le grande update
This commit is contained in:
RoyDumblauskas committed
1 parent
c889c4b2de
commit
e1aa2b47d3
6 files changed
+48
-320
No files matched your search
Generated
+6
-6
@@ -23,11 +23,11 @@
|
||||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1782091909,
|
||||
"narHash": "sha256-q9ygpiowWPeS/FzBz7gekF4uUamJSXH/TTMf4y0j23I=",
|
||||
"lastModified": 1790310854,
|
||||
"narHash": "sha256-QuU33Sw5IjLKKq8xitpNSHnOUTgjTG9ZQdqOdIRz4F8=",
|
||||
"owner": "Infinidoge",
|
||||
"repo": "nix-minecraft",
|
||||
"rev": "794884dacd31b251bce5abf2cf324be3659d5322",
|
||||
"rev": "8945905e42ce06b68464fcd7614937bb382a95f2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
@@ -54,11 +54,11 @@
|
||||
},
|
||||
"nixpkgs_2": {
|
||||
"locked": {
|
||||
"lastModified": 1781808408,
|
||||
"narHash": "sha256-0sOb6OIaD/K1zHxBhpmlKvkADfe0n8+l4Jj2e1Q0r3w=",
|
||||
"lastModified": 1790340521,
|
||||
"narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "e8210c649915deed7080033cdbabcc19e40bb899",
|
||||
"rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
-27
@@ -1,27 +0,0 @@
|
||||
{
|
||||
"nodes": {
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1781216227,
|
||||
"narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"ref": "nixos-26.05",
|
||||
"repo": "nixpkgs",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"root": {
|
||||
"inputs": {
|
||||
"nixpkgs": "nixpkgs"
|
||||
}
|
||||
}
|
||||
},
|
||||
"root": "root",
|
||||
"version": 7
|
||||
}
|
||||
@@ -1,245 +0,0 @@
|
||||
{
|
||||
description = "minio service for storing images with api access";
|
||||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-26.05";
|
||||
};
|
||||
|
||||
outputs =
|
||||
{ ... }:
|
||||
{
|
||||
nixosModules.minio-service =
|
||||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
let
|
||||
opts = config.services.minio-service;
|
||||
in
|
||||
{
|
||||
options.services.minio-service = {
|
||||
enable = lib.mkEnableOption "MinIO object storage server";
|
||||
|
||||
dataDir = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "/var/lib/minio";
|
||||
description = "Directory to store MinIO data.";
|
||||
};
|
||||
|
||||
dataPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 9000;
|
||||
description = "MinIO S3 API port.";
|
||||
};
|
||||
|
||||
consolePort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 9001;
|
||||
description = "MinIO Admin Console port.";
|
||||
};
|
||||
|
||||
credentialsFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "File containing MinIO credentials.";
|
||||
};
|
||||
|
||||
bootstrap-minio = {
|
||||
enable = lib.mkEnableOption "Enable bootstrapping minio creds";
|
||||
environments = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
description = "list of environments to bootstrap (dev, prod, stage, etc)";
|
||||
};
|
||||
};
|
||||
|
||||
default-nginx = {
|
||||
enable = lib.mkEnableOption "Enable nginx reverse proxy for MinIO";
|
||||
hostname = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "localhost";
|
||||
description = "Hostname for nginx reverse proxy.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf opts.enable {
|
||||
users.groups.minio = { };
|
||||
users.users.minio = {
|
||||
isSystemUser = true;
|
||||
createHome = true;
|
||||
home = "${opts.dataDir}";
|
||||
group = "minio";
|
||||
};
|
||||
|
||||
systemd.services.minio = {
|
||||
description = "MinIO S3-compatible object storage";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = ''
|
||||
${pkgs.minio}/bin/minio server ${opts.dataDir} \
|
||||
--address ":${toString opts.dataPort}" \
|
||||
--console-address ":${toString opts.consolePort}"
|
||||
'';
|
||||
|
||||
User = "minio";
|
||||
Group = "minio";
|
||||
# This breaks the local browser access
|
||||
# Environment = ''
|
||||
# MINIO_BROWSER_REDIRECT_URL=https://${opts.default-nginx.hostname}/console
|
||||
# '';
|
||||
EnvironmentFile = "${opts.credentialsFile}";
|
||||
Restart = "always";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.bootstrap-minio = lib.mkIf opts.bootstrap-minio.enable {
|
||||
description = "Minio bootstrap users, policies, buckets";
|
||||
after = [ "minio.service" ];
|
||||
requires = [ "minio.service" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
ExecStart = pkgs.writeShellScript "bootstrap-minio" ''
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
alias_name="local"
|
||||
mc_bin=${pkgs.minio-client}/bin/mc
