nicer container configs

today i woke up to the realisation that there's an extremely obvious way
to make these nicer, & then i did exactly that. For some reason I did
not think of this when originally removing the dependency to nix-hexchen's
evalConfig.

unfortunately, this is not /quite/ a no-op. The only actual change is
different whitespace in some of the semantically-equivalent
coredns-configs that got unified.

flake.nix

@@ -35,14 +35,14 @@
 
   outputs = { self, nixpkgs, nix-hexchen, deploy-rs, ... }@inputs:
     let modules = nix-hexchen.nixosModules;
-        profiles = nix-hexchen.nixosModules.profiles;
+        profiles = nix-hexchen.nixosModules.profiles // {
+          container = import ./modules/container-profile.nix;
+        };
         pkgs = import ./pkgs {
           sources = inputs;
           system = "x86_64-linux";
         };
-        # simulate the evalConfig as contained in nix-hexchen/lib/hosts.nix,
+        evalConfig = config: (nixpkgs.lib.nixosSystem {
-        # but compatible with flakes
-        evalConfig = extraSpecial: config: nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
           modules = [
             config
@@ -52,8 +52,8 @@
           specialArgs = {
             inherit modules profiles evalConfig;
             sources = inputs;
-          } // extraSpecial;
+          };
-        };
+        }).config.system.build.toplevel;
     in {
       # do this by hand instead of via nix-hexchen/lib/hosts.nix, since that one
       # apparently can't support pkgs depending on flake inputs

modules/container-profile.nix

@@ -0,0 +1,25 @@
+{ lib, ...}:
+
+{
+  boot.isContainer = true;
+  networking.useDHCP = false;
+  users.users.root.hashedPassword = "";
+  networking.firewall.enable = false;
+  services.coredns = {
+    enable = true;
+    config = ''
+    .:53 {
+      forward . 1.1.1.1
+    }
+    '';
+  };
+
+  # I /suspect/ this is not actually needed.
+  # TODO: find spoons to deal with potential breakage, test removing this
+  networking.defaultGateway = {
+    address = "192.168.100.1";
+    interface = "eth0";
+  };
+
+  system.stateVersion = lib.mkDefault "21.05";
+}

services/gitea.nix

@@ -12,35 +12,17 @@
         isReadOnly = false;
       };
     };
-    path = (evalConfig {
+    path = evalConfig ({ config, lib, pkgs, profiles, ... }: {
-      hosts = { };
-      groups = { };
-    } ({ config, lib, pkgs, profiles, modules, sources, ... }: {
-      boot.isContainer = true;
-      networking.useDHCP = false;
-      users.users.root.hashedPassword = "";
       system.stateVersion = "21.11";
 
-      imports = [ sources.nix-hexchen.nixosModules.profiles.nopersist ];
+      imports = [ profiles.nopersist profiles.container ];
 
       environment.systemPackages = [ pkgs.gitea ];
 
       hexchen.bindmounts."/var/lib/gitea" = "/persist/gitea";
 
       nixpkgs.config.allowUnfree = true;
-      networking.firewall.enable = false;
+
-      networking.defaultGateway = {
-        address = "192.168.100.1";
-        interface = "eth0";
-      };
-      services.coredns = {
-        enable = true;
-        config = ''
-          .:53 {
-            forward . 1.1.1.1
-          }
-        '';
-      };
       services.gitea = {
         enable = true;
         appName = "0x0: git for all creatures";
@@ -106,7 +88,7 @@
           AcceptEnv GIT_PROTOCOL
         '';
       };
-    })).config.system.build.toplevel;
+    });
   };
 
   services.nginx.virtualHosts."git.infra4future.de" = {

services/hedgedoc-hacc.nix

@@ -12,28 +12,10 @@
         isReadOnly = false;
       };
     };
-    path = (evalConfig {hosts = {}; groups = {};} ({ config, lib, pkgs, profiles, modules, sources, ... }: {
+    path = evalConfig ({ config, lib, pkgs, profiles, ... }: {
-      boot.isContainer = true;
+      imports = [ profiles.nopersist profiles.container ];
-      networking.useDHCP = false;
-      users.users.root.hashedPassword = "";
-      system.stateVersion = "21.05";
-
-      imports = [ sources.nix-hexchen.nixosModules.profiles.nopersist ];
-
       nixpkgs.config.allowUnfree = true;
-      networking.firewall.enable = false;
+
-      networking.defaultGateway = {
-        address = "192.168.100.1";
-        interface = "eth0";
-      };
-      services.coredns = {
-        enable = true;
-        config = ''
-        .:53 {
-          forward . 1.1.1.1
-        }
-        '';
-      };
       services.hedgedoc = {
         enable = true;
         settings = {
@@ -93,7 +75,7 @@
         startAt = "*-*-* 23:45:00";
         location = "/persist/backups/postgres";
       };
-    })).config.system.build.toplevel;
+    });
   };
   services.nginx.virtualHosts."pad.hacc.earth" = {
     enableACME = true;

