depot/cluster/services/ipfs/gateway.nix

97 lines
2.4 KiB
Nix
Raw Normal View History

{ config, hosts, tools, ... }:
2021-10-16 20:36:25 +03:00
with tools.nginx;
let
inherit (tools.meta) domain;
cfg = config.services.ipfs;
2022-06-18 03:44:51 +03:00
gw = config.links.ipfsGateway;
2021-10-16 20:36:25 +03:00
in
{
2022-08-01 22:14:16 +03:00
systemd.services.ipfs = {
2022-08-01 22:46:35 +03:00
serviceConfig = {
LimitNOFILE = 524288;
IOSchedulingPriority = 7;
};
2022-06-17 22:29:22 +03:00
};
2022-02-03 01:44:06 +02:00
systemd.slices.remotefshost.sliceConfig = {
IOWeight = 5;
IOReadIOPSMax = [
"/dev/sda 100"
"/dev/sdb 100"
];
IOWriteIOPSMax = [
"/dev/sda 100"
"/dev/sdb 100"
];
2022-08-01 22:52:35 +03:00
IODeviceLatencyTargetSec = [
2022-02-03 01:44:06 +02:00
"/dev/sda 500ms"
"/dev/sdb 500ms"
];
};
users.users.nginx.extraGroups = [ cfg.group ];
2021-10-16 20:36:25 +03:00
services.nginx.virtualHosts = {
"top-level.${domain}".locations = {
"~ ^/ip[fn]s" = {
2022-06-18 03:44:51 +03:00
proxyPass = gw.url;
2021-10-16 20:36:25 +03:00
extraConfig = ''
add_header X-Content-Type-Options "";
add_header Access-Control-Allow-Origin *;
'';
};
};
"lain-ipfs.${domain}" = vhosts.basic // {
locations = {
"= /".return = "404";
"~ ^/ip[fn]s" = {
2022-06-18 03:44:51 +03:00
proxyPass = gw.url;
2021-10-16 20:36:25 +03:00
extraConfig = ''
add_header X-Content-Type-Options "";
add_header Access-Control-Allow-Origin *;
'';
};
"/ipfs".extraConfig = "expires max;";
};
};
"ipfs.admin.${domain}" = vhosts.basic // {
locations."/api".proxyPass = "http://unix:/run/ipfs/ipfs-api.sock:";
2022-06-18 03:44:51 +03:00
locations."/ipns/webui.ipfs.${domain}".proxyPass = "${gw.url}/ipns/webui.ipfs.${domain}";
2021-10-16 20:36:25 +03:00
locations."= /".return = "302 /ipns/webui.ipfs.${domain}";
2022-05-16 01:10:58 +03:00
locations."/debug/metrics/prometheus" = {
proxyPass = "http://unix:/run/ipfs/ipfs-api.sock:";
extraConfig = ''
access_log off;
auth_request off;
allow ${hosts.VEGAS.interfaces.primary.addr};
deny all;
'';
};
2021-10-16 20:36:25 +03:00
};
};
services.oauth2_proxy.nginx.virtualHosts = [ "ipfs.admin.${domain}" ];
security.acme.certs."ipfs.${domain}" = {
domain = "*.ipfs.${domain}";
extraDomainNames = [ "*.ipns.${domain}" ];
2022-08-07 22:06:17 +03:00
dnsProvider = "pdns";
group = "nginx";
};
services.nginx.virtualHosts."ipfs.${domain}" = vhosts.basic // {
serverName = "~^(.+)\.(ip[fn]s)\.${domain}$";
enableACME = false;
useACMEHost = "ipfs.${domain}";
locations = {
"/" = {
2022-06-18 03:44:51 +03:00
proxyPass = gw.url;
extraConfig = ''
add_header X-Content-Type-Options "";
add_header Access-Control-Allow-Origin *;
'';
};
};
};
2021-10-16 20:36:25 +03:00
}