fix foldl

flake.lock

@@ -1,5 +1,41 @@
 {
   "nodes": {
+    "flake-parts": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib"
+      },
+      "locked": {
+        "lastModified": 1719877454,
+        "narHash": "sha256-g5N1yyOSsPNiOlFfkuI/wcUjmtah+nxdImJqrSATjOU=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "4e3583423212f9303aa1a6337f8dffb415920e4f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
+    "flake-parts_2": {
+      "inputs": {
+        "nixpkgs-lib": "nixpkgs-lib_2"
+      },
+      "locked": {
+        "lastModified": 1719877454,
+        "narHash": "sha256-g5N1yyOSsPNiOlFfkuI/wcUjmtah+nxdImJqrSATjOU=",
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "rev": "4e3583423212f9303aa1a6337f8dffb415920e4f",
+        "type": "github"
+      },
+      "original": {
+        "owner": "hercules-ci",
+        "repo": "flake-parts",
+        "type": "github"
+      }
+    },
     "flake-utils": {
       "inputs": {
         "systems": "systems"
@@ -22,24 +58,6 @@
       "inputs": {
         "systems": "systems_2"
       },
-      "locked": {
-        "lastModified": 1710146030,
-        "narHash": "sha256-SZ5L6eA7HJ/nmkzGG7/ISclqe6oZdOZTNoesiInkXPQ=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "b1d9ab70662946ef0850d488da1c9019f3a9752a",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_3": {
-      "inputs": {
-        "systems": "systems_3"
-      },
       "locked": {
         "lastModified": 1701680307,
         "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=",
@@ -56,7 +74,7 @@
     },
     "frontend": {
       "inputs": {
-        "flake-utils": "flake-utils_2",
+        "flake-utils": "flake-utils",
         "nixpkgs": "nixpkgs",
         "pnpm2nix": "pnpm2nix"
       },
@@ -76,18 +94,18 @@
     },
     "gtrackmap": {
       "inputs": {
-        "flake-utils": "flake-utils",
+        "flake-parts": "flake-parts_2",
         "frontend": "frontend",
         "nixpkgs": [
           "nixpkgs"
         ]
       },
       "locked": {
-        "lastModified": 1717955510,
+        "lastModified": 1719992292,
-        "narHash": "sha256-WuEs+ljTjyEIDNLmvyv7niQsNVr0lEfOjOcsmiL6mfQ=",
+        "narHash": "sha256-bMKzt/rKkBsI8NbtsmfGG0tHsn/UilZqgOYwHRk45KQ=",
         "owner": "gtrackmap",
         "repo": "gtrackmap",
-        "rev": "ef27a0397c4d73dc31e7b49c8a2736ae62b5a3ff",
+        "rev": "84df36e004cda9bd802e46ed0c814c7b08031807",
         "type": "github"
       },
       "original": {
@@ -96,45 +114,6 @@
         "type": "github"
       }
     },
-    "nextcloud": {
-      "inputs": {
-        "nixos-shell": "nixos-shell",
-        "nixpkgs": [
-          "nixpkgs"
-        ]
-      },
-      "locked": {
-        "lastModified": 1711735384,
-        "narHash": "sha256-2oFPzoL5QfC6bifttaUku2ENv9ATv6umH6qhZY4A7T8=",
-        "owner": "onny",
-        "repo": "nixos-nextcloud-testumgebung",
-        "rev": "fa6f062830b4bc3cedb9694c1dbf01d5fdf775ac",
-        "type": "github"
-      },
-      "original": {
-        "owner": "onny",
-        "repo": "nixos-nextcloud-testumgebung",
-        "type": "github"
-      }
-    },
-    "nixos-shell": {
-      "inputs": {
-        "nixpkgs": "nixpkgs_3"
-      },
-      "locked": {
-        "lastModified": 1711263551,
-        "narHash": "sha256-lDaSa0yT0uzFXq1rB0DbD5MNi2TmG9DaTrZqZoPP/I4=",
-        "owner": "Mic92",
-        "repo": "nixos-shell",
-        "rev": "b7e8a0c75c99d81039d1ca7eaab227e4814de638",
-        "type": "github"
-      },
-      "original": {
-        "owner": "Mic92",
-        "repo": "nixos-shell",
-        "type": "github"
-      }
-    },
     "nixpkgs": {
       "locked": {
         "lastModified": 1717196966,
@@ -151,6 +130,30 @@
         "type": "github"
       }
     },
+    "nixpkgs-lib": {
+      "locked": {
+        "lastModified": 1719876945,
+        "narHash": "sha256-Fm2rDDs86sHy0/1jxTOKB1118Q0O3Uc7EC0iXvXKpbI=",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/5daf0514482af3f97abaefc78a6606365c9108e2.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/5daf0514482af3f97abaefc78a6606365c9108e2.tar.gz"
+      }
+    },
+    "nixpkgs-lib_2": {
+      "locked": {
+        "lastModified": 1719876945,
+        "narHash": "sha256-Fm2rDDs86sHy0/1jxTOKB1118Q0O3Uc7EC0iXvXKpbI=",
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/5daf0514482af3f97abaefc78a6606365c9108e2.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://github.com/NixOS/nixpkgs/archive/5daf0514482af3f97abaefc78a6606365c9108e2.tar.gz"
+      }
+    },
     "nixpkgs_2": {
       "locked": {
         "lastModified": 1702151865,
@@ -169,26 +172,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1628465643,
+        "lastModified": 1719848872,
-        "narHash": "sha256-QSNw9bDq9uGUniQQtakRuw4m21Jxugm23SXLVgEV4DM=",
+        "narHash": "sha256-H3+EC5cYuq+gQW8y0lSrrDZfH71LB4DAf+TDFyvwCNA=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "6ef4f522d63f22b40004319778761040d3197390",
+        "rev": "00d80d13810dbfea8ab4ed1009b09100cca86ba8",
-        "type": "github"
-      },
-      "original": {
-        "id": "nixpkgs",
-        "ref": "nixos-unstable",
-        "type": "indirect"
-      }
-    },
-    "nixpkgs_4": {
-      "locked": {
-        "lastModified": 1719506693,
-        "narHash": "sha256-C8e9S7RzshSdHB7L+v9I51af1gDM5unhJ2xO1ywxNH8=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "b2852eb9365c6de48ffb0dc2c9562591f652242a",
         "type": "github"
       },
       "original": {
@@ -200,7 +188,7 @@
     },
     "pnpm2nix": {
       "inputs": {
-        "flake-utils": "flake-utils_3",
+        "flake-utils": "flake-utils_2",
         "nixpkgs": "nixpkgs_2"
       },
       "locked": {
@@ -219,9 +207,9 @@
     },
     "root": {
       "inputs": {
+        "flake-parts": "flake-parts",
         "gtrackmap": "gtrackmap",
-        "nextcloud": "nextcloud",
+        "nixpkgs": "nixpkgs_3"
-        "nixpkgs": "nixpkgs_4"
       }
     },
     "systems": {
@@ -253,21 +241,6 @@
         "repo": "default",
         "type": "github"
       }
-    },
-    "systems_3": {
-      "locked": {
-        "lastModified": 1681028828,
-        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
-        "owner": "nix-systems",
-        "repo": "default",
-        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
-        "type": "github"
-      },
-      "original": {
-        "owner": "nix-systems",
-        "repo": "default",
-        "type": "github"
-      }
     }
   },
   "root": "root",