services/hedgedoc-i4f.nix

@@ -12,29 +12,10 @@
         isReadOnly = false;
       };
     };
-    path = (evalConfig {hosts = {}; groups = {};} ({ config, lib, pkgs, profiles, modules, sources, ... }: {
+    path = evalConfig ({ config, lib, pkgs, profiles, ... }: {
-      boot.isContainer = true;
+      imports = [ profiles.nopersist profiles.container ];
-      networking.useDHCP = false;
-      users.users.root.hashedPassword = "";
-      system.stateVersion = "21.05";
-
-
-      imports = [ sources.nix-hexchen.nixosModules.profiles.nopersist ];
-
       nixpkgs.config.allowUnfree = true;
-      networking.firewall.enable = false;
+
-      networking.defaultGateway = {
-        address = "192.168.100.1";
-        interface = "eth0";
-      };
-      services.coredns = {
-        enable = true;
-        config = ''
-        .:53 {
-          forward . 1.1.1.1
-        }
-        '';
-      };
       services.hedgedoc = {
         enable = true;
         settings = {
@@ -79,7 +60,7 @@
         startAt = "*-*-* 23:45:00";
         location = "/persist/backups/postgres";
       };
-    })).config.system.build.toplevel;
+    });
   };
 
   services.nginx.virtualHosts."pad.infra4future.de" = {

services/mattermost.nix

@@ -16,22 +16,11 @@ in {
       };
     };
 
-    path = (evalConfig {hosts = {}; groups = {};} ({ config, lib, pkgs, profiles, modules, sources, ... }: {
+    path = evalConfig ({ config, lib, pkgs, profiles, ... }: {
-      boot.isContainer = true;
+      imports = [ profiles.nopersist profiles.container ];
-      networking.useDHCP = false;
-      users.users.root.hashedPassword = "";
-      system.stateVersion = "21.05";
-
-      imports = [ sources.nix-hexchen.nixosModules.profiles.nopersist ];
-
       nixpkgs.overlays = [ (self: super: { inherit mattermost; }) ];
 
       nixpkgs.config.allowUnfree = true;
-      networking.firewall.enable = false;
-      networking.defaultGateway = {
-        address = "192.168.100.1";
-        interface = "eth0";
-      };
 
       systemd.services.mattermost.serviceConfig.EnvironmentFile =
         "/persist/mattermost/secrets.env";
@@ -226,15 +215,7 @@ in {
 
       networking.firewall.allowedTCPPorts = [ 3000 ];
 
-      services.coredns = {
+    });
-        enable = true;
-        config = ''
-          .:53 {
-          forward . 1.1.1.1
-          }
-        '';
-      };
-    })).config.system.build.toplevel;
   };
 
   services.nginx.virtualHosts."mattermost.infra4future.de" = {

services/nextcloud.nix

@@ -12,14 +12,10 @@
         isReadOnly = false;
       };
     };
-    path = (evalConfig {hosts = {}; groups = {};} ({ config, lib, pkgs, profiles, modules, sources, ... }: {
+    path = evalConfig ({ config, lib, pkgs, profiles, sources, ... }: {
-      boot.isContainer = true;
-      networking.useDHCP = false;
-      users.users.root.hashedPassword = "";
-      system.stateVersion = "21.05";
-
       imports = [
-        sources.nix-hexchen.nixosModules.profiles.nopersist
+        profiles.nopersist
+        profiles.container
         (import "${sources.nixpkgs-unstable}/nixos/modules/services/web-apps/nextcloud.nix")
       ];
 
@@ -27,13 +23,7 @@
         "services/web-apps/nextcloud.nix"
       ];
 
-
       nixpkgs.config.allowUnfree = true;
-      networking.firewall.enable = false;
-      networking.defaultGateway = {
-        address = "192.168.100.1";
-        interface = "eth0";
-      };
 
       environment.systemPackages = [ pkgs.htop ];
 
@@ -98,16 +88,7 @@
         requires = ["postgresql.service"];
         after = ["postgresql.service"];
       };
-
+    });
-      services.coredns = {
-        enable = true;
-        config = ''
-          .:53 {
-            forward . 1.1.1.1
-          }
-        '';
-      };
-    })).config.system.build.toplevel;
   };
 
   services.nginx.virtualHosts."cloud.infra4future.de" = {

services/thelounge.nix

@@ -12,18 +12,13 @@ in
     hostAddress = "192.168.100.1";
     localAddress = "192.168.100.4";
 
