remove usernames from secret file, they're not used
This commit is contained in:
@@ -5,165 +5,174 @@
|
|||||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
|
||||||
};
|
};
|
||||||
|
|
||||||
outputs = { self, nixpkgs, ...}: {
|
outputs =
|
||||||
nixosModules.postgresql-db = {config, lib, pkgs, ...}:
|
{ self, nixpkgs, ... }:
|
||||||
let
|
{
|
||||||
opts = config.services.postgresql-db;
|
nixosModules.postgresql-db =
|
||||||
in {
|
{
|
||||||
options.services.postgresql-db = {
|
config,
|
||||||
enable = lib.mkEnableOption "Postgres make DBs";
|
lib,
|
||||||
|
pkgs,
|
||||||
|
...
|
||||||
|
}:
|
||||||
|
let
|
||||||
|
opts = config.services.postgresql-db;
|
||||||
|
in
|
||||||
|
{
|
||||||
|
options.services.postgresql-db = {
|
||||||
|
enable = lib.mkEnableOption "Postgres make DBs";
|
||||||
|
|
||||||
dataDir = lib.mkOption {
|
dataDir = lib.mkOption {
|
||||||
type = lib.types.path;
|
type = lib.types.path;
|
||||||
default = "/var/lib/postgresql";
|
default = "/var/lib/postgresql";
|
||||||
description = "Where to store database data";
|
description = "Where to store database data";
|
||||||
};
|
};
|
||||||
|
|
||||||
port = lib.mkOption {
|
port = lib.mkOption {
|
||||||
type = lib.types.port;
|
type = lib.types.port;
|
||||||
default = 5432;
|
default = 5432;
|
||||||
description = "port to host postgresql";
|
description = "port to host postgresql";
|
||||||
};
|
};
|
||||||
|
|
||||||
credentialsFile = lib.mkOption {
|
credentialsFile = lib.mkOption {
|
||||||
type = lib.types.path;
|
type = lib.types.path;
|
||||||
description = ''
|
description = ''
|
||||||
File containing postgresql user credentials.
|
File containing postgresql user credentials.
|
||||||
Only the Passwords. Names of Users just follow the pattern:
|
Only the Passwords. Names of Users just follow the pattern:
|
||||||
<DB_Name>_produser
|
<DB_Name>_produser
|
||||||
<DB_Name>_devuser
|
<DB_Name>_devuser
|
||||||
|
|
||||||
Password Format:
|
|
||||||
PSQL_<DB>_PASSWORD=password
|
|
||||||
PSQL_<DB>_DEV_PASSWORD=dev_password
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
databases = lib.mkOption {
|
Password Format:
|
||||||
type = lib.types.listOf lib.types.str;
|
PSQL_<DB>_PASSWORD=password
|
||||||
default = [];
|
PSQL_<DB>_DEV_PASSWORD=dev_password
|
||||||
description = "list of databases to bootstrap. Will expand into DB, and DB-DEV for each item. And each Database will recieve it's own user. The user credentials must be in the correct format in the credentials file.";
|
'';
|
||||||
};
|
};
|
||||||
};
|
|
||||||
|
|
||||||
config = lib.mkIf opts.enable {
|
databases = lib.mkOption {
|
||||||
users.groups.postgres = {};
|
type = lib.types.listOf lib.types.str;
|
||||||
users.users.postgres = {
|
default = [ ];
|
||||||
isSystemUser = true;
|
description = "list of databases to bootstrap. Will expand into DB, and DB-DEV for each item. And each Database will recieve it's own user. The user credentials must be in the correct format in the credentials file.";
|
||||||
createHome = true;
|
|
||||||
home = opts.dataDir;
|
|
||||||
group = "postgres";
|
|
||||||
};
|
|
||||||
|
|
||||||
services.postgresql = {
|
|
||||||
enable = true;
|
|
||||||
enableTCPIP = true;
|
|
||||||
dataDir = opts.dataDir;
|
|
||||||
settings.port = opts.port;
|
|
||||||
identMap = ''
|
|
||||||
postgres roy postgres
|
|
||||||
'';
|
|
||||||
|
|
||||||
# allow remote connections to dev databases
|
|
||||||
authentication = pkgs.lib.mkOverride 10 ''
|
|
||||||
local all postgres peer map=postgres
|
|
||||||
local all all peer
|
|
||||||
|
|
||||||
# Dev can be connected to via the LAN or Local
|
|
||||||
${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser all md5\n") opts.databases) }
|
|
||||||
# Prod can be connected via local machine
|
|
