From 298d3f2fc5c7f0d115ec7cf60ba64431f7778bc6 Mon Sep 17 00:00:00 2001 From: Roy Dumblauskas Date: Wed, 20 May 2026 00:00:37 -0500 Subject: [PATCH] remove usernames from secret file, they're not used --- homelab-services/postgresql-db/flake.nix | 313 ++++++++++++----------- nixos/configuration.nix | 6 +- nixos/secrets/psql.yaml | 8 +- 3 files changed, 167 insertions(+), 160 deletions(-) diff --git a/homelab-services/postgresql-db/flake.nix b/homelab-services/postgresql-db/flake.nix index ecbca1a..3e484b6 100644 --- a/homelab-services/postgresql-db/flake.nix +++ b/homelab-services/postgresql-db/flake.nix @@ -5,165 +5,174 @@ nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05"; }; - outputs = { self, nixpkgs, ...}: { - nixosModules.postgresql-db = {config, lib, pkgs, ...}: - let - opts = config.services.postgresql-db; - in { - options.services.postgresql-db = { - enable = lib.mkEnableOption "Postgres make DBs"; + outputs = + { self, nixpkgs, ... }: + { + nixosModules.postgresql-db = + { + config, + lib, + pkgs, + ... + }: + let + opts = config.services.postgresql-db; + in + { + options.services.postgresql-db = { + enable = lib.mkEnableOption "Postgres make DBs"; - dataDir = lib.mkOption { - type = lib.types.path; - default = "/var/lib/postgresql"; - description = "Where to store database data"; - }; + dataDir = lib.mkOption { + type = lib.types.path; + default = "/var/lib/postgresql"; + description = "Where to store database data"; + }; - port = lib.mkOption { - type = lib.types.port; - default = 5432; - description = "port to host postgresql"; - }; + port = lib.mkOption { + type = lib.types.port; + default = 5432; + description = "port to host postgresql"; + }; - credentialsFile = lib.mkOption { - type = lib.types.path; - description = '' - File containing postgresql user credentials. - Only the Passwords. Names of Users just follow the pattern: - _produser - _devuser - - Password Format: - PSQL__PASSWORD=password - PSQL__DEV_PASSWORD=dev_password - ''; - }; + credentialsFile = lib.mkOption { + type = lib.types.path; + description = '' + File containing postgresql user credentials. + Only the Passwords. Names of Users just follow the pattern: + _produser + _devuser - databases = lib.mkOption { - type = lib.types.listOf lib.types.str; - default = []; - description = "list of databases to bootstrap. Will expand into DB, and DB-DEV for each item. And each Database will recieve it's own user. The user credentials must be in the correct format in the credentials file."; - }; - }; + Password Format: + PSQL__PASSWORD=password + PSQL__DEV_PASSWORD=dev_password + ''; + }; - config = lib.mkIf opts.enable { - users.groups.postgres = {}; - users.users.postgres = { - isSystemUser = true; - createHome = true; - home = opts.dataDir; - group = "postgres"; - }; - - services.postgresql = { - enable = true; - enableTCPIP = true; - dataDir = opts.dataDir; - settings.port = opts.port; - identMap = '' - postgres roy postgres - ''; - - # allow remote connections to dev databases - authentication = pkgs.lib.mkOverride 10 '' - local all postgres peer map=postgres - local all all peer - - # Dev can be connected to via the LAN or Local - ${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser all md5\n") opts.databases) } - # Prod can be connected via local machine - ${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser 127.0.0.1/32 md5\n") opts.databases) } - ${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser ::1/128 md5\n") opts.databases) } - ''; - }; - - systemd.services.bootstrap-psql = { - description = "Bootstrap psql databases and users"; - after = [ "postgresql.service" ]; - requires = [ "postgresql.service" ]; - wantedBy = [ "multi-user.target" ]; - - serviceConfig = { - Type = "oneshot"; - User = "postgres"; - Group = "postgres"; - EnvironmentFile = opts.credentialsFile; - - ExecStart = pkgs.writeShellScript "bootstrap-psql" '' - set -euo pipefail - - psql_bin=${pkgs.postgresql}/bin/psql - - for db in ${lib.escapeShellArgs opts.databases}; do - db_upper="''${db^^}" - - user_var="PSQL_''${db_upper}_USER" - pass_var="PSQL_''${db_upper}_PASSWORD" - dev_user_var="PSQL_''${db_upper}_DEV_USER" - dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD" - - user_val="$db"_produser - pass_val=$(eval "echo \''${$pass_var:-}") - dev_user_val="$db"_devuser - dev_pass_val=$(eval "echo \''${$dev_pass_var:-}") - - if [ -z "$pass_val" ]; then - echo "Missing password credentials for database '$db'" >&2 - exit 1 - fi - - if [ -z "$dev_pass_val" ]; then - echo "Missing password credentials for database '$db'_dev" >&2 - exit 1 - fi - - echo "Bootstrapping PostgreSQL for database: $db" - - # Create databases if not exists - if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci ""$db" "; then - echo "$db already exists, skipping creation." - else - echo "Creating database $db" - $psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db";" - fi - - if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci "$db"_dev; then - echo ""$db"_dev already exists, skipping creation." - else - echo "Creating database "$db"_dev" - $psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db"_dev;" - fi - - # Create users if not exists - if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$user_val"; then - echo "$user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity" - else - echo "Creating $user_val" - $psql_bin --port=${toString opts.port} -c "CREATE ROLE "$user_val" WITH LOGIN PASSWORD '$pass_val';" - fi - - if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$dev_user_val"; then - echo "$dev_user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity" - else - echo "Creating $dev_user_val" - $psql_bin --port=${toString opts.port} -c "CREATE ROLE "$dev_user_val" WITH LOGIN PASSWORD '$dev_pass_val';" - fi - - # Give users privileges on databases (always) - $psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db" TO "$user_val";" - $psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db"_dev TO "$dev_user_val";" - - # Grant ownership - $psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db" OWNER TO "$user_val";" - $psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db"_dev OWNER TO "$dev_user_val";" - - done - ''; + databases = lib.mkOption { + type = lib.types.listOf lib.types.str; + default = [ ]; + description = "list of databases to bootstrap. Will expand into DB, and DB-DEV for each item. And each Database will recieve it's own user. The user credentials must be in the correct format in the credentials file."; }; }; - networking.firewall.allowedTCPPorts = lib.mkIf opts.enable [ opts.port] ; - }; + config = lib.mkIf opts.enable { + users.groups.postgres = { }; + users.users.postgres = { + isSystemUser = true; + createHome = true; + home = opts.dataDir; + group = "postgres"; + }; + + services.postgresql = { + enable = true; + enableTCPIP = true; + dataDir = opts.dataDir; + settings.port = opts.port; + identMap = '' + postgres roy postgres + ''; + + # allow remote connections to dev databases + authentication = pkgs.lib.mkOverride 10 '' + local all postgres peer map=postgres + local all all peer + + # Dev can be connected to via the LAN or Local + ${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser all md5\n") opts.databases)} + # Prod can be connected via local machine + ${lib.concatStringsSep " " ( + map (db: "host ${db} ${db}_produser 127.0.0.1/32 md5\n") opts.databases + )} + ${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser ::1/128 md5\n") opts.databases)} + ''; + }; + + systemd.services.bootstrap-psql = { + description = "Bootstrap psql databases and users"; + after = [ "postgresql.service" ]; + requires = [ "postgresql.service" ]; + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + Type = "oneshot"; + User = "postgres"; + Group = "postgres"; + EnvironmentFile = opts.credentialsFile; + + ExecStart = pkgs.writeShellScript "bootstrap-psql" '' + set -euo pipefail + + psql_bin=${pkgs.postgresql}/bin/psql + + for db in ${lib.escapeShellArgs opts.databases}; do + db_upper="''${db^^}" + + pass_var="PSQL_''${db_upper}_PASSWORD" + dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD" + + user_val="$db"_produser + pass_val=$(eval "echo \''${$pass_var:-}") + dev_user_val="$db"_devuser + dev_pass_val=$(eval "echo \''${$dev_pass_var:-}") + + if [ -z "$pass_val" ]; then + echo "Missing password credentials for database '$db'" >&2 + exit 1 + fi + + if [ -z "$dev_pass_val" ]; then + echo "Missing password credentials for database '$db'_dev" >&2 + exit 1 + fi + + echo "Bootstrapping PostgreSQL for database: $db" + + # Create databases if not exists + if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci ""$db" "; then + echo "$db already exists, skipping creation." + else + echo "Creating database $db" + $psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db";" + fi + + if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci "$db"_dev; then + echo ""$db"_dev already exists, skipping creation." + else + echo "Creating database "$db"_dev" + $psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db"_dev;" + fi + + # Create users if not exists + if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$user_val"; then + echo "$user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity" + else + echo "Creating $user_val" + $psql_bin --port=${toString opts.port} -c "CREATE ROLE "$user_val" WITH LOGIN PASSWORD '$pass_val';" + fi + + if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$dev_user_val"; then + echo "$dev_user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity" + else + echo "Creating $dev_user_val" + $psql_bin --port=${toString opts.port} -c "CREATE ROLE "$dev_user_val" WITH LOGIN PASSWORD '$dev_pass_val';" + fi + + # Give users privileges on databases (always) + $psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db" TO "$user_val";" + $psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db"_dev TO "$dev_user_val";" + + # Grant ownership + $psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db" OWNER TO "$user_val";" + $psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db"_dev OWNER TO "$dev_user_val";" + + done + ''; + }; + }; + + networking.firewall.allowedTCPPorts = lib.mkIf opts.enable [ opts.port ]; + }; + }; }; - }; } diff --git a/nixos/configuration.nix b/nixos/configuration.nix index 4d9ea34..ea7043e 100755 --- a/nixos/configuration.nix +++ b/nixos/configuration.nix @@ -135,8 +135,6 @@ in # Fullstack sourcecode # Minio for backend storage - # Should be able to decalre as a nixos module - # which builds container and pushes to k3s services.minio-service = { enable = true; @@ -161,11 +159,11 @@ in }; }; - # Postgresql/postgrest for row storage + # Postgresql/postgrest for row storage (not on k3s) services.postgresql-db = { enable = true; dataDir = "/var/lib/postgresql"; - port = 5431; + port = 5432; credentialsFile = config.sops.secrets."postgresql-credentials".path; databases = [ "rdblog" ]; }; diff --git a/nixos/secrets/psql.yaml b/nixos/secrets/psql.yaml index 53abbad..1803c7f 100644 --- a/nixos/secrets/psql.yaml +++ b/nixos/secrets/psql.yaml @@ -1,4 +1,4 @@ -credentials: ENC[AES256_GCM,data:c05URk3EnazNDMMOBPYlVWd3V6oOjTIPhBtrdf5HIKznPdygpzaCwv9MRn5c8DtzGPHV7/517v9pU1CW8+2guC2jVAHt7Wg+IM/4z+vHaxOzsB2n5UgPZaaeKAASA0O0thgABHLMiLZlQpPzO7qKlzvMfpTtWg==,iv:W7cnqmAyT1KvWkg5gzbVmTJ90EC+jbsDg96glISoAXc=,tag:1T2Sa/dYyYFfPPrLBrdUsg==,type:str] +credentials: ENC[AES256_GCM,data:jOJNNcqcWdtUpc78wUcxFqKiRHwHdCE+OkhyGOjMaGcBsaBlHUT/WccApQZ1IVVPfRMAtakHYaVfXKeWH2Nz,iv:OQWH2Hb+a5rrWyut/drRLlJeF96SYm+WZVi1UYZS+zk=,tag:F0fATlif7rmIZuAGyiGv1g==,type:str] sops: age: - recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y @@ -37,7 +37,7 @@ sops: ektNUE8xUmRsWEtyajNIYitEbWgyS0kKeKBcJV6/EQKhkbYeE+ALctucmOKV5hDD 1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-11-19T05:03:49Z" - mac: ENC[AES256_GCM,data:uqhNCdl+we0UBjPFOBngA/2ywwXfIxpgXB9ozb7Vcy/sEZCoSob+VuEAzBQ/cbE5EuBlxoltg3Ve0r0xNNQQ5rZ+q6rfyRaSLrO1Xd3B5ITg6hLHLXIjFOGW6q15E2X1vKipnXGE11LZCsTEHCS1JCntLxMu+cTpIZbnVOx+KcY=,iv:6/H5fPHtyqvkkONF49AxLAjKVQpY+jcGm+4d+a2aa9U=,tag:hdoKyv64RpxnbQfd+S6FLg==,type:str] + lastmodified: "2026-05-20T04:59:28Z" + mac: ENC[AES256_GCM,data:AOz3ei4hxSjMT8Xpn3nDzLUzNFQcYDQPu5nUdamgq0e1Y8j9pV7dQNAO0tgAdMxnz3hDPLnF7lmdvI6XdOj/F4gpoc/jm+2LwG405vCKBUvtW03Tx1vq9gmE9xwXo+RK3m7m2Rf4LP+ZS1uThEgrd4nceze/Heimj5acKSAdch4=,iv:rYiBCZK17Gii8vSRpMhzty4dtjjVuunMjrrey+8264A=,tag:ZdpVWajiJUjwtDncVDUBmw==,type:str] unencrypted_suffix: _unencrypted - version: 3.10.2 + version: 3.12.1