RoyDumblauskas/homelab-config
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

remove usernames from secret file, they're not used

Browse Source
This commit is contained in:
RoyDumblauskas
2026-05-20 00:00:37 -05:00
parent 802902bc39
commit 298d3f2fc5
3 changed files with 167 additions and 160 deletions
Download Patch File Download Diff File Expand all files Collapse all files
homelab-services/postgresql-db/flake.nix
+161 -152
View File
@@ -5,165 +5,174 @@
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
};
outputs = { self, nixpkgs, ...}: {
nixosModules.postgresql-db = {config, lib, pkgs, ...}:
let
opts = config.services.postgresql-db;
in {
options.services.postgresql-db = {
enable = lib.mkEnableOption "Postgres make DBs";
outputs =
{ self, nixpkgs, ... }:
{
nixosModules.postgresql-db =
{
config,
lib,
pkgs,
...
}:
let
opts = config.services.postgresql-db;
in
{
options.services.postgresql-db = {
enable = lib.mkEnableOption "Postgres make DBs";
dataDir = lib.mkOption {
type = lib.types.path;
default = "/var/lib/postgresql";
description = "Where to store database data";
};
dataDir = lib.mkOption {
type = lib.types.path;
default = "/var/lib/postgresql";
description = "Where to store database data";
};
port = lib.mkOption {
type = lib.types.port;
default = 5432;
description = "port to host postgresql";
};
port = lib.mkOption {
type = lib.types.port;
default = 5432;
description = "port to host postgresql";
};
credentialsFile = lib.mkOption {
type = lib.types.path;
description = ''
File containing postgresql user credentials.
Only the Passwords. Names of Users just follow the pattern:
<DB_Name>_produser
<DB_Name>_devuser
Password Format:
PSQL_<DB>_PASSWORD=password
PSQL_<DB>_DEV_PASSWORD=dev_password
'';
};
credentialsFile = lib.mkOption {
type = lib.types.path;
description = ''
File containing postgresql user credentials.
Only the Passwords. Names of Users just follow the pattern:
<DB_Name>_produser
<DB_Name>_devuser
databases = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [];
description = "list of databases to bootstrap. Will expand into DB, and DB-DEV for each item. And each Database will recieve it's own user. The user credentials must be in the correct format in the credentials file.";
};
};
Password Format:
PSQL_<DB>_PASSWORD=password
PSQL_<DB>_DEV_PASSWORD=dev_password
'';
};
config = lib.mkIf opts.enable {
users.groups.postgres = {};
users.users.postgres = {
isSystemUser = true;
createHome = true;
home = opts.dataDir;
group = "postgres";
};
services.postgresql = {
enable = true;
enableTCPIP = true;
dataDir = opts.dataDir;
settings.port = opts.port;
identMap = ''
postgres roy postgres
'';
# allow remote connections to dev databases
authentication = pkgs.lib.mkOverride 10 ''
local all postgres peer map=postgres
local all all peer
# Dev can be connected to via the LAN or Local
${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser all md5\n") opts.databases) }
# Prod can be connected via local machine
${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser 127.0.0.1/32 md5\n") opts.databases) }
${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser ::1/128 md5\n") opts.databases) }
'';
};
systemd.services.bootstrap-psql = {
description = "Bootstrap psql databases and users";
after = [ "postgresql.service" ];
requires = [ "postgresql.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
User = "postgres";
Group = "postgres";
EnvironmentFile = opts.credentialsFile;
ExecStart = pkgs.writeShellScript "bootstrap-psql" ''
set -euo pipefail
psql_bin=${pkgs.postgresql}/bin/psql
for db in ${lib.escapeShellArgs opts.databases}; do
db_upper="''${db^^}"
user_var="PSQL_''${db_upper}_USER"
pass_var="PSQL_''${db_upper}_PASSWORD"
dev_user_var="PSQL_''${db_upper}_DEV_USER"
dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD"
user_val="$db"_produser
pass_val=$(eval "echo \''${$pass_var:-}")
dev_user_val="$db"_devuser
dev_pass_val=$(eval "echo \''${$dev_pass_var:-}")
if [ -z "$pass_val" ]; then
echo "Missing password credentials for database '$db'" >&2
exit 1
fi
if [ -z "$dev_pass_val" ]; then
echo "Missing password credentials for database '$db'_dev" >&2
exit 1
fi
echo "Bootstrapping PostgreSQL for database: $db"
# Create databases if not exists
if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci ""$db" "; then
echo "$db already exists, skipping creation."