||||||
${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser 127.0.0.1/32 md5\n") opts.databases) }
|
|
||||||
${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser ::1/128 md5\n") opts.databases) }
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd.services.bootstrap-psql = {
|
|
||||||
description = "Bootstrap psql databases and users";
|
|
||||||
after = [ "postgresql.service" ];
|
|
||||||
requires = [ "postgresql.service" ];
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
|
|
||||||
serviceConfig = {
|
|
||||||
Type = "oneshot";
|
|
||||||
User = "postgres";
|
|
||||||
Group = "postgres";
|
|
||||||
EnvironmentFile = opts.credentialsFile;
|
|
||||||
|
|
||||||
ExecStart = pkgs.writeShellScript "bootstrap-psql" ''
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
psql_bin=${pkgs.postgresql}/bin/psql
|
|
||||||
|
|
||||||
for db in ${lib.escapeShellArgs opts.databases}; do
|
|
||||||
db_upper="''${db^^}"
|
|
||||||
|
|
||||||
user_var="PSQL_''${db_upper}_USER"
|
|
||||||
pass_var="PSQL_''${db_upper}_PASSWORD"
|
|
||||||
dev_user_var="PSQL_''${db_upper}_DEV_USER"
|
|
||||||
dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD"
|
|
||||||
|
|
||||||
user_val="$db"_produser
|
|
||||||
pass_val=$(eval "echo \''${$pass_var:-}")
|
|
||||||
dev_user_val="$db"_devuser
|
|
||||||
dev_pass_val=$(eval "echo \''${$dev_pass_var:-}")
|
|
||||||
|
|
||||||
if [ -z "$pass_val" ]; then
|
|
||||||
echo "Missing password credentials for database '$db'" >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ -z "$dev_pass_val" ]; then
|
|
||||||
echo "Missing password credentials for database '$db'_dev" >&2
|
|
||||||
exit 1
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Bootstrapping PostgreSQL for database: $db"
|
|
||||||
|
|
||||||
# Create databases if not exists
|
|
||||||
if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci ""$db" "; then
|
|
||||||
echo "$db already exists, skipping creation."
|
|
||||||
else
|
|
||||||
echo "Creating database $db"
|
|
||||||
$psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db";"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci "$db"_dev; then
|
|
||||||
echo ""$db"_dev already exists, skipping creation."
|
|
||||||
else
|
|
||||||
echo "Creating database "$db"_dev"
|
|
||||||
$psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db"_dev;"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Create users if not exists
|
|
||||||
if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$user_val"; then
|
|
||||||
echo "$user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
|
|
||||||
else
|
|
||||||
echo "Creating $user_val"
|
|
||||||
$psql_bin --port=${toString opts.port} -c "CREATE ROLE "$user_val" WITH LOGIN PASSWORD '$pass_val';"
|
|
||||||
fi
|
|
||||||
|
|
||||||
if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$dev_user_val"; then
|
|
||||||
echo "$dev_user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
|
|
||||||
else
|
|
||||||
echo "Creating $dev_user_val"
|
|
||||||
$psql_bin --port=${toString opts.port} -c "CREATE ROLE "$dev_user_val" WITH LOGIN PASSWORD '$dev_pass_val';"
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Give users privileges on databases (always)
|
|
||||||
$psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db" TO "$user_val";"
|
|
||||||
$psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db"_dev TO "$dev_user_val";"
|
|
||||||
|
|
||||||
# Grant ownership
|
|
||||||
$psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db" OWNER TO "$user_val";"
|
|
||||||
$psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db"_dev OWNER TO "$dev_user_val";"
|
|
||||||
|
|
||||||
done
|
|
||||||
'';
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
networking.firewall.allowedTCPPorts = lib.mkIf opts.enable [ opts.port] ;
