WIP: koyomi

This also enables podman on mayushii.

machines/default.nix

@@ -76,4 +76,13 @@ in
 
     targetHost = "yuzuru.sbruder.de";
   };
+  koyomi = {
+    system = "x86_64-linux";
+    extraModules = [
+      hardware.common-cpu-intel
+      hardware.common-pc-ssd
+    ];
+
+    targetHost = "koyomi.sbruder.de";
+  };
 }

machines/koyomi/README.md

@@ -0,0 +1,22 @@
+<!--
+SPDX-FileCopyrightText: 2024 Simon Bruder <simon@sbruder.de>
+
+SPDX-License-Identifier: CC-BY-SA-4.0
+-->
+
+# koyomi
+
+## Hardware
+
+TBD
+
+mdadm --create /dev/md/esp -n 2 -l 1 -e 1.0 /dev/nvme0n1p1 /dev/nvme1n1p1
+mdadm --create /dev/md/main -n 2 -l 1 -e 1.2 /dev/nvme0n1p2 /dev/nvme1n1p2
+
+## Purpose
+
+TBD
+
+## Name
+
+Araragi Koyomi is a student from the *Monogatari Series*.

machines/koyomi/configuration.nix

@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: 2024 Simon Bruder <simon@sbruder.de>
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+{ config, lib, pkgs, ... }:
+
+{
+  imports = [
+    ./hardware-configuration.nix
+    ../../modules
+    ../../users/simon
+  ];
+
+  sbruder = {
+    #wireguard.home.enable = true;
+  };
+
+  networking.hostName = "koyomi";
+
+  system.stateVersion = "23.11";
+}

machines/koyomi/hardware-configuration.nix

@@ -0,0 +1,61 @@
+# SPDX-FileCopyrightText: 2024 Simon Bruder <simon@sbruder.de>
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+{ modulesPath, ... }:
+
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+  ];
+
+  boot = {
+    swraid.enable = true;
+    kernelModules = [ "kvm-intel" ];
+    loader = {
+      grub.enable = false;
+      systemd-boot.enable = true;
+      efi.canTouchEfiVariables = true;
+    };
+    initrd = {
+      availableKernelModules = [ "aesni_intel" "ahci" "nvme" ];
+      kernelModules = [ "dm-snapshot" ];
+      luks.devices = {
+        koyomi-pv = {
+          name = "koyomi-pv";
+          device = "/dev/disk/by-uuid/9145417d-e8f5-4aa9-a526-419e507c47fd";
+          preLVM = true;
+          allowDiscards = true;
+        };
+      };
+    };
+  };
+
+  fileSystems = {
+    "/" = {
+      device = "/dev/disk/by-uuid/3b31163f-4fec-4e1c-b311-7c8aaca76cd4";
+      fsType = "btrfs";
+      options = [ "discard=async" "noatime" "compress=zstd" ];
+    };
+
+    "/boot" = {
+      device = "/dev/disk/by-uuid/12CE-A600";
+      fsType = "vfat";
+    };
+  };
+
+  networking.useDHCP = false;
+  networking.usePredictableInterfaceNames = false;
+  systemd.network = {
+    enable = true;
+    networks = {
+      eth0 = {
+        name = "eth0";
+        DHCP = "yes";
+        domains = [ "sbruder.de" ];
+        address = [ "2a01:4f8:151:712d::1/64" ];
+        gateway = [ "fe80::1" ];
+      };
+    };
+  };
+}

machines/mayushii/configuration.nix

@@ -19,6 +19,7 @@
     gui.enable = true;
     media-proxy.enable = true;
     mullvad.enable = true;
+    podman.enable = true;
     restic.system = {
       enable = true;
       qos = true;

modules/default.nix

@@ -33,7 +33,6 @@
     ./ausweisapp.nix
     ./authoritative-dns.nix
     ./cups.nix
-    ./docker.nix
     ./fancontrol.nix
     ./flatpak.nix
     ./fonts.nix
@@ -55,6 +54,7 @@
     ./nix.nix
     ./office.nix
     ./pipewire.nix
+    ./podman.nix
     ./prometheus/node_exporter.nix
     ./pubkeys.nix
     ./qbittorrent

modules/docker.nix

@@ -1,47 +0,0 @@
-# SPDX-FileCopyrightText: 2020-2021 Simon Bruder <simon@sbruder.de>
-#
-# SPDX-License-Identifier: AGPL-3.0-or-later
-
-{ config, lib, pkgs, ... }:
-
-{
-  # This uses a custom option (instead of `virtualisation.docker.enable`) since
-  # `virtualisation.oci-containers` conditionally sets
-  # `virtualisation.docker.enable` and therefore causes an infinite recursion.
-  options.sbruder.docker.enable = lib.mkEnableOption "docker with ipv6nat";
-
-  config = lib.mkIf config.sbruder.docker.enable {
-    environment.systemPackages = with pkgs; [
-      docker-compose
-      docker-credential-helpers
-      docker-ls
-    ];
-
-    virtualisation = {
-      docker = {
-        enable = true;
-        logDriver = "journald";
-        extraOptions = lib.concatStringsSep " " [
-          "--ipv6"
-          "--fixed-cidr-v6=fd00:d0ce:d0ce:d0ce::/64"
-        ];
-      };
-
-      oci-containers.containers.ipv6nat = {
-        image = "robbertkl/ipv6nat";
-        volumes = [
-          "/var/run/docker.sock:/var/run/docker.sock:ro"
-        ];
-        extraOptions = [
-          "--network=host"
-          "--cap-drop=ALL"
-          "--cap-add=NET_ADMIN"
-          "--cap-add=NET_RAW"
-          "--cap-add=SYS_MODULE"
-        ];
-      };
-    };
-
-    environment.etc."modules-load.d/ipv6nat.conf".text = "ip6_tables\n";
-  };
-}

modules/podman.nix

@@ -0,0 +1,29 @@
+# SPDX-FileCopyrightText: 2020-2024 Simon Bruder <simon@sbruder.de>
+#
+# SPDX-License-Identifier: AGPL-3.0-or-later
+
+{ config, lib, pkgs, ... }:
+
+{
+  options.sbruder.podman.enable = lib.mkEnableOption "podman";
+
+  config = lib.mkIf config.sbruder.podman.enable {
+    boot.enableContainers = false; # FIXME: this only needs to be set for some stateVersions
+
+    environment.systemPackages = with pkgs; [
+      buildah
+      podman-compose
+      skopeo
+    ];
+
+    virtualisation = {
+      podman = {
+        enable = true;
+        dockerSocket.enable = true;
+        defaultNetwork.settings = {
+          ipv6_enabled = true;
+        };
+      };
+    };
+  };
+}

modules/restic/system.nix

@@ -28,6 +28,7 @@ let
     "/home/*/mounts"
 
     # Docker (state should be kept somewhere else)
+    "/home/*/.local/share/containers" # podman
     "/var/lib/docker/"
 
     # Static configuration (generated from this repository)