le grande update
This commit is contained in:
RoyDumblauskas committed
1 parent
c889c4b2de
commit
e1aa2b47d3
6 files changed
+48
-320
No files matched your search
Generated
+6
-6
@@ -23,11 +23,11 @@
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782091909,
|
||||
"narHash": "sha256-q9ygpiowWPeS/FzBz7gekF4uUamJSXH/TTMf4y0j23I=",
|
||||
"lastModified": 1790310854,
|
||||
"narHash": "sha256-QuU33Sw5IjLKKq8xitpNSHnOUTgjTG9ZQdqOdIRz4F8=",
|
||||
"owner": "Infinidoge",
|
||||
"repo": "nix-minecraft",
|
||||
"rev": "794884dacd31b251bce5abf2cf324be3659d5322",
|
||||
"rev": "8945905e42ce06b68464fcd7614937bb382a95f2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -54,11 +54,11 @@
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1781808408,
|
||||
"narHash": "sha256-0sOb6OIaD/K1zHxBhpmlKvkADfe0n8+l4Jj2e1Q0r3w=",
|
||||
"lastModified": 1790340521,
|
||||
"narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "e8210c649915deed7080033cdbabcc19e40bb899",
|
||||
"rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
-27
@@ -1,27 +0,0 @@
|
||||
{
|
||||
"nodes": {
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1781216227,
|
||||
"narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-26.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
@@ -1,245 +0,0 @@
|
||||
{
|
||||
description = "minio service for storing images with api access";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
|
||||
};
|
||||
|
||||
outputs =
|
||||
{ ... }:
|
||||
{
|
||||
nixosModules.minio-service =
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
opts = config.services.minio-service;
|
||||
in
|
||||
{
|
||||
options.services.minio-service = {
|
||||
enable = lib.mkEnableOption "MinIO object storage server";
|
||||
|
||||
dataDir = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "/var/lib/minio";
|
||||
description = "Directory to store MinIO data.";
|
||||
};
|
||||
|
||||
dataPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 9000;
|
||||
description = "MinIO S3 API port.";
|
||||
};
|
||||
|
||||
consolePort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 9001;
|
||||
description = "MinIO Admin Console port.";
|
||||
};
|
||||
|
||||
credentialsFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "File containing MinIO credentials.";
|
||||
};
|
||||
|
||||
bootstrap-minio = {
|
||||
enable = lib.mkEnableOption "Enable bootstrapping minio creds";
|
||||
environments = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
description = "list of environments to bootstrap (dev, prod, stage, etc)";
|
||||
};
|
||||
};
|
||||
|
||||
default-nginx = {
|
||||
enable = lib.mkEnableOption "Enable nginx reverse proxy for MinIO";
|
||||
hostname = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "localhost";
|
||||
description = "Hostname for nginx reverse proxy.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf opts.enable {
|
||||
users.groups.minio = { };
|
||||
users.users.minio = {
|
||||
isSystemUser = true;
|
||||
createHome = true;
|
||||
home = "${opts.dataDir}";
|
||||
group = "minio";
|
||||
};
|
||||
|
||||
systemd.services.minio = {
|
||||
description = "MinIO S3-compatible object storage";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = ''
|
||||
${pkgs.minio}/bin/minio server ${opts.dataDir} \
|
||||
--address ":${toString opts.dataPort}" \
|
||||
--console-address ":${toString opts.consolePort}"
|
||||
'';
|
||||
|
||||
User = "minio";
|
||||
Group = "minio";
|
||||
# This breaks the local browser access
|
||||
# Environment = ''
|
||||
# MINIO_BROWSER_REDIRECT_URL=https://${opts.default-nginx.hostname}/console
|
||||
# '';
|
||||
EnvironmentFile = "${opts.credentialsFile}";
|
||||
Restart = "always";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.bootstrap-minio = lib.mkIf opts.bootstrap-minio.enable {
|
||||
description = "Minio bootstrap users, policies, buckets";
|
||||
after = [ "minio.service" ];
|
||||
requires = [ "minio.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = pkgs.writeShellScript "bootstrap-minio" ''
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
alias_name="local"
|
||||
mc_bin=${pkgs.minio-client}/bin/mc
|
||||
|
||||
# Delete alias if it already exists
|
||||
$mc_bin alias rm "$alias_name" || true
|
||||
|
||||
# Point mc at the local minio instance
|
||||
$mc_bin alias set "$alias_name" http://localhost:${toString opts.dataPort} \
|
||||
"$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
|
||||
|
||||
# Loop through requested environments
|
||||
for env in ${lib.escapeShellArgs opts.bootstrap-minio.environments}; do
