Merge remote-tracking branch 'origin/master' into systemd-216
This commit is contained in:
Eelco Dolstra
@@ -18,77 +18,6 @@ with lib;
|
||||
# Shut up warnings about not having a boot loader.
|
||||
system.build.installBootLoader = "${pkgs.coreutils}/bin/true";
|
||||
|
||||
# Provide a root login prompt on /var/lib/root-login.socket that
|
||||
# doesn't ask for a password. This socket can only be used by root
|
||||
# on the host.
|
||||
systemd.sockets.root-login =
|
||||
{ description = "Root Login Socket";
|
||||
wantedBy = [ "sockets.target" ];
|
||||
socketConfig =
|
||||
{ ListenStream = "/var/lib/root-login.socket";
|
||||
SocketMode = "0600";
|
||||
Accept = true;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."root-login@" =
|
||||
{ description = "Root Login %i";
|
||||
environment.TERM = "linux";
|
||||
serviceConfig =
|
||||
{ Type = "simple";
|
||||
StandardInput = "socket";
|
||||
ExecStart = "${pkgs.socat}/bin/socat -t0 - \"exec:${pkgs.shadow}/bin/login -f root,pty,setsid,setpgid,stderr,ctty\"";
|
||||
TimeoutStopSec = 1; # FIXME
|
||||
};
|
||||
restartIfChanged = false;
|
||||
};
|
||||
|
||||
# Provide a daemon on /var/lib/run-command.socket that reads a
|
||||
# command from stdin and executes it.
|
||||
systemd.sockets.run-command =
|
||||
{ description = "Run Command Socket";
|
||||
wantedBy = [ "sockets.target" ];
|
||||
socketConfig =
|
||||
{ ListenStream = "/var/lib/run-command.socket";
|
||||
SocketMode = "0600"; # only root can connect
|
||||
Accept = true;
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services."run-command@" =
|
||||
{ description = "Run Command %i";
|
||||
environment.TERM = "linux";
|
||||
serviceConfig =
|
||||
{ Type = "simple";
|
||||
StandardInput = "socket";
|
||||
TimeoutStopSec = 1; # FIXME
|
||||
};
|
||||
script =
|
||||
''
|
||||
#! ${pkgs.stdenv.shell} -e
|
||||
source /etc/bashrc
|
||||
read c
|
||||
eval "command=($c)"
|
||||
exec "''${command[@]}"
|
||||
'';
|
||||
restartIfChanged = false;
|
||||
};
|
||||
|
||||
systemd.services.container-startup-done =
|
||||
{ description = "Container Startup Notification";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "multi-user.target" ];
|
||||
script =
|
||||
''
|
||||
if [ -p /var/lib/startup-done ]; then
|
||||
echo done > /var/lib/startup-done
|
||||
fi
|
||||
'';
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
restartIfChanged = false;
|
||||
};
|
||||
|
||||
systemd.services.systemd-remount-fs.enable = false;
|
||||
|
||||
};
|
||||
|
||||
@@ -10,7 +10,7 @@ let
|
||||
isExecutable = true;
|
||||
src = ./nixos-container.pl;
|
||||
perl = "${pkgs.perl}/bin/perl -I${pkgs.perlPackages.FileSlurp}/lib/perl5/site_perl";
|
||||
inherit (pkgs) socat;
|
||||
inherit (pkgs) utillinux;
|
||||
};
|
||||
|
||||
# The container's init script, a small wrapper around the regular
|
||||
@@ -254,9 +254,8 @@ in
|
||||
ExecReload = pkgs.writeScript "reload-container"
|
||||
''
|
||||
#! ${pkgs.stdenv.shell} -e
|
||||
SYSTEM_PATH=/nix/var/nix/profiles/system
|
||||
echo $SYSTEM_PATH/bin/switch-to-configuration test | \
|
||||
${pkgs.socat}/bin/socat unix:$root/var/lib/run-command.socket -
|
||||
${nixos-container}/bin/nixos-container run "$INSTANCE" -- \
|
||||
bash --login -c "/nix/var/nix/profiles/system/bin/switch-to-configuration test"
|
||||
'';
|
||||
|
||||
SyslogIdentifier = "container %i";
|
||||
|
||||
@@ -0,0 +1,67 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
pkgs2storeContents = l : map (x: { object = x; symlink = "none"; }) l;
|
||||
|
||||
in {
|
||||
# Create the tarball
|
||||
system.build.dockerImage = import ../../lib/make-system-tarball.nix {
|
||||
inherit (pkgs) stdenv perl xz pathsFromGraph;
|
||||
|
||||
contents = [];
|
||||
extraArgs = "--owner=0";
|
||||
storeContents = [
|
||||
{ object = config.system.build.toplevel + "/init";
|
||||
symlink = "/bin/init";
|
||||
}
|
||||
] ++ (pkgs2storeContents [ pkgs.stdenv ]);
|
||||
};
|
||||
|
||||
boot.postBootCommands =
|
||||
''
