[NixOS] - Podman SETUP

[K-MeLeOn]

Hey !!

Just want to share with you some NixOS config for Newt in Rootful and Rootless mode 😃 (only Rootful for now)

After many many many hours of shi**y config, I can now say I have a pretty correct one !

Disclaimer
I let you search how to use NIXSOPS to avoid letting secret in your store & config

So, for now I have some problem with rootless :

• Can't use internal DNS smoothly that force the use of direct IP/port, even HTTPS
• Can't correctly firewalled the installation due to native rootless isolation -> problematic issue for me

For the rootful one, it's totally different and more preferable (as I havn't fully understand my rootless poblems) :

• Usage of internal DNS with local FQDN (reverse proxy needed)
• Usage of nftable to isolate communication capabilities of the container

I'll return here sometimes to update it if it's needed or if I upgrade my installation for a better one.

All my configurations are splited into several files, I merged them for a better readability.

ROOTFUL

container

{ pkgs, ... }: 
let
  usr              = "svc_newt";
  app              = "newt";
  podmanNetwork    = "newt";
  createScriptName = "createPodmanNetwork_" + podmanNetwork;
  networkSubnet    = "10.90.1.0/24"; # Choose what you want, don't forget to modify `networkGateway` too
  networkGateway   = "10.90.1.1";    # Always .1
in
{
   virtualisation = {
     oci-containers.backend = "podman";
     containers.enable = true;
     podman = {
       enable           = true;
       autoPrune.enable = true;
       defaultNetwork.settings.dns_enabled = true;
    };
  };
  
  # oci-container don't create network automatically either, it's ok, we need to modify it anyway
  system.activationScripts.${createScriptName}.text = ''
    #!/bin/sh
    if ! ${pkgs.podman}/bin/podman network exists ${podmanNetwork}; then
      ${pkgs.podman}/bin/podman network create \
        --subnet ${networkSubnet} \
        --gateway ${networkGateway} \
      ${podmanNetwork}
    fi
  '';

  virtualisation.oci-containers.containers.${app} = {
    image = "docker.io/fosrl/newt:latest";
    autoStart = true;
    networks = [ "${app}" ];

    environment = {
      PANGOLIN_ENDPOINT = "https://<SUB.DOMAIN.TLD>";
      NEWT_ID           = "<YOUR_ID>";
      NEWT_SECRET       = "<YOUR_SECRET>";
    };
    
    ###### ------ If you want to user your Self-Signed CA
    entrypoint = "/update-ca-entrypoint.sh";
    cmd = [
      "/entrypoint.sh"
      "newt"
    ];

    volumes = [
      "/<PATH>/certs-ca/intermediate-ca.pem:/usr/local/share/ca-certificates/intermediate-ca.pem:ro"
      "/<PATH>/certs-ca/root-ca.pem:/usr/local/share/ca-certificates/root-ca.pem:ro"
      "/<PATH>/certs-ca/update-ca-entrypoint.sh:/update-ca-entrypoint.sh:ro"
    ];
    ###### ------
    
    extraOptions = [
      "--security-opt=no-new-privileges"
    ];
  };
}

update-ca-entrypoint.sh

#!/bin/sh

set -e

update-ca-certificates
exec $@

firewall

let
  subnet     = "10.90.1.0/24";        # Same as defined in the container network
  ipNetstack = "172.21.0.2";          # netstack userspace WG proxy Newt -> Gerbil
  ipDNS1     = "<IP_DNS1>";
  ipDNS2     = "<IP_DNS2>";
  ipRP1      = "<IP_REVERSE_PROXY1>";
  ipVPS      = "<IP_VPS>";
  wgPort     = 51820;         
in
{
  netowrking.nftables.enable = true;
  networking.nftables.tables.newt_podlock = {
    family = "inet";
    content = ''
      chain forward {
        type filter hook forward priority -100;
        policy accept;
 
        ip saddr ${subnet} jump pod_egress
      }

      chain pod_egress {
        ct state established,related accept

        # DNS / DoT to IP_DNS1 / IP_DNS2
        ip daddr ${ipDNS1} udp dport 53  accept
        ip daddr ${ipDNS1} tcp dport 53  accept
        ip daddr ${ipDNS1} tcp dport 853 accept
        ip daddr ${ipDNS2} udp dport 53  accept
        ip daddr ${ipDNS2} tcp dport 53  accept
        ip daddr ${ipDNS2} tcp dport 853 accept

        # HTTPS to reverse proxy
        ip daddr ${ipRP1} tcp dport 443 accept

        # HTTPS to VPS
        ip daddr ${ipVPS} tcp dport 443 accept
        ip daddr ${ipNetstack} tcp dport 443 accept

        # Handshake WireGuard to VPS
        ip daddr ${ipVPS} udp dport ${toString wgPort} accept
        
        # log prefix "podlock drop " level info  # <------ USE IT TO FOUND IP COMMUNICATION WITH `sudo journalctl -k -f`

        # Drop all other requests
        drop # <------ REMOVE IT TO UPDATE THE CONTAINER DIRECTLY FROM THE HOST OR USE YOUR MIRRORING CONTAINER LOCAL APP (Harbor ?)
      }
    '';
  };
}

Now use your config like this and enjoy !