From 871ff4e7fb4c22b2aea5cec147b091128fd50c72 Mon Sep 17 00:00:00 2001
From: Tim Keller <tjk@tjkeller.xyz>
Date: Tue, 15 Sep 2026 15:38:50 -0500
Subject: docker config + enable configs and fix bug poweredge pro

---
 hosts/poweredge-pro/configuration.nix | 27 ++++++++++++++++++++++++++-
 hosts/poweredge-pro/key.nix           |  2 +-
 2 files changed, 27 insertions(+), 2 deletions(-)

(limited to 'hosts/poweredge-pro')

diff --git a/hosts/poweredge-pro/configuration.nix b/hosts/poweredge-pro/configuration.nix
index fc6b854..53f2599 100644
--- a/hosts/poweredge-pro/configuration.nix
+++ b/hosts/poweredge-pro/configuration.nix
@@ -3,6 +3,8 @@
 		./key.nix
 		./networking.nix
 		./fileshares.nix
+		./filebrowser.nix
+		./dns.nix
 	];
 
 	# Setup bootloader
@@ -18,12 +20,35 @@
 			zfs.enable = true;
 			#cuda.enable = true;
 		};
-		collections.virtualization.enable = true;
+		collections = {
+			virtualization.enable = true;
+			development.docker.enable = true;
+		};
 	};
 
 	# Import zfs pools
 	boot.zfs.extraPools = [ "VMDisk" "Storage" ];
 
+	# Workaround for docker + libvirt bug
+	systemd.services.bridge-nf-off = {
+		description = "Keep bridged VM traffic out of the IP netfilter path";
+		after = [ "docker.service" ];
+		partOf = [ "docker.service" ];
+		wantedBy = [ "multi-user.target" "docker.service" ];
+		serviceConfig = {
+			Type = "oneshot";
+			RemainAfterExit = true;
+		};
+		script = ''
+			${pkgs.kmod}/bin/modprobe br_netfilter 2>/dev/null || true
+			for k in iptables ip6tables arptables; do
+				echo 0 > /proc/sys/net/bridge/bridge-nf-call-$k 2>/dev/null || true
+			done
+		'';
+	};
+
+	networking.firewall.checkReversePath = "loose";
+
 	# Enable user timmy
 	_users.timmy.enable = true;
 
diff --git a/hosts/poweredge-pro/key.nix b/hosts/poweredge-pro/key.nix
index f5074f2..40cd529 100644
--- a/hosts/poweredge-pro/key.nix
+++ b/hosts/poweredge-pro/key.nix
@@ -1,4 +1,4 @@
-{
+{ pkgs, ... }: {
 	# Nixos root
 	boot.initrd.systemd.enable = true;  # Default since 26.05
 	boot.initrd.supportedFilesystems.ext4 = true;
-- 
cgit v1.2.3