|
||||
# After booting, register the contents of the Nix store in the Nix
|
||||
# database.
|
||||
if [ -f /nix-path-registration ]; then
|
||||
${config.nix.package}/bin/nix-store --load-db < /nix-path-registration &&
|
||||
rm /nix-path-registration
|
||||
fi
|
||||
|
||||
# nixos-rebuild also requires a "system" profile and an
|
||||
# /etc/NIXOS tag.
|
||||
touch /etc/NIXOS
|
||||
${config.nix.package}/bin/nix-env -p /nix/var/nix/profiles/system --set /run/current-system
|
||||
|
||||
# Set virtualisation to docker
|
||||
echo "docker" > /run/systemd/container
|
||||
'';
|
||||
|
||||
|
||||
# docker image config
|
||||
require = [
|
||||
../installer/cd-dvd/channel.nix
|
||||
../profiles/minimal.nix
|
||||
../profiles/clone-config.nix
|
||||
];
|
||||
|
||||
boot.isContainer = true;
|
||||
|
||||
# Iptables do not work in docker
|
||||
networking.firewall.enable = false;
|
||||
|
||||
services.openssh.enable = true;
|
||||
|
||||
# Socket activated ssh presents problem in docker
|
||||
services.openssh.startWhenNeeded = false;
|
||||
|
||||
# Allow the user to login as root without password
|
||||
security.initialRootPassword = "";
|
||||
|
||||
# Some more help text.
|
||||
services.mingetty.helpLine =
|
||||
''
|
||||
|
||||
Log in as "root" with an empty password.
|
||||
'';
|
||||
}
|
||||
@@ -7,6 +7,7 @@ with lib;
|
||||
let
|
||||
|
||||
cfg = config.virtualisation.libvirtd;
|
||||
vswitch = config.virtualisation.vswitch;
|
||||
configFile = pkgs.writeText "libvirtd.conf" ''
|
||||
unix_sock_group = "libvirtd"
|
||||
unix_sock_rw_perms = "0770"
|
||||
@@ -56,6 +57,20 @@ in
|
||||
'';
|
||||
};
|
||||
|
||||
virtualisation.libvirtd.onShutdown =
|
||||
mkOption {
|
||||
type = types.enum ["shutdown" "suspend" ];
|
||||
default = "suspend";
|
||||
description =
|
||||
''
|
||||
When shutting down / restarting the host what method should
|
||||
be used to gracefully halt the guests. Setting to "shutdown"
|
||||
will cause an ACPI shutdown of each guest. "suspend" will
|
||||
attempt to save the state of the guests ready to restore on boot.
