podman: install package and create config files

Co-authored-by: Dylan Wilson <[email protected]>

modules/services/podman-linux/default.nix

@@ -1,17 +1,99 @@
 { config, pkgs, lib, ... }:
-
-{
+let
+  cfg = config.services.podman;
+  toml = pkgs.formats.toml { };
+in {
   meta.maintainers = with lib.hm.maintainers; [ bamhm182 n-hass ];
 
   imports =
     [ ./containers.nix ./install-quadlet.nix ./networks.nix ./services.nix ];
 
   options.services.podman = {
     enable = lib.mkEnableOption "Podman, a daemonless container engine";
+
+    settings = {
+      containers = lib.mkOption {
+        type = toml.type;
+        default = { };
+        description = "containers.conf configuration";
+      };
+
+      storage = lib.mkOption {
+        type = toml.type;
+        description = "storage.conf configuration";
+      };
+
+      registries = {
+        search = lib.mkOption {
+          type = lib.types.listOf lib.types.str;
+          default = [ "docker.io" ];
+          description = ''
+            List of repositories to search.
+          '';
+        };
+
+        insecure = lib.mkOption {
+          default = [ ];
+          type = lib.types.listOf lib.types.str;
+          description = ''
+            List of insecure repositories.
+          '';
+        };
+
+        block = lib.mkOption {
+          default = [ ];
+          type = lib.types.listOf lib.types.str;
+          description = ''
+            List of blocked repositories.
+          '';
+        };
+      };
+
+      policy = lib.mkOption {
+        default = { };
+        type = lib.types.attrs;
+        example = lib.literalExpression ''
+          {
+            default = [ { type = "insecureAcceptAnything"; } ];
+            transports = {
+              docker-daemon = {
+                "" = [ { type = "insecureAcceptAnything"; } ];
+              };
+            };
+          }
+        '';
+        description = ''
+          Signature verification policy file.
+          If this option is empty the default policy file from
+          `skopeo` will be used.
+        '';
+      };
+    };
   };
 
-  config = lib.mkIf config.services.podman.enable {
+  config = lib.mkIf cfg.enable {
     assertions =
       [ (lib.hm.assertions.assertPlatform "podman" pkgs lib.platforms.linux) ];
+
+    home.packages = [ cfg.package ];
+
+    services.podman.settings.storage = {
+      storage.driver = lib.mkDefault "overlay";
+    };
+
+    xdg.configFile = {
+      "containers/policy.json".source = if cfg.settings.policy != { } then
+        pkgs.writeText "policy.json" (builtins.toJSON cfg.settings.policy)
+      else
+        "${pkgs.skopeo.policy}/default-policy.json";
+      "containers/registries.conf".source = toml.generate "registries.conf" {
+        registries =
+          lib.mapAttrs (n: v: { registries = v; }) cfg.settings.registries;
+      };
+      "containers/storage.conf".source =
+        toml.generate "storage.conf" cfg.settings.storage;
+      "containers/containers.conf".source =
+        toml.generate "containers.conf" cfg.settings.containers;
+    };
   };
 }

tests/modules/services/podman-linux/configuration-containers-expected.conf

@@ -0,0 +1,10 @@
+[network]
+default_subnet = "172.16.10.0/24"
+
+[[network.default_subnet_pools]]
+base = "172.16.11.0/24"
+size = 24
+
+[[network.default_subnet_pools]]
+base = "172.16.12.0/24"
+size = 24

tests/modules/services/podman-linux/configuration-policy-expected.json

@@ -0,0 +1 @@
+{"default":[{"type":"insecureAcceptAnything"}]}

tests/modules/services/podman-linux/configuration-registries-expected.conf

@@ -0,0 +1,8 @@
+[registries.block]
+registries = ["ghcr.io", "gallery.ecr.aws"]
+
+[registries.insecure]
+registries = ["quay.io"]
+
+[registries.search]
+registries = ["docker.io"]

tests/modules/services/podman-linux/configuration-storage-expected.conf

@@ -0,0 +1,4 @@
+[storage]
+driver = "overlay"
+graphroot = "$HOME/.containers/graphroot"
+runroot = "$HOME/.containers/runroot"

tests/modules/services/podman-linux/configuration.nix

@@ -0,0 +1,63 @@
+{ ... }:
+
+{
+  services.podman = {
+    enable = true;
+    settings = {
+      containers = {
+        network = {
+          default_subnet = "172.16.10.0/24";
+          default_subnet_pools = [
+            {
+              base = "172.16.11.0/24";
+              size = 24;
+            }
+            {
+              base = "172.16.12.0/24";
+              size = 24;
+            }
+          ];
+        };
+      };
+      storage = {
+        storage = {
+          runroot = "$HOME/.containers/runroot";
+          graphroot = "$HOME/.containers/graphroot";
+        };
+      };
+      registries = {
+        block = [ "ghcr.io" "gallery.ecr.aws" ];
+        insecure = [ "quay.io" ];
+        search = [ "docker.io" ];
+      };
+      policy = { default = [{ type = "insecureAcceptAnything"; }]; };
+    };
+  };
+
+  nmt.script = ''
+    configPath=home-files/.config/containers
+    containersFile=$configPath/containers.conf
+    policyFile=$configPath/policy.json
+    registriesFile=$configPath/registries.conf
+    storageFile=$configPath/storage.conf
+
+    assertFileExists $containersFile
+    assertFileExists $policyFile
+    assertFileExists $registriesFile
+    assertFileExists $storageFile
+
+    containersFile=$(normalizeStorePaths $containersFile)
+    policyFile=$(normalizeStorePaths $policyFile)
+    registriesFile=$(normalizeStorePaths $registriesFile)
+    storageFile=$(normalizeStorePaths $storageFile)
+
+    assertFileContent $containersFile ${
+      ./configuration-containers-expected.conf
+    }
+    assertFileContent $policyFile ${./configuration-policy-expected.json}
+    assertFileContent $registriesFile ${
+      ./configuration-registries-expected.conf
+    }
+    assertFileContent $storageFile ${./configuration-storage-expected.conf}
+  '';
+}

tests/modules/services/podman-linux/default.nix

@@ -1,4 +1,5 @@
 {
+  podman-configuration = ./configuration.nix;
   podman-container = ./container.nix;
   podman-integration = ./integration.nix;
   podman-manifest = ./manifest.nix;