|
||||
|
||||
# Delete alias if it already exists
|
||||
$mc_bin alias rm "$alias_name" || true
|
||||
|
||||
# Point mc at the local minio instance
|
||||
$mc_bin alias set "$alias_name" http://localhost:${toString opts.dataPort} \
|
||||
"$MINIO_ROOT_USER" "$MINIO_ROOT_PASSWORD"
|
||||
|
||||
# Loop through requested environments
|
||||
for env in ${lib.escapeShellArgs opts.bootstrap-minio.environments}; do
|
||||
bucket="$env"
|
||||
user_var="MINIO_''${env^^}_USER"
|
||||
pass_var="MINIO_''${env^^}_PASSWORD"
|
||||
|
||||
# expand env var names dynamically
|
||||
user_val=$(eval "echo \''${$user_var:-}")
|
||||
pass_val=$(eval "echo \''${$pass_var:-}")
|
||||
|
||||
if [ -z "$user_val" ] || [ -z "$pass_val" ]; then
|
||||
echo "Missing credentials for $env ($user_var / $pass_var)" >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
policy="policy-$env"
|
||||
|
||||
echo "Bootstrapping environment: $env"
|
||||
|
||||
# Create bucket if not exists
|
||||
$mc_bin mb --ignore-existing "$alias_name/$bucket"
|
||||
|
||||
# Set bucket limit in future
|
||||
# $mc_bin bucket quota is deprecated
|
||||
|
||||
# Create policy JSON (full access to that bucket)
|
||||
policy_file=$(mktemp)
|
||||
cat > "$policy_file" <<EOF
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": ["s3:*"],
|
||||
"Resource": [
|
||||
"arn:aws:s3:::$bucket",
|
||||
"arn:aws:s3:::$bucket/*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
EOF
|
||||
|
||||
# Apply policy
|
||||
$mc_bin admin policy create "$alias_name" "$policy" "$policy_file"
|
||||
|
||||
# Create or update user
|
||||
if ! $mc_bin admin user info "$alias_name" "$user_val" >/dev/null 2>&1; then
|
||||
$mc_bin admin user add "$alias_name" "$user_val" "$pass_val"
|
||||
echo "Created user $user_val"
|
||||
fi
|
||||
|
||||
# Attach policy
|
||||
$mc_bin admin policy attach "$alias_name" "$policy" --user "''${user_val}"
|
||||
|
||||
# Cleanup
|
||||
rm -f "$policy_file"
|
||||
|
||||
done
|
||||
'';
|
||||
User = "minio";
|
||||
Group = "minio";
|
||||
EnvironmentFile = "${opts.credentialsFile}";
|
||||
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx = lib.mkIf opts.default-nginx.enable {
|
||||
enable = true;
|
||||
|
||||
virtualHosts.${opts.default-nginx.hostname} = {
|
||||
forceSSL = true;
|
||||
|
||||
# Parse TLD from hostname to use wildcard cert (just takes last two elements separated by a period)
|
||||
useACMEHost =
|
||||
let
|
||||
b = builtins;
|
||||
s = lib.strings;
|
||||
fl = s.splitString "." "${opts.default-nginx.hostname}";
|
||||
in
|
||||
b.concatStringsSep "." [
|
||||
(b.elemAt fl (b.length fl - 2))
|
||||
(b.elemAt fl (b.length fl - 1))
|
||||
];
|
||||
|
||||
# This does not work even with the MINIO_BROWSER_REDIRECT_URL set
|
||||
locations."/console" = {
|
||||
proxyPass = "http://localhost:${toString opts.consolePort}";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
'';
|
||||
};
|
||||
|
||||
# Add directive for s3like queries, which only accept root path allegedly
|
||||
locations."/" = {
|
||||
proxyPass = "http://localhost:${toString opts.dataPort}";
|
||||
extraConfig = ''
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
client_max_body_size 0;
|
||||
proxy_buffering off;
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = lib.mkMerge [
|
||||
(lib.mkIf opts.enable [
|
||||
opts.dataPort
|
||||
opts.consolePort
|
||||
])
|
||||
(lib.mkIf opts.default-nginx.enable [
|
||||
80
|
||||
443
|
||||
])
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
Generated
+3
-3
@@ -2,11 +2,11 @@
|
||||
"nodes": {
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1781216227,
|
||||
"narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
|
||||
"lastModified": 1790340521,
|
||||
"narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
|
||||
"rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
+3
-3
@@ -2,11 +2,11 @@
|
||||
"nodes": {
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1789114715,
|
||||
"narHash": "sha256-ugpsyk3NM2s87vXfUiIIiibbJ4Pp0JPS5p/3mfs+q+c=",
|
||||
"lastModified": 1790340521,
|
||||
"narHash": "sha256-cRrWlIjVRJ6BHDr9caUdXsZ3owzWIKYHpNmGPHBInIU=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "21a67dc470149f337cecafbe965d8d252a390518",
|
||||
"rev": "f5c082a40f7571c266e74e80ae2e68aadd8a9fc7",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
||||
Reference in new issue
Block a user