2015-09-14 06:27:31 +00:00
|
|
|
# Systemd services for lxd.
|
|
|
|
|
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
|
|
|
|
with lib;
|
|
|
|
|
|
|
|
let
|
|
|
|
cfg = config.virtualisation.lxd;
|
2021-01-15 12:32:04 +00:00
|
|
|
in {
|
|
|
|
imports = [
|
|
|
|
(mkRemovedOptionModule [ "virtualisation" "lxd" "zfsPackage" ] "Override zfs in an overlay instead to override it globally")
|
|
|
|
];
|
2015-09-14 06:27:31 +00:00
|
|
|
|
|
|
|
###### interface
|
|
|
|
|
|
|
|
options = {
|
2018-03-16 09:58:54 +00:00
|
|
|
virtualisation.lxd = {
|
|
|
|
enable = mkOption {
|
2015-09-14 06:27:31 +00:00
|
|
|
type = types.bool;
|
|
|
|
default = false;
|
2018-03-16 09:58:54 +00:00
|
|
|
description = ''
|
|
|
|
This option enables lxd, a daemon that manages
|
|
|
|
containers. Users in the "lxd" group can interact with
|
|
|
|
the daemon (e.g. to start or stop containers) using the
|
|
|
|
<command>lxc</command> command line tool, among others.
|
2020-06-05 12:40:02 +00:00
|
|
|
|
|
|
|
Most of the time, you'll also want to start lxcfs, so
|
|
|
|
that containers can "see" the limits:
|
|
|
|
<code>
|
|
|
|
virtualisation.lxc.lxcfs.enable = true;
|
|
|
|
</code>
|
2018-03-16 09:58:54 +00:00
|
|
|
'';
|
2015-09-14 06:27:31 +00:00
|
|
|
};
|
2019-11-19 04:08:49 +00:00
|
|
|
|
|
|
|
package = mkOption {
|
|
|
|
type = types.package;
|
2020-06-05 10:57:18 +00:00
|
|
|
default = pkgs.lxd.override { nftablesSupport = config.networking.nftables.enable; };
|
2020-01-30 14:26:54 +00:00
|
|
|
defaultText = "pkgs.lxd";
|
2019-11-19 04:08:49 +00:00
|
|
|
description = ''
|
|
|
|
The LXD package to use.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
lxcPackage = mkOption {
|
|
|
|
type = types.package;
|
|
|
|
default = pkgs.lxc;
|
2020-01-30 14:26:54 +00:00
|
|
|
defaultText = "pkgs.lxc";
|
2019-11-19 04:08:49 +00:00
|
|
|
description = ''
|
|
|
|
The LXC package to use with LXD (required for AppArmor profiles).
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2018-03-16 09:58:54 +00:00
|
|
|
zfsSupport = mkOption {
|
|
|
|
type = types.bool;
|
2021-01-15 12:32:04 +00:00
|
|
|
default = config.boot.zfs.enabled;
|
|
|
|
defaultText = "config.boot.zfs.enabled";
|
2018-03-16 09:58:54 +00:00
|
|
|
description = ''
|
2019-11-19 04:08:49 +00:00
|
|
|
Enables lxd to use zfs as a storage for containers.
|
|
|
|
|
2018-03-16 09:58:54 +00:00
|
|
|
This option is enabled by default if a zfs pool is configured
|
|
|
|
with nixos.
|
|
|
|
'';
|
|
|
|
};
|
2020-06-05 10:57:18 +00:00
|
|
|
|
2019-12-14 14:29:08 +00:00
|
|
|
recommendedSysctlSettings = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = false;
|
|
|
|
description = ''
|
2021-02-28 11:25:39 +00:00
|
|
|
Enables various settings to avoid common pitfalls when
|
2019-12-14 14:29:08 +00:00
|
|
|
running containers requiring many file operations.
|
|
|
|
Fixes errors like "Too many open files" or
|
|
|
|
"neighbour: ndisc_cache: neighbor table overflow!".
|
|
|
|
See https://lxd.readthedocs.io/en/latest/production-setup/
|
|
|
|
for details.
|
|
|
|
'';
|
|
|
|
};
|
2021-02-28 13:02:42 +00:00
|
|
|
|
|
|
|
startTimeout = mkOption {
|
|
|
|
type = types.int;
|
|
|
|
default = 600;
|
|
|
|
apply = toString;
|
|
|
|
description = ''
|
|
|
|
Time to wait (in seconds) for LXD to become ready to process requests.
|
|
|
|
If LXD does not reply within the configured time, lxd.service will be
|
|
|
|
considered failed and systemd will attempt to restart it.
|
|
|
|
'';
|
|
|
|
};
|
2018-03-16 09:58:54 +00:00
|
|
|
};
|
2015-09-14 06:27:31 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
###### implementation
|
|
|
|
config = mkIf cfg.enable {
|
2019-11-19 04:08:49 +00:00
|
|
|
environment.systemPackages = [ cfg.package ];
