RoyDumblauskas/homelab-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

networking

Browse Source
This commit is contained in:
RoyDumblauskas
2026-09-12 15:02:09 -05:00
parent 5cd487ce65
commit 2569083817
4 changed files with 38 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files
homelab-services/postgresql-db/flake.nix
+26 -33
View File
@@ -40,18 +40,28 @@
File containing postgresql user credentials.
Only the Passwords. Names of Users just follow the pattern:
<DB_Name>_produser
<DB_Name>_devuser
Password Format:
PSQL_<DB>_PASSWORD=password
PSQL_<DB>_DEV_PASSWORD=dev_password
'';
};
databases = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
description = "list of databases to bootstrap. Will expand into DB, and DB-DEV for each item. And each Database will recieve it's own user. The user credentials must be in the correct format in the credentials file.";
description = ''
List of databases to bootstrap.
Each Database will recieve it's own user.
The user credentials must be in the correct format in the credentials file.
'';
};
ipMasks = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
description = ''
List of ipMasks that psql will accept connections from
'';
};
};
@@ -74,22 +84,27 @@
postgres roy postgres
'';
# allow remote connections to dev databases
authentication = pkgs.lib.mkOverride 10 ''
local all postgres peer map=postgres
local all all peer
# Dev can be connected to via the LAN or Local
${lib.concatStringsSep " " (
map (db: "host ${db}_dev ${db}_devuser all scram-sha-256\n") opts.databases
)}
# Prod can be connected via local machine
${lib.concatStringsSep " " (
# Prod can be connected via local machine and declared masks
${lib.concatStringsSep "" (
map (db: "host ${db} ${db}_produser 127.0.0.1/32 scram-sha-256\n") opts.databases
)}
${lib.concatStringsSep " " (
${lib.concatStringsSep "" (
map (db: "host ${db} ${db}_produser ::1/128 scram-sha-256\n") opts.databases
)}
# configurable list of subnets allowed to connect (for example k3s pods subnet)
# will allow connection to all declared ips. fine for now
${lib.concatStringsSep "" (
map (
db:
lib.concatStringsSep "" (
map (mask: "host ${db} ${db}_produser ${opts.ipMasks} scram-sha-256\n") opts.ipMasks
)
) opts.databases
)}
'';
};
@@ -118,19 +133,12 @@
user_val="$db"_produser
pass_val=$(eval "echo \''${$pass_var:-}")
dev_user_val="$db"_devuser
dev_pass_val=$(eval "echo \''${$dev_pass_var:-}")
if [ -z "$pass_val" ]; then
echo "Missing password credentials for database '$db'" >&2
exit 1
fi
if [ -z "$dev_pass_val" ]; then
echo "Missing password credentials for database '$db'_dev" >&2
exit 1
fi
echo "Bootstrapping PostgreSQL for database: $db"
# Create users if not exists
@@ -141,13 +149,6 @@
$psql_bin --port=${toString opts.port} -c "CREATE ROLE "$user_val" WITH LOGIN PASSWORD '$pass_val';"
fi
if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$dev_user_val"; then
echo "$dev_user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
else
echo "Creating $dev_user_val"
$psql_bin --port=${toString opts.port} -c "CREATE ROLE "$dev_user_val" WITH LOGIN PASSWORD '$dev_pass_val';"
fi
# Create databases if not exists
if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci ""$db" "; then
echo "$db already exists, skipping creation."
@@ -156,16 +157,8 @@
$psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db" WITH OWNER "$user_val";"
fi
if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci "$db"_dev; then
echo ""$db"_dev already exists, skipping creation."
else
echo "Creating database "$db"_dev"
$psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db"_dev WITH OWNER "$dev_user_val";"
fi
# Grant ownership (idempotency for weird states)
$psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db" OWNER TO "$user_val";"
$psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db"_dev OWNER TO "$dev_user_val";"
done
'';
nixos/configuration.nix
+6 -2
View File
@@ -67,9 +67,9 @@
acceptTerms = true;
defaults = {
# use staging for testing
# server = "https://acme-staging-v02.api.letsencrypt.org/directory";
server = "https://acme-staging-v02.api.letsencrypt.org/directory";
# use prod for deploy
server = "https://acme-v02.api.letsencrypt.org/directory";
# server = "https://acme-v02.api.letsencrypt.org/directory";
email = "roydumblauskas@gmail.com";
dnsProvider = "cloudflare";
# When the service CHECKS to see if certs are near expiry (< 30 days)
@@ -112,6 +112,7 @@
extraFlags = [
"--data-dir=/var/lib/rancher/k3s"
"--cluster-cidr 10.42.0.0/20" # allow this subnet to connect to psql
];
};
@@ -179,6 +180,9 @@
"rdblog"
"gitea"
];
ipMasks = [
"10.42.0.0/20" # k3s cluster mask
];
};
# ================================ #
nixos/secrets/gitea.yaml
+3 -3
View File
@@ -1,4 +1,4 @@
credentials: ENC[AES256_GCM,data:ZwMVkmcjBwSsTrMpR1hmkJQs7c16dlLnQVFPbIgDzByImas0yr/ZGEacgXo6ep448f0O9Utvt8xadhHpYfmb/aIoVvINEx8gF68=,iv:l92f8YRsNXMfG8fAzQ9Q9nTKpq/5hZp6dq52B8a+TTw=,tag:h9iyQBzoJfla5VAMz8gXiA==,type:str]
credentials: ENC[AES256_GCM,data:3F9YE18X4zRqppoVSnoiwBJPNuxbB6hlntXIiNV8yWhomVP6TRwhadSC3J3t/rqzD6TdbnweInDlU9U9JtfDM6H+MTXd5eVynG/aR4c=,iv:yjm4TU8AqcpY2mn+cl1/Ya9e5FHWsUVAkcyvmFxaLVU=,tag:lx/ACG2g0H/eoiJ6AVEbjQ==,type:str]
sops:
age:
- enc: |
@@ -37,7 +37,7 @@ sops:
o+m9XdwX6u7OaazWx7J9tWOS+O1sJoNGMpAj/K5N6OjoNGT4Lu8t+w==
-----END AGE ENCRYPTED FILE-----
recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
lastmodified: "2026-08-24T21:25:20Z"
mac: ENC[AES256_GCM,data:8PJBKtz371YpW+cXch/6J1wDs7Vz+326jcgnAyfAQm9ugFzBR1MhjofTxKk+lRW115BSZA7tQDHYuD+1Cr7pkV0ifSfVRU4DryvLlEJogKbMSjudU7+asRLBS70rnhN7ZH8+mvOzwnvSx8vDjnaNd0ke/BZEGkUm3l2CM1+yfw4=,iv:I0ahjK7ZG7NhJPSBVVbS18yhtA6JI+JehopjCBwrRo8=,tag:B+XR+vi6h2J26DRtEAl4xA==,type:str]
lastmodified: "2026-09-12T19:58:39Z"
mac: ENC[AES256_GCM,data:nWWObv95W+Ewp49Ygqrsat3yFlY15d8jcmjZusk8gCb1ollX8ulifP/SCt8GTOTQootbXpKxJc+BqBYcdR46gxMZert0ok2o9B7ks5zI7a0pH54mLDclN1ONmAyHRC0IqSfe7XSn70dgjLchjpCSjeTaylzidwBAUfKbkZtzjG8=,iv:jLqbj1XJaZNPKDNRUafxAexHeKQh9GqEeaIr+vzqGCc=,tag:QBir2cmH8M0zSjpAkQrHwQ==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.3
nixos/secrets/psql.yaml
+3 -3
View File
@@ -1,4 +1,4 @@
credentials: ENC[AES256_GCM,data:DAUjS1wPVY0zNCL1OsCFLYVUwsEQk3rFeY/xj/Ny4vd1Q2019kjLqRFVGPdxISYCyogJPTT1inBu1JpuXfDHkKBB+HG4Ta5WNhVitI+FeLsTd9TQEEy+DlrdtKF+1DMOcraxBOqZvuo7P/+bEzqEl6QTMR/TfG5jBw1/6g==,iv:QCmuSh6c1177plXDKSK8NfiwC5DyZFLwsNsI2u1Wxz8=,tag:fGKQsiRAGDYs18btFFjT0A==,type:str]
credentials: ENC[AES256_GCM,data:No2VCubcIimFbkhwnD4sGuaR5OehpxvOj5Ln7bXydTrn6RcgrgkmHYBHAMajcL13XHom4IY30fBpiNQ=,iv:0UMfuCJyuXkO1vBrH2d7UtV5qZJatdef8C8RskrlQ74=,tag:G7zcM1J1G53nH5O9X2PMoA==,type:str]
sops:
age:
- enc: |
@@ -37,7 +37,7 @@ sops:
1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w==
-----END AGE ENCRYPTED FILE-----
recipient: age1hzaf8j6djfc4yc98m3kqjzzdj4tcskf9kdzvjmje2xuqcfmrz5lqdtn5w7
lastmodified: "2026-08-23T18:51:08Z"
mac: ENC[AES256_GCM,data:snU9+KYMyX3+2pB9qqqlYTFAHMeNvKTzkKR2um6y/hpRMHmVVRqKjxPWS4G2zfPaEwJeEblfJMzt69a6IrnoW2wD2usrrE7uoWSMkO3a/iN2cFlcdSHQ8wWfzMoBl26d4a7Bs4xOIn4ynvA4UwGM3PbjSMUwsi5qteKDBwwkGcg=,iv:UHqCHEYdBe92dgon+8x5Zg9xmMOsi2coxwkQOV6Q/3o=,tag:fpoL/F/XedlT+jw2pQb3Ig==,type:str]
lastmodified: "2026-09-12T19:58:55Z"
mac: ENC[AES256_GCM,data:zplquNejJ1M8dBYF7h2yPmHzO2gFDPr3VFCLEszJE/0LxBQmon0/IaOUrvbShIgkOh7eq06vrNSpp42/r37sv1Uoy4j/E0OLCtB8NYEsP5aW5joSKJZlzdQJUEbB38Zf7vM7FFNKBYeAtJflhbI/A3qyq7Xs4qTKWj8IJY4nx78=,iv:fQJfqsQcUVPB/Q6HxdG8gM1IDTvjQniIqDs+dFvGt7o=,tag:eTllYOsgCtCsQCBxr3pbpw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.13.3