Add Docker 29 for nftables, clean-up daemon options

Signed-off-by: Mel <mel@rnrd.eu>

2 files changed, 28 insertions, 19 deletions

diff --git a/modules/common.nix b/modules/common.nix
index 9ad59aa..5766037 100644
--- a/modules/common.nix
+++ b/modules/common.nix
@@ -13,7 +13,7 @@
   ];
 
   boot.kernelPackages = pkgs.linuxPackages_latest;
-  
+
   # fish enables this by default,
   # it makes every nixos rebuild very slow.
   documentation.man.generateCaches = false;
@@ -49,22 +49,44 @@
   };
 
   boot.kernel.sysctl = {
+    # turn all of the ip forwarding on
     "net.ipv4.ip_forward" = lib.mkDefault 1;
+    "net.ipv6.conf.all.forwarding" = lib.mkDefault 1;
+    "net.ipv6.conf.default.forwarding" = lib.mkDefault 1;
   };
 
   services.envfs.enable = true;
 
   virtualisation = {
+    oci-containers.backend = "docker";
+    # we need these settings to allow our networks to be ipv6-enabled and
+    # to make docker support nftables directly without any compat layers.
+    # we also ignore the default bridge, because it's setup
+    # is a lot more complicated...
     docker = {
       enable = true;
       autoPrune.enable = true;
 
+      # required to support nftables natively.
+      # see: https://docs.docker.com/engine/network/firewall-nftables
+      package = pkgs.docker_29;
+      extraPackages = [ pkgs.nftables ];
+
       daemon.settings = {
-        metrics-addr = "${me.tailscale.ip}:9323";
+        "metrics-addr" = "${me.tailscale.ip}:9323";
+
+        # ipv6 support
+        "ipv6" = true;
+        "ip6tables" = true;
+
+        # nftables options
+        "experimental" = true;
+        "ip-forward" = true;
+        "firewall-backend" = "nftables";
       };
     };
-    oci-containers.backend = "docker";
   };
+  systemd.services.docker.path = [ pkgs.nftables ]; # add nft tool into docker
 
   services = {
     openssh = {
diff --git a/modules/foundation/services/networks.nix b/modules/foundation/services/networks.nix
index b5f1732..00a4045 100644
--- a/modules/foundation/services/networks.nix
+++ b/modules/foundation/services/networks.nix
@@ -183,22 +183,9 @@ in
       assert assertMsg (defaultsCount != 0) "no default service network";
       builtins.head networksLabeledDefault;
 
-    # we need these settings to allow our networks to be IPv6-enabled.
-    # we also ignore the default bridge, because it's setup
-    # is a lot more complicated...
     virtualisation.docker.daemon.settings = {
-      experimental = true;
-      ipv6 = true;
-      ip6tables = true;
-      "ip-forward" = true;
-      "firewall-backend" = "nftables";
-      fixed-cidr-v6 = "${cfg.defaultIPv6SubnetPrefix}:255::/${toString cfg.defaultIPv6SubnetLength}";
-    };
-
-    # turn these ipv6 forwarding on, if it isn't already.
-    boot.kernel.sysctl = {
-      "net.ipv6.conf.all.forwarding" = lib.mkDefault 1;
-      "net.ipv6.conf.default.forwarding" = lib.mkDefault 1;
+      # a feeble attempt at making the default bridge support ipv6...
+      "fixed-cidr-v6" = "${cfg.defaultIPv6SubnetPrefix}:255::/${toString cfg.defaultIPv6SubnetLength}";
     };
 
     networking.firewall = {
@@ -223,7 +210,7 @@ in
               serviceGroup
               ;
 
-            docker = getExe pkgs.docker;
+            docker = lib.getExe config.virtualisation.docker.package;
 
             subnet = if ipv6.subnet == null then subnetByIndex index else ipv6.subnet;
             gateway = if ipv6.gateway == null then gatewayByIndex index else ipv6.gateway;