202 lines
7.7 KiB
Nix
202 lines
7.7 KiB
Nix
let
|
|
# generate one using openssl (somehow)
|
|
# XXX: when importing, garage tells you importing is only meant for keys previously generated by garage. is it okay to generate them using openssl? it seems to work fine
|
|
snakeoil_key = {
|
|
id = "GK22a15201acacbd51cd43e327";
|
|
secret = "82b2b4cbef27bf8917b350d5b10a87c92fa9c8b13a415aeeea49726cf335d74e";
|
|
};
|
|
in
|
|
# TODO: expand to a multi-machine setup
|
|
{ config, lib, pkgs, ... }: {
|
|
# add in options to ensure creation of buckets and keys
|
|
options =
|
|
let
|
|
inherit (lib) types mkOption mkEnableOption;
|
|
in {
|
|
services.garage = {
|
|
ensureBuckets = mkOption {
|
|
type = types.attrsOf (types.submodule {
|
|
options = {
|
|
website = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
};
|
|
# I think setting corsRules should allow another website to show images from your bucket
|
|
corsRules = {
|
|
enable = mkEnableOption "CORS Rules";
|
|
allowedHeaders = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
};
|
|
allowedMethods = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
};
|
|
allowedOrigins = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
};
|
|
};
|
|
aliases = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [];
|
|
};
|
|
};
|
|
});
|
|
};
|
|
ensureKeys = mkOption {
|
|
type = types.attrsOf (types.submodule {
|
|
# TODO: these should be managed as secrets, not in the nix store
|
|
options = {
|
|
id = mkOption {
|
|
type = types.str;
|
|
};
|
|
secret = mkOption {
|
|
type = types.str;
|
|
};
|
|
# TODO: assert at least one of these is true
|
|
# currently, needs to be done in the top level module
|
|
ensureAccess = mkOption {
|
|
type = types.attrsOf (types.submodule {
|
|
options = {
|
|
read = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
};
|
|
write = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
};
|
|
owner = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
};
|
|
};
|
|
});
|
|
default = [];
|
|
};
|
|
};
|
|
});
|
|
};
|
|
};
|
|
};
|
|
|
|
config = {
|
|
virtualisation.vmVariant = {
|
|
virtualisation.diskSize = 2048;
|
|
virtualisation.forwardPorts = [
|
|
{
|
|
from = "host";
|
|
host.port = 3901;
|
|
guest.port = 3901;
|
|
}
|
|
{
|
|
from = "host";
|
|
host.port = 3902;
|
|
guest.port = 3902;
|
|
}
|
|
];
|
|
};
|
|
|
|
environment.systemPackages = [ pkgs.minio-client pkgs.awscli ];
|
|
|
|
networking.firewall.allowedTCPPorts = [ 3901 3902 ];
|
|
services.garage = {
|
|
enable = true;
|
|
package = pkgs.garage_0_9;
|
|
settings = {
|
|
replication_mode = "none";
|
|
# TODO: use a secret file
|
|
# I'd like to have a NixOS module that declares the need for a secret file
|
|
# that way, the need can be met by any secrets solution (agenix, sops-nix, colmena, a nixops4 module, ...)
|
|
rpc_secret = "d576c4478cc7d0d94cfc127138cbb82018b0155c037d1c827dfb6c36be5f6625";
|
|
# TODO: why does this have to be set? is there not a sensible default?
|
|
rpc_bind_addr = "[::]:3901";
|
|
rpc_public_addr = "[::1]:3901";
|
|
s3_api.api_bind_addr = "[::]:3900";
|
|
s3_web.bind_addr = "[::]:3902";
|
|
s3_web.root_domain = ".web.garage.localhost";
|
|
index = "index.html";
|
|
|
|
s3_api.s3_region = "garage";
|
|
s3_api.root_domain = ".s3.garage.localhost";
|
|
};
|
|
};
|
|
systemd.services.ensure-garage = {
|
|
after = [ "garage.service" ];
|
|
wantedBy = [ "garage.service" ];
|
|
path = [ config.services.garage.package pkgs.perl pkgs.awscli ];
|
|
script = ''