else
echo "Creating database $db"
$psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db";"
fi
if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci "$db"_dev; then
echo ""$db"_dev already exists, skipping creation."
else
echo "Creating database "$db"_dev"
$psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db"_dev;"
fi
# Create users if not exists
if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$user_val"; then
echo "$user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
else
echo "Creating $user_val"
$psql_bin --port=${toString opts.port} -c "CREATE ROLE "$user_val" WITH LOGIN PASSWORD '$pass_val';"
fi
if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$dev_user_val"; then
echo "$dev_user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
else
echo "Creating $dev_user_val"
$psql_bin --port=${toString opts.port} -c "CREATE ROLE "$dev_user_val" WITH LOGIN PASSWORD '$dev_pass_val';"
fi
# Give users privileges on databases (always)
$psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db" TO "$user_val";"
$psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db"_dev TO "$dev_user_val";"
# Grant ownership
$psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db" OWNER TO "$user_val";"
$psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db"_dev OWNER TO "$dev_user_val";"
done
'';
databases = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
description = "list of databases to bootstrap. Will expand into DB, and DB-DEV for each item. And each Database will recieve it's own user. The user credentials must be in the correct format in the credentials file.";
};
};
networking.firewall.allowedTCPPorts = lib.mkIf opts.enable [ opts.port] ;
};
config = lib.mkIf opts.enable {
users.groups.postgres = { };
users.users.postgres = {
isSystemUser = true;
createHome = true;
home = opts.dataDir;
group = "postgres";
};
services.postgresql = {
enable = true;
enableTCPIP = true;
dataDir = opts.dataDir;
settings.port = opts.port;
identMap = ''
postgres roy postgres
'';
# allow remote connections to dev databases
authentication = pkgs.lib.mkOverride 10 ''
local all postgres peer map=postgres
local all all peer
# Dev can be connected to via the LAN or Local
${lib.concatStringsSep " " (map (db: "host ${db}_dev ${db}_devuser all md5\n") opts.databases)}
# Prod can be connected via local machine
${lib.concatStringsSep " " (
map (db: "host ${db} ${db}_produser 127.0.0.1/32 md5\n") opts.databases
)}
${lib.concatStringsSep " " (map (db: "host ${db} ${db}_produser ::1/128 md5\n") opts.databases)}
'';
};
systemd.services.bootstrap-psql = {
description = "Bootstrap psql databases and users";
after = [ "postgresql.service" ];
requires = [ "postgresql.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
User = "postgres";
Group = "postgres";
EnvironmentFile = opts.credentialsFile;
ExecStart = pkgs.writeShellScript "bootstrap-psql" ''
set -euo pipefail
psql_bin=${pkgs.postgresql}/bin/psql
for db in ${lib.escapeShellArgs opts.databases}; do
db_upper="''${db^^}"
pass_var="PSQL_''${db_upper}_PASSWORD"
dev_pass_var="PSQL_''${db_upper}_DEV_PASSWORD"
user_val="$db"_produser
pass_val=$(eval "echo \''${$pass_var:-}")
dev_user_val="$db"_devuser
dev_pass_val=$(eval "echo \''${$dev_pass_var:-}")
if [ -z "$pass_val" ]; then
echo "Missing password credentials for database '$db'" >&2
exit 1
fi
if [ -z "$dev_pass_val" ]; then
echo "Missing password credentials for database '$db'_dev" >&2
exit 1
fi
echo "Bootstrapping PostgreSQL for database: $db"
# Create databases if not exists
if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci ""$db" "; then
echo "$db already exists, skipping creation."
else
echo "Creating database $db"
$psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db";"
fi
if $psql_bin --port=${toString opts.port} -c "\l" | grep -ci "$db"_dev; then
echo ""$db"_dev already exists, skipping creation."
