]> Git — Sourcephile - sourcephile-nix.git/blob - nixos/modules/virtualisation/lxd.nix
nix: use nixpkgs/patches/wip.diff instead of nixpkgs/overlays.nix and nixos/modules.nix
[sourcephile-nix.git] / nixos / modules / virtualisation / lxd.nix
1 # Systemd services for lxd.
2
3 { config, lib, pkgs, ... }:
4
5 with lib;
6
7 let
8
9 cfg = config.virtualisation.lxd;
10 zfsCfg = config.boot.zfs;
11
12 in
13
14 {
15 ###### interface
16
17 options = {
18 virtualisation.lxd = {
19 enable = mkOption {
20 type = types.bool;
21 default = false;
22 description = ''
23 This option enables lxd, a daemon that manages
24 containers. Users in the "lxd" group can interact with
25 the daemon (e.g. to start or stop containers) using the
26 <command>lxc</command> command line tool, among others.
27
28 Most of the time, you'll also want to start lxcfs, so
29 that containers can "see" the limits:
30 <code>
31 virtualisation.lxc.lxcfs.enable = true;
32 </code>
33 '';
34 };
35
36 package = mkOption {
37 type = types.package;
38 default = pkgs.lxd.override { nftablesSupport = config.networking.nftables.enable; };
39 defaultText = "pkgs.lxd";
40 description = ''
41 The LXD package to use.
42 '';
43 };
44
45 lxcPackage = mkOption {
46 type = types.package;
47 default = pkgs.lxc;
48 defaultText = "pkgs.lxc";
49 description = ''
50 The LXC package to use with LXD (required for AppArmor profiles).
51 '';
52 };
53
54 zfsPackage = mkOption {
55 type = types.package;
56 default = with pkgs; if zfsCfg.enableUnstable then zfsUnstable else zfs;
57 defaultText = "pkgs.zfs";
58 description = ''
59 The ZFS package to use with LXD.
60 '';
61 };
62
63 zfsSupport = mkOption {
64 type = types.bool;
65 default = false;
66 description = ''
67 Enables lxd to use zfs as a storage for containers.
68
69 This option is enabled by default if a zfs pool is configured
70 with nixos.
71 '';
72 };
73
74 recommendedSysctlSettings = mkOption {
75 type = types.bool;
76 default = false;
77 description = ''
78 enables various settings to avoid common pitfalls when
79 running containers requiring many file operations.
80 Fixes errors like "Too many open files" or
81 "neighbour: ndisc_cache: neighbor table overflow!".
82 See https://lxd.readthedocs.io/en/latest/production-setup/
83 for details.
84 '';
85 };
86 };
87 };
88
89 ###### implementation
90
91 config = mkIf cfg.enable {
92 environment.systemPackages = [ cfg.package ];
93
94 security.apparmor = {
95 enable = true;
96 packages = [ cfg.lxcPackage ];
97 policies = {
98 "bin/lxc-start".profile = ''
99 #include ${cfg.lxcPackage}/etc/apparmor.d/usr.bin.lxc-start
100 '';
101 "lxc-containers".profile = ''
102 #include ${cfg.lxcPackage}/etc/apparmor.d/lxc-containers
103 '';
104 };
105 };
106
107 systemd.services.lxd = {
108 description = "LXD Container Management Daemon";
109
110 wantedBy = [ "multi-user.target" ];
111 after = [ "systemd-udev-settle.service" ];
112
113 path = lib.optional cfg.zfsSupport cfg.zfsPackage;
114
115 preStart = ''
116 mkdir -m 0755 -p /var/lib/lxc/rootfs
117 '';
118
119 serviceConfig = {
120 ExecStart = "@${cfg.package}/bin/lxd lxd --group lxd";
121 Type = "simple";
122 KillMode = "process"; # when stopping, leave the containers alone
123 LimitMEMLOCK = "infinity";
124 LimitNOFILE = "1048576";
125 LimitNPROC = "infinity";
126 TasksMax = "infinity";
127
128 # By default, `lxd` loads configuration files from hard-coded
129 # `/usr/share/lxc/config` - since this is a no-go for us, we have to
130 # explicitly tell it where the actual configuration files are
131 Environment = mkIf (config.virtualisation.lxc.lxcfs.enable)
132 "LXD_LXC_TEMPLATE_CONFIG=${pkgs.lxcfs}/share/lxc/config";
133 };
134 };
135
136 users.groups.lxd.gid = config.ids.gids.lxd;
137
138 users.users.root = {
139 subUidRanges = [ { startUid = 1000000; count = 65536; } ];
140 subGidRanges = [ { startGid = 1000000; count = 65536; } ];
141 };
142
143 boot.kernel.sysctl = mkIf cfg.recommendedSysctlSettings {
144 "fs.inotify.max_queued_events" = 1048576;
145 "fs.inotify.max_user_instances" = 1048576;
146 "fs.inotify.max_user_watches" = 1048576;
147 "vm.max_map_count" = 262144;
148 "kernel.dmesg_restrict" = 1;
149 "net.ipv4.neigh.default.gc_thresh3" = 8192;
150 "net.ipv6.neigh.default.gc_thresh3" = 8192;
151 "kernel.keys.maxkeys" = 2000;
152 };
153 };
154 }