NixOS Containers: Difference between revisions

(2 intermediate revisions by 2 users not shown)

Line 113:

</syntaxhighlight>

Further informations are available in the {{manual:nixos|sec=#ch-containers|chapter=NixOS manual}}.

View log for container<syntaxhighlight lang="console">

# journalctl -M webserver

</syntaxhighlight>Further informations are available in the {{manual:nixos|sec=#ch-containers|chapter=NixOS manual}}.

== Tips and tricks ==

Line 147:

Line 149:

# nixos-container start flake-test

</syntaxhighlight>

==== Use agenix secrets in container ====

To add <code>agenix</code> secrets to a container bind mount the <code>ssh-host.key</code> and import the <code>agenix.nixosModule</code> and set <code>age.identityPaths</code> [https://discourse.nixos.org/t/secrets-inside-nixos-containers/34403/6 Source]<syntaxhighlight lang="nix">

{ agenix, ... }:

{

containers."withSecret" = {

# pass the private key to the container for agenix to decrypt the secret

bindMounts."/etc/ssh/ssh_host_ed25519_key".isReadOnly = true;

config =

{

config,

lib,

pkgs,

...

}:

{

imports = [ agenix.nixosModules.default ]; # import agenix-module into the nixos-container

age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; # isn't set automatically when openssh is not setup

# import the secret

age.secrets."secret-name" = {

file = ../secrets/secret.age;

};

}

</syntaxhighlight>

Line 165:

Line 197:

* [https://blog.beardhatcode.be/2020/12/Declarative-Nixos-Containers.html Blog Article - Declarative NixOS Containers]

* [https://discourse.nixos.org/t/extra-container-run-declarative-containers-without-full-system-rebuilds/511 NixOS Discourse - Extra-container: Run declarative containers without full system rebuilds]

* [https://github.com/NixOS/nixpkgs/blob/master/pkgs/~~tools~~/~~virtualization~~/nixos-container/nixos-container.pl Nixpkgs - nixos-container.pl]

* [https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/ni/nixos-container/nixos-container.pl Nixpkgs - nixos-container.pl]

* [https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualisation/nixos-containers.nix Nixpkgs - nixos-containers.nix]

* [https://nixcademy.com/2023/08/29/nixos-nspawn/ nixos-nspawn]

@@ Line 113: / Line 113: @@
 </syntaxhighlight>
-Further informations are available in the {{manual:nixos|sec=#ch-containers|chapter=NixOS manual}}.
+View log for container<syntaxhighlight lang="console">
+# journalctl -M webserver
+</syntaxhighlight>Further informations are available in the {{manual:nixos|sec=#ch-containers|chapter=NixOS manual}}.
 == Tips and tricks ==
@@ Line 147: / Line 149: @@
 # nixos-container start flake-test
+</syntaxhighlight>
+==== Use agenix secrets in container ====
+To add <code>agenix</code> secrets to a container bind mount the <code>ssh-host.key</code> and import the <code>agenix.nixosModule</code> and set <code>age.identityPaths</code> [https://discourse.nixos.org/t/secrets-inside-nixos-containers/34403/6 Source]<syntaxhighlight lang="nix">
+{ agenix, ... }:
+{
+  containers."withSecret" = {
+    # pass the private key to the container for agenix to decrypt the secret
+    bindMounts."/etc/ssh/ssh_host_ed25519_key".isReadOnly = true;
+    config =
+      {
+        config,
+        lib,
+        pkgs,
+        ...
+      }:
+      {
+        imports = [ agenix.nixosModules.default ]; # import agenix-module into the nixos-container
+        age.identityPaths = [ "/etc/ssh/ssh_host_ed25519_key" ]; # isn't set automatically when openssh is not setup
+        # import the secret
+        age.secrets."secret-name" = {
+          file = ../secrets/secret.age;
+        };
+      };
+  };
+}
 </syntaxhighlight>
@@ Line 165: / Line 197: @@
 * [https://blog.beardhatcode.be/2020/12/Declarative-Nixos-Containers.html Blog Article - Declarative NixOS Containers]
 * [https://discourse.nixos.org/t/extra-container-run-declarative-containers-without-full-system-rebuilds/511 NixOS Discourse - Extra-container: Run declarative containers without full system rebuilds]
-* [https://github.com/NixOS/nixpkgs/blob/master/pkgs/tools/virtualization/nixos-container/nixos-container.pl Nixpkgs - nixos-container.pl]
+* [https://github.com/NixOS/nixpkgs/blob/master/pkgs/by-name/ni/nixos-container/nixos-container.pl Nixpkgs - nixos-container.pl]
 * [https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/virtualisation/nixos-containers.nix Nixpkgs - nixos-containers.nix]
 * [https://nixcademy.com/2023/08/29/nixos-nspawn/ nixos-nspawn]