From 6366e68092ecd83edde43be7650a16dec985e316 Mon Sep 17 00:00:00 2001 From: Sefa Eyeoglu Date: Mon, 27 Jul 2026 20:58:05 +0200 Subject: [PATCH] feat(galileo): add frigate Signed-off-by: Sefa Eyeoglu --- flake.nix | 1 - nix/modules/base/oci-images.nix | 83 ++++++++++++++++++ nix/modules/extensions/frigate/service.nix | 37 ++++++++ nix/modules/extensions/podman/service.nix | 19 ++++ nix/modules/machines/galileo/frigate.env.age | Bin 0 -> 606 bytes nix/modules/machines/galileo/frigate.nix | 26 ++++++ .../galileo/home-assistant/service.nix | 2 + nixosConfigurations/common/server.nix | 2 - nixosConfigurations/eclipse/configuration.nix | 1 + nixosConfigurations/eclipse/default.nix | 20 ++--- nixosConfigurations/eclipse/frigate.nix | 30 +------ nixosConfigurations/galileo/configuration.nix | 1 + nixosConfigurations/galileo/default.nix | 16 ++-- nixosConfigurations/universe/default.nix | 24 +++-- nixosModules/default.nix | 5 -- nixosModules/oci-image-external.nix | 79 ----------------- secrets.nix | 1 + sefa_cloud.tf | 1 + 18 files changed, 199 insertions(+), 149 deletions(-) create mode 100644 nix/modules/base/oci-images.nix create mode 100644 nix/modules/extensions/frigate/service.nix create mode 100644 nix/modules/extensions/podman/service.nix create mode 100644 nix/modules/machines/galileo/frigate.env.age create mode 100644 nix/modules/machines/galileo/frigate.nix delete mode 100644 nixosModules/default.nix delete mode 100644 nixosModules/oci-image-external.nix diff --git a/flake.nix b/flake.nix index d7e1dba8..3180c01e 100644 --- a/flake.nix +++ b/flake.nix @@ -81,7 +81,6 @@ ./flakeDeploy.nix ./lib - ./nixosModules ./pkgs ./nixosConfigurations/andromeda diff --git a/nix/modules/base/oci-images.nix b/nix/modules/base/oci-images.nix new file mode 100644 index 00000000..7b503644 --- /dev/null +++ b/nix/modules/base/oci-images.nix @@ -0,0 +1,83 @@ +{ + flake.modules.nixos."base" = { + config, + lib, + pkgs, + ... + }: let + inherit (lib) types mapAttrs mkIf mkDefault mkMerge literalExpression mkOption; + + cfg = config.virtualisation.oci-containers.externalImages; + + imageRef = types.submodule { + options = { + registry = mkOption { + readOnly = true; + type = types.str; + }; + repository = mkOption { + readOnly = true; + type = types.str; + }; + tag = mkOption { + readOnly = true; + type = types.str; + }; + ref = mkOption { + readOnly = true; + type = types.str; + }; + }; + }; + + readYAML = file: let + inherit (builtins) fromJSON readFile; + inherit (pkgs) runCommand yj; + # convert to json + json = runCommand "converted.json" {} '' + ${yj}/bin/yj < ${file} > $out + ''; + in + fromJSON (readFile json); + + defaultImageOpts = {registry = cfg.defaultRegistry;}; + + mkImageRef = image: let + inherit (image') registry repository tag; + + image' = defaultImageOpts // image.image; + in + image' // {ref = "${registry}/${repository}:${tag}";}; + + images = readYAML cfg.imagesFile; + images' = mapAttrs (_: v: mkImageRef v) images; + in { + options.virtualisation.oci-containers.externalImages = { + imagesFile = mkOption { + description = "Path to configuration file containing image references"; + type = types.path; + example = literalExpression "./values.yaml"; + }; + + defaultRegistry = mkOption { + default = "docker.io"; + description = "Default registry to use when unspecified"; + type = types.str; + }; + + images = mkOption { + description = "Image references"; + type = types.attrsOf imageRef; + }; + }; + + config = mkMerge [ + { + virtualisation.oci-containers.externalImages.imagesFile = mkDefault ../../../values.yaml; + } + (mkIf (cfg.imagesFile != null) { + virtualisation.oci-containers.externalImages.images = images'; + }) + ]; + }; +} diff --git a/nix/modules/extensions/frigate/service.nix b/nix/modules/extensions/frigate/service.nix new file mode 100644 index 00000000..2614e8d1 --- /dev/null +++ b/nix/modules/extensions/frigate/service.nix @@ -0,0 +1,37 @@ +{ + flake.modules.nixos."ext-frigate" = {config, ...