remove usernames from secret file, they're not used
This commit is contained in:
@@ -5,165 +5,174 @@
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
|
||||
};
|
||||
|
||||
outputs = { self, nixpkgs, ...}: {
|
||||
nixosModules.postgresql-db = {config, lib, pkgs, ...}:
|
||||
let
|
||||
opts = config.services.postgresql-db;
|
||||
in {
|
||||
options.services.postgresql-db = {
|
||||
enable = lib.mkEnableOption "Postgres make DBs";
|
||||
outputs =
|
||||
{ self, nixpkgs, ... }:
|
||||
{
|
||||
nixosModules.postgresql-db =
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
opts = config.services.postgresql-db;
|
||||
in
|
||||
{
|
||||
options.services.postgresql-db = {
|
||||
enable = lib.mkEnableOption "Postgres make DBs";
|
||||
|
||||
dataDir = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "/var/lib/postgresql";
|
||||
description = "Where to store database data";
|
||||
};
|
||||
dataDir = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "/var/lib/postgresql";
|
||||
description = "Where to store database data";
|
||||
};
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 5432;
|
||||
description = "port to host postgresql";
|
||||
};
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 5432;
|
||||
description = "port to host postgresql";
|
||||
};
|
||||
|
||||
credentialsFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = ''
|
||||
File containing postgresql user credentials.
|
||||
Only the Passwords. Names of Users just follow the pattern:
|
||||
<DB_Name>_produser
|
||||
<DB_Name>_devuser
|
||||
|
||||
Password Format:
|
||||
PSQL_<DB>_PASSWORD=password
|
||||
PSQL_<DB>_DEV_PASSWORD=dev_password
|
||||
'';
|
||||
};
|
||||
credentialsFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = ''
|
||||
File containing postgresql user credentials.
|
||||
Only the Passwords. Names of Users just follow the pattern:
|
||||
<DB_Name>_produser
|
||||
<DB_Name>_devuser
|
||||
|
||||
databases = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [];
|
||||
description = "list of databases to bootstrap. Will expand into DB, and DB-DEV for each item. And each Database will recieve it's own user. The user credentials must be in the correct format in the credentials file.";
|
||||
};
|
||||
};
|
||||
Password Format:
|
||||
PSQL_<DB>_PASSWORD=password
|
||||
PSQL_<DB>_DEV_PASSWORD=dev_password
|
||||
'';
|
||||
};
|
||||
|
||||
config = lib.mkIf opts.enable {
|
||||
users.groups.postgres = {};
|
||||
users.users.postgres = {
|
||||
isSystemUser = true;
|
||||
createHome = true;
|
||||
home = opts.dataDir;
|
||||
group = "postgres";
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
enableTCPIP = true;
|
||||
dataDir = opts.dataDir;
|
||||
settings.port = opts.port;
|
||||
identMap = ''
|
||||
postgres roy postgres
|
||||
'';
|
||||
|
||||
# allow remote connections to dev databases
|
||||
authentication = pkgs.lib.mkOverride 10 ''
|
||||
local all postgres peer map=postgres
|
||||
local all all peer
|
||||
|
||||
# Dev can be connected to via the LAN or Local
|
||||
${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser all md5\n") opts.databases) }
|
||||
# Prod can be connected via local machine
|
||||
${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser 127.0.0.1/32 md5\n") opts.databases) }
|
||||
${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser ::1/128 md5\n") opts.databases) }
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services.bootstrap-psql = {
|
||||
description = "Bootstrap psql databases and users";
|
||||
after = [ "postgresql.service" ];
|
||||
requires = [ "postgresql.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "postgres";
|
||||
Group = "postgres";
|
||||
EnvironmentFile = opts.credentialsFile;
|
||||
|
||||
ExecStart = pkgs.writeShellScript "bootstrap-psql" ''
|
||||
set -euo pipefail
|
||||
|
||||
psql_bin=${pkgs.postgresql}/bin/psql
|
||||
|
||||
for db in ${lib.escapeShellArgs opts.databases}; do
|
||||
db_upper="''${db^^}"
|
||||
|
||||
user_var="PSQL_''${db_upper}_USER"
|
||||
pass_var="PSQL_''${db_upper}_PASSWORD"
|
||||
dev_user_var="PSQL_''${db_upper}_DEV_USER"
|
||||
dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD"
|
||||
|
||||
user_val="$db"_produser
|
||||
pass_val=$(eval "echo \''${$pass_var:-}")
|
||||
dev_user_val="$db"_devuser
|
||||
dev_pass_val=$(eval "echo \''${$dev_pass_var:-}")
|
||||
|
||||
if [ -z "$pass_val" ]; then
|
||||
echo "Missing password credentials for database '$db'" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z "$dev_pass_val" ]; then
|
||||
echo "Missing password credentials for database '$db'_dev" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Bootstrapping PostgreSQL for database: $db"
|
||||
|
||||
# Create databases if not exists
|
||||
if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci ""$db" "; then
|
||||
echo "$db already exists, skipping creation."
|
||||
else
|
||||
echo "Creating database $db"
|
||||
$psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db";"
|
||||
fi
|
||||
|
||||
if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci "$db"_dev; then
|
||||
echo ""$db"_dev already exists, skipping creation."
