Manage data-access container declaratively

containers/data-access/config.nix

@@ -0,0 +1,23 @@
+{ pkgs, ... }: {
+
+  imports = [
+    ./config.secret.nix
+  ];
+
+  users.users.data = {
+    isNormalUser = true;
+    home = "/home/data";
+    description = "Data Access";
+    uid = 1000;
+    group = "users";
+  };
+  services.openssh = {
+    enable = true;
+    passwordAuthentication = false;
+    permitRootLogin = "no";
+    hostKeys = [
+      { bits = 4096; path = "/var/secrets/ssh_host_rsa_key"; type = "rsa"; }
+      { path = "/var/secrets/ssh_host_ed25519_key"; type = "ed25519"; }
+    ];
+  };
+}

containers/data-access/default.nix

@@ -0,0 +1,30 @@
+{ config, ... }:
+
+{
+  imports = [ ./secret.nix ];
+
+  config = {
+    chvp.hasContainers = true;
+
+    containers.data-access = {
+      ephemeral = true;
+      autoStart = true;
+      bindMounts = {
+        "/home/data/data" = {
+          hostPath = "/srv/data";
+          isReadOnly = false;
+        };
+        "/var/secrets" = {
+          hostPath = "${config.chvp.dataPrefix}/var/secrets/data-access";
+          isReadOnly = true;
+        };
+      };
+      privateNetwork = true;
+      hostAddress = "192.168.100.10";
+      hostAddress6 = "fc00::1";
+      localAddress = "192.168.100.11";
+      localAddress6 = "fc00::2";
+      config = import ./config.nix;
+    };
+  };
+}