minor modifications to containers

flake.lock

@@ -427,11 +427,11 @@
     },
     "nix-secrets": {
       "locked": {
-        "lastModified": 1728307023,
+        "lastModified": 1728426148,
-        "narHash": "sha256-0UW+bb5hXNeLgrBbHuwZLeP/yTSC12wHrArpzNW7/kw=",
+        "narHash": "sha256-NN1eE1bEnUcmd0u7EzmzrbsuyY2Nfwqh+kDfKEPrmRM=",
         "ref": "refs/heads/master",
-        "rev": "3db4dbfd1032f9fe9f5c898d74ea738a0a70395b",
+        "rev": "6152199b861b3534ab5075de9f9cdc2590150fe4",
-        "revCount": 176,
+        "revCount": 179,
         "type": "git",
         "url": "ssh://git@git.bitlab21.com/sam/nix-secrets.git"
       },

home/common/optional/desktop/common/default.nix

@@ -20,5 +20,6 @@
     pkgs.gnome.simple-scan
     pkgs.pandoc
     pkgs.texlive.combined.scheme-small
+    pkgs.libreoffice
   ];
 }

home/common/optional/desktop/common/firefox.nix

@@ -7,6 +7,8 @@
   user = config.home.username;
   jellyfinIp = configVars.networking.addresses.jellyfin.ip;
   jellyfinPort = configVars.networking.addresses.jellyfin.port;
+  bitcoinNodeIp = configVars.networking.addresses.bitcoin-node.ip;
+  mempoolPort = configVars.networking.addresses.bitcoin-node.services.mempool.port;
 in {
   programs.firefox = {
     enable = true;
@@ -61,6 +63,10 @@ in {
               name = "Jellyfin";
               url = "http://${jellyfinIp}:${jellyfinPort}";
             }
+            {
+              name = "Mempool";
+              url = "http://${bitcoinNodeIp}:${toString mempoolPort}";
+            }
             {
               name = "Nixos Package Search";
               url = "https://search.nixos.org/packages";

hosts/common/optional/nixos-containers/jellyfin.nix

@@ -52,7 +52,7 @@ in {
         firewall = {
           enable = true;
           allowedTCPPorts = [
-            5432
+            8096
           ];
         };
         useHostResolvConf = lib.mkForce false;

hosts/common/optional/nixos-containers/nix-bitcoin.nix

@@ -12,6 +12,7 @@
   bitcoin-HMAC-public = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."software/bitcoind/bitcoin-HMAC-public".path;
   containerName = "bitcoin-node";
   containerIp = configVars.networking.addresses.bitcoin-node.ip;
+  mempoolPort = configVars.networking.addresses.bitcoin-node.services.mempool.port;
   gatewayIp = configVars.networking.addresses.gateway.ip;
   allowip = configVars.networking.addresses.bitcoin-node.services.bitcoind.allowip;
   pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
@@ -146,7 +147,7 @@ in {
           enable = true;
           electrumServer = "electrs";
           frontend = {
-            port = 4080;
+            port = mempoolPort;
             address = "0.0.0.0";
           };
         };

