services:
  nixos:
    image: nixos-builder:latest
    container_name: nixos-builder
    volumes:
      - .:/workspace
      - ./age.key:/etc/sops/keys/age.key:ro
      - nix_store:/nix
      - nix_cache:/root/.cache/nix
    environment:
      - NIX_CONFIG_DIR=/root/.config/nix
      - SOPS_AGE_KEY_FILE=/etc/sops/keys/age.key
      - TMPDIR=/tmp
    tmpfs:
      - /tmp
    working_dir: /workspace
    tty: true
    stdin_open: true
    profiles:
      - default
    security_opt:
      - apparmor:unconfined
    cap_add:
      - SYS_ADMIN

volumes:
  nix_store:
  nix_cache: