upRootNutrition/dotfiles
upRootNutrition/dotfiles
1
0
Fork 0
mirror of https://gitlab.com/upRootNutrition/dotfiles.git synced 2025-12-07 05:27:13 -06:00
Code Issues Projects 1 Releases Packages Wiki Activity Actions

test: setting up opencloud and microvms

Browse source
This commit is contained in:
Nick 2025-12-05 02:47:08 -06:00
parent 97aebfbb59
commit 9ab5ebd35f
8 changed files with 81 additions and 122 deletions
Download patch file Download diff file Expand all files Collapse all files

40
modules/nixos/guests/opencloud/opencloud1/default.nix
View file

@ -32,7 +32,6 @@ in
stateDir = "/var/lib/${serviceCfg.name}";
environmentFile = "/run/secrets/projectenv";
};
openssh = {
enable = true;
settings = {
@ -41,13 +40,11 @@ in
};
};
};
networking.firewall.allowedTCPPorts = [
22 # SSH
587 # SMTP
serviceCfg.ports.port0
];
systemd = {
services = {
systemd-networkd.wantedBy = [ "multi-user.target" ];
@ -55,17 +52,28 @@ in
path = [ pkgs.inotify-tools ];
};
opencloud-fix-permissions = {
description = "Fix OpenCloud storage permissions on file changes";
description = "Fix OpenCloud storage permissions";
after = [ "opencloud.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
ExecStart = pkgs.writeShellScript "fix-perms-on-change" ''
${pkgs.inotify-tools}/bin/inotifywait -m -r -e create,moved_to /var/lib/opencloud/storage --format '%w%f' | while read filepath; do
${pkgs.coreutils}/bin/chown opencloud:opencloud "$filepath"
Type = "oneshot";
ExecStart = pkgs.writeShellScript "fix-perms" ''
echo "Starting permission fix..."
OPENCLOUD_UID=$(id -u opencloud)
echo "OpenCloud UID: $OPENCLOUD_UID"
find /var/lib/opencloud/storage/users -type f ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r file; do
echo "Fixing file: $file"
chown opencloud:opencloud "$file" 2>/dev/null || true
done
find /var/lib/opencloud/storage/users -type d ! -uid "$OPENCLOUD_UID" 2>/dev/null | while read -r dir; do
echo "Fixing dir: $dir"
chown opencloud:opencloud "$dir" 2>/dev/null || true
done
echo "Permission fix complete"
'';
Restart = "always";
User = "root";
};
};
@ -74,7 +82,7 @@ in
description = "Periodically fix OpenCloud storage permissions";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "1min";
OnBootSec = "30s";
OnUnitActiveSec = "1min";
Unit = "opencloud-fix-permissions.service";
};
@ -98,14 +106,11 @@ in
];
};
};
tmpfiles.rules = [
"d ${serviceCfg.varPaths.path0} 0755 ${serviceCfg.name} ${serviceCfg.name} -"
"z /etc/opencloud 0700 ${serviceCfg.name} ${serviceCfg.name} -"
];
};
microvm = {
vcpu = 1;
mem = 1024 * 1;
@ -158,19 +163,18 @@ in
};
environment.systemPackages = builtins.attrValues {
inherit (pkgs)
inotifywait
opencloud
;
};
};
};
};
security.acme.certs."${host}" = {
dnsProvider = dns;
environmentFile = config.sops.secrets.${dnsPath}.path;
group = "caddy";
};
services.caddy.virtualHosts = {
"${host}" = {
extraConfig =
@ -189,9 +193,7 @@ in
'';
};
};
users.users.caddy.extraGroups = [ "acme" ];
systemd = {
tmpfiles.rules = [
"d ${serviceCfg.mntPaths.path0} 0751 microvm wheel - -"
@ -199,12 +201,10 @@ in
"d ${serviceCfg.mntPaths.path0}/config 0751 microvm wheel - -"
];
};
sops.secrets = {
"${serviceCfg.name}/projectenv" = {
owner = "root";
mode = "0600";
};
};
}