}: { + virtualisation.oci-containers.containers."frigate" = { + environmentFiles = [ + config.age.secrets."frigate.env".path + ]; + + ports = [ + "1935:1935" # RTMP + "5000:5000" # API + "8554:8554" # RTSP feeds + "8555:8555/tcp" # WebRTC + "8555:8555/udp" # WebRTC + ]; + + extraOptions = [ + "--mount=type=tmpfs,destination=/tmp/cache,tmpfs-size=2G" + "--device=/dev/bus/usb:/dev/bus/usb" + "--device=/dev/dri:/dev/dri" + "--privileged" + "--shm-size=256m" + ]; + }; + + networking.firewall = { + allowedTCPPorts = [ + 1935 + 5000 + 8554 + 8555 + ]; + allowedUDPPorts = [ + 8555 + ]; + }; + }; +} diff --git a/nix/modules/extensions/podman/service.nix b/nix/modules/extensions/podman/service.nix new file mode 100644 index 00000000..2441c3de --- /dev/null +++ b/nix/modules/extensions/podman/service.nix @@ -0,0 +1,19 @@ +{ + flake.modules.nixos."ext-podman" = { + virtualisation.podman = { + enable = true; + autoPrune.enable = true; + dockerSocket.enable = true; + }; + + virtualisation.oci-containers.backend = "podman"; + + services.traefik = { + supplementaryGroups = ["podman"]; + static.settings.providers.docker = { + exposedByDefault = false; + endpoint = "unix:///run/podman/podman.sock"; + }; + }; + }; +} diff --git a/nix/modules/machines/galileo/frigate.env.age b/nix/modules/machines/galileo/frigate.env.age new file mode 100644 index 0000000000000000000000000000000000000000..3744dda0e4d6587a112614e34d89bff4f8b32312 GIT binary patch literal 606 zcmYdHPt{G$OD?J`D9Oyv)5|YP*Do{V(zR14F3!+RO))YxHMCTSDm4o?4^%L9Hb~A3 z%gQhr$8<vEilV( zikqY5-Sev-KQ(bYYoTcP!@_fJO@)DXa_Wl!&PJ=HO_mcEik)6^E@xG${Fa6 $out - ''; - in - fromJSON (readFile json); - - defaultImageOpts = {registry = cfg.defaultRegistry;}; - - mkImageRef = image: let - inherit (image') registry repository tag; - - image' = defaultImageOpts // image.image; - in - image' // {ref = "${registry}/${repository}:${tag}";}; - - images = readYAML cfg.imagesFile; - images' = mapAttrs (_: v: mkImageRef v) images; -in { - options.virtualisation.oci-containers.externalImages = { - imagesFile = mkOption { - description = "Path to configuration file containing image references"; - type = types.path; - example = literalExpression "./values.yaml"; - }; - - defaultRegistry = mkOption { - default = "docker.io"; - description = "Default registry to use when unspecified"; - type = types.str; - }; - - images = mkOption { - description = "Image references"; - type = types.attrsOf imageRef; - }; - }; - - config = mkIf (cfg.imagesFile != null) { - virtualisation.oci-containers.externalImages.images = images'; - }; -} diff --git a/secrets.nix b/secrets.nix index 9b349e34..10576d79 100644 --- a/secrets.nix +++ b/secrets.nix @@ -22,6 +22,7 @@ in { "nix/modules/machines/galileo/asf/asf-bot1.json.age".publicKeys = galileo ++ scrumplex; "nix/modules/machines/galileo/asf/asf-bot2.json.age".publicKeys = galileo ++ scrumplex; "nix/modules/machines/galileo/asf/asf-ipc-passwd.age".publicKeys = galileo ++ scrumplex; + "nix/modules/machines/galileo/frigate.env.age".publicKeys = galileo ++ scrumplex; "nix/modules/machines/galileo/home-assistant/secrets.yaml.age".publicKeys = galileo ++ scrumplex; "nix/modules/machines/galileo/id_borgbase.age".publicKeys = galileo ++ scrumplex; "nix/modules/machines/galileo/syncthing/cert.pem.age".publicKeys = galileo ++ scrumplex; diff --git a/sefa_cloud.tf b/sefa_cloud.tf index 49dd4572..f1c35a7a 100644 --- a/sefa_cloud.tf +++ b/sefa_cloud.tf @@ -84,6 +84,7 @@ resource "hcloud_zone_rrset" "galileocnames_sefa_cloud" { for_each = toset([ "asf", "syncthing", + "view", ]) zone = data.hcloud_zone.sefa_cloud.name name = "${each.key}.galileo" -- 2.51.2