pyrox.dev
1{
2 config,
3 lib,
4 pkg,
5 ...
6}:
7let
8 inherit (lib)
9 mkOption
10 types
11 ;
12
13 cfg = config.virtualisation.podman.networkSocket;
14
15in
16{
17 imports = [
18 ./network-socket-ghostunnel.nix
19 ];
20
21 options.virtualisation.podman.networkSocket = {
22 enable = mkOption {
23 type = types.bool;
24 default = false;
25 description = ''
26 Make the Podman and Docker compatibility API available over the network
27 with TLS client certificate authentication.
28
29 This allows Docker clients to connect with the equivalents of the Docker
30 CLI `-H` and `--tls*` family of options.
31
32 For certificate setup, see <https://docs.docker.com/engine/security/protect-access/>
33
34 This option is independent of [](#opt-virtualisation.podman.dockerSocket.enable).
35 '';
36 };
37
38 server = mkOption {
39 type = types.enum [ ];
40 description = ''
41 Choice of TLS proxy server.
42 '';
43 example = "ghostunnel";
44 };
45
46 openFirewall = mkOption {
47 type = types.bool;
48 default = false;
49 description = ''
50 Whether to open the port in the firewall.
51 '';
52 };
53
54 tls.cacert = mkOption {
55 type = types.path;
56 description = ''
57 Path to CA certificate to use for client authentication.
58 '';
59 };
60
61 tls.cert = mkOption {
62 type = types.path;
63 description = ''
64 Path to certificate describing the server.
65 '';
66 };
67
68 tls.key = mkOption {
69 type = types.path;
70 description = ''
71 Path to the private key corresponding to the server certificate.
72
73 Use a string for this setting. Otherwise it will be copied to the Nix
74 store first, where it is readable by any system process.
75 '';
76 };
77
78 port = mkOption {
79 type = types.port;
80 default = 2376;
81 description = ''
82 TCP port number for receiving TLS connections.
83 '';
84 };
85 listenAddress = mkOption {
86 type = types.str;
87 default = "0.0.0.0";
88 description = ''
89 Interface address for receiving TLS connections.
90 '';
91 };
92 };
93
94 config = {
95 networking.firewall.allowedTCPPorts = lib.optional (cfg.enable && cfg.openFirewall) cfg.port;
96 };
97
98 meta.maintainers = lib.teams.podman.members ++ [ lib.maintainers.roberth ];
99}