networking

homelab-services/postgresql-db/flake.nix

@@ -40,18 +40,28 @@
                 File containing postgresql user credentials.
                 Only the Passwords. Names of Users just follow the pattern:
                 <DB_Name>_produser
-                <DB_Name>_devuser
 
                 Password Format:
                 PSQL_<DB>_PASSWORD=password
-                PSQL_<DB>_DEV_PASSWORD=dev_password
               '';
             };
 
             databases = lib.mkOption {
               type = lib.types.listOf lib.types.str;
               default = [ ];
-              description = "list of databases to bootstrap. Will expand into DB, and DB-DEV for each item. And each Database will recieve it's own user. The user credentials must be in the correct format in the credentials file.";
+              description = ''
+                List of databases to bootstrap.
+                Each Database will recieve it's own user.
+                The user credentials must be in the correct format in the credentials file.
+              '';
+            };
+
+            ipMasks = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [ ];
+              description = ''
+                List of ipMasks that psql will accept connections from
+              '';
             };
           };
 
@@ -74,22 +84,27 @@
                 postgres roy postgres
               '';
 
-              # allow remote connections to dev databases
               authentication = pkgs.lib.mkOverride 10 ''
                 local all postgres peer map=postgres
                 local all all peer
 
-                # Dev can be connected to via the LAN or Local
+                # Prod can be connected via local machine and declared masks
-                ${lib.concatStringsSep " " (
-                  map (db: "host ${db}_dev ${db}_devuser all scram-sha-256\n") opts.databases
-                )}
-                # Prod can be connected via local machine
                 ${lib.concatStringsSep "" (
                   map (db: "host ${db} ${db}_produser 127.0.0.1/32 scram-sha-256\n") opts.databases
                 )}
                 ${lib.concatStringsSep "" (
                   map (db: "host ${db} ${db}_produser ::1/128 scram-sha-256\n") opts.databases
                 )}
+                # configurable list of subnets allowed to connect (for example k3s pods subnet)
+                # will allow connection to all declared ips. fine for now
+                ${lib.concatStringsSep "" (
+                  map (
+                    db:
+                    lib.concatStringsSep "" (
+                      map (mask: "host ${db} ${db}_produser ${opts.ipMasks} scram-sha-256\n") opts.ipMasks
+                    )
+                  ) opts.databases
+                )}
               '';
             };
 
@@ -118,19 +133,12 @@
 
                     user_val="$db"_produser
                     pass_val=$(eval "echo \''${$pass_var:-}")
-                    dev_user_val="$db"_devuser
-                    dev_pass_val=$(eval "echo \''${$dev_pass_var:-}")
 
                     if [ -z "$pass_val" ]; then
                       echo "Missing password credentials for database '$db'" >&2
                       exit 1
                     fi
 
-                    if [ -z "$dev_pass_val" ]; then
-                      echo "Missing password credentials for database '$db'_dev" >&2
-                      exit 1
-                    fi
-
                     echo "Bootstrapping PostgreSQL for database: $db"
 
                     # Create users if not exists
@@ -141,13 +149,6 @@
                       $psql_bin --port=${toString opts.port} -c "CREATE ROLE "$user_val" WITH LOGIN PASSWORD '$pass_val';"
                     fi
 
-                    if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$dev_user_val"; then
-                      echo "$dev_user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
-                    else
-                      echo "Creating $dev_user_val"
-                      $psql_bin --port=${toString opts.port} -c "CREATE ROLE "$dev_user_val" WITH LOGIN PASSWORD '$dev_pass_val';"
-                    fi
-
                     # Create databases if not exists
                     if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci ""$db" "; then
                       echo "$db already exists, skipping creation."
@@ -156,16 +157,8 @@
                       $psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db" WITH OWNER "$user_val";"
                     fi
 
-                    if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci "$db"_dev; then
-                      echo ""$db"_dev already exists, skipping creation."
-                    else
-                      echo "Creating database "$db"_dev"
-                      $psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db"_dev WITH OWNER "$dev_user_val";"
-                    fi
-
                     # Grant ownership (idempotency for weird states)
                     $psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db" OWNER TO "$user_val";"
-                    $psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db"_dev OWNER TO "$dev_user_val";"
 
                   done
                 '';

nixos/configuration.nix

@@ -67,9 +67,9 @@
     acceptTerms = true;
     defaults = {
       # use staging for testing
-      # server = "https://acme-staging-v02.api.letsencrypt.org/directory";
+      server = "https://acme-staging-v02.api.letsencrypt.org/directory";
       # use prod for deploy
-      server = "https://acme-v02.api.letsencrypt.org/directory";
+      # server = "https://acme-v02.api.letsencrypt.org/directory";
       email = "roydumblauskas@gmail.com";
       dnsProvider = "cloudflare";
       # When the service CHECKS to see if certs are near expiry (< 30 days)
@@ -112,6 +112,7 @@
 
     extraFlags = [
       "--data-dir=/var/lib/rancher/k3s"
+      "--cluster-cidr 10.42.0.0/20" # allow this subnet to connect to psql
     ];
   };
 
@@ -179,6 +180,9 @@
       "rdblog"
       "gitea"
     ];
+    ipMasks = [
+      "10.42.0.0/20" # k3s cluster mask
+    ];
   };
 
