Main

Modules/System/Application/cli/docker.nix

@@ -1,3 +1,21 @@
+# Docker (System Module)
+#
+# Provides:
+#   - Docker runtime and CLI
+#   - Docker Compose
+#   - User access via `docker` group
+#   - Optional rootless mode and cgroup v2 support
+#
+# Options:
+#   - enable       → Enable Docker system module
+#   - username     → User to add to the docker group
+#   - enableOnBoot → Start Docker service on boot (default: true)
+#   - rootless     → Enable Docker rootless mode (disabled by default)
+#
+# Notes:
+#   - Rootless mode is disabled by default
+#   - Uses cgroup v2 for better resource management on modern kernels
+
 { config, lib, pkgs, ... }:
 
 let
@@ -5,16 +23,46 @@ let
 in
 {
   options.nyx-module.system.docker = {
-    enable = lib.mkEnableOption "Enable docker (system) module";
+    enable = lib.mkEnableOption "Enable Docker (system module)";
 
-    package = lib.mkOption {
-      type = lib.types.package;
-      default = pkgs.docker;
-      description = "Package to install for docker.";
+    username = lib.mkOption {
+      type = lib.types.str;
+      example = "alice";
+      description = "User to add to the docker group.";
     };
+
+    enableOnBoot = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = "Whether to enable Docker service on boot.";
+    };
+
+    rootless = lib.mkEnableOption "Enable rootless Docker mode";
   };
 
   config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ cfg.package ];
+    virtualisation.docker = {
+      enable = true;
+      enableOnBoot = cfg.enableOnBoot;
+      rootless.enable = cfg.rootless;
+    };
+
+    users.users.${cfg.username}.extraGroups = [ "docker" ];
+
+    environment.systemPackages = with pkgs; [
+      docker
+      docker-compose
+    ];
+
+    # Optional: Docker cgroup v2 (usually enabled by default in modern NixOS)
+    boot.kernelParams = [ "cgroup_enable=memory" "cgroup_memory=1" ];
+
+
+    assertions = [
+      {
+        assertion = cfg.username != "";
+        message = "nyx-module.system.docker.username must be set to a valid user.";
+      }
+    ];
   };
 }