nixos-config/modules/nixos/virtualisation/oci-containers/networks.nix

{ config, lib, options, pkgs, ... }:

let
  cfg = config.virtualisation.oci-containers;
  inherit (lib) escapeShellArg;

  networkVolume = { config, lib, ... }: {
    options = {
      labels = lib.mkOption {
        type = with lib.types; attrsOf str;
        default = { };
        description = ''
          A list of labels to be attached to the network at runtime.
        '';
        example = {
          "foo" = "baz";
        };
      };

      ipv6 = lib.mkOption {
        type = lib.types.bool;
        default = true;
        description = "Enable IPv6 networking";
        example = false;
      };

      extraOptions = lib.mkOption {
        type = with lib.types; listOf str;
        description = ''
          A list of extra arguments to be passed to {command}`${options.virtualisation.oci-containers.backend.default} run`.
        '';
        default = [ ];
      };

      preRunExtraOptions = lib.mkOption {
        type = with lib.types; listOf str;
        description = ''
          A list of extra arguments to be passed to {command}`${options.virtualisation.oci-containers.backend.default}`.
        '';
        default = [ ];
      };
    };

    config.extraOptions =
      lib.optionals config.ipv6 [ "--ipv6" ]
      ++ lib.mapAttrsToList (name: value: "--label ${name}=${value}") config.labels;
  };

  mkService = name: value: let
    removeScript =
      if cfg.backend == "podman"
      then "podman network rm --force ${name}"
      else "${cfg.backend} network rm -f ${name}";

    preStartScript = pkgs.writeShellScript "pre-start-oci-container-network-${name}" ''
      ${removeScript}
    '';
  in {
    path =
      if cfg.backend == "docker" then [ config.virtualisation.docker.package ]
      else if cfg.backend == "podman" then [ config.virtualisation.podman.package ]
      else throw "Unhandled backend: ${cfg.backend}";
    script = lib.concatStringsSep "  \\\n  " ([
      "exec ${cfg.backend} "
    ] ++ (map escapeShellArg value.preRunExtraOptions) ++ [
      "network create"
    ] ++ (map escapeShellArg value.extraOptions) ++ [
      name
    ]);
    postStop = removeScript;

    serviceConfig = {
      ExecStartPre = [ preStartScript ];
      Type = "oneshot";
      RemainAfterExit = true;
    };

    before = [ "multi-user.target" ];
    wantedBy = [ "multi-user.target" ];
  };
in
{
  options.virtualisation.oci-containers.networks = lib.mkOption {
    type = with lib.types; attrsOf (submodule networkVolume);
    description = ''
      A set of networks to be created into the container engine at runtime.
    '';
    default = { };
    example = {
      penpot = { };
      foo.labels = { "bar" = "baz"; };
    };
  };

  config = lib.mkIf (cfg.networks != { }) {
    systemd.services = lib.mapAttrs' (n: v: lib.nameValuePair "${cfg.backend}-network-${n}" (mkService n v)) cfg.networks;
  };
}