try cdi

hosts/artemis/homebrew.nix

@@ -44,6 +44,7 @@
     casks = [
       "steam"
       "discord"
+      "discord@canary"
       "Sikarugir-App/sikarugir/sikarugir"
       "zen"
       "python"

modules/k3s/default.nix

@@ -22,6 +22,25 @@ in
 
     boot.kernelModules = [ "fuse" ];
     programs.fuse.userAllowOther = true;
+    environment.etc."cdi/fuse.json".text = builtins.toJSON {
+      cdiVersion = "1.1.0";
+      kind = "cdi.nyxerinys.dev/fuse";
+      devices = [
+        {
+          name = "rw";
+          containerEdits = {
+            deviceNodes = [
+              {
+                path = "/dev/fuse";
+                type = "c";
+                fileMode = 438;
+                permissions = "rw";
+              }
+            ];
+          };
+        }
+      ];
+    };
 
     networking.firewall.allowedTCPPorts = [
       6443 # k3s, api server

modules/k3s/deployments/storage-combo.nix

@@ -26,29 +26,30 @@
                     containerPort = 2222; 
                   }
                 ];
-                volumeMounts = [
-                  {
-                    name = "fuse-device";
-                    mountPath = "/dev/fuse";
-                  }
-                ];
+                # volumeMounts = [
+                #   {
+                #     name = "fuse-device";
+                #     mountPath = "/dev/fuse";
+                #   }
+                # ];
+                resources.requests."cdi.k8s.io/cdi.nyxerinys.dev_fuse" = "1";
                 securityContext = {
                   capabilities.add = ["SYS_ADMIN"];
-                  privileged = false;
-                  runAsUser = 0;
-                  runAsGroup = 0;
-                };
-              }
-            ];
-            volumes = [
-              {
-                name = "fuse-device";
-                hostPath = {
-                  path = "/dev/fuse";
-                  type = "CharDevice";
+                  # privileged = false;
+                  # runAsUser = 0;
+                  # runAsGroup = 0;
                 };
               }
             ];
+            # volumes = [
+            #   {
+            #     name = "fuse-device";
+            #     hostPath = {
+            #       path = "/dev/fuse";
+            #       type = "CharDevice";
+            #     };
+            #   }
+            # ];
           };
         };
       };

modules/k3s/images/rsshfs-server.nix

@@ -26,8 +26,8 @@ let
     KbdInteractiveAuthentication no
     PubkeyAuthentication no
 
-    PermitRootLogin yes
-    AllowUsers root
+    PermitRootLogin no
+    AllowUsers dev
 
     AllowTcpForwarding yes
     X11Forwarding no
@@ -81,7 +81,7 @@ pkgs.dockerTools.buildLayeredImage {
     mkdir -p ./var/empty
     chmod 755 ./var/empty
     
-    mkdir -p ./home/dev/.ssh
+    mkdir -p ./home/dev/
     chown -R 1000:1000 ./home/dev
 
     mkdir -p ./containers