else
echo "Creating database "$db"_dev"
$psql_bin --port=${toString opts.port} -c "CREATE DATABASE "$db"_dev;"
fi
# Create users if not exists
if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$user_val"; then
echo "$user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
else
echo "Creating $user_val"
$psql_bin --port=${toString opts.port} -c "CREATE ROLE "$user_val" WITH LOGIN PASSWORD '$pass_val';"
fi
if $psql_bin --port=${toString opts.port} -c "\du" | grep -ci "$dev_user_val"; then
echo "$dev_user_val already exists, skipping creation. WARN: password may not be correct. Delete user and allow to be recreated for assurity"
else
echo "Creating $dev_user_val"
$psql_bin --port=${toString opts.port} -c "CREATE ROLE "$dev_user_val" WITH LOGIN PASSWORD '$dev_pass_val';"
fi
# Give users privileges on databases (always)
$psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db" TO "$user_val";"
$psql_bin --port=${toString opts.port} -c "GRANT ALL PRIVILEGES ON DATABASE "$db"_dev TO "$dev_user_val";"
# Grant ownership
$psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db" OWNER TO "$user_val";"
$psql_bin --port=${toString opts.port} -c "ALTER DATABASE "$db"_dev OWNER TO "$dev_user_val";"
done
'';
};
};
networking.firewall.allowedTCPPorts = lib.mkIf opts.enable [ opts.port ];
};
};
};
};
}
nixos/configuration.nix
+2 -4
View File
@@ -135,8 +135,6 @@ in
# Fullstack sourcecode
# Minio for backend storage
# Should be able to decalre as a nixos module
# which builds container and pushes to k3s
services.minio-service = {
enable = true;
@@ -161,11 +159,11 @@ in
};
};
# Postgresql/postgrest for row storage
# Postgresql/postgrest for row storage (not on k3s)
services.postgresql-db = {
enable = true;
dataDir = "/var/lib/postgresql";
port = 5431;
port = 5432;
credentialsFile = config.sops.secrets."postgresql-credentials".path;
databases = [ "rdblog" ];
};
nixos/secrets/psql.yaml
+4 -4
View File
@@ -1,4 +1,4 @@
credentials: ENC[AES256_GCM,data:c05URk3EnazNDMMOBPYlVWd3V6oOjTIPhBtrdf5HIKznPdygpzaCwv9MRn5c8DtzGPHV7/517v9pU1CW8+2guC2jVAHt7Wg+IM/4z+vHaxOzsB2n5UgPZaaeKAASA0O0thgABHLMiLZlQpPzO7qKlzvMfpTtWg==,iv:W7cnqmAyT1KvWkg5gzbVmTJ90EC+jbsDg96glISoAXc=,tag:1T2Sa/dYyYFfPPrLBrdUsg==,type:str]
credentials: ENC[AES256_GCM,data:jOJNNcqcWdtUpc78wUcxFqKiRHwHdCE+OkhyGOjMaGcBsaBlHUT/WccApQZ1IVVPfRMAtakHYaVfXKeWH2Nz,iv:OQWH2Hb+a5rrWyut/drRLlJeF96SYm+WZVi1UYZS+zk=,tag:F0fATlif7rmIZuAGyiGv1g==,type:str]
sops:
age:
- recipient: age1zad0qu648dhjav4pzjhkc6vswnqtacuv9230xcgle8wmv56r8ykqn0ud7y
@@ -37,7 +37,7 @@ sops:
ektNUE8xUmRsWEtyajNIYitEbWgyS0kKeKBcJV6/EQKhkbYeE+ALctucmOKV5hDD
1WiDsujdVQkAp1WtBFc9KHexaEJ1DjKVOKsIIjj/YlmKz5P0S7Sm0w==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-11-19T05:03:49Z"
mac: ENC[AES256_GCM,data:uqhNCdl+we0UBjPFOBngA/2ywwXfIxpgXB9ozb7Vcy/sEZCoSob+VuEAzBQ/cbE5EuBlxoltg3Ve0r0xNNQQ5rZ+q6rfyRaSLrO1Xd3B5ITg6hLHLXIjFOGW6q15E2X1vKipnXGE11LZCsTEHCS1JCntLxMu+cTpIZbnVOx+KcY=,iv:6/H5fPHtyqvkkONF49AxLAjKVQpY+jcGm+4d+a2aa9U=,tag:hdoKyv64RpxnbQfd+S6FLg==,type:str]
lastmodified: "2026-05-20T04:59:28Z"
mac: ENC[AES256_GCM,data:AOz3ei4hxSjMT8Xpn3nDzLUzNFQcYDQPu5nUdamgq0e1Y8j9pV7dQNAO0tgAdMxnz3hDPLnF7lmdvI6XdOj/F4gpoc/jm+2LwG405vCKBUvtW03Tx1vq9gmE9xwXo+RK3m7m2Rf4LP+ZS1uThEgrd4nceze/Heimj5acKSAdch4=,iv:rYiBCZK17Gii8vSRpMhzty4dtjjVuunMjrrey+8264A=,tag:ZdpVWajiJUjwtDncVDUBmw==,type:str]
unencrypted_suffix: _unencrypted
version: 3.10.2
version: 3.12.1