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
};
|
||||
|
||||
|
||||
@@ -73,12 +88,17 @@ in
|
||||
{ description = "Libvirt Virtual Machine Management Daemon";
|
||||
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "systemd-udev-settle.service" ];
|
||||
after = [ "systemd-udev-settle.service" ]
|
||||
++ optional vswitch.enable "vswitchd.service";
|
||||
|
||||
path =
|
||||
[ pkgs.bridge_utils pkgs.dmidecode pkgs.dnsmasq
|
||||
path = [
|
||||
pkgs.bridge_utils
|
||||
pkgs.dmidecode
|
||||
pkgs.dnsmasq
|
||||
pkgs.ebtables
|
||||
] ++ optional cfg.enableKVM pkgs.qemu_kvm;
|
||||
]
|
||||
++ optional cfg.enableKVM pkgs.qemu_kvm
|
||||
++ optional vswitch.enable vswitch.package;
|
||||
|
||||
preStart =
|
||||
''
|
||||
@@ -152,7 +172,12 @@ in
|
||||
${pkgs.libvirt}/etc/rc.d/init.d/libvirt-guests start || true
|
||||
'';
|
||||
|
||||
postStop = "${pkgs.libvirt}/etc/rc.d/init.d/libvirt-guests stop";
|
||||
postStop =
|
||||
''
|
||||
export PATH=${pkgs.gettext}/bin:$PATH
|
||||
export ON_SHUTDOWN=${cfg.onShutdown}
|
||||
${pkgs.libvirt}/etc/rc.d/init.d/libvirt-guests stop
|
||||
'';
|
||||
|
||||
serviceConfig.Type = "oneshot";
|
||||
serviceConfig.RemainAfterExit = true;
|
||||
|
||||
@@ -7,7 +7,7 @@ use File::Slurp;
|
||||
use Fcntl ':flock';
|
||||
use Getopt::Long qw(:config gnu_getopt);
|
||||
|
||||
my $socat = '@socat@/bin/socat';
|
||||
my $nsenter = "@utillinux@/bin/nsenter";
|
||||
|
||||
# Ensure a consistent umask.
|
||||
umask 0022;
|
||||
@@ -25,7 +25,6 @@ Usage: nixos-container list
|
||||
nixos-container login <container-name>
|
||||
nixos-container root-login <container-name>
|
||||
nixos-container run <container-name> -- args...
|
||||
nixos-container set-root-password <container-name> <password>
|
||||
nixos-container show-ip <container-name>
|
||||
nixos-container show-host-key <container-name>
|
||||
EOF
|
||||
@@ -186,6 +185,22 @@ sub stopContainer {
|
||||
or die "$0: failed to stop container\n";
|
||||
}
|
||||
|
||||
# Return the PID of the init process of the container.
|
||||
sub getLeader {
|
||||
my $s = `machinectl show "$containerName" -p Leader`;
|
||||
chomp $s;
|
||||
$s =~ /^Leader=(\d+)$/ or die "unable to get container's main PID\n";
|
||||
return int($1);
|
||||
}
|
||||
|
||||
# Run a command in the container.
|
||||
sub runInContainer {
|
||||
my @args = @_;
|
||||
my $leader = getLeader;
|
||||
exec($nsenter, "-t", $leader, "-m", "-u", "-i", "-n", "-p", "--", @args);
|
||||
die "cannot run ‘nsenter’: $!\n";
|
||||
}
|
||||
|
||||
if ($action eq "destroy") {
|
||||
die "$0: cannot destroy declarative container (remove it from your configuration.nix instead)\n"
|
||||
unless POSIX::access($confFile, &POSIX::W_OK);
|
||||
@@ -235,28 +250,14 @@ elsif ($action eq "login") {
|
||||
}
|
||||
|
||||
elsif ($action eq "root-login") {
|
||||
exec($socat, "unix:$root/var/lib/root-login.socket", "-,echo=0,raw");
|
||||
runInContainer("su", "root", "-l");
|
||||
}
|
||||
|
||||
elsif ($action eq "run") {
|
||||
shift @ARGV; shift @ARGV;
|
||||
my $pid = open(SOCAT, "|-", $socat, "-t0", "-", "unix:$root/var/lib/run-command.socket") or die "$0: cannot start $socat: $!\n";
|
||||
print SOCAT join(' ', map { "'$_'" } @ARGV), "\n";
|
||||
flush SOCAT;
|
||||
waitpid($pid, 0);
|
||||
close(SOCAT);
|
||||
}
|
||||
|
||||
elsif ($action eq "set-root-password") {
|
||||
# FIXME: don't get password from the command line.
|
||||
my $password = $ARGV[2] or die "$0: no password given\n";
|
||||
my $pid = open(SOCAT, "|-", $socat, "-t0", "-", "unix:$root/var/lib/run-command.socket") or die "$0: cannot start $socat: $!\n";
|
||||
print SOCAT "passwd\n";
|
||||
print SOCAT "$password\n";
|
||||
print SOCAT "$password\n";
|
||||
flush SOCAT;
|
||||
waitpid($pid, 0);
|
||||
close(SOCAT);
