nix/nixos/containers/default.nix

{ ip, stateVersion, hostname, ... }: {
  imports = [
    ./${hostname}
    # Modules
    ../common/modules/nixos.nix
    ../common/modules/networking.nix
    # Services
    ../common/services/promtail.nix
    ../common/services/telegraf.nix
    ../common/services/openssh.nix
    ../common/services/gnupg-agent.nix
  ];

  networking.interfaces.eth0.ipv4.addresses = [{
    address = "192.168.2.${ip}";
    prefixLength = 24;
  }];

  programs.fish.enable = true;
  time.timeZone = "Asia/Tokyo";
  
  # We can access the internet through this interface.
  networking.defaultGateway = {
    address = "192.168.2.1";
    interface = "eth0";
  };

  boot.isContainer = true;
  system.stateVersion = stateVersion;
  networking.hostName = "${hostname}";

  # Set up the secrets file:
  sops.secrets."tailscale_key" = {
    owner = "root";
    sopsFile = ../../secrets/containers/${hostname}.yaml;
    restartUnits = [ 
      "tailscaled.service"
      "tailscaled-autoconnect.service" 
    ];
  };

  services.tailscale = {
    enable = true;
    authKeyFile = "/run/secrets/tailscale_key";
    interfaceName = "tailscale0";
    extraUpFlags = [
      "--login-server=https://headscale.sysctl.io"
      "--accept-dns"
      "--accept-routes"
    ];
  };
  
  networking.firewall.interfaces.tailscale0.allowedTCPPorts = [ 22 ];
  networking.firewall.checkReversePath = "loose";
  networking.extraHosts = ''
    100.64.0.14 influx.sysctl.io
    100.64.0.14 loki.sysctl.io
  '';

  # Select internationalisation properties.
  i18n.defaultLocale = "en_US.UTF-8";
  i18n.extraLocaleSettings = {
    LC_ADDRESS = "en_US.UTF-8";
    LC_IDENTIFICATION = "en_US.UTF-8";
    LC_MEASUREMENT = "en_US.UTF-8";
    LC_MONETARY = "en_US.UTF-8";
    LC_NAME = "en_US.UTF-8";
    LC_NUMERIC = "en_US.UTF-8";
    LC_PAPER = "en_US.UTF-8";
    LC_TELEPHONE = "en_US.UTF-8";
    LC_TIME = "en_US.UTF-8";
  };

}