hosts/common/optional/nixos-containers/worker.nix

@@ -0,0 +1,163 @@
+{
+  lib,
+  pkgs,
+  configVars,
+  inputs,
+  config,
+  ...
+}: let
+  pubKeys = lib.filesystem.listFilesRecursive ../../users/keys;
+  containerName = "worker";
+  containerIp = configVars.networking.addresses.worker.ip;
+  gatewayIp = configVars.networking.addresses.gateway.ip;
+  sopsHashedPasswordFile = lib.optionalString (lib.hasAttr "sops-nix" inputs) config.sops.secrets."ssh_keys/baseddata-models-access/id_ed25519".path;
+  baseddataEnv = "dev";
+in {
+  sops.secrets = {
+    "ssh_keys/baseddata-models-access/id_ed25519" = {};
+  };
+
+  environment.persistence."/persist" = {
+    hideMounts = true;
+    directories = [
+      "/var/lib/nixos-containers/${containerName}"
+    ];
+  };
+
+  networking.nat.enable = true;
+  networking.nat.internalInterfaces = ["ve-+"];
+  networking.nat.externalInterface = "br0";
+
+  containers.${containerName} = {
+    autoStart = true;
+    privateNetwork = true;
+    hostBridge = "br0";
+    nixpkgs = pkgs.path;
+    bindMounts = {
+      "/root/.ssh/id_ed25519" = {
+        hostPath = "${sopsHashedPasswordFile}";
+        isReadOnly = true;
+      };
+    };
+
+    config = {
+      pkgs,
+      lib,
+      ...
+    }: {
+      networking = {
+        defaultGateway = "${gatewayIp}";
+        interfaces.eth0.ipv4.addresses = [
+          {
+            "address" = "${containerIp}";
+            "prefixLength" = 24;
+          }
+        ];
+        firewall = {
+          enable = true;
+          allowedTCPPorts = [
+            4200
+          ];
+        };
+        useHostResolvConf = lib.mkForce false;
+      };
+
+      services.resolved.enable = true;
+
+      environment.systemPackages = [
+        pkgs.vim
+        pkgs.git
+        pkgs.python311
+        pkgs.poetry
+      ];
+
+      environment.variables = {
+        BASEDDATA_ENVIRONMENT = "dev";
+        NIX_LD_LIBRARY_PATH = "/run/current-system/sw/share/nix-ld/lib";
+        NIX_LD = "/run/current-system/sw/share/nix-ld/lib/ld.so";
+        LD_LIBRARY_PATH = "$NIX_LD_LIBRARY_PATH";
+      };
+
+      systemd.services.baseddata-deploy-service = {
+        wantedBy = ["multi-user.target"];
+        after = ["network.target"];
+        description = "Initiates deployment of application and builds python environment using Poetry";
+        environment = {
+          BASEDDATA_ENVIRONMENT = "${baseddataEnv}";
+        };
+        serviceConfig = {
+          ExecStart = pkgs.writeShellScript "baseddata-deploy-service" ''
+            GITCMD="${pkgs.openssh}/bin/ssh -i /root/.ssh/id_ed25519"
+            if [ ! -d "/srv/baseddata-models" ]; then
+              GIT_SSH_COMMAND=$GITCMD  ${pkgs.git}/bin/git clone --branch $BASEDDATA_ENVIRONMENT git@git.bitlab21.com:sam/baseddata-models.git /srv/baseddata-models
+            else
+              cd /srv/baseddata-models
+              GIT_SSH_COMMAND=$GITCMD ${pkgs.git}/bin/git stash --include-untracked
+              GIT_SSH_COMMAND=$GITCMD ${pkgs.git}/bin/git pull
+            fi
+
+            cd /srv/baseddata-models
+            mkdir .venv
+            ${pkgs.poetry}/bin/poetry install
+          '';
+          Restart = "on-failure";
+        };
+      };
+
+      systemd.services.baseddata-prefect-server = {
+        wantedBy = ["multi-user.target"];
+        after = ["baseddata-deploy-service.target"];
+        description = "Initates the Prefect server";
+        environment = {
+          NIX_LD_LIBRARY_PATH = "/run/current-system/sw/share/nix-ld/lib";
+          NIX_LD = "/run/current-system/sw/share/nix-ld/lib/ld.so";
+          LD_LIBRARY_PATH = "/run/current-system/sw/share/nix-ld/lib";
+          PREFECT_API_URL = "http://${containerIp}:4200/api";
+          BASEDDATA_ENVIRONMENT = "${baseddataEnv}";
+        };
+        serviceConfig = {
+          WorkingDirectory = "/srv/baseddata-models";
+          ExecStart = pkgs.writeShellScript "baseddata-serve-flows" ''
+            .venv/bin/prefect server start --host 0.0.0.0
+          '';
+          Restart = "on-failure";
+        };
+      };
+
+      systemd.services.baseddata-serve-flows = {
+        wantedBy = ["multi-user.target"];
+        after = ["baseddata-prefect-server.target"];
+        description = "Serves the Prefect flows";
+        environment = {
+          PREFECT_API_URL = "http://${containerIp}:4200/api";
+          BASEDDATA_ENVIRONMENT = "${baseddataEnv}";
+        };
+        serviceConfig = {
+          Environment="PATH=/run/current-system/sw/bin/";
+          WorkingDirectory = "/srv/baseddata-models";
+          ExecStart = pkgs.writeShellScript "baseddata-serve-flows" ''
+            .venv/bin/python automation/flows/serve-flows.py
+          '';
+          Restart = "on-failure";
+        };
+      };
+
+      programs.nix-ld.enable = true;
+      programs.nix-ld.libraries = with pkgs; [
+        zlib
+        libgcc
+      ];
+
+      services.openssh = {
+        enable = true;
+        settings.PasswordAuthentication = false;
+      };
+
+      users.users.root = {
+        openssh.authorizedKeys.keys = lib.lists.forEach pubKeys (key: builtins.readFile key);
+      };
+
+      system.stateVersion = "24.05";
+    };
+  };
+}

hosts/semita/default.nix

@@ -55,6 +55,7 @@ in {
     ../common/optional/nixos-containers/nix-bitcoin.nix
     ../common/optional/nixos-containers/postgres.nix
     ../common/optional/nixos-containers/jellyfin.nix
+    ../common/optional/nixos-containers/worker.nix
   ];
 
   fileSystems."/media/main-ssd" = {
@@ -130,5 +131,21 @@ in {
     };
   };
 
+  # Using non-Nix Python Packages with Binaries on NixOS https://github.com/mcdonc/.nixconfig/blob/e7885ad18b7980f221e59a21c91b8eb02795b541/videos/pydev/script.rst
+  programs.nix-ld.enable = true;
+  programs.nix-ld.libraries = with pkgs; [
+    zlib # numpy
+    libgcc  # sqlalchemy
+    # that's where the shared libs go, you can find which one you need using 
+    # nix-locate --top-level libstdc++.so.6  (replace this with your lib)
+    # ^ this requires `nix-index` pkg
+  ];
+
+  environment.variables = {
+      NIX_LD_LIBRARY_PATH="/run/current-system/sw/share/nix-ld/lib";
+      NIX_LD="/run/current-system/sw/share/nix-ld/lib/ld.so";
+      LD_LIBRARY_PATH=lib.mkForce "$NIX_LD_LIBRARY_PATH";
+  };
+
   services.libinput.enable = true;
 }