1 files changed, 37 insertions, 4 deletions
diff --git a/modules/foundation/services.nix b/modules/foundation/services.nix
index 5acb0c6..bedceb1 100644
--- a/modules/foundation/services.nix
+++ b/modules/foundation/services.nix
@@ -38,6 +38,16 @@ let
         default = [ ];
       };
 
+      devices = mkOption {
+        type = with types; listOf str;
+        default = [ ];
+      };
+
+      capabilities = mkOption {
+        type = with types; listOf str;
+        default = [ ];
+      };
+
       entrypoint = mkOption {
         type = types.nullOr types.str;
         default = null;
@@ -62,6 +72,11 @@ let
         type = types.listOf types.path;
         default = [ ];
       };
+
+      customNetwork = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+      };
     };
   };
 
@@ -178,11 +193,15 @@ in
             image,
             ports,
             volumes,
+            devices,
+            capabilities,
             entrypoint ? null,
             cmd ? null,
             workdir ? null,
             environment ? null,
             environmentFiles ? null,
+            customNetwork ? null,
+
             group,
             ...
           }:
@@ -196,10 +215,24 @@ in
               ;
             ports = map mkOciPort ports;
             volumes = map mkOciVolume volumes;
-            extraOptions = lib.mkIf (group != "") [
-              "--network-alias=${name}"
-              "--network=${group}"
-            ];
+
+            extraOptions = let
+              mapOptions = optionName: values:
+                map (v: "--${optionName}=${v}") values;
+
+              networkOptions =
+                if customNetwork != null then [
+                  "--network=${customNetwork}"
+                ] else if group != "" then [
+                  "--network-alias=${name}"
+                  "--network=${group}"
+                ] else [];
+
+              capabilityOptions = mapOptions "cap-add" capabilities;
+
+              deviceOptions = mapOptions "device" devices;
+            in
+            networkOptions ++ capabilityOptions ++ deviceOptions;
           }
           // (mkImage {
             oldImage = fullImage;