|
||||
# Escape command.
|
||||
my $s = join(' ', map { s/'/'\\''/g; "'$_'" } @ARGV);
|
||||
runInContainer("su", "root", "-l", "-c", "exec " . $s);
|
||||
}
|
||||
|
||||
elsif ($action eq "show-ip") {
|
||||
|
||||
@@ -0,0 +1,117 @@
|
||||
# Systemd services for openvswitch
|
||||
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
|
||||
let
|
||||
cfg = config.virtualisation.vswitch;
|
||||
|
||||
in
|
||||
|
||||
{
|
||||
|
||||
options = {
|
||||
|
||||
virtualisation.vswitch.enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
description =
|
||||
''
|
||||
Enable Open vSwitch. A configuration
|
||||
daemon (ovs-server) will be started.
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
virtualisation.vswitch.package = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs.openvswitch;
|
||||
description =
|
||||
''
|
||||
Open vSwitch package to use.
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
config = mkIf cfg.enable (let
|
||||
|
||||
# Where the communication sockets live
|
||||
runDir = "/var/run/openvswitch";
|
||||
|
||||
# Where the config database live (can't be in nix-store)
|
||||
stateDir = "/var/db/openvswitch";
|
||||
|
||||
# The path to the an initialized version of the database
|
||||
db = pkgs.stdenv.mkDerivation {
|
||||
name = "vswitch.db";
|
||||
unpackPhase = "true";
|
||||
buildPhase = "true";
|
||||
buildInputs = with pkgs; [
|
||||
cfg.package
|
||||
];
|
||||
installPhase =
|
||||
''
|
||||
ensureDir $out/
|
||||
'';
|
||||
};
|
||||
|
||||
in {
|
||||
|
||||
environment.systemPackages = [ cfg.package ];
|
||||
|
||||
boot.kernelModules = [ "tun" "openvswitch" ];
|
||||
|
||||
boot.extraModulePackages = [ cfg.package ];
|
||||
|
||||
systemd.services.ovsdb = {
|
||||
description = "Open_vSwitch Database Server";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "systemd-udev-settle.service" ];
|
||||
wants = [ "vswitchd.service" ];
|
||||
path = [ cfg.package ];
|
||||
restartTriggers = [ db cfg.package ];
|
||||
# Create the config database
|
||||
preStart =
|
||||
''
|
||||
mkdir -p ${runDir}
|
||||
mkdir -p /var/db/openvswitch
|
||||
chmod +w /var/db/openvswitch
|
||||
if [[ ! -e /var/db/openvswitch/conf.db ]]; then
|
||||
${cfg.package}/bin/ovsdb-tool create \
|
||||
"/var/db/openvswitch/conf.db" \
|
||||
"${cfg.package}/share/openvswitch/vswitch.ovsschema"
|
||||
fi
|
||||
chmod -R +w /var/db/openvswitch
|
||||
'';
|
||||
serviceConfig.ExecStart =
|
||||
''
|
||||
${cfg.package}/bin/ovsdb-server \
|
||||
--remote=punix:${runDir}/db.sock \
|
||||
--private-key=db:Open_vSwitch,SSL,private_key \
|
||||
--certificate=db:Open_vSwitch,SSL,certificate \
|
||||
--bootstrap-ca-cert=db:Open_vSwitch,SSL,ca_cert \
|
||||
--unixctl=ovsdb.ctl.sock \
|
||||
/var/db/openvswitch/conf.db
|
||||
'';
|
||||
serviceConfig.Restart = "always";
|
||||
serviceConfig.RestartSec = 3;
|
||||
postStart =
|
||||
''
|
||||
${cfg.package}/bin/ovs-vsctl --timeout 3 --retry --no-wait init
|
||||
'';
|
||||
|
||||
};
|
||||
|
||||
systemd.services.vswitchd = {
|
||||
description = "Open_vSwitch Daemon";
|
||||
bindsTo = [ "ovsdb.service" ];
|
||||
after = [ "ovsdb.service" ];
|
||||
path = [ cfg.package ];
|
||||
serviceConfig.ExecStart = ''${cfg.package}/bin/ovs-vswitchd'';
|
||||
};
|
||||
|
||||
});
|
||||
|
||||
}
|
||||
Reference in New Issue
Block a user