alexion
969737b6b5
Add a `nesting` placement field to the Host-side guest interface, a bool off by default. On, it grants the guest's container the prerequisites its interior needs to run Podman and other OCI containers: the `CAP_NET_ADMIN` capability an OCI runtime uses to build its bridges and firewall rules, and the `/dev/net/tun` and `/dev/fuse` device nodes it reaches for to network those containers and back their overlay storage. Off, both the capability and device lists are empty, so a non-nesting guest is untouched. cgroup delegation, the other nested prerequisite, the NixOS container backend already grants every container unconditionally, so the Skeleton records it with an absence pointer rather than re-emitting it. Add a nesting-sample guest whose interior defines an `oci-containers` workload on Podman, and enable it on neogaia with `nesting` on, so the path builds end to end through the Host's `nix flake check` — which pulls in podman and the generated container unit for the nested system.
77 lines
2.2 KiB
Nix
77 lines
2.2 KiB
Nix
{
|
|
config,
|
|
inputs,
|
|
pkgs,
|
|
...
|
|
}:
|
|
# neogaia — Dell XPS 13 9380 laptop.
|
|
# Disk layout is in ./disk.nix.
|
|
# `fileSystems` are derived from it, none declared here.
|
|
{
|
|
imports = [
|
|
inputs.nixos-hardware.nixosModules.dell-xps-13-9380
|
|
./hardware-configuration.nix
|
|
./disk.nix
|
|
];
|
|
|
|
system.stateVersion = "26.05";
|
|
|
|
# systemd-boot on the EFI system partition.
|
|
boot.loader.systemd-boot.enable = true;
|
|
boot.loader.efi.canTouchEfiVariables = true;
|
|
|
|
boot.kernelPackages = pkgs.linuxPackages_cachyos;
|
|
|
|
# Redistributable firmware for the QCA6174 wifi (ath10k blobs).
|
|
# Intel microcode updates follow from this, so none is declared here.
|
|
hardware.enableRedistributableFirmware = true;
|
|
|
|
# RAM-backed swap, no on-disk swap partition.
|
|
zramSwap.enable = true;
|
|
|
|
# So wifi can be joined from the console.
|
|
networking.networkmanager.enable = true;
|
|
|
|
# So setup can be driven over the network.
|
|
# The matching host public keys sit beside this file in plaintext, since
|
|
# publishing them is their purpose.
|
|
modules.ssh.enable = true;
|
|
modules.ssh.hostKeys.sopsFile = ../../secrets/neogaia.yaml;
|
|
modules.ssh.userKey.sopsFile = ../../secrets/neogaia.yaml;
|
|
|
|
# A machine the operator works from, so it admits the workstation keys alone.
|
|
modules.ssh.authorizedKeys = config.modules.ssh.workstationKeys;
|
|
|
|
modules.toolkit.enable = true;
|
|
|
|
# The walking-skeleton guest, enabled like any module: proves the guest path
|
|
# end to end through this host's `nix flake check`.
|
|
# Modest caps keep the skeleton guest from starving the laptop.
|
|
guests.sample.enable = true;
|
|
guests.sample.limits = {
|
|
memory = "1G";
|
|
cpu = "100%";
|
|
tasksMax = 512;
|
|
};
|
|
|
|
# The nesting guest, run with `nesting` on: proves an interior OCI container
|
|
# on Podman builds end to end through this host's `nix flake check`.
|
|
guests.nesting-sample.enable = true;
|
|
guests.nesting-sample.nesting = true;
|
|
guests.nesting-sample.limits = {
|
|
memory = "1G";
|
|
cpu = "100%";
|
|
tasksMax = 512;
|
|
};
|
|
|
|
modules.agents.claude-code.enable = true;
|
|
modules.agents.tools.gitea-axi.enable = true;
|
|
modules.agents.pi.enable = true;
|
|
|
|
modules.desktop.enable = true;
|
|
modules.desktop.obsidian.enable = true;
|
|
|
|
time.timeZone = "America/New_York";
|
|
i18n.defaultLocale = "en_GB.UTF-8";
|
|
}
|