~

nixos/docker/default.nix

@@ -0,0 +1,5 @@
+{ ... }: {
+	imports = [
+		./pihole
+	];
+}

nixos/docker/pihole/default.nix

@@ -0,0 +1,23 @@
+{ pkgs, lib, config, ... }: let
+	cfg = config.r5e.containers.pihole;
+in with lib; {
+	options.r5e.containers.pihole = {
+		enable = mkEnableOption "pihole";
+		api-password = mkOption {
+			type = types.string;
+			default = "";
+		};
+	};
+
+	config = mkIf cfg.enable mkMerge [
+		(import ./docker-compose.nix { inherit pkgs lib; })
+		{
+			virtualisation.oci-containers.containers.pihole = {
+				environment = {
+					TZ = config.time.timeZone;
+					FTLCONF_webserver_api_password = mkIf (cfg.api-password != null) cfg.api-password;
+				};
+			};
+		}
+	];
+}

nixos/docker/pihole/docker-compose.nix

@@ -0,0 +1,79 @@
+# Auto-generated using compose2nix v0.3.1.
+{ pkgs, lib, ... }:
+
+{
+  # Runtime
+  virtualisation.docker = {
+    enable = true;
+    autoPrune.enable = true;
+  };
+  virtualisation.oci-containers.backend = "docker";
+
+  # Containers
+  virtualisation.oci-containers.containers."pihole" = {
+    image = "pihole/pihole:latest";
+    environment = {
+      "FTLCONF_dns_listeningMode" = "all";
+    };
+    volumes = [
+      "/etc/pihole:/etc/pihole:rw"
+    ];
+    ports = [
+      "53:53/tcp"
+      "53:53/udp"
+      "80:80/tcp"
+      "443:443/tcp"
+    ];
+    log-driver = "journald";
+    extraOptions = [
+      "--cap-add=SYS_NICE"
+      "--network-alias=pihole"
+      "--network=pihole_default"
+    ];
+  };
+  systemd.services."docker-pihole" = {
+    serviceConfig = {
+      Restart = lib.mkOverride 90 "always";
+      RestartMaxDelaySec = lib.mkOverride 90 "1m";
+      RestartSec = lib.mkOverride 90 "100ms";
+      RestartSteps = lib.mkOverride 90 9;
+    };
+    after = [
+      "docker-network-pihole_default.service"
+    ];
+    requires = [
+      "docker-network-pihole_default.service"
+    ];
+    partOf = [
+      "docker-compose-pihole-root.target"
+    ];
+    wantedBy = [
+      "docker-compose-pihole-root.target"
+    ];
+  };
+
+  # Networks
+  systemd.services."docker-network-pihole_default" = {
+    path = [ pkgs.docker ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      ExecStop = "docker network rm -f pihole_default";
+    };
+    script = ''
+      docker network inspect pihole_default || docker network create pihole_default
+    '';
+    partOf = [ "docker-compose-pihole-root.target" ];
+    wantedBy = [ "docker-compose-pihole-root.target" ];
+  };
+
+  # Root service
+  # When started, this will automatically create all resources and start
+  # the containers. When stopped, this will teardown all resources.
+  systemd.targets."docker-compose-pihole-root" = {
+    unitConfig = {
+      Description = "Root target generated by compose2nix.";
+    };
+    wantedBy = [ "multi-user.target" ];
+  };
+}

nixos/docker/pihole/docker-compose.yml

@@ -0,0 +1,36 @@
+# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
+name: pihole
+services:
+  pihole:
+    container_name: pihole
+    image: pihole/pihole:latest
+    ports:
+      # DNS Ports
+      - "53:53/tcp"
+      - "53:53/udp"
+      # Default HTTP Port
+      - "80:80/tcp"
+      # Default HTTPs Port. FTL will generate a self-signed certificate
+      - "443:443/tcp"
+      # Uncomment the line below if you are using Pi-hole as your DHCP server
+      #- "67:67/udp"
+      # Uncomment the line below if you are using Pi-hole as your NTP server
+      #- "123:123/udp"
+    environment:
+      # If using Docker's default `bridge` network setting the dns listening mode should be set to 'all'
+      FTLCONF_dns_listeningMode: 'all'
+    # Volumes store your data between container upgrades
+    volumes:
+      # For persisting Pi-hole's databases and common configuration file
+      - '/etc/pihole:/etc/pihole'
+      # Uncomment the below if you have custom dnsmasq config files that you want to persist. Not needed for most starting fresh with Pi-hole v6. If you're upgrading from v5 you and have used this directory before, you should keep it enabled for the first v6 container start to allow for a complete migration. It can be removed afterwards. Needs environment variable FTLCONF_misc_etc_dnsmasq_d: 'true'
+      #- './etc-dnsmasq.d:/etc/dnsmasq.d'
+    cap_add:
+      # See https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
+      # Required if you are using Pi-hole as your DHCP server, else not needed
+      # - NET_ADMIN
+      # Required if you are using Pi-hole as your NTP client to be able to set the host's system time
+      # - SYS_TIME
+      # Optional, if Pi-hole should get some more processing time
+      - SYS_NICE
+    restart: unless-stopped

nixos/hosts/near/configuration.nix

@@ -4,6 +4,7 @@
 		inputs.raspberry-pi-nix.nixosModules.sd-image
 		./hardware-configuration.nix
 		../base.nix
+		../../docker
 	];
 
 	users.users.root.openssh.authorizedKeys.keys = [
@@ -12,63 +13,18 @@
 
 	programs.git.enable = true;
 	virtualisation.docker.enable = true;
-
-	services = {
-		homepage-dashboard = {
+	r5e.containers = {
+		pihole = {
 			enable = true;
-			listenPort = 80;
-			openFirewall = true;
-			settings = {
-				title = "near";
-				theme = "dark";
-				color = "violet";
-				headerStyle = "clean";
-				target = "_self";
-				quickLaunch.provider = "duckduckgo";
-			};
-			widgets = [
-				{
-					search.provider = "duckduckgo";
-				}
-				{
-					resources = {
-						cpu = true;
-						memory = true;
-						disk = "/";
-						uptime = true;
-						network = true;
-					};
-				}
-				{
-					openmeteo = {
-						label = "Jacksonville";
-						latitude = 30.3321838;
-						longitude = -81.655651;
-						timezone = "America/New_York";
-						units = "imperial";
-					};
-				}
-			];
-		};
-		openssh = {
-			ports = [ 22 ];
-			banner = "I won't hold it against you";
-			settings = {
-				PasswordAuthentication = false;
-			};
 		};
 	};
 
 	networking = {
 		hostName = "near";
 		firewall.allowedTCPPorts = [ 22 ];
-		#! TODO: webkitgtk seems to be a cache miss (alongside SDL and openal) which makes this take FOREVER to build
-		# networkmanager = {
-		# 	enable = true;
-		# };
 	};
 
-	environment.systemPackages = with pkgs; [ git ];
+	environment.systemPackages = with pkgs; [ git linux-wifi-hotspot ];
 
 	time.timeZone = "America/New_York";