Fix concourse & caddy startup

flake.lock

@@ -220,6 +220,38 @@
         "type": "github"
       }
     },
+    "fix-atomic-container-restarts": {
+      "locked": {
+        "lastModified": 1688325567,
+        "narHash": "sha256-7thz5UlbgR9LNWOoPKMtpchI8U1EQpj6p4FhIGe3ZRI=",
+        "owner": "pub-solar",
+        "repo": "nixpkgs",
+        "rev": "2a04ada27acb5a7401f8265e9d0a6db0f259cafb",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pub-solar",
+        "ref": "fix/atomic-container-restarts",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "fix-yubikey-agent": {
+      "locked": {
+        "lastModified": 1654372286,
+        "narHash": "sha256-z1WrQkL67Sosz1VnuKQLpzEkEl4ianeLpWJX8Q6bVQY=",
+        "owner": "pub-solar",
+        "repo": "nixpkgs",
+        "rev": "4995a873a796c54cc49e5dca9e1d20350eceec7b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "pub-solar",
+        "ref": "fix/use-latest-unstable-yubikey-agent",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
     "flake-compat": {
       "flake": false,
       "locked": {
@@ -560,28 +592,14 @@
         "type": "github"
       }
     },
-    "pub-solar": {
-      "locked": {
-        "lastModified": 1654372286,
-        "narHash": "sha256-z1WrQkL67Sosz1VnuKQLpzEkEl4ianeLpWJX8Q6bVQY=",
-        "owner": "pub-solar",
-        "repo": "nixpkgs",
-        "rev": "4995a873a796c54cc49e5dca9e1d20350eceec7b",
-        "type": "github"
-      },
-      "original": {
-        "owner": "pub-solar",
-        "ref": "fix/use-latest-unstable-yubikey-agent",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
     "root": {
       "inputs": {
         "agenix": "agenix",
         "darwin": "darwin",
         "deploy": "deploy",
         "digga": "digga",
+        "fix-atomic-container-restarts": "fix-atomic-container-restarts",
+        "fix-yubikey-agent": "fix-yubikey-agent",
         "flake-compat": "flake-compat",
         "home": "home",
         "keycloak-theme-pub-solar": "keycloak-theme-pub-solar",
@@ -590,7 +608,6 @@
         "nixos": "nixos",
         "nixos-generators": "nixos-generators",
         "nixos-hardware": "nixos-hardware",
-        "pub-solar": "pub-solar",
         "scan2paperless": "scan2paperless"
       }
     },

flake.nix

@@ -41,7 +41,8 @@
     keycloak-theme-pub-solar.inputs.nixpkgs.follows = "nixos";
 
     master.url = "github:nixos/nixpkgs/master";
-    pub-solar.url = "github:pub-solar/nixpkgs/fix/use-latest-unstable-yubikey-agent";
+    fix-yubikey-agent.url = "github:pub-solar/nixpkgs/fix/use-latest-unstable-yubikey-agent";
+    fix-atomic-container-restarts.url = "github:pub-solar/nixpkgs/fix/atomic-container-restarts";
     scan2paperless.url = "git+https://git.pub.solar/b12f/scan2paperless.git";
   };
 

hosts/nougat-2/caddy.nix

@@ -91,8 +91,9 @@ in {
       services.caddy = {
         enable = lib.mkForce true;
 
-        email = "acme@benjaminbaedorf.eu";
-        globalConfig = lib.mkForce "";
+        globalConfig = lib.mkForce ''
+          auto_https disable_certs
+        '';
 
         virtualHosts = {
           "dashboard.nougat-2.b12f.io" = {

hosts/nougat-2/concourse.nix

@@ -43,7 +43,7 @@ in {
   ids.gids.concourse = 995;
 
   systemd.tmpfiles.rules = [
-    "d '/data/concourse/db' 0770 ${builtins.toString config.ids.uids.postgres} postgres - -"
+    "d '/data/concourse/db' 0770 root postgres - -"
   ];
 
   system.activationScripts.mkConcourseNet = let
@@ -53,6 +53,29 @@ in {
     ${dockerBin} network inspect concourse-net >/dev/null 2>&1 || ${dockerBin} network create concourse-net --subnet 172.20.0.0/24
   '';
 
+  containers.concourse = {
+    autoStart = true;
+    privateNetwork = true;
+    hostAddress = "192.168.101.0";
+    localAddress = "192.168.107.0";
+    hostAddress6 = "fc00::1";
+    localAddress6 = "fc00::7";
+
+    bindMounts = {
+      "/var/lib/postgresql/14" = {
+        hostPath = "/data/concourse/db";
+        isReadOnly = false;
+      };
+
+      "${config.age.secrets.keycloak-database-password.path}" = {
+        hostPath = "${config.age.secrets.keycloak-database-password.path}";
+        isReadOnly = true;
+      };
+    };
+
+    config = {
+      networking.nameservers = ["1.1.1.1"];
+
   virtualisation.oci-containers = {
     containers."concourse-db" = {
       image = "postgres:14";

hosts/nougat-2/configuration.nix

@@ -66,10 +66,10 @@ in {
   networking.defaultGateway = "135.181.179.65";
 
   networking.interfaces."enp0s31f6".ipv6.addresses = [
-    #{
-    #  address = "2a01:4f9:3a:2170::1";
-    #  prefixLength = 64;
-    #}
+    {
+      address = "2a01:4f9:3a:2170::1";
+      prefixLength = 64;
+    }
   ];
   networking.defaultGateway6 = {
     address = "fe80::1";

hosts/nougat-2/nougat-2.nix

@@ -3,6 +3,7 @@
   pkgs,
   lib,
   self,
+  fix-atomic-container-restartsModulesPath,
   ...
 }:
 with lib; let
@@ -16,6 +17,7 @@ in {
     ./caddy.nix
     ./keycloak.nix
     ./gitea.nix
-    ./concourse.nix
+    # ./concourse.nix
+    # "${fix-atomic-container-restartsModulesPath}/virtualisation/nixos-containers.nix"
   ];
 }

overlays/overrides.nix

@@ -6,7 +6,7 @@ channels: final: prev: {
     ;
 
   inherit
-    (channels.pub-solar)
+    (channels.fix-yubikey-agent)
     yubikey-agent
     ;