From f68b245d920cb36c3e73032875543aad17967c3d Mon Sep 17 00:00:00 2001 From: Bernardo Magri Date: Tue, 16 Jun 2026 17:15:45 +0100 Subject: [PATCH] feat(services): add podman, flatpak (+ Flathub) and pika backup Extend nomarchy.services.* with three more opt-in toggles: - podman: rootless containers, `docker` aliased to it, container DNS, and a subuid/subgid range for the login user. - flatpak: services.flatpak + a oneshot that adds the Flathub remote system-wide (idempotent, retries when online). - pika: ships pika-backup, the GUI for scheduled Borg backups. Commented examples in the downstream system.nix template, per convention. Co-Authored-By: Claude Opus 4.8 --- README.md | 3 ++ docs/ROADMAP.md | 20 +++++++----- modules/nixos/services.nix | 54 ++++++++++++++++++++++++++++++--- templates/downstream/system.nix | 3 ++ 4 files changed, 67 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index b243e28..0f43b86 100644 --- a/README.md +++ b/README.md @@ -221,6 +221,9 @@ examples: **[docs/OVERRIDES.md](docs/OVERRIDES.md)**. | `nomarchy.system.power.batteryChargeLimit` | `null` | Stop charging at this % (e.g. `80`) where the hardware supports it; needs `power.laptop` | | `nomarchy.services.tailscale.enable` | `false` | Opt-in: Tailscale mesh VPN (then `sudo tailscale up`) | | `nomarchy.services.syncthing.enable` | `false` | Opt-in: Syncthing file sync as the login user (GUI at `127.0.0.1:8384`) | +| `nomarchy.services.podman.enable` | `false` | Opt-in: rootless Podman (`docker` aliased to it) | +| `nomarchy.services.flatpak.enable` | `false` | Opt-in: Flatpak + the Flathub remote | +| `nomarchy.services.pika.enable` | `false` | Opt-in: Pika Backup (GUI Borg backups) | Beyond the `nomarchy.*` surface, the system layer turns on the usual desktop services with `lib.mkDefault` (override natively). One worth diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md index eaef340..bd9dab2 100644 --- a/docs/ROADMAP.md +++ b/docs/ROADMAP.md @@ -261,21 +261,25 @@ how to override it. Items marked ✓ are shipped. application suite above — heavier or more personal integrations shipped **off by default**, each a `nomarchy.services..enable` toggle a downstream flips on in one line. Keeps the base lean while making common - additions trivial. **✓ First two shipped** — `nomarchy.services.tailscale` - and `nomarchy.services.syncthing` (`modules/nixos/services.nix`, system-side; - Syncthing runs as the login user with its GUI on 127.0.0.1:8384), with - commented examples in the downstream `system.nix` template. More candidates - by area: + additions trivial. **✓ Five shipped** in `modules/nixos/services.nix` + (system-side), each with a commented example in the downstream `system.nix` + template: `tailscale`, `syncthing` (runs as the login user, GUI on + 127.0.0.1:8384), `podman` (rootless, `docker` aliased, user subuid/subgid), + `flatpak` (+ Flathub remote added by a oneshot), `pika` (Pika Backup GUI). + More candidates by area: - ✓ **cloud/sync:** Syncthing (`services.syncthing`); Nextcloud client (todo) - **local AI:** LM Studio (`lmstudio`); Ollama (`services.ollama`, optional GPU accel) — pairs with the menu's Ask-Claude philosophy - - **containers/VMs:** Docker/Podman; libvirt + virt-manager + - ✓ **containers/VMs:** Podman (`virtualisation.podman`); Docker / libvirt + + virt-manager (todo) - ✓ **networking:** Tailscale (`services.tailscale`); WireGuard (todo) - **gaming/media:** Steam (`programs.steam`); OBS Studio - **devices:** printing (CUPS + Avahi); KDE Connect / phone integration; OpenRGB - - **backup:** restic/borg (`services.restic`) - - **escape hatch:** Flatpak (`services.flatpak`) for apps outside nixpkgs + - ✓ **backup:** Pika Backup (`pika-backup`, GUI over Borg); restic/borg + services (todo) + - ✓ **escape hatch:** Flatpak (`services.flatpak`) + Flathub, for apps + outside nixpkgs Surface decided: `nomarchy.services.