|
||||
bucket="$env"
|
||||
user_var="MINIO_''${env^^}_USER"
|
||||
pass_var="MINIO_''${env^^}_PASSWORD"
|
||||
|
||||
# expand env var names dynamically
|
||||
user_val=$(eval "echo \''${$user_var:-}")
|
||||
pass_val=$(eval "echo \''${$pass_var:-}")
|
||||
|
||||
if [ -z "$user_val" ] || [ -z "$pass_val" ]; then
|
||||
echo "Missing credentials for $env ($user_var / $pass_var)" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
policy="policy-$env"
|
||||
|
||||
echo "Bootstrapping environment: $env"
|
||||
|
||||
# Create bucket if not exists
|
||||
$mc_bin mb --ignore-existing "$alias_name/$bucket"
|
||||
|
||||
# Set bucket limit in future
|
||||
# $mc_bin bucket quota is deprecated
|
||||
|
||||
# Create policy JSON (full access to that bucket)
|
||||
policy_file=$(mktemp)
|
||||
cat > "$policy_file" <<EOF
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": ["s3:*"],
|
||||
"Resource": [
|
||||
"arn:aws:s3:::$bucket",
|
||||
"arn:aws:s3:::$bucket/*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
|
||||
# Apply policy
|
||||
$mc_bin admin policy create "$alias_name" "$policy" "$policy_file"
|
||||
|
||||
# Create or update user
|
||||
if ! $mc_bin admin user info "$alias_name" "$user_val" >/dev/null 2>&1; then
|
||||
$mc_bin admin user add "$alias_name" "$user_val" "$pass_val"
|
||||
echo "Created user $user_val"
|
||||
fi
|
||||
|
||||
# Attach policy
|
||||
$mc_bin admin policy attach "$alias_name" "$policy" --user "''${user_val}"
|
||||
|
||||
# Cleanup
|
||||
rm -f "$policy_file"
|
||||
|
||||
done
|
||||
'';
|
||||
User = "minio";
|
||||
Group = "minio";
|
||||
EnvironmentFile = "${opts.credentialsFile}";
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = lib.mkIf opts.default-nginx.enable {
|
||||
enable = true;
|
||||
|
||||
virtualHosts.${opts.default-nginx.hostname} = {
|
||||
forceSSL = true;
|
||||
|
||||
# Parse TLD from hostname to use wildcard cert (just takes last two elements separated by a period)
|
||||
useACMEHost =
|
||||
let
|
||||
b = builtins;
|
||||
s = lib.strings;
|
||||
fl = s.splitString "." "${opts.default-nginx.hostname}";
|
||||
in
|
||||
b.concatStringsSep "." [
|
||||
(b.elemAt fl (b.length fl - 2))
|
||||
(b.elemAt fl (b.length fl - 1))
|
||||
];
|
||||
|
||||
# This does not work even with the MINIO_BROWSER_REDIRECT_URL set
|
||||
locations."/console" = {
|
||||
proxyPass = "http://localhost:${toString opts.consolePort}";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
'';
|
||||
};
|
||||
|
||||
# Add directive for s3like queries, which only accept root path allegedly
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:${toString opts.dataPort}";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
client_max_body_size 0;
|
||||
proxy_buffering off;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkMerge [
|
||||
(lib.mkIf opts.enable [
|
||||
opts.dataPort
|
||||
opts.consolePort
|
||||
])
|
||||
(lib.mkIf opts.default-nginx.enable [
|
||||
80
|
||||
443
|
||||
])
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Generated
+3
-3
@@ -2,11 +2,11 @@
|
||||
"nodes": {
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1781216227,
|
||||
"narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
|
||||
"lastModified": 1790340521,
|
||||
"narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
|
||||
"rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
+3
-3
@@ -2,11 +2,11 @@
|
||||
"nodes": {
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1789114715,
|
||||
"narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
|
||||
"lastModified": 1790340521,
|
||||
"narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "21a67dc470149f337cecafbe965d8d252a390518",
|
||||
"rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
Generated
+36
-36
@@ -7,11 +7,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1781152676,
|
||||
"narHash": "sha256-RxWs5ND31KzTG7wvMM+PMfUjyNpmIEr999lqNARaM5o=",
|
||||
"lastModified": 1789770686,
|
||||
"narHash": "sha256-uZkBR7yHdIKUFB5SZdfgh1qkGfI3XmYmI/lTiquxbck=",
|
||||
"owner": "nix-community",
|
||||
"repo": "disko",
|
||||
"rev": "ff8702b4de27f72b4c78573dfb89ec74e36abdf1",
|
||||
"rev": "725ea35e410ad83be4931d1bff7e090eacaf3563",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -28,11 +28,11 @@
|
||||
},
|
||||
"locked": {
|
||||
"dir": "pkgs/firefox-addons",
|
||||
"lastModified": 1789185767,
|
||||
"narHash": "sha256-jaWL9beN3ifjNzNEBxo0abA+TSi0n7Q8LRQvZTxEqaM=",
|
||||
"lastModified": 1790395354,
|
||||
"narHash": "sha256-UfIw3T23XyA9pGul+UbDQ1QW0SfpGI1zC/aQonx3mDI=",