flake.nix

@@ -1,26 +1,27 @@
 {
   inputs = {
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-    nextcloud = {
+    flake-parts.url = "github:hercules-ci/flake-parts";
-      url = "github:onny/nixos-nextcloud-testumgebung";
-      inputs.nixpkgs.follows = "nixpkgs";
-    };
     gtrackmap = {
       url = "github:gtrackmap/gtrackmap";
       inputs.nixpkgs.follows = "nixpkgs";
     };
   };
-  outputs = { self, nixpkgs, gtrackmap, ... }@attrs: {
+  outputs = { flake-parts, nixpkgs, gtrackmap, ... }@inputs: (
-    nixosConfigurations.freun-dev = nixpkgs.lib.nixosSystem {
+    flake-parts.lib.mkFlake { inherit inputs; } {
+      flake.nixosConfigurations = {
+        freun-dev = nixpkgs.lib.nixosSystem {
           system = "x86_64-linux";
-      specialArgs = attrs;
+          specialArgs = inputs;
           modules = [
-        ./hardware-configuration.nix
+            ./hosts/freun-dev
-        ./configuration.nix
+            gtrackmap.nixosModules.default
-        ./services.nix
-        gtrackmap.nixosModules.x86_64-linux.default
           ];
         };
       };
+      systems = [
+        "x86_64-linux"
+      ];
+    }
+  );
 }
-

hosts/freun-dev/configuration.nix

@@ -2,8 +2,7 @@
 # your system.  Help is available in the configuration.nix(5) man page
 # and in the NixOS manual (accessible by running `nixos-help`).
 
