Yeah it works great and is very secure but every time I create a new service it’s a lot of copy paste boilerplate, maybe I’ll put most of that into a nix function at some point but until then here’s an example n8n config, as loaded from the main nixos file.
Gaze into the boilerplate
{ config, pkgs, lib, … }: { users.users.n8n = { # calculate sub{u,g}id using uid subUidRanges = [{ startUid = 100000+65536*( config.users.users.n8n.uid - 999); count = 65536; }]; subGidRanges = [{ startGid = 100000+65536*( config.users.users.n8n.uid - 999); count = 65536; }]; isNormalUser = true; linger = true; # start user services on system start, fist time start after nixos-switch still has to be done manually for some reason though openssh.authorizedKeys.keys = config.users.users.root.openssh.authorizedKeys.keys; # allows the ssh keys that can login as root to login as this user too }; home-manager.users.n8n = { pkgs, … }: let dir = config.users.users.n8n.home; data-dir = “${dir}/${config.users.users.n8n.name}-data”; # defines the path “/home/n8n/n8n-data” using evaluated home paths, could probably remove a lot of redundant n8n definitions… in { home.stateVersion = “24.11”; systemd.user.tmpfiles.rules = let folders = [ “${data-dir}” #“${data-dir}/data-volume-name-one” ]; formated_folders = map (folder: “d ${folder} - - - -”) folders; # a function that takes a path string and formats it for systemd tmpfiles such that they get created as folders in formated_folders; services.podman = { enable = true; containers = { n8n-app = { # define a container, service name is “podman-n8n-app.service” in case you need to make multiple containers depend and run after each other image = “docker.n8n.io/n8nio/n8n”; ports = [ “${config.local.users.users.n8n.listenIp}:${toString config.local.users.users.n8n.listenPort}:5678” # I’m using a self defined option to keep track of all ports and uids in a seperate file, these values just map to “127.0.0.1:30023:5678”, a caddy does a reverse proxy there with the same option as the port. ]; volumes = [ “${data-dir}:/home/node/.n8n” # the folder we created above ]; userNS = “keep-id:uid=1000,gid=1000”; # n8n stores files as non-root inside the container so they end up as some high uid outside and the user which runs these containers can’t read it because of that. This maps the user 1000 inside the container to the uid of the user that’s running podman. Takes a lot of time to generate the podman image for a first run though so make sure systemd doesn’t time out environment = { # MYHORSE = “amazing”; }; # there’s also an environmentfile option for secret management, which works with sops if you set the owner of the secret/secret template extraPodmanArgs = [ “–pull=newer” # always pull newer images when starting, I could make this declaritive but I haven’t found a good way to automagically update the container hashes in my nix config at the push of a button. ]; # few more options exist that I didn’t need here }; }; }; }; }
=> More informations about this toot | View the thread | More toots from InnerScientist@lemmy.world
=> View agile_squirrel@lemmy.ml profile
text/geminiThis content has been proxied by September (ba2dc).