|
config = lib.mkIf opts.enable {
|
||||||
};
|
users.groups.postgres = { };
|
||||||
|
users.users.postgres = {
|
||||||
|
isSystemUser = true;
|
||||||
|
createHome = true;
|
||||||
|
home = opts.dataDir;
|
||||||
|
group = "postgres";
|
||||||
|
};
|
||||||
|
|
||||||
|
services.postgresql = {
|
||||||
|
enable = true;
|
||||||
|
enableTCPIP = true;
|
||||||
|
dataDir = opts.dataDir;
|
||||||
|
settings.port = opts.port;
|
||||||
|
identMap = ''
|
||||||
|
postgres roy postgres
|
||||||
|
'';
|
||||||
|
|
||||||
|
# allow remote connections to dev databases
|
||||||
|
authentication = pkgs.lib.mkOverride 10 ''
|
||||||
|
local all postgres peer map=postgres
|
||||||
|
local all all peer
|
||||||
|
|
||||||
|
# Dev can be connected to via the LAN or Local
|
||||||
|
${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser all md5\n") opts.databases)}
|
||||||
|
# Prod can be connected via local machine
|
||||||
|
${lib.concatStringsSep " " (
|
||||||
|
map (db: "host ${db} ${db}_produser 127.0.0.1/32 md5\n") opts.databases
|
||||||
|
)}
|
||||||
|
${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser ::1/128 md5\n") opts.databases)}
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
|
||||||
|
systemd.services.bootstrap-psql = {
|
||||||
|
description = "Bootstrap psql databases and users";
|
||||||
|
after = [ "postgresql.service" ];
|
||||||
|
requires = [ "postgresql.service" ];
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
User = "postgres";
|
||||||
|
Group = "postgres";
|
||||||
|
EnvironmentFile = opts.credentialsFile;
|
||||||
|
|
||||||
|
ExecStart = pkgs.writeShellScript "bootstrap-psql" ''
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
psql_bin=${pkgs.postgresql}/bin/psql
|
||||||
|
|
||||||
|
for db in ${lib.escapeShellArgs opts.databases}; do
|
||||||
|
db_upper="''${db^^}"
|
||||||
|
|
||||||
|
pass_var="PSQL_''${db_upper}_PASSWORD"
|
||||||
|
dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD"
|
||||||
|
|
||||||
|
user_val="$db"_produser
|
||||||
|
pass_val=$(eval "echo \''${$pass_var:-}")
|
||||||
|
dev_user_val="$db"_devuser
|
||||||
|
dev_pass_val=$(eval "echo \''${$dev_pass_var:-}")
|
||||||
|
|
||||||
|
if [ -z "$pass_val" ]; then
|
||||||
|
echo "Missing password credentials for database '$db'" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [ -z "$dev_pass_val" ]; then
|
||||||
|
echo "Missing password credentials for database '$db'_dev" >&2
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Bootstrapping PostgreSQL for database: $db"
|
||||||
|
|
||||||
|
# Create databases if not exists
|
||||||
|
if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci ""$db" "; then
|
||||||
|
echo "$db already exists, skipping creation."
|
||||||
|
else
|
||||||
|
echo "Creating database $db"
|
||||||
|
$psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db";"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci "$db"_dev; then
|
||||||
|
echo ""$db"_dev already exists, skipping creation."
|
||||||
|
else
|
||||||
|
echo "Creating database "$db"_dev"
|
||||||
|
$psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db"_dev;"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Create users if not exists
|
||||||
|
if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$user_val"; then
|
||||||
|
echo "$user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
|
||||||
|
else
|
||||||
|
echo "Creating $user_val"
|
||||||
|
$psql_bin --port=${toString opts.port} -c "CREATE ROLE "$user_val" WITH LOGIN PASSWORD '$pass_val';"
|
||||||
|
fi
|
||||||
|
|
||||||
|
if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$dev_user_val"; then
|
||||||
|
echo "$dev_user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
|
||||||
|
else
|
||||||
|
echo "Creating $dev_user_val"