-{ config, pkgs, self, ... }:
+{ pkgs, ... }:
-
 {
   nix = {
     settings = {
@@ -146,4 +145,3 @@
   # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
   system.stateVersion = "23.05"; # Did you read the comment?
 }
-

hosts/freun-dev/default.nix

@@ -0,0 +1,7 @@
+{ ... }: {
+  imports = [
+    ./configuration.nix
+    ./hardware-configuration.nix
+    ./services.nix
+  ];
+}

hosts/freun-dev/services.nix

@@ -0,0 +1,63 @@
+{ pkgs, ... }:
+rec {
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  services.caddy = {
+    enable = true;
+    enableReload = true;
+    email = "admin@pimeys.pm";
+  };
+
+  services.postgresql.enable = true;
+
+  virtualisation.podman = {
+    enable = true;
+    autoPrune.enable = true;
+    dockerCompat = true;
+    defaultNetwork.settings = {
+      # Required for container networking to be able to use names.
+      dns_enabled = true;
+    };
+  };
+
+  virtualisation.oci-containers.backend = "podman";
+
+  networking.firewall = {
+    trustedInterfaces = [ "podman1" ];
+    interfaces.podman1.allowedUDPPorts = [ 53 ];
+  };
+
+  imports = [
+    ../../modules/services/vaultwarden.nix
+    ../../modules/services/immich.nix
+    ../../modules/services/syncthing.nix
+    ../../modules/services/invidious.nix
+    ../../modules/services/grafana.nix
+    ../../modules/services/gtrackmap.nix
+    ../../modules/services/owncast.nix
+    ../../modules/services/hydra.nix
+    ../../modules/services/wireguard.nix
+  ];
+
+  services.immich = {
+    enable = true;
+    fqdn = "img.freun.dev";
+    data_dir = fileSystems.immich_data.mountPoint;
+    secrets = "/var/secrets/immich";
+  };
+
+  fileSystems.immich_data = {
+    mountPoint = "/mnt/storage/immich";
+    device = "//u407959.your-storagebox.de/backup/immich";
+    fsType = "cifs";
+    options =
+      let
+        # this line prevents hanging on network split
+        automount_opts = "x-systemd.automount,auto,x-systemd.device-timeout=5s,x-systemd.mount-timeout=5s";
+
+      in
+      [ "${automount_opts},credentials=/var/secrets/smb-storage" ];
+  };
+
+  environment.systemPackages = [ pkgs.cifs-utils ];
+}

modules/services/immich.nix

@@ -0,0 +1,110 @@
+{ lib, config, ... }:
+let
+  cfg = config.services.immich;
+in
+{
+  options.services.immich = with lib; {
+    enable = mkEnableOption "Enable immich";
+
+    fqdn = mkOption {
+      type = types.str;
+      description = "FQDN to use for the immich server";
+    };
+    data_dir = mkOption {
+      type = types.str;
+      description = "The directory to store immich data in";
+    };
+    secrets = mkOption {
+      type = types.str;
+      description = "Path to file with secrets";
+    };
+    version = mkOption {
+      type = types.str;
+      default = "release";
+      description = "The version (docker image tag) of immich to use";
+    };
+    mounts = mkOption {
+      type = types.listOf types.str;
+      description = "Additional mounts to add to the immich container";
+      default = [ ];
+    };
+    port = mkOption {
+      type = types.int;
+      default = 2283;
+      description = "Port to expose the immich server on";
+    };
+  };
+
+  imports = [
+    ../util/container-services.nix
+  ];
+
+  config = lib.mkIf cfg.enable rec {
+    container-services.immich = {
+      description = "Immich image server";
+      services = {
+        server = {
+          image = "ghcr.io/immich-app/immich-server:${cfg.version}";
+          environmentFiles = [
+            cfg.secrets
+          ];
+          volumes = [
+            "${cfg.data_dir}:/usr/src/app/upload:rw"
+            "/etc/localtime:/etc/localtime:ro"
+          ] ++ cfg.mounts;
+          ports = [ "${builtins.toString cfg.port}:3001/tcp" ];
+          dependsOn = [
+            container-services.immich.services.redis
+            container-services.immich.services.postgres
+          ];
+        };
+        machine_learning = {
+          image = "ghcr.io/immich-app/immich-machine-learning:${cfg.version}";
+          environmentFiles = [
+            cfg.secrets
+          ];
+          volumes = [
+            "model_cache:/cache:rw"
+          ];
+        };
+        redis = {
+          image = "registry.hub.docker.com/library/redis:6.2-alpine";
+          healthCheck.test = "redis-cli ping || exit 1";
+          environmentFiles = [
+            cfg.secrets
+          ];
+        };
+        postgres = {
+          image = "registry.hub.docker.com/tensorchord/pgvecto-rs:pg14-v0.2.0";
+          environmentFiles = [
+            cfg.secrets
+          ];
+          environment = {
+            POSTGRES_INITDB_ARGS = "--data-checksums";
+          };
+          volumes = [
+            "db_data:/var/lib/postgresql/data:rw"
+          ];
+          cmd = [ "postgres" "-c" "shared_preload_libraries=vectors.so" "-c" "search_path=\"$user\", public, vectors" "-c" "logging_collector=on" "-c" "max_wal_size=2GB" "-c" "shared_buffers=512MB" "-c" "wal_compression=on" ];
+          healthCheck = {
+            test = ''
+              pg_isready --dbname='$\{DB_DATABASE_NAME}' || exit 1
+              Chksum="$(psql --dbname='$\{DB_DATABASE_NAME}' --username='$\{DB_USERNAME}' --tuples-only --no-align --command='SELECT COALESCE(SUM(checksum_failures), 0) FROM pg_stat_database')"
+              echo "checksum failure count is $Chksum"
+              [ "$Chksum" = '0' ] || exit 1
+            '';
+            interval = "5m";
+            startInterval = "30s";
+            startPeriod = "5m";
+          };
+        };
+      };
+    };
+
+    services.caddy.virtualHosts = {
+      "${cfg.fqdn}".extraConfig = ''
+        reverse_proxy localhost:${builtins.toString cfg.port}
+      '';
+    };
+  };
+}

