idk

homelab-services/minio-service/flake.nix

@@ -36,10 +36,19 @@
             description = "File containing MinIO credentials.";
           };
 
+          bootstrap-minio = {
+            enable = lib.mkEnableOption "Enable bootstrapping minio creds";
+            environments = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+              default = [];
+              description = "list of environments to bootstrap (dev, prod, stage, etc)";
+            };
+          };
+
           default-nginx = {
             enable = lib.mkEnableOption "Enable nginx reverse proxy for MinIO";
             hostname = lib.mkOption {
-              type = lib.types.str;
+              type = lib.types.list lib.types.str;
               default = "localhost";
               description = "Hostname for nginx reverse proxy.";
             };
@@ -74,6 +83,25 @@
             };
           };
 
+          systemd.services.bootstrap-minio = lib.mkIf opts.bootstrap-minio.enable {
+            description = "Minio bootstrap users, policies, buckets";
+            after = [ "minio.service" ];
+            requires = [ "minio.service" ];
+            wantedBy = [ "multi-user.target" ];
+
+            serviceConfig = {
+              Type = "oneshot";
+              ExecStart = pkgs.writeShellScript "bootstrap-minio" ''
+                set -euo pipefail
+
+                echo $SHELL
+              '';
+              User = "minio";
+              Group = "minio";
+              
+            };
+          };
+
           services.nginx = lib.mkIf opts.default-nginx.enable {
             enable = true;
             virtualHosts.${opts.default-nginx.hostname} = {
@@ -82,12 +110,6 @@
               acmeRoot = null;
               # Dev and Prod buckets must be created manually
               # will work on script/minio command line for this later
-              locations."/dev" = {
-                proxyPass = "http://localhost:${toString opts.dataPort}/dev";
-              };
-              locations."/prod" = {
-                proxyPass = "http://localhost:${toString opts.dataPort}/prod";
-              };
               locations."/console" = {
                 proxyPass = "http://localhost:${toString opts.consolePort}/browser";
               };

nixos/secrets/minio.yaml

@@ -1,4 +1,4 @@
-minioCredentials: ENC[AES256_GCM,data:+DlcdCZ4LVwaJz9Ham32K2q04Z5yT2M4e4xAqDmm0yI7r7vOPoUV0bdUrQpRIoolOhCTuYP7GD4vKREYAmx9jZns,iv:hykXPSrX1GxAs9r1BCsvkAq6FX/BjrHIVw2b5wCiF9k=,tag:dImEF+Um1f6PFqKAKsRplw==,type:str]
+minioCredentials: ENC[AES256_GCM,data:Ipbne+j6W7agqeaWU9MEAuKbTbEWrnwy7Qo1eI4CsiqtFgYhPCFBfm1UYxMS2ppfEngdkVPuehUdHKCSV3zBNeEl9gNzJnE4eAl/eKGUttgGs+VdKqc/j89eM8d6io/zebJjCh9oI6TKO/HznfDS8UntDmem2ZeDRD5HEt+kLFIpeS7oKDSLkaH8hRG5O+TA+avIO2nGWU0Wci+tfIjwPZQpKYyzaO5VwJg=,iv:cEFMUHAV1v2ISR07iBD1FWmfrZVon0h1c/6ixAvbKDY=,tag:qDrhqjcJVuGOdUBj1ZLodA==,type:str]
 sops:
     age:
         - recipient: age13ldedhh6ymava0d5dn54860a3f799gufknre9lfegegjt9ytes2qq5qgmr
@@ -19,7 +19,7 @@ sops:
             cmhUZUxNSitwSjJDRSticXkvRldtWFEKdyBb6PqMfIeE2BSjNAyYdaoAviaDzU6m
             jRf2N7UV5RIdodxh+xwhBB0YO/bl64KWwPKKRagkMGBEwHGd4sMXuA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-06-13T03:43:44Z"
-    mac: ENC[AES256_GCM,data:TZZKAovCNYraSsjdecEIp4/+enPdOhQVOAG+C0n7hRfdv2KEHcOKiqxRf8u/JLLyO1XTCqlsNxwuPMGpArzklaj5luK7uRYxU0rQYfBW6Rfn5vV/YpSBtGMlg3CDUoUaKAvGFu9QWnailnDMFVHDxFX8+wzb+x+iJub/JihciSQ=,iv:Ev0E3IW653E7+rMQcdkA3rvkVwlRwitNQtMd99g9i2c=,tag:8YYhkkHYrOB2dLnwpNEMEQ==,type:str]
+    lastmodified: "2025-08-17T01:10:22Z"
+    mac: ENC[AES256_GCM,data:oTMIg3gQI/8yYWGeHj0LVMsyb5pNV56IylxAQsLxiCJUG/MEMM0ullQextFLmkIXwBr6+K+n6TekD8k17HfK0e0Y4JlSvfwC+CDuiFtfvR9NCp4h1jEL8GE9D8IwmfzHVjl/iPlClhgqytr26+jyBO38OWN1LKPzzCSANvo7FM4=,iv:VYNml+txUbuP2tHQNf+9tG9oEVB4ioRXTmW50dyRza0=,tag:NRLWkCwmlp8iIVOJBWtF2w==,type:str]
     unencrypted_suffix: _unencrypted
     version: 3.10.2