|
|
set -xeuo pipefail
|
|
# give garage time to start up
|
|
sleep 3
|
|
|
|
# XXX: this is very sensitive to being a single instance
|
|
# (doing the bare minimum to get garage up and running)
|
|
# also, it's crazy that we have to parse command output like this
|
|
# TODO: talk to garage maintainer about making this nicer to work with in Nix
|
|
# before I do that though, I should figure out how setting it up across multiple machines will work
|
|
# You could ask for a change or `--json` flag anyway, and maybe tell them what you're working on.
|
|
GARAGE_ID=$(garage node id 2>/dev/null | perl -ne '/(.*)@.*/ && print $1')
|
|
garage layout assign -z g1 -c 1G $GARAGE_ID
|
|
LAYOUT_VER=$(garage layout show | perl -ne '/Current cluster layout version: (\d*)/ && print $1')
|
|
garage layout apply --version $((LAYOUT_VER + 1))
|
|
|
|
# XXX: this is a hack because we want to write to the buckets here but we're not guaranteed any access keys
|
|
# TODO: generate this key here rather than using a well-known key
|
|
garage key import --yes -n tmp ${snakeoil_key.id} ${snakeoil_key.secret}
|
|
export AWS_ACCESS_KEY_ID=${snakeoil_key.id};
|
|
export AWS_SECRET_ACCESS_KEY=${snakeoil_key.secret};
|
|
|
|
${
|
|
lib.concatStringsSep "\n" (lib.mapAttrsToList (bucket: { website, aliases, corsRules }: ''
|
|
# garage bucket info tells us if the bucket already exists
|
|
garage bucket info ${bucket} || garage bucket create ${bucket}
|
|
|
|
# TODO: should this --deny the website if `website` is false?
|
|
${lib.optionalString website ''
|
|
garage bucket website --allow ${/* more robust: */ lib.strings.escapeShellArg bucket}
|
|
''}
|
|
|
|
${lib.concatStringsSep "\n" (map (alias: ''
|
|
garage bucket alias ${bucket} ${alias}
|
|
'') aliases)}
|
|
|
|
${lib.optionalString corsRules.enable ''
|
|
# TODO: can i turn this whole thing into one builtins.toJSON?
|
|
# why not :D
|
|
# we also have `lib.strings.escapeShellArg` for the quoting
|
|
export CORS=${lib.concatStrings [
|
|
"'"
|
|
''{"CORSRules":[{''
|
|
''"AllowedHeaders":${builtins.toJSON corsRules.allowedHeaders},''
|
|
''"AllowedMethods":${builtins.toJSON corsRules.allowedMethods},''
|
|
''"AllowedOrigins":${builtins.toJSON corsRules.allowedOrigins}''
|
|
''}]}''
|
|
"'"
|
|
]}
|
|
|
|
garage bucket allow --read --write --owner ${bucket} --key tmp
|
|
aws --endpoint http://s3.garage.localhost:3900 s3api put-bucket-cors --bucket ${bucket} --cors-configuration $CORS
|
|
garage bucket deny --read --write --owner ${bucket} --key tmp
|
|
''}
|
|
'') config.services.garage.ensureBuckets)
|
|
# probably nice to factor this out into a function
|
|
}
|
|
${
|
|
lib.concatStringsSep "\n" (lib.mapAttrsToList (key: {id, secret, ensureAccess}: ''
|
|
garage key import --yes -n ${key} ${id} ${secret}
|
|
${
|
|
lib.concatStringsSep "\n" (lib.mapAttrsToList (bucket: { read, write, owner }: ''
|
|
garage bucket allow ${lib.optionalString read "--read"} ${lib.optionalString write "--write"} ${lib.optionalString owner "--owner"} ${bucket} --key ${key}
|
|
'') ensureAccess)
|
|
}
|
|
'') config.services.garage.ensureKeys)
|
|
}
|
|
|
|
garage key delete ${snakeoil_key.id} --yes
|
|
'';
|
|
};
|
|
};
|
|
}
|