modules/util/container-services.nix

@@ -0,0 +1,230 @@
+{ pkgs, lib, config, ... }:
+let
+  cfg = config.container-services;
+
+  healthcheck = with pkgs.lib; {
+    test = mkOption {
+      type = types.oneOf types.str (types.listOf types.str);
+    };
+    interval = mkOption {
+      type = types.str;
+      default = "30s";
+    };
+    startupInterval = mkOption {
+      type = types.str;
+      default = "30s";
+    };
+    startPeriod = mkOption {
+      type = types.str;
+      default = "0s";
+    };
+  };
+
+  service = with pkgs.lib; {
+    name = mkOption {
+      type = types.nilOr types.str;
+      default = nil;
+    };
+
+    alias = mkOption {
+      type = types.nilOr types.str;
+      default = nil;
+    };
+
+    dependsOn = mkOption {
+      type = types.listOf service;
+      default = [ ];
+    };
+
+    image = mkOption {
+      type = types.str;
+    };
+
+    volumes = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+    };
+
+    ports = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+    };
+
+    environment = mkOption {
+      type = types.attrsOf types.str;
+      default = { };
+    };
+
+    environmentFiles = mkOption {
+      type = types.listOf types.str;
+      default = [ ];
+    };
+
+    cmd = mkOption {
+      type = types.nilOr (types.listOf types.str);
+      default = nil;
+    };
+
+    healthCheck = mkOption {
+      type = types.nilOr (types.submodule healthcheck);
+      default = nil;
+    };
+  };
+
+  pod = with pkgs.lib; {
+    name = mkOption {
+      type = types.nilOr str;
+      default = nil;
+    };
+
+    description = mkOption {
+      type = types.nilOr str;
+      default = nil;
+    };
+
+    services = mkOption {
+      type = types.attrsOf (types.submodule service);
+      default = { };
+    };
+  };
+
+  backend = config.virtualisation.oci-containers.backend;
+  volumeName = pod: name: "${pod.name}-${name}";
+  volumeServiceName = pod: name: "${backend}-volume-${volumeName pod name}";
+  volumeServiceRef = pod: name: config.systemd.services."${backend}-volume-${volumeName pod name}".name + ".service";
+  serviceName = pod: service: "${backend}-${pod.name}-${service.name}";
+  serviceRef = pod: service: config.systemd.services."${backend}-${pod.name}-${service.name}".name + ".service";
+  networkName = pod: "${pod.name}-default";
+  networkServiceName = pod: "${backend}-network-${pod.name}";
+  networkServiceRef = pod: config.systemd.services."${backend}-network-${pod.name}".name + ".service";
+  podName = pod: "${backend}-pod-${pod.name}";
+  podRef = pod: config.systemd.targets."${backend}-pod-${pod.name}".name + ".target";
+  namedVolumes = service: lib.filter (volume: (! ((lib.hasPrefix "/" volume) || (lib.hasPrefix "./" volume)))) (lib.map (volume: lib.head (lib.splitString ":" volume)) service.volumes);
+  oneShotService = { pod, description, script }: {
+    path = [ (if backend == "podman" then pkgs.podman else pkgs.docker) ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    inherit description;
+    inherit script;
+    partOf = [ podRef pod ];
+    wantedBy = [ podRef pod ];
+  };
+in
+{
+  options = with pkgs.lib; {
+    container-services = mkOption {
+      type = types.attrsOf (types.submodule pod);
+      default = { };
+    };
+  };
+
+  config = {
+    container-services = lib.mapAttrs
+      (name: pod: {
+        name = lib.mkDefault pod.name;
+        services = lib.mapAttrs
+          (name: service: {
+            name = lib.mkDefault name;
+          })
+          pod.services;
+      })
+      cfg;
+
+    systemd.targets = lib.mapAttrs' (_: pod:
+      lib.nameValuePair (podName pod) {
+        wantedBy = [ "multi-user.target" ];
+        unitConfig = {
+          Description = pod.description or pod.name;
+        };
+      }
+    );
+
+    systemd.services = lib.foldl
+      (services: pod: lib.mergeAttrsList [
+        services
+        {