*`, system-side for system services (home-side ones can extend the same prefix later). Remaining: curate the diff --git a/modules/nixos/services.nix b/modules/nixos/services.nix index 739dcdf..9526a0e 100644 --- a/modules/nixos/services.nix +++ b/modules/nixos/services.nix @@ -1,10 +1,9 @@ # Opt-in services & integrations — off by default, one toggle each, enabled # in system.nix (see the commented examples in the downstream template). -# These are system services: Tailscale is system-only, and Syncthing runs as -# the login user. Their own `nomarchy.services.*` namespace, distinct from the -# distro's core `nomarchy.system.*` toggles. `username` (from specialArgs) is -# read lazily, only when Syncthing is enabled. -{ config, lib, ... }@args: +# These are system-side: their own `nomarchy.services.*` namespace, distinct +# from the distro's core `nomarchy.system.*` toggles. `username` (from +# specialArgs) is read lazily, only where a service needs it. +{ config, lib, pkgs, ... }@args: let cfg = config.nomarchy.services; @@ -18,6 +17,18 @@ in syncthing.enable = lib.mkEnableOption '' Syncthing continuous file sync, running as the login user — add folders and devices in the web UI at http://127.0.0.1:8384''; + + podman.enable = lib.mkEnableOption '' + Podman for rootless containers, with `docker` aliased to it and DNS on + the default network; the login user gets a subuid/subgid range''; + + flatpak.enable = lib.mkEnableOption '' + Flatpak, with the Flathub remote added system-wide — install apps with + `flatpak install flathub `''; + + pika.enable = lib.mkEnableOption '' + Pika Backup, a friendly GUI for scheduled Borg backups (the app; + configure repositories and schedules inside it)''; }; config = lib.mkMerge [ @@ -36,5 +47,38 @@ in guiAddress = "127.0.0.1:8384"; }; }) + + (lib.mkIf cfg.podman.enable { + virtualisation.podman = { + enable = true; + dockerCompat = lib.mkDefault true; # `docker` → podman (off if you run real docker) + defaultNetwork.settings.dns_enabled = true; # DNS for rootless containers + }; + # Rootless podman needs a subuid/subgid range for the user. + users.users.${args.username}.autoSubUidGidRange = lib.mkDefault true; + }) + + (lib.mkIf cfg.flatpak.enable { + services.flatpak.enable = true; + # Flatpak ships no remotes; add Flathub system-wide. Idempotent + # (--if-not-exists), and it reads the .flatpakrepo over the network, so + # it waits for connectivity and simply retries next boot if offline. + systemd.services.nomarchy-flathub = { + description = "Add the Flathub Flatpak remote"; + wantedBy = [ "multi-user.target" ]; + wants = [ "network-online.target" ]; + after = [ "network-online.target" ]; + path = [ pkgs.flatpak ]; + serviceConfig.Type = "oneshot"; + script = '' + flatpak remote-add --system --if-not-exists flathub \ + https://dl.flathub.org/repo/flathub.flatpakrepo + ''; + }; + }) + + (lib.mkIf cfg.pika.enable { + environment.systemPackages = [ pkgs.pika-backup ]; + }) ]; } diff --git a/templates/downstream/system.nix b/templates/downstream/system.nix index 04206cf..38b6ea6 100644 --- a/templates/downstream/system.nix +++ b/templates/downstream/system.nix @@ -33,6 +33,9 @@ # # nomarchy.services.tailscale.enable = true; # mesh VPN — then `sudo tailscale up` # nomarchy.services.syncthing.enable = true; # file sync — GUI at http://127.0.0.1:8384 + # nomarchy.services.podman.enable = true; # rootless containers (docker → podman) + # nomarchy.services.flatpak.enable = true; # Flatpak + the Flathub remote + # nomarchy.services.pika.enable = true; # Pika Backup (GUI Borg backups) system.stateVersion = "26.05"; }