-    path = (evalConfig {hosts = {}; groups = {};} ({ config, lib, pkgs, profiles, modules, sources, ... }: {
+    path = evalConfig ({ config, lib, pkgs, profiles, modules, sources, ... }: {
-      boot.isContainer = true;
+      # for some inexplicable reason this does not import nopersist.
-      networking.useDHCP = false;
+      # i'm too lazy rn to deal with possible breakages if I add it.
-      users.users.root.hashedPassword = "";
+      # if you have spoons & nothing else to do, consider this a suggestion!
-      system.stateVersion = "21.05";
+      imports = [ profiles.container ];
 
       nixpkgs.config.allowUnfree = true;
-      networking.firewall.enable = false;
-      networking.defaultGateway = {
-        address = "192.168.100.1";
-        interface = "eth0";
-      };
 
       services.thelounge = {
         enable = true;
@@ -66,16 +61,7 @@ in
       # override the package we use
       systemd.services.thelounge.serviceConfig.ExecStart =
         pkgs.lib.mkForce "${thelounge}/bin/thelounge start";
-
+    });
-      services.coredns = {
-        enable = true;
-        config = ''
-          .:53 {
-          forward . 1.1.1.1
-          }
-        '';
-      };
-    })).config.system.build.toplevel;
   };
 
   services.nginx.virtualHosts."webchat.voc.hacc.space" = {

services/tracktrain.nix

@@ -47,21 +47,10 @@ in
       };
     };
 
-    path = (evalConfig {
+    path = evalConfig ({ config, lib, pkgs, profiles, ... }: {
-      hosts = { };
-      groups = { };
-    } ({ config, lib, pkgs, profiles, modules, sources, ... }: {
-      boot.isContainer = true;
-      networking.useDHCP = false;
-      users.users.root.hashedPassword = "";
       system.stateVersion = "21.11";
 
-      imports = [ sources.nix-hexchen.nixosModules.profiles.nopersist ];
+      imports = [ profiles.nopersist profiles.container ];
-      networking.firewall.enable = false;
-      networking.defaultGateway = {
-        address = "192.168.100.1";
-        interface = "eth0";
-      };
 
       users.users.tracktrain = {
         group = "tracktrain";
@@ -87,7 +76,7 @@ in
           mkdir -p /persist/tracktrain
           cd /persist/tracktrain
           ln -sf ${pkgs.writeText "tracktrain-config.yaml" tracktrain-config} config.yaml
-          wget "https://ilztalbahn.eu/wp-content/uploads/2020/07/gtfs.zip"
+          wget "https://ilztalbahn.eu/wp-content/uploads/2020/07/gtfs.zip" || sleep 4; wget "https://ilztalbahn.eu/wp-content/uploads/2020/07/gtfs.zip"
           ${pkgs.tracktrain}/bin/tracktrain +RTS -T
         '';
       };
@@ -157,16 +146,7 @@ in
 
       systemd.services.grafana.serviceConfig.EnvironmentFile =
         "/persist/secrets.env";
-
+    });
-      services.coredns = {
-        enable = true;
-        config = ''
-          .:53 {
-          forward . 1.1.1.1
-          }
-        '';
-      };
-    })).config.system.build.toplevel;
   };
 
 }

services/uffd.nix

@@ -14,28 +14,10 @@ in {
         isReadOnly = false;
       };
     };
-    path = (evalConfig {hosts = {}; groups = {};} ({ config, lib, pkgs, profiles, modules, sources, ... }: {
+    path = evalConfig ({ config, lib, pkgs, profiles, ... }: {
-      boot.isContainer = true;
+      imports = [ profiles.nopersist profiles.container ];
-      networking.useDHCP = false;
-      users.users.root.hashedPassword = "";
-      system.stateVersion = "21.05";
-
-      imports = [ sources.nix-hexchen.nixosModules.profiles.nopersist ];
 
       nixpkgs.config.allowUnfree = true;
-      networking.firewall.enable = false;
-      networking.defaultGateway = {
-        address = "192.168.100.1";
-        interface = "eth0";
-      };
-      services.coredns = {
-        enable = true;
-        config = ''
-        .:53 {
-          forward . 1.1.1.1
-        }
-        '';
-      };
 
       services.uwsgi = {
         enable = true;
@@ -52,7 +34,7 @@ in {
           hook-pre-app = "exec:FLASK_APP=${uffd}/lib/python3.10/site-packages/uffd flask db upgrade";
         };
       };
-    })).config.system.build.toplevel;
+    });
   };
   services.nginx.virtualHosts."login.infra4future.de" = {
     enableACME = true;