117 lines
3.6 KiB
Nix
117 lines
3.6 KiB
Nix
{
|
|
description = "Declare a new table and user for postgresql";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
|
|
};
|
|
|
|
outputs = { self, nixpkgs, ...}: {
|
|
nixosModules.postgresql-db = {config, lib, pkgs, ...}:
|
|
let
|
|
opts = config.services.postgresql-db;
|
|
in {
|
|
options.services.postgresql-db = {
|
|
enable = lib.mkEnableOption "Postgres make DBs";
|
|
|
|
dataDir = lib.mkOption {
|
|
type = lib.types.path;
|
|
default = "var/lib/postgresql";
|
|
description = "Where to store database data";
|
|
};
|
|
|
|
port = lib.mkOption {
|
|
type = lib.types.port;
|
|
default = 5432;
|
|
description = "port to host postgresql";
|
|
};
|
|
|
|
credentialsFile = lib.mkOption {
|
|
type = lib.types.path;
|
|
description = "File containing postgresql user credentials";
|
|
};
|
|
|
|
databases = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
default = [];
|
|
description = "list of databases to bootstrap";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf opts.enable {
|
|
users.groups.postgres = {};
|
|
users.users.postgres = {
|
|
isSystemUser = true;
|
|
createHome = true;
|
|
home = opts.dataDir;
|
|
group = "postgres";
|
|
};
|
|
|
|
services.postgresql = {
|
|
enable = true;
|
|
dataDir = opts.dataDir;
|
|
settings.port = opts.port;
|
|
};
|
|
|
|
systemd.services.bootstrap-psql = {
|
|
description = "Minio bootstrap users, policies, buckets";
|
|
after = [ "postgresql.service" ];
|
|
requires = [ "postgresql.service" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = "postgres";
|
|
Group = "postgres";
|
|
EnvironmentFile = opts.credentialsFile;
|
|
|
|
ExecStart = pkgs.writeShellScript "bootstrap-psql" ''
|
|
set -euo pipefail
|
|
|
|
psql_bin=${pkgs.postgres}/bin/psql
|
|
|
|
# Create databases and users
|
|
for db in ${lib.escapeShellArgs opts.databases}; do
|
|
# Uppercase database name
|
|
db_upper="''${db^^}"
|
|
|
|
user_var="PSQL_''${db_upper}_USER"
|
|
pass_var="PSQL_''${db_upper}_PASSWORD"
|
|
|
|
# Expand variable values (from EnvironmentFile)
|
|
user_val=$(eval "echo \''${$user_var:-}")
|
|
pass_val=$(eval "echo \''${$pass_var:-}")
|
|
|
|
if [ -z "$user_val" ] || [ -z "$pass_val" ]; then
|
|
echo "Missing credentials for database '$db' ($user_var / $pass_var)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Bootstrapping PostgreSQL for database: $db"
|
|
|
|
# Create user if not exists
|
|
$psql_bin --tuples-only --no-align -c \
|
|
"SELECT 1 FROM pg_roles WHERE rolname=$user_val" | grep -q 1 \
|
|
|| $psql_bin -c "CREATE USER $user_val WITH PASSWORD '$pass_val';"
|
|
|
|
# Create database if not exists
|
|
$psql_bin --tuples-only --no-align -c \
|
|
"SELECT 1 FROM pg_database WHERE datname='$db'" | grep -q 1 \
|
|
|| $psql_bin -c "CREATE DATABASE $db OWNER $user_val;"
|
|
|
|
# Ensure user owns DB + grants
|
|
$psql_bin -c "ALTER DATABASE $db OWNER TO $user_val;"
|
|
$psql_bin -d "$db" -c "GRANT ALL PRIVILEGES ON DATABASE $db TO $user_val;"
|
|
|
|
echo "Bootstrapped DB $db (user: $user_val)"
|
|
done
|
|
'';
|
|
};
|
|
|
|
|
|
};
|
|
|
|
};
|
|
};
|
|
};
|
|
}
|