Add Docker 29 for nftables, clean-up daemon options

Signed-off-by: Mel <mel@rnrd.eu>

1 files changed, 3 insertions, 16 deletions

diff --git a/modules/foundation/services/networks.nix b/modules/foundation/services/networks.nix
index b5f1732..00a4045 100644
--- a/modules/foundation/services/networks.nix
+++ b/modules/foundation/services/networks.nix
@@ -183,22 +183,9 @@ in
       assert assertMsg (defaultsCount != 0) "no default service network";
       builtins.head networksLabeledDefault;
 
-    # we need these settings to allow our networks to be IPv6-enabled.
-    # we also ignore the default bridge, because it's setup
-    # is a lot more complicated...
     virtualisation.docker.daemon.settings = {
-      experimental = true;
-      ipv6 = true;
-      ip6tables = true;
-      "ip-forward" = true;
-      "firewall-backend" = "nftables";
-      fixed-cidr-v6 = "${cfg.defaultIPv6SubnetPrefix}:255::/${toString cfg.defaultIPv6SubnetLength}";
-    };
-
-    # turn these ipv6 forwarding on, if it isn't already.
-    boot.kernel.sysctl = {
-      "net.ipv6.conf.all.forwarding" = lib.mkDefault 1;
-      "net.ipv6.conf.default.forwarding" = lib.mkDefault 1;
+      # a feeble attempt at making the default bridge support ipv6...
+      "fixed-cidr-v6" = "${cfg.defaultIPv6SubnetPrefix}:255::/${toString cfg.defaultIPv6SubnetLength}";
     };
 
     networking.firewall = {
@@ -223,7 +210,7 @@ in
               serviceGroup
               ;
 
-            docker = getExe pkgs.docker;
+            docker = lib.getExe config.virtualisation.docker.package;
 
             subnet = if ipv6.subnet == null then subnetByIndex index else ipv6.subnet;
             gateway = if ipv6.gateway == null then gatewayByIndex index else ipv6.gateway;