|
||||
else
|
||||
echo "Creating database "$db"_dev"
|
||||
$psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db"_dev;"
|
||||
fi
|
||||
|
||||
# Create users if not exists
|
||||
if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$user_val"; then
|
||||
echo "$user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
|
||||
else
|
||||
echo "Creating $user_val"
|
||||
$psql_bin --port=${toString opts.port} -c "CREATE ROLE "$user_val" WITH LOGIN PASSWORD '$pass_val';"
|
||||
fi
|
||||
|
||||
if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$dev_user_val"; then
|
||||
echo "$dev_user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
|
||||
else
|
||||
echo "Creating $dev_user_val"
|
||||
$psql_bin --port=${toString opts.port} -c "CREATE ROLE "$dev_user_val" WITH LOGIN PASSWORD '$dev_pass_val';"
|
||||
fi
|
||||
|
||||
# Give users privileges on databases (always)
|
||||
$psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db" TO "$user_val";"
|
||||
$psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db"_dev TO "$dev_user_val";"
|
||||
|
||||
# Grant ownership
|
||||
$psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db" OWNER TO "$user_val";"
|
||||
$psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db"_dev OWNER TO "$dev_user_val";"
|
||||
|
||||
done
|
||||
'';
|
||||
databases = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
description = "list of databases to bootstrap. Will expand into DB, and DB-DEV for each item. And each Database will recieve it's own user. The user credentials must be in the correct format in the credentials file.";
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkIf opts.enable [ opts.port] ;
|
||||
};
|
||||
config = lib.mkIf opts.enable {
|
||||
users.groups.postgres = { };
|
||||
users.users.postgres = {
|
||||
isSystemUser = true;
|
||||
createHome = true;
|
||||
home = opts.dataDir;
|
||||
group = "postgres";
|
||||
};
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
enableTCPIP = true;
|
||||
dataDir = opts.dataDir;
|
||||
settings.port = opts.port;
|
||||
identMap = ''
|
||||
postgres roy postgres
|
||||
'';
|
||||
|
||||
# allow remote connections to dev databases
|
||||
authentication = pkgs.lib.mkOverride 10 ''
|
||||
local all postgres peer map=postgres
|
||||
local all all peer
|
||||
|
||||
# Dev can be connected to via the LAN or Local
|
||||
${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser all md5\n") opts.databases)}
|
||||
# Prod can be connected via local machine
|
||||
${lib.concatStringsSep " " (
|
||||
map (db: "host ${db} ${db}_produser 127.0.0.1/32 md5\n") opts.databases
|
||||
)}
|
||||
${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser ::1/128 md5\n") opts.databases)}
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.services.bootstrap-psql = {
|
||||
description = "Bootstrap psql databases and users";
|
||||
after = [ "postgresql.service" ];
|
||||
requires = [ "postgresql.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = "postgres";
|
||||
Group = "postgres";
|
||||
EnvironmentFile = opts.credentialsFile;
|
||||
|
||||
ExecStart = pkgs.writeShellScript "bootstrap-psql" ''
|
||||
set -euo pipefail
|
||||
|
||||
psql_bin=${pkgs.postgresql}/bin/psql
|
||||
|
||||
for db in ${lib.escapeShellArgs opts.databases}; do
|
||||
db_upper="''${db^^}"
|
||||
|
||||
pass_var="PSQL_''${db_upper}_PASSWORD"
|
||||
dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD"
|
||||
|
||||
user_val="$db"_produser
|
||||
pass_val=$(eval "echo \''${$pass_var:-}")
|
||||
dev_user_val="$db"_devuser
|
||||
dev_pass_val=$(eval "echo \''${$dev_pass_var:-}")
|
||||
|
||||
if [ -z "$pass_val" ]; then
|
||||
echo "Missing password credentials for database '$db'" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -z "$dev_pass_val" ]; then
|
||||
echo "Missing password credentials for database '$db'_dev" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
echo "Bootstrapping PostgreSQL for database: $db"
|
||||
|
||||
# Create databases if not exists
|
||||
if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci ""$db" "; then
|
||||
echo "$db already exists, skipping creation."
|
||||
else
|
||||
echo "Creating database $db"
|
||||
$psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db";"
|
||||
fi
|
||||
|
||||
if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci "$db"_dev; then
|
||||
echo ""$db"_dev already exists, skipping creation."
|
||||
else
|
||||
echo "Creating database "$db"_dev"
|
||||
$psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db"_dev;"
|
||||
fi
|
||||
|
||||
# Create users if not exists
|
||||
if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$user_val"; then
|
||||
echo "$user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
|
||||
else
|
||||
echo "Creating $user_val"
|
||||
$psql_bin --port=${toString opts.port} -c "CREATE ROLE "$user_val" WITH LOGIN PASSWORD '$pass_val';"
|
||||
fi
|
||||
|
||||
if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$dev_user_val"; then
|
||||
echo "$dev_user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
|
||||
else
|
||||
echo "Creating $dev_user_val"
|
||||
$psql_bin --port=${toString opts.port} -c "CREATE ROLE "$dev_user_val" WITH LOGIN PASSWORD '$dev_pass_val';"
|
||||
fi
|
||||
|
||||
# Give users privileges on databases (always)
|
||||
$psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db" TO "$user_val";"
|
||||
$psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db"_dev TO "$dev_user_val";"
|
||||
|
||||
# Grant ownership
|
||||
$psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db" OWNER TO "$user_val";"
|
||||
$psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db"_dev OWNER TO "$dev_user_val";"
|
||||
|
||||
done
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkIf opts.enable [ opts.port ];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user