Periodic/system-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[containers] Update a bunch of containers.

Browse Source
This commit is contained in:
Periodic
2026-09-06 12:06:12 -07:00
parent 32c87fbb9a
commit d1e90a1789
9 changed files with 58 additions and 44 deletions
Download Patch File Download Diff File Expand all files Collapse all files
secrets/mcp.yaml
+5 -3
View File
@@ -34,6 +34,8 @@ wargame-vods:
password: ENC[AES256_GCM,data:4Vl2Jd80bu3gVKDN7gINo8rbui6x3zxPvYEHf6GBiJDQdmRt8od/5yw4S/8=,iv:ZLdp3j0+8vLluNssXlV52XIJMczhai+6zcHsRwDwGPM=,tag:rjbp9cFbj3EFxnUZQO/QYg==,type:str]
admin-token: ENC[AES256_GCM,data:xxec5YDtWW7VpV+POtfhfhHG45ebCdNuD6PyHExyp0H9Ef/edTCgJtnPYWM=,iv:bLidEo0L1vP8IRtcdZ4Bcw4chHErCUHH31xQS7cFk3g=,tag:AJ9fb6xo8w41FOWu2fHHgQ==,type:str]
youtube-api-key: ENC[AES256_GCM,data:9W6+QK52mlTPh55ZqHXq020IpPbwbr9+Qzqhi6u96NrnRJEEVr+Z,iv:s3g2kGg2xPWD6/BuQxJ7Eqbm5HpatQbkF6PxuKufxro=,tag:1vvC8STNTX3+e5hLQTJglQ==,type:str]
pocket-id:
encryption_key: ENC[AES256_GCM,data:zwfKjZRDi14/sKDVVpBa0cWSb7S0YnUQOmH0bJF7+jxpiIKzU/mSqIry7eI=,iv:whBV1ZaJ+ygaiwYqjbTyKfKWRwxpx8CdqC/pwM3fGUU=,tag:2VacYAW3l61SgGPjIfQO5A==,type:str]
sops:
age:
- enc: |
@@ -63,7 +65,7 @@ sops:
dvKJPDYvGb/8JXSkZNkLlWvHEVnsAJ1mJFb1idenYzeQvJlsX07rYA==
-----END AGE ENCRYPTED FILE-----
recipient: age1jrk4h7x4qzhr6z5m4d099mlfyjc4n5n9s52r4gfsdz0slnqlqa9sss735v
lastmodified: "2026-08-17T01:55:47Z"
mac: ENC[AES256_GCM,data:uR1BHCZi0O0KQUwVauev4CmUwAvj7xABsnQR+3FRfTJK3mcnm2TR+GabQ9F8YyTDo86fK8pYLl4iki766LUy78QJBFMXCKmB7shx5kWIDKWcSU2xlkrPbXSZmQr0Hh5x46YaZbd9UO8xabUdy3p3Vu282V192HWFXsGBQ3T1mvY=,iv:lp2ca+4vd7lIjibaTBBxy/3NmdWenaZrE2dWZzrfrBM=,tag:cJWZT7BgdVJXjwJh/4USuw==,type:str]
lastmodified: "2026-09-06T18:47:12Z"
mac: ENC[AES256_GCM,data:Y/I0EDZsjYYEJisPiEa/gS8d+vc9ksmwH87fAPn1bDzJq+reIiwg+ESkGik8VYcQL8NO6YF3ZU8nyuqIT62ZnWDUU1RZaYwoSkCpEylWmH4xq4ShJTm2Fkqj9f0wtkrCw6uOW5wlio+BlWp6gkYuC9Zp2u29ms73Z0HLU5LPTIg=,iv:h6i4UqFqA3Q3agCP4YWltMe+59VU+tuxG13jw7NO+yI=,tag:BP+7JhgYFoeOuNeUUeLOLg==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.2
version: 3.13.3
system/features/web-containers.nix
+11 -4
View File
@@ -12,7 +12,11 @@
let
strOpt = mkOption { type = str; };
intOpt = mkOption { type = int; };
boolOpt = mkOption {
boolOptTrue = mkOption {
type = bool;
default = true;
};
boolOptFalse = mkOption {
type = bool;
default = false;
};
@@ -35,13 +39,14 @@
volumes = strList;
environment = attrOpt;
environmentFiles = strList;
public = boolOpt;
public = boolOptFalse;
user = mkOption {
type = nullOr str;
default = null;
};
extraOptions = strList;
oauthProxy = boolOpt;
oauthProxy = boolOptFalse;
alwaysPull = boolOptTrue;
extraLabels = attrOpt;
};
});
@@ -76,6 +81,7 @@
extraOptions,
oauthProxy,
extraLabels,
alwaysPull,
}:
let
fqn = "${hostname}.${domain}";
@@ -97,6 +103,7 @@
{ "traefik.http.routers.${serviceName}.middlewares" = "oidc-auth@file"; }
else
{ };
options = if alwaysPull then extraOptions ++ [ "--pull=always" ] else options;
in
{
inherit
@@ -106,7 +113,6 @@
