nixpkgs/nixos/modules/virtualisation/lxc.nix
2023-12-04 10:06:54 -05:00

81 lines
2.0 KiB
Nix

# LXC Configuration
{ config, lib, pkgs, ... }:
let
cfg = config.virtualisation.lxc;
in
{
meta = {
maintainers = lib.teams.lxc.members;
};
options.virtualisation.lxc = {
enable =
lib.mkOption {
type = lib.types.bool;
default = false;
description =
lib.mdDoc ''
This enables Linux Containers (LXC), which provides tools
for creating and managing system or application containers
on Linux.
'';
};
systemConfig =
lib.mkOption {
type = lib.types.lines;
default = "";
description =
lib.mdDoc ''
This is the system-wide LXC config. See
{manpage}`lxc.system.conf(5)`.
'';
};
defaultConfig =
lib.mkOption {
type = lib.types.lines;
default = "";
description =
lib.mdDoc ''
Default config (default.conf) for new containers, i.e. for
network config. See {manpage}`lxc.container.conf(5)`.
'';
};
usernetConfig =
lib.mkOption {
type = lib.types.lines;
default = "";
description =
lib.mdDoc ''
This is the config file for managing unprivileged user network
administration access in LXC. See {manpage}`lxc-usernet(5)`.
'';
};
};
###### implementation
config = lib.mkIf cfg.enable {
environment.systemPackages = [ pkgs.lxc ];
environment.etc."lxc/lxc.conf".text = cfg.systemConfig;
environment.etc."lxc/lxc-usernet".text = cfg.usernetConfig;
environment.etc."lxc/default.conf".text = cfg.defaultConfig;
systemd.tmpfiles.rules = [ "d /var/lib/lxc/rootfs 0755 root root -" ];
security.apparmor.packages = [ pkgs.lxc ];
security.apparmor.policies = {
"bin.lxc-start".profile = ''
include ${pkgs.lxc}/etc/apparmor.d/usr.bin.lxc-start
'';
"lxc-containers".profile = ''
include ${pkgs.lxc}/etc/apparmor.d/lxc-containers
'';
};
};
}