115 lines
3.6 KiB
Nix
115 lines
3.6 KiB
Nix
{
|
|
description = "Declare a new table and user for postgresql";
|
|
|
|
inputs = {
|
|
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
|
|
};
|
|
|
|
outputs = { self, nixpkgs, ...}: {
|
|
nixosModules.postgresql-db = {config, lib, pkgs, ...}:
|
|
let
|
|
opts = config.services.postgresql-db;
|
|
in {
|
|
options.services.postgresql-db = {
|
|
enable = lib.mkEnableOption "Postgres make DBs";
|
|
|
|
dataDir = lib.mkOption {
|
|
type = lib.types.path;
|
|
default = "/var/lib/postgresql";
|
|
description = "Where to store database data";
|
|
};
|
|
|
|
port = lib.mkOption {
|
|
type = lib.types.port;
|
|
default = 5432;
|
|
description = "port to host postgresql";
|
|
};
|
|
|
|
credentialsFile = lib.mkOption {
|
|
type = lib.types.path;
|
|
description = "File containing postgresql user credentials";
|
|
};
|
|
|
|
databases = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
default = [];
|
|
description = "list of databases to bootstrap";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf opts.enable {
|
|
users.groups.postgres = {};
|
|
users.users.postgres = {
|
|
isSystemUser = true;
|
|
createHome = true;
|
|
home = opts.dataDir;
|
|
group = "postgres";
|
|
};
|
|
|
|
services.postgresql = {
|
|
enable = true;
|
|
dataDir = opts.dataDir;
|
|
settings.port = opts.port;
|
|
identMap = ''
|
|
postgres roy postgres
|
|
two roy freakonomics
|
|
'';
|
|
};
|
|
|
|
systemd.services.bootstrap-psql = {
|
|
description = "Bootstrap psql dbs and users";
|
|
after = [ "postgresql.service" ];
|
|
requires = [ "postgresql.service" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = "postgres";
|
|
Group = "postgres";
|
|
EnvironmentFile = opts.credentialsFile;
|
|
|
|
ExecStart = pkgs.writeShellScript "bootstrap-psql" ''
|
|
set -euo pipefail
|
|
|
|
psql_bin=${pkgs.postgresql}/bin/psql
|
|
|
|
for db in ${lib.escapeShellArgs opts.databases}; do
|
|
db_upper="''${db^^}"
|
|
|
|
user_var="PSQL_''${db_upper}_USER"
|
|
pass_var="PSQL_''${db_upper}_PASSWORD"
|
|
|
|
user_val=$(eval "echo \''${$user_var:-}")
|
|
pass_val=$(eval "echo \''${$pass_var:-}")
|
|
|
|
if [ -z "$user_val" ] || [ -z "$pass_val" ]; then
|
|
echo "Missing credentials for database '$db' ($user_var / $pass_var)" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "Bootstrapping PostgreSQL for database: $db"
|
|
|
|
# CREATE USER (if not exists)
|
|
$psql_bin --tuples-only --no-align -c \
|
|
"SELECT 1 FROM pg_roles WHERE rolname='\$${user_val}'" | grep -q 1 \
|
|
|| $psql_bin -c "CREATE USER ''${user_val} WITH PASSWORD '\$${pass_val}';"
|
|
|
|
# CREATE DATABASE (if not exists)
|
|
$psql_bin --tuples-only --no-align -c \
|
|
"SELECT 1 FROM pg_database WHERE datname='\$${db}'" | grep -q 1 \
|
|
|| $psql_bin -c "CREATE DATABASE ''${db} OWNER '\$${user_val}';"
|
|
|
|
# Privileges
|
|
$psql_bin -c "ALTER DATABASE ''${db} OWNER TO ''${user_val};"
|
|
$psql_bin -d "$db" -c "GRANT ALL PRIVILEGES ON DATABASE ''${db} TO ''${user_val};"
|
|
|
|
echo "Bootstrapped DB ''${db} (user: ''${user_val})"
|
|
done
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|