environment
environmentFiles
user
extraOptions
;
autoStart = true;
labels = {
@@ -119,6 +125,7 @@
// oauthLabels
// homepageLabels
// extraLabels;
extraOptions = options;
};
in
builtins.mapAttrs mkContainer config.virtualisation.web-containers.containers
system/hosts/mcp/containers.nix
+2
View File
@@ -133,6 +133,7 @@
image = "ghcr.io/gethomepage/homepage:latest";
autoStart = true;
extraOptions = [
"--pull=always"
"-l=traefik.enable=true"
"-l=traefik.http.routers.homepage.rule=${localHostRuleHavenisms "start"}"
"-l=traefik.http.services.homepage.loadbalancer.server.port=3000"
@@ -157,6 +158,7 @@
image = "ghcr.io/analogj/scrutiny:master-omnibus";
autoStart = true;
extraOptions = [
"--pull=always"
"-l=traefik.enable=true"
"-l=traefik.http.routers.scrutiny.rule=${localHostRuleHavenisms "scrutiny"}"
"-l=traefik.http.services.scrutiny.loadbalancer.server.port=8080"
system/hosts/mcp/containers/blazestar.net/uptime.nix
+1 -1
View File
@@ -4,7 +4,7 @@ let
in
{
virtualisation.web-containers.containers.uptime = {
image = "louislam/uptime-kuma:1";
image = "louislam/uptime-kuma:1"; # TODO: Why not version 2?
hostname = "uptime";
domain = blazestar;
port = 3001;
system/hosts/mcp/containers/collabora.nix
+2 -2
View File
@@ -1,5 +1,4 @@
{ config, pkgs, ... }:
let inherit (import ./lib.nix config) mkContainer; in
{ ... }:
{
virtualisation.oci-containers.containers.collabora = {
image = "collabora/code";
@@ -10,5 +9,6 @@ let inherit (import ./lib.nix config) mkContainer; in
DONT_GEN_SSL_CERT = "true";
};
autoStart = true;
extraOptions = [ "--pull=always" ];
};
}
system/hosts/mcp/containers/gitea.nix
+1
View File
@@ -68,5 +68,6 @@ in
# The runner will spawn new containers to run the actions
"${config.local.container-socket}:/var/run/docker.sock:ro"
];
extraOptions = [ "--pull=always" ];
};
}
system/hosts/mcp/containers/lib.nix
+1 -1
View File
@@ -67,7 +67,6 @@ in
environmentFiles
ports
user
extraOptions
;
autoStart = true;
labels = {
@@ -78,6 +77,7 @@ in
// oauthLabels
// homepageLabels
// extraLabels;
extraOptions = extraOptions ++ [ "--pull=always" ];
};
# Creates a MariaDB container for a specific app. It should be safe to give
system/hosts/mcp/containers/media-system.nix
+8 -26
View File
@@ -44,9 +44,10 @@ in
virtualisation.oci-containers.containers = {
jellyfin = {
image = "lscr.io/linuxserver/jellyfin:10.11.6";
image = "lscr.io/linuxserver/jellyfin:latest";
autoStart = true;
extraOptions = [
"--pull=always"
"--device=/dev/dri:/dev/dri"
"-l=traefik.enable=true"
"-l=traefik.http.routers.jellyfin.rule=${hostRuleHavenisms "jellyfin"}"
@@ -79,6 +80,7 @@ in
"gluetun"
];
extraOptions = [
"--pull=always"
"--network=container:gluetun"
"-l=homepage.group=Arr"
"-l=homepage.name=Deluge"
@@ -101,6 +103,7 @@ in
"gluetun"
];
extraOptions = [
"--pull=always"
"--network=container:gluetun"
"-l=homepage.group=Arr"
"-l=homepage.name=qBitTorrent"
@@ -124,6 +127,7 @@ in
image = "qmcgaw/gluetun:latest";
autoStart = true;
extraOptions = [
"--pull=always"
