Add Docker 29 for nftables, clean-up daemon options

Signed-off-by: Mel <mel@rnrd.eu>

1 files changed, 25 insertions, 3 deletions

diff --git a/modules/common.nix b/modules/common.nix
index 9ad59aa..5766037 100644
--- a/modules/common.nix
+++ b/modules/common.nix
@@ -13,7 +13,7 @@
   ];
 
   boot.kernelPackages = pkgs.linuxPackages_latest;
-  
+
   # fish enables this by default,
   # it makes every nixos rebuild very slow.
   documentation.man.generateCaches = false;
@@ -49,22 +49,44 @@
   };
 
   boot.kernel.sysctl = {
+    # turn all of the ip forwarding on
     "net.ipv4.ip_forward" = lib.mkDefault 1;
+    "net.ipv6.conf.all.forwarding" = lib.mkDefault 1;
+    "net.ipv6.conf.default.forwarding" = lib.mkDefault 1;
   };
 
   services.envfs.enable = true;
 
   virtualisation = {
+    oci-containers.backend = "docker";
+    # we need these settings to allow our networks to be ipv6-enabled and
+    # to make docker support nftables directly without any compat layers.
+    # we also ignore the default bridge, because it's setup
+    # is a lot more complicated...
     docker = {
       enable = true;
       autoPrune.enable = true;
 
+      # required to support nftables natively.
+      # see: https://docs.docker.com/engine/network/firewall-nftables
+      package = pkgs.docker_29;
+      extraPackages = [ pkgs.nftables ];
+
       daemon.settings = {
-        metrics-addr = "${me.tailscale.ip}:9323";
+        "metrics-addr" = "${me.tailscale.ip}:9323";
+
+        # ipv6 support
+        "ipv6" = true;
+        "ip6tables" = true;
+
+        # nftables options
+        "experimental" = true;
+        "ip-forward" = true;
+        "firewall-backend" = "nftables";
       };
     };
-    oci-containers.backend = "docker";
   };
+  systemd.services.docker.path = [ pkgs.nftables ]; # add nft tool into docker
 
   services = {
     openssh = {