mirror of
https://github.com/oqyude/nixos.git
synced 2026-10-11 22:37:25 +03:00
fix(review-T17): apply review fixes B1/I1/I2/M1/M2 + T10+T15+any.nix+wsl cleanup
Review of dev vs16644fcfound 1 BLOCKING + 3 IMPORTANT + 2 MINOR. All addressed in this commit: B1 (R1.4 stale files in project-rules.md + AGENTS.md): Replaced 'vds/nginx.nix' (removed inef38dc4) with 'home/termux.nix' (added in958247b). R1.4 now correctly lists the 4 files that use 100.64.0.0: home/termux.nix:256, modules/server/nextcloud.nix:73, modules/server/nginx.nix:109,253, modules/vds/systemd.nix:10. I1 (count drift in '15 modules' docs): - AGENTS.md:84 + project-rules.md:97: '15 → 14' (with note that stirling-pdf was deleted in5dd7a58) - manifest.json (T16): rewritten acceptance to '15 archived (13 from server/default.nix:37-50 + 2 from containers/ kokoro-tts and openhands) + 1 deleted (stirling-pdf) + 1 active (open-webui in containers/)' - modules/server/default.nix:37-50: comment now explains the three categories I2 (T1 + T13 status stuck on pending): Both flipped to 'completed' in manifest.json. T1 import fix verified by nix eval (epral stateVersion = '24.05'). T13 done in61b3724(nginx firewall rule removed). I3 (.ci/checks.sh committed) satisfied. M1 (R1.3 stale nginx.nix:225 line number): Removed line number from both project-rules.md and AGENTS.md. Replaced with 'nginx.nix (networking.firewall)'. M2 (R1.2 listed 7 services, 2 in archive): Updated to 12 actual services in both files. n8n and minecraft were archived in T16; they no longer need storage guard. T10 (reality443Forwarding погашен): Removed option from options.nix:66-74, realityPorts from 3x-ui.nix:33-35, and 'reality443Forwarding = true' from vds/default.nix:19. ADR-note comments left in place. T15 (kokoro-tts and openhands archived): git mv modules/containers/kokoro-tts.nix → archive/containers/ git mv modules/containers/openhands.nix → archive/containers/ Also moved modules/containers/kokoro-tts/ (Dockerfile, app.py, etc.) to archive/containers/kokoro-tts/ for completeness. any.nix (nix flake check support): Added stub fileSystems + boot.loader.grub to configurations/any.nix so 'nix flake check' can evaluate the 'default' template config (which is never deployed — real hosts have their own disko/grub). wsl cleanup (dead imports blocking nix flake check): - Removed modules/wsl/containers/default.nix (was only imported nowhere, contained kokoro-tts reference) - Removed './containers' import from modules/wsl/default.nix (resolved to the now-removed default.nix) nix flake check: previously failed with 'Path modules/containers does not exist' (cached evaluation referenced old path). After this commit the error is gone — flake check progressed past the path resolution and started building derivations. Full build output not captured (5-min timeout for download from cache.nixos.org), but path errors are resolved. T5 risk acknowledgment: .agent/decisions/0002-backups-external.md updated with explicit risk table for 'if no backups' scenario + ADR/R1.9 guidance. T1, T2, T6, T7, T8, T9, T10, T12, T13, T15, T16, T17: all → completed in manifest.json. T3, T4, T5, T11, T14: previously completed. Remaining DEFERRED: T3 (otrecа SSH recovery), T5 (5.6 answer).
This commit is contained in:
@@ -0,0 +1,121 @@
|
||||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
xlib,
|
||||
...
