42 lines
1.7 KiB
Nix
42 lines
1.7 KiB
Nix
{ pkgs, ... }:
|
|
|
|
let
|
|
# nixpkgs' rootless podman ships without /etc/containers config, so short
|
|
# names (nginx:1.29-alpine) and the signature policy can't resolve. These are
|
|
# the two files podman looks for under ~/.config/containers.
|
|
registriesConf = pkgs.writeText "registries.conf" ''
|
|
unqualified-search-registries = ["docker.io"]
|
|
'';
|
|
policyJson = pkgs.writeText "policy.json" ''
|
|
{ "default": [ { "type": "insecureAcceptAnything" } ] }
|
|
'';
|
|
in
|
|
{
|
|
# Static site — no language toolchain needed, just the image build.
|
|
packages = [
|
|
# --- build & ship the image ---
|
|
pkgs.podman # `podman build -t git.0x29a.ch/aaron/website:1.0.0 .`
|
|
# # reads the Dockerfile natively; push with `podman push`.
|
|
];
|
|
|
|
enterShell = ''
|
|
# Seed rootless-podman config once, so `podman build` resolves short image
|
|
# names and finds a signature policy. Never clobbers existing user config.
|
|
conf="$HOME/.config/containers"
|
|
if [ ! -e "$conf/registries.conf" ] || [ ! -e "$conf/policy.json" ]; then
|
|
mkdir -p "$conf"
|
|
[ -e "$conf/registries.conf" ] || install -m644 ${registriesConf} "$conf/registries.conf"
|
|
[ -e "$conf/policy.json" ] || install -m644 ${policyJson} "$conf/policy.json"
|
|
echo "seeded rootless-podman config in $conf"
|
|
fi
|
|
|
|
# Persist registry logins. Rootless podman defaults to the volatile
|
|
# $XDG_RUNTIME_DIR (wiped on reboot); point it at ~/.config so a single
|
|
# `podman login git.0x29a.ch` survives reboots. The token lives in
|
|
# auth.json (base64, outside the repo) — never committed.
|
|
export REGISTRY_AUTH_FILE="$HOME/.config/containers/auth.json"
|
|
|
|
echo "website devenv ready — build: podman build -t git.0x29a.ch/aaron/website:1.0.0 ."
|
|
'';
|
|
}
|