|
||||||
|
$psql_bin --port=${toString opts.port} -c "CREATE ROLE "$dev_user_val" WITH LOGIN PASSWORD '$dev_pass_val';"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Give users privileges on databases (always)
|
||||||
|
$psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db" TO "$user_val";"
|
||||||
|
$psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db"_dev TO "$dev_user_val";"
|
||||||
|
|
||||||
|
# Grant ownership
|
||||||
|
$psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db" OWNER TO "$user_val";"
|
||||||
|
$psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db"_dev OWNER TO "$dev_user_val";"
|
||||||
|
|
||||||
|
done
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
networking.firewall.allowedTCPPorts = lib.mkIf opts.enable [ opts.port ];
|
||||||
|
};
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -135,8 +135,6 @@ in
|
|||||||
# Fullstack sourcecode
|
# Fullstack sourcecode
|
||||||
|
|
||||||
# Minio for backend storage
|
# Minio for backend storage
|
||||||
# Should be able to decalre as a nixos module
|
|
||||||
# which builds container and pushes to k3s
|
|
||||||
services.minio-service = {
|
services.minio-service = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
@@ -161,11 +159,11 @@ in
|
|||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
# Postgresql/postgrest for row storage
|
# Postgresql/postgrest for row storage (not on k3s)
|
||||||
services.postgresql-db = {
|
services.postgresql-db = {
|
||||||
enable = true;
|
enable = true;
|
||||||
dataDir = "/var/lib/postgresql";
|
dataDir = "/var/lib/postgresql";
|
||||||
port = 5431;
|
port = 5432;
|
||||||
credentialsFile = config.sops.secrets."postgresql-credentials".path;
|
credentialsFile = config.sops.secrets."postgresql-credentials".path;
|
||||||
databases = [ "rdblog" ];
|
databases = [ "rdblog" ];
|
||||||
};
|
};
|
||||||
|
|||||||
@@ -1,4 +1,4 @@
|
|||||||
credentials: ENC[AES256_GCM,data:c05URk3EnazNDMMOBPYlVWd3V6oOjTIPhBtrdf5HIKznPdygpzaCwv9MRn5c8DtzGPHV7/517v9pU1CW8+2guC2jVAHt7Wg+IM/4z+vHaxOzsB2n5UgPZaaeKAASA0O0thgABHLMiLZlQpPzO7qKlzvMfpTtWg==,iv:W7cnqmAyT1KvWkg5gzbVmTJ90EC+jbsDg96glISoAXc=,tag:1T2Sa/dYyYFfPPrLBrdUsg==,type:str]
|
credentials: ENC[AES256_GCM,data:jOJNNcqcWdtUpc78wUcxFqKiRHwHdCE+OkhyGOjMaGcBsaBlHUT/WccApQZ1IVVPfRMAtakHYaVfXKeWH2Nz,iv:OQWH2Hb+a5rrWyut/drRLlJeF96SYm+WZVi1UYZS+zk=,tag:F0fATlif7rmIZuAGyiGv1g==,type:str]
|
||||||
sops:
|
sops:
|
||||||
age:
|
age:
|
||||||
- recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
|
- recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
|
||||||
@@ -37,7 +37,7 @@ sops:
|
|||||||
ektNUE8xUmRsWEtyajNIYitEbWgyS0kKeKBcJV6/EQKhkbYeE+ALctucmOKV5hDD
|
ektNUE8xUmRsWEtyajNIYitEbWgyS0kKeKBcJV6/EQKhkbYeE+ALctucmOKV5hDD
|
||||||
1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w==
|
1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w==
|
||||||
-----END AGE ENCRYPTED FILE-----
|
-----END AGE ENCRYPTED FILE-----
|
||||||
lastmodified: "2025-11-19T05:03:49Z"
|
lastmodified: "2026-05-20T04:59:28Z"
|
||||||
mac: ENC[AES256_GCM,data:uqhNCdl+we0UBjPFOBngA/2ywwXfIxpgXB9ozb7Vcy/sEZCoSob+VuEAzBQ/cbE5EuBlxoltg3Ve0r0xNNQQ5rZ+q6rfyRaSLrO1Xd3B5ITg6hLHLXIjFOGW6q15E2X1vKipnXGE11LZCsTEHCS1JCntLxMu+cTpIZbnVOx+KcY=,iv:6/H5fPHtyqvkkONF49AxLAjKVQpY+jcGm+4d+a2aa9U=,tag:hdoKyv64RpxnbQfd+S6FLg==,type:str]
|
mac: ENC[AES256_GCM,data:AOz3ei4hxSjMT8Xpn3nDzLUzNFQcYDQPu5nUdamgq0e1Y8j9pV7dQNAO0tgAdMxnz3hDPLnF7lmdvI6XdOj/F4gpoc/jm+2LwG405vCKBUvtW03Tx1vq9gmE9xwXo+RK3m7m2Rf4LP+ZS1uThEgrd4nceze/Heimj5acKSAdch4=,iv:rYiBCZK17Gii8vSRpMhzty4dtjjVuunMjrrey+8264A=,tag:ZdpVWajiJUjwtDncVDUBmw==,type:str]
|
||||||
unencrypted_suffix: _unencrypted
|
unencrypted_suffix: _unencrypted
|
||||||
version: 3.10.2
|
version: 3.12.1
|
||||||
|
|||||||
Reference in New Issue
Block a user