nixfiles/hosts/hetzner-vm/containers/piped/default.nix

{
  tree,
  lib,
  inputs,
  config,
  pkgs,
  ...
}: let
  #container-addresses = import ../../data/container-addresses.nix {};
  #hostIP = container-addresses.host;
  #containerIP = container-addresses.containers.piped;
  containerConfig = config.containers.piped.config;

  ports = import ./data/ports.nix {};

  # Using secrets from Host
  secrets = config.services.secrets.secrets;
  secrets_list = [
    "piped_restic_env"
    "piped_restic_password"
    {
      name = "piped_cockroachdb_ca_certificate";
      path = "/var/lib/cockroachdb-certs/ca.crt";
    }
    {
      name = "piped_cockroachdb_node_certificate";
      path = "/var/lib/cockroachdb-certs/node.crt";
    }
    {
      name = "piped_cockroachdb_node_key";
      path = "/var/lib/cockroachdb-certs/node.key";
    }
  ];

  containerName = "piped";
  pipedSocketForComponent = (
    component: "/var/lib/nixos-containers/${containerName}/var/sockets/piped-${component}.sock"
  );
in {
  # Create this directory outside the container so the bind mounts work
  systemd.tmpfiles.rules = [
    "d /var/lib/nixos-containers/${containerName}/var/lib/cockroachdb-certs - root root"
  ];

  users.users."cockroachdb-piped" = {
    uid = containerConfig.users.users.cockroachdb.uid;
    group = "cockroachdb-piped";
  };
  users.groups."cockroachdb-piped" = {
    gid = containerConfig.users.groups.cockroachdb.gid;
  };

  containers.piped = {
    autoStart = true;
    #privateNetwork = false;
    #hostAddress = hostIP;
    #localAddress = containerIP;

    bindMounts = lib.mkMerge (lib.forEach secrets_list (secret_item: let
      secret =
        if builtins.isString secret_item
        then secrets.${secret_item}
        else secrets.${secret_item.name};

      hostPath = secret.path;
      containerPath =
        if builtins.isString secret_item
        then hostPath
        else secret_item.path;
    in {
      "${containerPath}" = {
        inherit hostPath;
      };
    }));

    specialArgs = {
      inherit inputs;
      inherit tree;
      host_secrets = secrets;
    };

    config = {config, ...}: {
      nixpkgs.pkgs = pkgs;

      imports = with tree;
        [
          profiles.base
          inputs.home-manager-unstable.nixosModules.home-manager

          #profiles.sshd
          profiles.nginx
          profiles.cockroachdb-bin-fix

          modules.nixos.secrets
          inputs.piped-flake.nixosModules.default

          users.root
        ]
        ++ (with hosts.hetzner-vm.containers.piped.profiles; [
          piped
          restic
          cockroachdb
        ]);

      # For Shared Secrets
      systemd.tmpfiles.rules = [
        "d ${config.services.secrets.secretsDir} - root root"
      ];

      networking.firewall = {
        enable = true;
        allowedTCPPorts = [22] ++ (lib.attrValues ports);
      };

      home-manager.users.root = {
        imports = with tree; [home.base home.dev.small];

        home.stateVersion = "23.05";
      };

      # Manually configure nameserver. Using resolved inside the container seems to fail
      # currently
      environment.etc."resolv.conf".text = "nameserver 8.8.8.8";
      system.stateVersion = "23.05";
    };
  };

  services.nginx.virtualHosts."piped-fi.owo.monster" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://unix:${pipedSocketForComponent "frontend"}";
    };
  };

  services.nginx.virtualHosts."backend.piped-fi.owo.monster" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://unix:${pipedSocketForComponent "backend"}";
    };
  };

  services.nginx.virtualHosts."proxy.piped-fi.owo.monster" = {
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = "http://unix:${pipedSocketForComponent "proxy"}";
      extraConfig = config.services.piped.proxyNginxExtraConfig;
    };
  };
}