   # ================================ #

nixos/secrets/gitea.yaml

@@ -1,4 +1,4 @@
-credentials: ENC[AES256_GCM,data:ZwMVkmcjBwSsTrMpR1hmkJQs7c16dlLnQVFPbIgDzByImas0yr/ZGEacgXo6ep448f0O9Utvt8xadhHpYfmb/aIoVvINEx8gF68=,iv:l92f8YRsNXMfG8fAzQ9Q9nTKpq/5hZp6dq52B8a+TTw=,tag:h9iyQBzoJfla5VAMz8gXiA==,type:str]
+credentials: ENC[AES256_GCM,data:3F9YE18X4zRqppoVSnoiwBJPNuxbB6hlntXIiNV8yWhomVP6TRwhadSC3J3t/rqzD6TdbnweInDlU9U9JtfDM6H+MTXd5eVynG/aR4c=,iv:yjm4TU8AqcpY2mn+cl1/Ya9e5FHWsUVAkcyvmFxaLVU=,tag:lx/ACG2g0H/eoiJ6AVEbjQ==,type:str]
 sops:
     age:
         - enc: |
@@ -37,7 +37,7 @@ sops:
             o+m9XdwX6u7OaazWx7J9tWOS+O1sJoNGMpAj/K5N6OjoNGT4Lu8t+w==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    lastmodified: "2026-08-24T21:25:20Z"
+    lastmodified: "2026-09-12T19:58:39Z"
-    mac: ENC[AES256_GCM,data:8PJBKtz371YpW+cXch/6J1wDs7Vz+326jcgnAyfAQm9ugFzBR1MhjofTxKk+lRW115BSZA7tQDHYuD+1Cr7pkV0ifSfVRU4DryvLlEJogKbMSjudU7+asRLBS70rnhN7ZH8+mvOzwnvSx8vDjnaNd0ke/BZEGkUm3l2CM1+yfw4=,iv:I0ahjK7ZG7NhJPSBVVbS18yhtA6JI+JehopjCBwrRo8=,tag:B+XR+vi6h2J26DRtEAl4xA==,type:str]
+    mac: ENC[AES256_GCM,data:nWWObv95W+Ewp49Ygqrsat3yFlY15d8jcmjZusk8gCb1ollX8ulifP/SCt8GTOTQootbXpKxJc+BqBYcdR46gxMZert0ok2o9B7ks5zI7a0pH54mLDclN1ONmAyHRC0IqSfe7XSn70dgjLchjpCSjeTaylzidwBAUfKbkZtzjG8=,iv:jLqbj1XJaZNPKDNRUafxAexHeKQh9GqEeaIr+vzqGCc=,tag:QBir2cmH8M0zSjpAkQrHwQ==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3

nixos/secrets/psql.yaml

@@ -1,4 +1,4 @@
-credentials: ENC[AES256_GCM,data:DAUjS1wPVY0zNCL1OsCFLYVUwsEQk3rFeY/xj/Ny4vd1Q2019kjLqRFVGPdxISYCyogJPTT1inBu1JpuXfDHkKBB+HG4Ta5WNhVitI+FeLsTd9TQEEy+DlrdtKF+1DMOcraxBOqZvuo7P/+bEzqEl6QTMR/TfG5jBw1/6g==,iv:QCmuSh6c1177plXDKSK8NfiwC5DyZFLwsNsI2u1Wxz8=,tag:fGKQsiRAGDYs18btFFjT0A==,type:str]
+credentials: ENC[AES256_GCM,data:No2VCubcIimFbkhwnD4sGuaR5OehpxvOj5Ln7bXydTrn6RcgrgkmHYBHAMajcL13XHom4IY30fBpiNQ=,iv:0UMfuCJyuXkO1vBrH2d7UtV5qZJatdef8C8RskrlQ74=,tag:G7zcM1J1G53nH5O9X2PMoA==,type:str]
 sops:
     age:
         - enc: |
@@ -37,7 +37,7 @@ sops:
             1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
-    lastmodified: "2026-08-23T18:51:08Z"
+    lastmodified: "2026-09-12T19:58:55Z"
-    mac: ENC[AES256_GCM,data:snU9+KYMyX3+2pB9qqqlYTFAHMeNvKTzkKR2um6y/hpRMHmVVRqKjxPWS4G2zfPaEwJeEblfJMzt69a6IrnoW2wD2usrrE7uoWSMkO3a/iN2cFlcdSHQ8wWfzMoBl26d4a7Bs4xOIn4ynvA4UwGM3PbjSMUwsi5qteKDBwwkGcg=,iv:UHqCHEYdBe92dgon+8x5Zg9xmMOsi2coxwkQOV6Q/3o=,tag:fpoL/F/XedlT+jw2pQb3Ig==,type:str]
+    mac: ENC[AES256_GCM,data:zplquNejJ1M8dBYF7h2yPmHzO2gFDPr3VFCLEszJE/0LxBQmon0/IaOUrvbShIgkOh7eq06vrNSpp42/r37sv1Uoy4j/E0OLCtB8NYEsP5aW5joSKJZlzdQJUEbB38Zf7vM7FFNKBYeAtJflhbI/A3qyq7Xs4qTKWj8IJY4nx78=,iv:fQJfqsQcUVPB/Q6HxdG8gM1IDTvjQniIqDs+dFvGt7o=,tag:eTllYOsgCtCsQCBxr3pbpw==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.13.3