AtaraxiaDev/nixos-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

fix: dns in podman containers

Browse Source
This commit is contained in:
Dmitriy Kholkin 2025-07-18 16:35:39 +03:00
parent 1def5dd78b
commit 089cef5e37
Signed by: AtaraxiaDev
GPG Key ID: FD266B810DF48DF2
2 changed files with 25 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
modules/nixos/containers/media-stack/default.nix
View File

@ -28,7 +28,6 @@ let
"0.0.0.0:7000:7000" "0.0.0.0:7000:7000"
"0.0.0.0:7000:7000/udp" "0.0.0.0:7000:7000/udp"
]; ];
pod-dns = "10.10.10.1";
in in
{ {
imports = [ imports = [
@ -67,7 +66,6 @@ in
virtualisation.quadlet.pods.media-stack = { virtualisation.quadlet.pods.media-stack = {
podConfig = { podConfig = {
dns = [ pod-dns ];
networks = [ networks.br-services.ref ]; networks = [ networks.br-services.ref ];
publishPorts = open-ports; publishPorts = open-ports;
}; };

31
modules/nixos/virtualisation/virtualisation.nix
View File

@ -6,7 +6,12 @@
... ...
}: }:
let let
inherit (lib) mkEnableOption mkIf optionals; inherit (lib)
mapAttrs
mkEnableOption
mkIf
optionals
;
cfg = config.ataraxia.virtualisation; cfg = config.ataraxia.virtualisation;
defaultUser = config.ataraxia.defaults.users.defaultUser; defaultUser = config.ataraxia.defaults.users.defaultUser;
@ -75,14 +80,13 @@ in
spiceUSBRedirection.enable = cfg.libvirt; spiceUSBRedirection.enable = cfg.libvirt;
quadlet = { quadlet = {
enable = true; enable = cfg.podman;
autoEscape = true; autoEscape = true;
autoUpdate.enable = false; autoUpdate.enable = false;
networks = { networks = {
br-services.networkConfig = { br-services.networkConfig = {
# TODO: enable dns, fix dns resolution disableDns = false;
# dns = [ "10.10.10.1" ]; dns = [ "10.10.10.1" ];
disableDns = true;
driver = "bridge"; driver = "bridge";
ipamDriver = "host-local"; ipamDriver = "host-local";
ipv6 = false; ipv6 = false;
@ -110,7 +114,22 @@ in
]; ];
}; };
networking.firewall.trustedInterfaces = mkIf cfg.libvirt [ "virbr0" ]; networking.firewall = {
trustedInterfaces = mkIf cfg.libvirt [ "virbr0" ];
interfaces =
{
"podman*".allowedUDPPorts = mkIf cfg.podman [
53
5353
];
}
// mapAttrs (_: _: {
allowedUDPPorts = [
53
5353
];
}) config.virtualisation.quadlet.networks;
};
security.unprivilegedUsernsClone = true; security.unprivilegedUsernsClone = true;