eeva/home-manager
1
0
Fork 0
mirror of https://github.com/nix-community/home-manager synced 2024-11-23 11:39:46 +01:00
Code Issues Releases Wiki Activity

podman: moved settings under config

Browse source
This commit is contained in:
Dylan Wilson 2024-11-08 10:47:16 -05:00
parent 02dfe57e5d
commit 968ea66db0
No known key found for this signature in database
2 changed files with 84 additions and 79 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

113
modules/services/podman-linux/default.nix
View file

@ -11,61 +11,63 @@ in {
options.services.podman = {
enable = lib.mkEnableOption "Podman, a daemonless container engine";
containersConf.settings = lib.mkOption {
type = toml.type;
default = { };
description = "containers.conf configuration";
};
storage.settings = lib.mkOption {
type = toml.type;
description = "storage.conf configuration";
};
registries = {
search = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ "docker.io" ];
description = ''
List of repositories to search.
'';
config = {
containers.settings = lib.mkOption {
type = toml.type;
default = { };
description = "containers.conf configuration";
};
insecure = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.str;
description = ''
List of insecure repositories.
'';
storage.settings = lib.mkOption {
type = toml.type;
description = "storage.conf configuration";
};
block = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.str;
description = ''
List of blocked repositories.
'';
};
};
registries = {
search = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ "docker.io" ];
description = ''
List of repositories to search.
'';
};
policy = lib.mkOption {
default = { };
type = lib.types.attrs;
example = lib.literalExpression ''
{
default = [ { type = "insecureAcceptAnything"; } ];
transports = {
docker-daemon = {
"" = [ { type = "insecureAcceptAnything"; } ];
insecure = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.str;
description = ''
List of insecure repositories.
'';
};
block = lib.mkOption {
default = [ ];
type = lib.types.listOf lib.types.str;
description = ''
List of blocked repositories.
'';
};
};
policy = lib.mkOption {
default = { };
type = lib.types.attrs;
example = lib.literalExpression ''
{
default = [ { type = "insecureAcceptAnything"; } ];
transports = {
docker-daemon = {
"" = [ { type = "insecureAcceptAnything"; } ];
};
};
};
}
'';
description = ''
Signature verification policy file.
If this option is empty the default policy file from
`skopeo` will be used.
'';
}
'';
description = ''
Signature verification policy file.
If this option is empty the default policy file from
`skopeo` will be used.
'';
};
};
};
@ -75,22 +77,23 @@ in {
home.packages = [ cfg.package ];
services.podman.storage.settings = {
services.podman.config.storage.settings = {
storage.driver = lib.mkDefault "overlay";
};
xdg.configFile = {
"containers/policy.json".source = if cfg.policy != { } then
pkgs.writeText "policy.json" (builtins.toJSON cfg.policy)
"containers/policy.json".source = if cfg.config.policy != { } then
pkgs.writeText "policy.json" (builtins.toJSON cfg.config.policy)
else
"${pkgs.skopeo.policy}/default-policy.json";
"containers/registries.conf".source = toml.generate "registries.conf" {
registries = lib.mapAttrs (n: v: { registries = v; }) cfg.registries;
registries =
lib.mapAttrs (n: v: { registries = v; }) cfg.config.registries;
};
"containers/storage.conf".source =
toml.generate "storage.conf" cfg.storage.settings;
toml.generate "storage.conf" cfg.config.storage.settings;
"containers/containers.conf".source =
toml.generate "containers.conf" cfg.containersConf.settings;
toml.generate "containers.conf" cfg.config.containers.settings;
};
};
}

50
tests/modules/services/podman-linux/configuration.nix
View file

@ -3,33 +3,35 @@
{
services.podman = {
enable = true;
containersConf.settings = {
network = {
default_subnet = "172.16.10.0/24";
default_subnet_pools = [
{
base = "172.16.11.0/24";
size = 24;
}
{
base = "172.16.12.0/24";
size = 24;
}
];
config = {
containers.settings = {
network = {
default_subnet = "172.16.10.0/24";
default_subnet_pools = [
{
base = "172.16.11.0/24";
size = 24;
}
{
base = "172.16.12.0/24";
size = 24;
}
];
};
};
};
storage.settings = {
storage = {
runroot = "$HOME/.containers/runroot";
graphroot = "$HOME/.containers/graphroot";
storage.settings = {
storage = {
runroot = "$HOME/.containers/runroot";
graphroot = "$HOME/.containers/graphroot";
};
};
registries = {
block = [ "ghcr.io" "gallery.ecr.aws" ];
insecure = [ "quay.io" ];
search = [ "docker.io" ];
};
policy = { default = [{ type = "insecureAcceptAnything"; }]; };
};
registries = {
block = [ "ghcr.io" "gallery.ecr.aws" ];
insecure = [ "quay.io" ];
search = [ "docker.io" ];
};
policy = { default = [{ type = "insecureAcceptAnything"; }]; };
};
nmt.script = ''