# add network admin capability.
"--cap-add=NET_ADMIN"
"--device=/dev/net/tun:/dev/net/tun"
@@ -150,6 +154,7 @@ in
image = "lscr.io/linuxserver/prowlarr";
autoStart = true;
extraOptions = [
"--pull=always"
"-l=traefik.enable=true"
"-l=traefik.http.routers.prowlarr.rule=${localHostRuleHavenisms "prowlarr"}"
"-l=traefik.http.services.prowlarr.loadbalancer.server.port=9696"
@@ -188,6 +193,7 @@ in
image = "lscr.io/linuxserver/radarr";
autoStart = true;
extraOptions = [
"--pull=always"
"-l=traefik.enable=true"
"-l=traefik.http.routers.radarr.rule=${localHostRuleHavenisms "radarr"}"
"-l=traefik.http.services.radarr.loadbalancer.server.port=7878"
@@ -212,6 +218,7 @@ in
image = "lscr.io/linuxserver/sonarr";
autoStart = true;
extraOptions = [
"--pull=always"
"-l=traefik.enable=true"
"-l=traefik.http.routers.sonarr.rule=${localHostRuleHavenisms "sonarr"}"
"-l=traefik.http.services.sonarr.loadbalancer.server.port=8989"
@@ -232,31 +239,6 @@ in
UMASK = "002";
};
};
readarr = {
# The Linuxserver version of this image doesn't have a latest tag. Odd.
image = "lscr.io/linuxserver/readarr:develop";
autoStart = true;
extraOptions = [
"-l=traefik.enable=true"
"-l=traefik.http.routers.readarr.rule=${localHostRuleHavenisms "readarr"}"
"-l=traefik.http.services.readarr.loadbalancer.server.port=8787"
"-l=homepage.group=Arr"
"-l=homepage.name=Readarr"
"-l=homepage.icon=readarr.svg"
"-l=homepage.href=https://readarr.${havenisms}"
"-l=homepage.description=E-book acquisition"
"-l=homepage.widget.type=readarr"
"-l=homepage.widget.url=http://readarr.havenisms.com:8787"
"-l=homepage.widget.key={{HOMEPAGE_FILE_READARR_KEY}}"
];
volumes = [
"/tank/media:/data"
"/tank/config/readarr:/config"
];
environment = {
UMASK = "002";
};
};
bazarr = mkContainer {
# The Linuxserver version of this image doesn't have a latest tag. Odd.
image = "lscr.io/linuxserver/bazarr:latest";
system/hosts/mcp/containers/pocket-id.nix
+25 -5
View File
@@ -8,11 +8,28 @@ let
# - 3000: Web UI
# - 2019: Admin endpoint
port = 8888;
encryption_key = "pocket-id/encryption_key";
in
{
sops.secrets = {
"${encryption_key}" = {
restartUnits = [ "${config.local.container-backend}-pocket-id.service" ];
mode = "0400";
owner = "pocket-id";
};
};
sops.templates."pocket-id.env" = {
content = ''
ENCRYPTION_KEY=${config.sops.placeholder."${encryption_key}"}
'';
owner = "pocket-id";
};
virtualisation.oci-containers.containers.pocket-id = mkContainer {
image = "ghcr.io/pocket-id/pocket-id";
dependsOn = [];
dependsOn = [ ];
hostName = "auth";
port = port;
public = false;
@@ -24,17 +41,20 @@ in
description = "Pocket ID Auth Server";
};
volumes = [
"/tank/pocket-id/data:/app/backend/data"
"/tank/pocket-id/data:/app/data"
];
environment = {
PUBLIC_APP_URL = "https://auth.${blazestar}";
APP_URL = "https://auth.${blazestar}";
# Whether the app is behind a reverse proxy.
TRUST_PROXY = "false";
CADDY_PORT = toString port;
TRUST_PROXY = "true";
PORT = toString port;
# PORT = "3000"; # Frontend port
# BACKEND_PORT = "8080"; # Backend port
PUID = toString config.users.users."pocket-id".uid;
PGID = toString config.users.groups."pocket-id".gid;
};
environmentFiles = [
config.sops.templates."pocket-id.env".path
];
};
}