+          "${networkServiceName pod}" = oneShotService {
+            description = "Network for ${pod.name}";
+            script = ''
+              ${backend} network inspect ${networkName pod} || ${backend} network create ${networkName pod}
+            '';
+          };
+        }
+        (lib.mapAttrs'
+          (_: service:
+            let
+              dependencies =
+                (lib.map (service: serviceRef pod.name service.name) service.dependsOn) ++
+                (lib.map (name: volumeServiceRef pod.name name) (namedVolumes service)) ++
+                (networkServiceRef pod);
+            in
+            {
+              name = (serviceName pod service);
+              value = {
+                serviceConfig = {
+                  Restart = lib.mkOverride 500 "always";
+                };
+                after = dependencies;
+                requires = dependencies;
+                partOf = [ (podRef pod) ];
+                wantedBy = [ (podRef pod) ];
+              };
+            }
+          )
+          pod.services)
+        (lib.listToAttrs (lib.flatten (
+          lib.map
+            (service: (
+              lib.map
+                (volume: {
+                  name = volumeServiceName pod volume;
+                  value = oneShotService {
+                    description = "Volume ${volume} of ${pod.name}";
+                    script = ''
+                      ${backend} volume inspect ${volumeName pod volume} || ${backend} volume create ${volumeName pod volume}
+                    '';
+                  };
+                })
+                namedVolumes)
+            )
+            pod.services)))
+      ])
+      { }
+      (lib.attrValues cfg);
+
+    virtualisation.oci-containers.containers = lib.foldl
+      (containers: pod: containers // (
+        lib.mapAttrs'
+          (_: service: {
+            name = serviceName pod service;
+            value = {
+              image = service.image;
+              volumes = service.volumes;
+              log-driver = "journal";
+              ports = service.ports;
+              environment = service.environment;
+              environmentFiles = service.environmentFiles;
+              cmd = service.cmd;
+              extraOptions = [
+                "--network-alias=${service.alias or service.name}"
+                "--network=${networkName pod}"
+              ] ++ (if (service.healthCheck != null) then [
+                "--health-cmd=${
+                if (builtins.isList service.healthCheck.test)
+                then builtins.toJSON service.healthCheck.test
+                else service.healthCheck.test
+              }"
+                "--health-interval=${service.healthCheck.interval}"
+                "--health-startup-interval=${service.healthCheck.startupInterval}"
+                "--health-start-period=${service.healthCheck.startPeriod}"
+              ] else [ ]);
+            };
+          })
+          pod.services
+      ))
+      { }
+      (lib.attrValues cfg);
+  };
+}

services.nix

@@ -1,41 +0,0 @@
-{ ... }:
-{
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-
-  services.caddy = {
-    enable = true;
-    enableReload = true;
-    email = "admin@pimeys.pm";
-  };
-
-  services.postgresql.enable = true;
-
-  virtualisation.podman = {
-    enable = true;
-    autoPrune.enable = true;
-    dockerCompat = true;
-    defaultNetwork.settings = {
-      # Required for container networking to be able to use names.
-      dns_enabled = true;
-    };
-  };
-
-  virtualisation.oci-containers.backend = "podman";
-
-  networking.firewall = {
-    trustedInterfaces = [ "podman1" ];
-    interfaces.podman1.allowedUDPPorts = [ 53 ];
-  };
-
-  imports = [
-    ./vaultwarden.nix
-    ./immich.nix
-    ./syncthing.nix
-    ./invidious.nix
-    ./grafana.nix
-    ./gtrackmap.nix
-    ./owncast.nix
-    ./hydra.nix
-    ./wireguard.nix
-  ];
-}