{ inputs, ... }: # ============================================================================ # USDA Dashboard External System Module # ============================================================================ # External system configuration for usda-dash # This module can be referenced from nixos-systems/inventory.nix using: # # nix-lxc = { # devices = { # "usda-dash" = builtins.fetchGit { # url = "https://git.factory.uga.edu/MODEL/usda-dash-config.git"; # rev = "commit-hash"; # submodules = true; # REQUIRED for usda-vision submodule # }; # }; # }; # # IMPORTANT: For LXC containers running Docker, the Proxmox LXC must be configured with: # - Features: nesting=1, keyctl=1 # - Unprivileged: no (or privileged: yes) # Edit the container config in Proxmox: /etc/pve/lxc/.conf # Add: features: nesting=1,keyctl=1 { config, lib, pkgs, ... }: let # Import the usda-vision flake usda-vision-flake = (builtins.getFlake (toString ./usda-vision)).packages.${pkgs.system}; # Get packages from the flake camera-sdk = usda-vision-flake.camera-sdk; usda-vision-app = usda-vision-flake.usda-vision; in { # ========== Module Configuration ========== config = { # Nix configuration for LXC container without sandbox support nix.settings = { sandbox = false; # LXC containers don't support kernel namespaces for sandboxing experimental-features = [ "nix-command" "flakes" ]; }; # System packages specific to usda-dash environment.systemPackages = with pkgs; [ # Core tools git vim htop curl wget nfs-utils # Docker and Docker Compose for running usda-vision docker docker-compose # Supabase supabase-cli # Camera SDK camera-sdk # USDA Vision application package with convenience scripts usda-vision-app ]; # Make camera SDK libraries available system-wide environment.variables = { LD_LIBRARY_PATH = "${camera-sdk}/lib"; }; # Enable Docker service with LXC-compatible settings virtualisation.docker = { enable = true; autoPrune.enable = true; # Enable experimental features for better LXC compatibility daemon.settings = { experimental = true; }; }; # LXC-specific settings for nested containers boot.kernel.sysctl = { # Required for Docker networking in LXC "net.ipv4.ip_forward" = 1; "net.ipv4.conf.all.forwarding" = 1; }; # Configure users athenix.users.sv22900.enable = true; # Add users to docker group users.users.sv22900.extraGroups = [ "docker" ]; users.users.engr-ugaif.extraGroups = [ "docker" ]; # Create persistent directories and .env file location systemd.tmpfiles.rules = [ "d /var/lib/usda-vision 0755 root root -" "f /var/lib/usda-vision/.env 0644 root root -" "d /var/lib/supabase 0755 root root -" "d /mnt/nfs_share 0755 root root -" ]; # Enable NFS client support services.rpcbind.enable = true; # NFS mount for shared storage fileSystems."/mnt/nfs_share" = { device = "192.168.1.249:/mnt/nfs_share"; fsType = "nfs"; options = [ "nfsvers=4" "rw" "soft" "_netdev" ]; }; # Supabase CLI configuration - runs in writable directory systemd.services.supabase-cli = { enable = true; description = "Supabase CLI Service"; preStart = '' # Clean slate - remove old content but keep the directory rm -rf /var/lib/supabase/* rm -rf /var/lib/supabase/.* 2>/dev/null || true # Copy supabase directory structure from the app if [ -d ${usda-vision-app}/opt/usda-vision/supabase ]; then ${pkgs.rsync}/bin/rsync -av ${usda-vision-app}/opt/usda-vision/supabase/ /var/lib/supabase/supabase/ fi # Create necessary directories for supabase mkdir -p /var/lib/supabase/supabase/.branches chmod -R 755 /var/lib/supabase ''; serviceConfig = { WorkingDirectory = "/var/lib/supabase"; EnvironmentFile="/var/lib/usda-vision/.env"; ExecStart = "${pkgs.supabase-cli}/bin/supabase start"; ExecStop = "${pkgs.supabase-cli}/bin/supabase stop"; Type = "oneshot"; RemainAfterExit = true; User = "root"; Group = "root"; }; }; # Systemd service to manage usda-vision docker compose systemd.services.usda-vision = { description = "USDA Vision Docker Compose Stack"; after = [ "docker.service" "network-online.target" "systemd-tmpfiles-setup.service" ]; wants = [ "network-online.target" ]; wantedBy = [ "multi-user.target" ]; # Only start if .env file exists and is not empty unitConfig = { ConditionPathExists = "/var/lib/usda-vision/.env"; ConditionPathIsReadWrite = "/var/lib/usda-vision/.env"; }; preStart = '' # Copy application code to writable directory if not already present or if source is newer echo "Syncing application code to /var/lib/usda-vision..." ${pkgs.rsync}/bin/rsync -av --delete \ --checksum \ --exclude='node_modules' \ --exclude='.env' \ --exclude='__pycache__' \ --exclude='.venv' \ ${usda-vision-app}/opt/usda-vision/ /var/lib/usda-vision/ # Ensure .env file exists with defaults if empty if [ ! -s /var/lib/usda-vision/.env ]; then if [ -f ${usda-vision-app}/opt/usda-vision/.env.example ]; then echo "Copying .env.example to /var/lib/usda-vision/.env" cp ${usda-vision-app}/opt/usda-vision/.env.example /var/lib/usda-vision/.env echo "Please edit /var/lib/usda-vision/.env with your configuration" fi fi ''; serviceConfig = { Type = "oneshot"; RemainAfterExit = true; WorkingDirectory = "/var/lib/usda-vision"; User = "root"; Group = "root"; # Start: pull latest images and start containers from writable directory ExecStart = "${pkgs.docker-compose}/bin/docker-compose -f /var/lib/usda-vision/docker-compose.yml up -d --build"; # Stop: gracefully stop containers ExecStop = "${pkgs.docker-compose}/bin/docker-compose -f /var/lib/usda-vision/docker-compose.yml down"; # Reload: restart containers ExecReload = "${pkgs.bash}/bin/bash -c '${pkgs.docker-compose}/bin/docker-compose -f /var/lib/usda-vision/docker-compose.yml down && ${pkgs.docker-compose}/bin/docker-compose -f /var/lib/usda-vision/docker-compose.yml up -d --build'"; TimeoutStartSec = 300; TimeoutStopSec = 120; }; }; # Firewall configuration - open ports for USDA Vision services networking.firewall = { enable = false; allowedTCPPorts = [ # Web services 80 # HTTP 443 # HTTPS 3000 # Main web app (if exposed directly) 3001 # Vision video remote web app 3002 # Vision system remote web app 3003 # Scheduling remote web app 4000 # Analytics service web app # Supabase services 54321 # Supabase Kong (API Gateway) 54322 # Supabase PostgreSQL 54323 # Supabase Studio 54324 # Supabase Inbucket (email testing) 54327 # Supabase Analytics # USDA Vision services 8000 # Camera Management API 8025 # Mailpit (email testing) 8090 # Media API 8189 # MediaMTX API 8554 # RTSP (MediaMTX) 8889 # MediaMTX WebRTC ]; allowedUDPPorts = [ 3956 # GigE Vision Control Protocol (GVCP) ]; allowPing = true; }; # Any other usda-dash specific configuration }; }