|
2015-09-14 06:27:31 +00:00
|
|
|
|
2021-02-28 11:25:39 +00:00
|
|
|
# Note: the following options are also declared in virtualisation.lxc, but
|
|
|
|
# the latter can't be simply enabled to reuse the formers, because it
|
|
|
|
# does a bunch of unrelated things.
|
|
|
|
systemd.tmpfiles.rules = [ "d /var/lib/lxc/rootfs 0755 root root -" ];
|
|
|
|
|
2021-03-03 00:16:41 +00:00
|
|
|
security.apparmor.packages = [ cfg.lxcPackage ];
|
2021-02-28 11:25:39 +00:00
|
|
|
security.apparmor.profiles = [
|
|
|
|
"${cfg.lxcPackage}/etc/apparmor.d/lxc-containers"
|
|
|
|
"${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start"
|
|
|
|
];
|
2018-02-10 08:18:53 +00:00
|
|
|
|
2021-01-04 09:59:19 +00:00
|
|
|
# TODO: remove once LXD gets proper support for cgroupsv2
|
|
|
|
# (currently most of the e.g. CPU accounting stuff doesn't work)
|
|
|
|
systemd.enableUnifiedCgroupHierarchy = false;
|
|
|
|
|
2021-02-28 11:25:39 +00:00
|
|
|
systemd.sockets.lxd = {
|
|
|
|
description = "LXD UNIX socket";
|
|
|
|
wantedBy = [ "sockets.target" ];
|
|
|
|
|
|
|
|
socketConfig = {
|
|
|
|
ListenStream = "/var/lib/lxd/unix.socket";
|
|
|
|
SocketMode = "0660";
|
|
|
|
SocketGroup = "lxd";
|
|
|
|
Service = "lxd.service";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2018-03-16 09:58:54 +00:00
|
|
|
systemd.services.lxd = {
|
|
|
|
description = "LXD Container Management Daemon";
|
2015-09-14 06:27:31 +00:00
|
|
|
|
2018-03-16 09:58:54 +00:00
|
|
|
wantedBy = [ "multi-user.target" ];
|
2021-02-28 11:25:39 +00:00
|
|
|
after = [ "network-online.target" "lxcfs.service" ];
|
|
|
|
requires = [ "network-online.target" "lxd.socket" "lxcfs.service" ];
|
|
|
|
documentation = [ "man:lxd(1)" ];
|
2015-09-14 06:27:31 +00:00
|
|
|
|
2021-02-28 11:25:39 +00:00
|
|
|
path = optional cfg.zfsSupport config.boot.zfs.package;
|
2018-02-10 08:18:53 +00:00
|
|
|
|
2018-03-16 09:58:54 +00:00
|
|
|
serviceConfig = {
|
2020-04-28 01:50:34 +00:00
|
|
|
ExecStart = "@${cfg.package}/bin/lxd lxd --group lxd";
|
2021-02-28 13:02:42 +00:00
|
|
|
ExecStartPost = "${cfg.package}/bin/lxd waitready --timeout=${cfg.startTimeout}";
|
2021-02-28 11:25:39 +00:00
|
|
|
ExecStop = "${cfg.package}/bin/lxd shutdown";
|
|
|
|
|
2018-03-16 09:58:54 +00:00
|
|
|
KillMode = "process"; # when stopping, leave the containers alone
|
2019-12-14 14:29:08 +00:00
|
|
|
LimitMEMLOCK = "infinity";
|
|
|
|
LimitNOFILE = "1048576";
|
|
|
|
LimitNPROC = "infinity";
|
|
|
|
TasksMax = "infinity";
|
2020-06-05 12:40:02 +00:00
|
|
|
|
2021-02-28 11:25:39 +00:00
|
|
|
Restart = "on-failure";
|
2021-02-28 13:02:42 +00:00
|
|
|
TimeoutStartSec = "${cfg.startTimeout}s";
|
2021-02-28 11:25:39 +00:00
|
|
|
TimeoutStopSec = "30s";
|
|
|
|
|
2020-06-05 12:40:02 +00:00
|
|
|
# By default, `lxd` loads configuration files from hard-coded
|
|
|
|
# `/usr/share/lxc/config` - since this is a no-go for us, we have to
|
|
|
|
# explicitly tell it where the actual configuration files are
|
|
|
|
Environment = mkIf (config.virtualisation.lxc.lxcfs.enable)
|
|
|
|
"LXD_LXC_TEMPLATE_CONFIG=${pkgs.lxcfs}/share/lxc/config";
|
2015-09-14 06:27:31 +00:00
|
|
|
};
|
2018-03-16 09:58:54 +00:00
|
|
|
};
|
|
|
|
|
2018-06-29 23:58:35 +00:00
|
|
|
users.groups.lxd.gid = config.ids.gids.lxd;
|
2015-09-14 06:27:31 +00:00
|
|
|
|
2018-06-29 23:58:35 +00:00
|
|
|
users.users.root = {
|
2015-09-14 06:27:31 +00:00
|
|
|
subUidRanges = [ { startUid = 1000000; count = 65536; } ];
|
|
|
|
subGidRanges = [ { startGid = 1000000; count = 65536; } ];
|
|
|
|
};
|
2019-12-14 14:29:08 +00:00
|
|
|
|
|
|
|
boot.kernel.sysctl = mkIf cfg.recommendedSysctlSettings {
|
|
|
|
"fs.inotify.max_queued_events" = 1048576;
|
|
|
|
"fs.inotify.max_user_instances" = 1048576;
|
|
|
|
"fs.inotify.max_user_watches" = 1048576;
|
|
|
|
"vm.max_map_count" = 262144;
|
|
|
|
"kernel.dmesg_restrict" = 1;
|
|
|
|
"net.ipv4.neigh.default.gc_thresh3" = 8192;
|
|
|
|
"net.ipv6.neigh.default.gc_thresh3" = 8192;
|
|
|
|
"kernel.keys.maxkeys" = 2000;
|
|
|
|
};
|
2015-09-14 06:27:31 +00:00
|
|
|
};
|
|
|
|
}
|