|
||||
}:
|
||||
|
||||
{
|
||||
# Runtime
|
||||
virtualisation.podman = {
|
||||
enable = true;
|
||||
autoPrune.enable = true;
|
||||
dockerCompat = true;
|
||||
dockerSocket.enable = true;
|
||||
defaultNetwork.settings.dns_enabled = true;
|
||||
};
|
||||
|
||||
# Enable container name DNS for all Podman networks.
|
||||
networking.firewall.interfaces =
|
||||
let
|
||||
matchAll = if !config.networking.nftables.enable then "podman+" else "podman*";
|
||||
in
|
||||
{
|
||||
"${matchAll}".allowedUDPPorts = [ 53 ];
|
||||
};
|
||||
|
||||
virtualisation.oci-containers.backend = "podman";
|
||||
|
||||
# Containers
|
||||
virtualisation.oci-containers.containers."openhands-app" = {
|
||||
image = "ghcr.io/openhands/openhands:latest";
|
||||
environment = {
|
||||
"AGENT_SERVER_IMAGE_REPOSITORY" = "ghcr.io/openhands/agent-server";
|
||||
"AGENT_SERVER_IMAGE_TAG" = "31536c8-python";
|
||||
"WORKSPACE_MOUNT_PATH" = "${xlib.dirs.services-mnt-folder}/containers/openhands/workspace";
|
||||
};
|
||||
volumes = [
|
||||
"${xlib.dirs.services-mnt-folder}/containers/openhands/userspace:/.openhands:rw"
|
||||
"${xlib.dirs.services-mnt-folder}/containers/openhands/workspace:/opt/workspace_base:rw"
|
||||
"/run/podman/podman.sock:/var/run/docker.sock:rw"
|
||||
];
|
||||
ports = [
|
||||
"3000:3000/tcp"
|
||||
];
|
||||
log-driver = "journald";
|
||||
extraOptions = [
|
||||
# "--network=host"
|
||||
"--add-host=host.docker.internal:host-gateway"
|
||||
"--network-alias=openhands"
|
||||
"--network=openhands_default"
|
||||
];
|
||||
};
|
||||
systemd.services."podman-openhands-app" = {
|
||||
serviceConfig = {
|
||||
Restart = lib.mkOverride 90 "no";
|
||||
};
|
||||
after = [
|
||||
"podman-network-openhands_default.service"
|
||||
];
|
||||
requires = [
|
||||
"podman-network-openhands_default.service"
|
||||
];
|
||||
partOf = [
|
||||
"podman-compose-openhands-root.target"
|
||||
];
|
||||
wantedBy = [
|
||||
"podman-compose-openhands-root.target"
|
||||
];
|
||||
};
|
||||
|
||||
# Networks
|
||||
systemd.services."podman-network-openhands_default" = {
|
||||
path = [ pkgs.podman ];
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
ExecStop = "podman network rm -f openhands_default";
|
||||
};
|
||||
script = ''
|
||||
podman network inspect openhands_default || podman network create openhands_default
|
||||
'';
|
||||
partOf = [ "podman-compose-openhands-root.target" ];
|
||||
wantedBy = [ "podman-compose-openhands-root.target" ];
|
||||
};
|
||||
|
||||
# Builds
|
||||
# systemd.services."podman-build-openhands-app" = {
|
||||
# enable = false;
|
||||
# path = [
|
||||
# pkgs.podman
|
||||
# pkgs.git
|
||||
# ];
|
||||
# serviceConfig = {
|
||||
# Type = "oneshot";
|
||||
# TimeoutSec = 300;
|
||||
# };
|
||||
# script = ''
|
||||
# cd ${xlib.dirs.services-mnt-folder}/containers/openhands/source
|
||||
# podman build -t openhands:latest -f ./containers/app/Dockerfile .
|
||||
# '';
|
||||
# };
|
||||
|
||||
# Root service
|
||||
# When started, this will automatically create all resources and start
|
||||
# the containers. When stopped, this will teardown all resources.
|
||||
systemd.targets."podman-compose-openhands-root" = {
|
||||
unitConfig = {
|
||||
Description = "Root target generated by compose2nix.";
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${xlib.dirs.services-mnt-folder} 0755 root root -"
|
||||
"d ${xlib.dirs.services-mnt-folder}/containers 0755 root root -"
|
||||
"d ${xlib.dirs.services-mnt-folder}/containers/openhands 0755 root root -"
|
||||
"d ${xlib.dirs.services-mnt-folder}/containers/openhands/userspace 0755 root root -"
|
||||
"d ${xlib.dirs.services-mnt-folder}/containers/openhands/workspace 0755 root root -"
|
||||
];
|
||||
}
|
||||
Reference in New Issue
Block a user