nixfiles/hosts/hetzner-vm/containers/quassel/default.nix

{
  self,
  hostPath,
  tree,
  lib,
  inputs,
  config,
  pkgs,
  ...
}: let
  containerAddresses = import "${hostPath}/data/containerAddresses.nix";
  hostIP = containerAddresses.host;
  containerIP = containerAddresses.containers.quassel;

  containerLib = import "${self}/lib/containerLib.nix" {
    inherit lib;
  };

  # Using secrets from Host
  secrets = config.services.secrets.secrets;
  secretsList = [
    "quassel_restic_env"
    "quassel_restic_password"
  ];
in {
  containers.quassel = {
    autoStart = true;
    privateNetwork = true;
    hostAddress = hostIP;
    localAddress = containerIP;
    bindMounts = containerLib.genBindHostsForSecrets secrets secretsList;

    specialArgs = {
      inherit inputs;
      inherit tree;
      inherit self;
      inherit hostPath;
      hostSecrets = secrets;
    };

    config = {config, ...}: {
      nixpkgs.pkgs = pkgs;

      imports = with tree;
        [
          presets.nixos.containerBase
          profiles.sshd
          profiles.firewallAllow.ssh
        ]
        ++ (with hosts.hetzner-vm.containers.quassel.profiles; [
          quassel
          restic
        ]);

      # For Shared Secrets
      systemd.tmpfiles.rules = [
        "d ${config.services.secrets.secretsDir} - root root"
      ];

      networking.firewall.allowedTCPPorts = [4242];

      home-manager.users.root.home.stateVersion = "23.05";
      system.stateVersion = "23.05";
    };
  };

  networking.nat.forwardPorts = [
    {
      sourcePort = 4242;
      destination = "${containerIP}\:4242";
    }
  ];

  networking.firewall.allowedTCPPorts = [4242];
}