|
||||
"owner": "rycee",
|
||||
"repo": "nur-expressions",
|
||||
"rev": "811170bb74b11f3b9489618ce77487cc58c79067",
|
||||
"rev": "f2188a86e55cd04677a31a9b101dc702024479c7",
|
||||
"type": "gitlab"
|
||||
},
|
||||
"original": {
|
||||
@@ -100,11 +100,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1789182507,
|
||||
"narHash": "sha256-9nt4W0HNNP84B+b37yRs9Zxat1ZR5guJxEZDEjAgex4=",
|
||||
"lastModified": 1790215976,
|
||||
"narHash": "sha256-VkR1rMGyjU9jtw8ISFx5uqR9e+LEaOlhHwrseFkiIVk=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "b1d1b60084970f9d1e2b72662639dab6d039be71",
|
||||
"rev": "a6631107a83ceab5872f298a2ea710859c80c4cb",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -190,11 +190,11 @@
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782091909,
|
||||
"narHash": "sha256-q9ygpiowWPeS/FzBz7gekF4uUamJSXH/TTMf4y0j23I=",
|
||||
"lastModified": 1790310854,
|
||||
"narHash": "sha256-QuU33Sw5IjLKKq8xitpNSHnOUTgjTG9ZQdqOdIRz4F8=",
|
||||
"owner": "Infinidoge",
|
||||
"repo": "nix-minecraft",
|
||||
"rev": "794884dacd31b251bce5abf2cf324be3659d5322",
|
||||
"rev": "8945905e42ce06b68464fcd7614937bb382a95f2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -205,11 +205,11 @@
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1787525875,
|
||||
"narHash": "sha256-sKbMlkDCBVmAjUVT94LwhVtET/YEMtZaFdn5UduWxz8=",
|
||||
"lastModified": 1790340521,
|
||||
"narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a3b98866eecd08edac6e61a3081e69540a35020f",
|
||||
"rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -253,11 +253,11 @@
|
||||
},
|
||||
"nixpkgs_4": {
|
||||
"locked": {
|
||||
"lastModified": 1781808408,
|
||||
"narHash": "sha256-0sOb6OIaD/K1zHxBhpmlKvkADfe0n8+l4Jj2e1Q0r3w=",
|
||||
"lastModified": 1790340521,
|
||||
"narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "e8210c649915deed7080033cdbabcc19e40bb899",
|
||||
"rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -269,11 +269,11 @@
|
||||
},
|
||||
"nixpkgs_5": {
|
||||
"locked": {
|
||||
"lastModified": 1781216227,
|
||||
"narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
|
||||
"lastModified": 1790340521,
|
||||
"narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
|
||||
"rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -285,11 +285,11 @@
|
||||
},
|
||||
"nixpkgs_6": {
|
||||
"locked": {
|
||||
"lastModified": 1789114715,
|
||||
"narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
|
||||
"lastModified": 1790340521,
|
||||
"narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "21a67dc470149f337cecafbe965d8d252a390518",
|
||||
"rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -301,11 +301,11 @@
|
||||
},
|
||||
"nixpkgs_7": {
|
||||
"locked": {
|
||||
"lastModified": 1788405554,
|
||||
"narHash": "sha256-r2f1oUwixlgq9zOdYLqJLfS/lWBT60/IITjhTKI59JU=",
|
||||
"lastModified": 1789749394,
|
||||
"narHash": "sha256-cFTsMQz8Hzn8MT49oaeLSHg62tE86NykugCWkeM2ypk=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a5cc6f2c37bf518436dc8d1c288ccd0c43c2f4c4",
|
||||
"rev": "cf9d2fb3e50fa1cd5114c47505ea9177f7ff5f49",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -317,11 +317,11 @@
|
||||
},
|
||||
"nixpkgs_8": {
|
||||
"locked": {
|
||||
"lastModified": 1789114715,
|
||||
"narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
|
||||
"lastModified": 1790340521,
|
||||
"narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "21a67dc470149f337cecafbe965d8d252a390518",
|
||||
"rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -338,11 +338,11 @@
|
||||
"systems": "systems_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1788623321,
|
||||
"narHash": "sha256-i8v07Plhfpx/nVFMvnMSC6P05RQ43mbLQsS5grni4Vk=",
|
||||
"lastModified": 1789959143,
|
||||
"narHash": "sha256-9oBHyJtUyunZL+6v0Ub8Y759cXcejQiTHpXtGcx5RLs=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixvim",
|
||||
"rev": "68c2edd2787f055d9c306bcfe726f3b8f11b9441",
|
||||
"rev": "4836e77b1798cd42e2de28593bec4c1788da08f5",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -405,11 +405,11 @@
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1788914643,
|
||||
"narHash": "sha256-4GuMPW90JSxXWDPUB9M+1m7fYbe3H0apOd86/zBQ2Kw=",
|
||||
"lastModified": 1790247521,
|
||||
"narHash": "sha256-TNfgoHsqsYYvaJImlWctfRkh4PseTagzegU1Dgdbehw=",
|
||||
"owner": "Mic92",
|
||||
"repo": "sops-nix",
|
||||
"rev": "13616fff713a9f94055c66f15687ebdc17a335df",
|
||||
"rev": "2bd00bd9bb35fe6d114888c8f1c2e946c541dd8f",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
Reference in new issue
Block a user