152 lines
3.9 KiB
Nix
152 lines
3.9 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
let
|
|
cfg = config.local.programs.browsers;
|
|
|
|
hostAddress = "192.168.7.10";
|
|
localAddress = "192.168.7.11";
|
|
|
|
contPackages =
|
|
lib.optional cfg.tor-browser.enable cfg.tor-browser.package
|
|
++ lib.optional cfg.librewolf.enable cfg.librewolf.package
|
|
++ lib.optional cfg.mullvad-browser.enable cfg.mullvad-browser.package;
|
|
|
|
hostPackages = lib.flip map contPackages (p:
|
|
let
|
|
hostRunBrowser = pkgs.writeScript "cont-run-browser" ''
|
|
host=browsers.containers
|
|
if [ -z "$(ssh-keygen -F $host)" ]; then
|
|
ssh-keyscan -H $host >> ~/.ssh/known_hosts
|
|
fi
|
|
ssh -o PubkeyAuthentication=no kira@$host $@
|
|
'';
|
|
|
|
hostBrowserScript = pkgs.writeScriptBin "${p.meta.mainProgram}" ''
|
|
${hostRunBrowser} ${p.meta.mainProgram} $@
|
|
'';
|
|
in
|
|
pkgs.runCommand "${p.meta.mainProgram}" { } ''
|
|
mkdir $out
|
|
cp -r ${hostBrowserScript}/bin $out/bin
|
|
cp -r ${p}/share $out/share
|
|
''
|
|
);
|
|
|
|
isEnable = cfg.tor-browser.enable
|
|
or cfg.librewolf.enable
|
|
or cfg.mullvad-browser.enable;
|
|
in
|
|
{
|
|
imports = [
|
|
./tor-browser.nix
|
|
./mullvad-browser.nix
|
|
./librewolf.nix
|
|
];
|
|
|
|
config = lib.mkIf isEnable {
|
|
environment.systemPackages = hostPackages;
|
|
|
|
hardware.pulseaudio = {
|
|
systemWide = true;
|
|
support32Bit = true;
|
|
tcp = {
|
|
enable = true;
|
|
anonymousClients.allowedIpRanges = [ "127.0.0.1" "192.168.7.0/24" ];
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
firewall = {
|
|
allowedTCPPorts = [ 4713 ];
|
|
allowedTCPPortRanges = [
|
|
{ from = 3000; to = 3999; }
|
|
{ from = 5000; to = 5999; }
|
|
{ from = 8000; to = 9999; }
|
|
{ from = 32000; to = 33999; }
|
|
];
|
|
trustedInterfaces = [ "ve-*" ];
|
|
};
|
|
nat = {
|
|
enable = true;
|
|
internalInterfaces = [ "ve-browsers" ];
|
|
externalInterface = "wg0";
|
|
};
|
|
};
|
|
|
|
containers.browsers = {
|
|
autoStart = true;
|
|
ephemeral = true;
|
|
|
|
privateNetwork = true;
|
|
inherit hostAddress localAddress;
|
|
|
|
bindMounts = lib.mkMerge [
|
|
{
|
|
"/tmp/.X11-unix" = {};
|
|
"/etc/ssh/keys" = {
|
|
isReadOnly = false;
|
|
hostPath = "/persistence/per-machine/browsers/etc/ssh/keys";
|
|
};
|
|
"/home/kira/Downloads" = {
|
|
isReadOnly = false;
|
|
hostPath = "/home/jan/downloads/browser";
|
|
};
|
|
"/run/opengl-driver/lib" = { };
|
|
"/run/opengl-driver-32/lib" = { };
|
|
}
|
|
(lib.mkIf cfg.librewolf.enable {
|
|
"/home/kira/.librewolf" = {
|
|
isReadOnly = false;
|
|
hostPath = "/persistence/per-machine/browsers/home/kira/.librewolf";
|
|
};
|
|
})
|
|
];
|
|
|
|
config = { pkgs, ... }: {
|
|
system.stateVersion = "23.11";
|
|
|
|
# Inherit configs from host
|
|
networking.hosts = lib.mkMerge [
|
|
config.networking.hosts
|
|
{ "${hostAddress}" = [ "host" ]; }
|
|
];
|
|
fonts = {
|
|
inherit (config.fonts) enableDefaultPackages packages;
|
|
fontconfig = { inherit (config.fonts.fontconfig) defaultFonts; };
|
|
};
|
|
|
|
services.openssh = {
|
|
enable = true;
|
|
settings = {
|
|
PasswordAuthentication = true;
|
|
MaxAuthTries = 2;
|
|
};
|
|
hostKeys = [
|
|
{
|
|
bits = 4096;
|
|
path = "/etc/ssh/keys/ssh_host_rsa_key";
|
|
type = "rsa";
|
|
}
|
|
{
|
|
path = "/etc/ssh/keys/ssh_host_ed25519_key";
|
|
type = "ed25519";
|
|
}
|
|
];
|
|
};
|
|
|
|
users.users.kira = {
|
|
isNormalUser = true;
|
|
home = "/home/kira";
|
|
password = "hello";
|
|
extraGroups = [ "pulse-access" ];
|
|
packages = contPackages;
|
|
};
|
|
|
|
environment.sessionVariables = {
|
|
DISPLAY = ":0";
|
|
PULSE_SERVER = "tcp:${hostAddress}:4713";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|