/lib/$i /var/lib/$i
|
||||
done
|
||||
|
||||
# Copy generated qemu config to libvirt directory
|
||||
cp -f ${qemuConfigFile} /var/lib/${dirName}/qemu.conf
|
||||
|
||||
# stable (not GC'able as in /nix/store) paths for using in <emulator> section of xml configs
|
||||
for emulator in ${pkgs.libvirt}/libexec/libvirt_lxc ${cfg.qemuPackage}/bin/qemu-kvm ${cfg.qemuPackage}/bin/qemu-system-*; do
|
||||
for emulator in ${cfg.package}/libexec/libvirt_lxc ${cfg.qemuPackage}/bin/qemu-kvm ${cfg.qemuPackage}/bin/qemu-system-*; do
|
||||
ln -s --force "$emulator" /run/${dirName}/nix-emulators/
|
||||
done
|
||||
|
||||
@@ -234,7 +243,7 @@ in {
|
||||
|
||||
systemd.services.libvirt-guests = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
path = with pkgs; [ coreutils libvirt gawk ];
|
||||
path = with pkgs; [ coreutils gawk cfg.package ];
|
||||
restartIfChanged = false;
|
||||
|
||||
environment.ON_BOOT = "${cfg.onBoot}";
|
||||
@@ -249,7 +258,7 @@ in {
|
||||
|
||||
systemd.services.virtlogd = {
|
||||
description = "Virtual machine log manager";
|
||||
serviceConfig.ExecStart = "@${pkgs.libvirt}/sbin/virtlogd virtlogd";
|
||||
serviceConfig.ExecStart = "@${cfg.package}/sbin/virtlogd virtlogd";
|
||||
restartIfChanged = false;
|
||||
};
|
||||
|
||||
@@ -261,7 +270,7 @@ in {
|
||||
|
||||
systemd.services.virtlockd = {
|
||||
description = "Virtual machine lock manager";
|
||||
serviceConfig.ExecStart = "@${pkgs.libvirt}/sbin/virtlockd virtlockd";
|
||||
serviceConfig.ExecStart = "@${cfg.package}/sbin/virtlockd virtlockd";
|
||||
restartIfChanged = false;
|
||||
};
|
||||
|
||||
|
||||
@@ -96,13 +96,12 @@ in
|
||||
|
||||
virtualisation.containers = {
|
||||
enable = true; # Enable common /etc/containers configuration
|
||||
containersConf.extraConfig = lib.optionalString cfg.enableNvidia
|
||||
(builtins.readFile (toml.generate "podman.nvidia.containers.conf" {
|
||||
engine = {
|
||||
conmon_env_vars = [ "PATH=${lib.makeBinPath [ pkgs.nvidia-podman ]}" ];
|
||||
runtimes.nvidia = [ "${pkgs.nvidia-podman}/bin/nvidia-container-runtime" ];
|
||||
};
|
||||
}));
|
||||
containersConf.settings = lib.optionalAttrs cfg.enableNvidia {
|
||||
engine = {
|
||||
conmon_env_vars = [ "PATH=${lib.makeBinPath [ pkgs.nvidia-podman ]}" ];
|
||||
runtimes.nvidia = [ "${pkgs.nvidia-podman}/bin/nvidia-container-runtime" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.packages = [ cfg.package ];
|
||||
|
||||
Reference in New Issue
Block a user