depot/hosts/VEGAS/services/ipfs/default.nix

105 lines
2.7 KiB
Nix
Raw Normal View History

2022-05-16 01:10:58 +03:00
{ aspect, config, hosts, lib, pkgs, tools, ... }:
2021-10-16 20:36:25 +03:00
with tools.nginx;
let
inherit (tools.meta) domain;
cfg = config.services.ipfs;
2022-06-18 03:44:51 +03:00
gw = config.links.ipfsGateway;
2021-10-16 20:36:25 +03:00
in
{
2022-02-03 21:36:14 +02:00
imports = [
aspect.modules.ipfs
];
2021-10-16 20:36:25 +03:00
2022-06-17 22:29:22 +03:00
systemd.services.ipfs.environment = {
OTEL_TRACES_EXPORTER = "otlp";
OTEL_EXPORTER_OTLP_PROTOCOL = "grpc";
OTEL_EXPORTER_OTLP_ENDPOINT = config.links.tempo-otlp-grpc.url;
2022-06-17 22:29:22 +03:00
OTEL_TRACES_SAMPLER = "parentbased_traceidratio";
OTEL_TRACES_SAMPLER_ARG = "0.01";
};
2022-02-03 01:44:06 +02:00
systemd.slices.remotefshost.sliceConfig = {
IOWeight = 5;
IOReadIOPSMax = [
"/dev/sda 100"
"/dev/sdb 100"
];
IOWriteIOPSMax = [
"/dev/sda 100"
"/dev/sdb 100"
];
IODviceLatencyTargetSec = [
"/dev/sda 500ms"
"/dev/sdb 500ms"
];
};
users.users.nginx.extraGroups = [ cfg.group ];
2021-10-16 20:36:25 +03:00
services.nginx.virtualHosts = {
"top-level.${domain}".locations = {
"~ ^/ip[fn]s" = {
2022-06-18 03:44:51 +03:00
proxyPass = gw.url;
2021-10-16 20:36:25 +03:00
extraConfig = ''
add_header X-Content-Type-Options "";
add_header Access-Control-Allow-Origin *;
'';
};
};
"lain-ipfs.${domain}" = vhosts.basic // {
locations = {
"= /".return = "404";
"~ ^/ip[fn]s" = {
2022-06-18 03:44:51 +03:00
proxyPass = gw.url;
2021-10-16 20:36:25 +03:00
extraConfig = ''
add_header X-Content-Type-Options "";
add_header Access-Control-Allow-Origin *;
'';
};
"/ipfs".extraConfig = "expires max;";
};
};
"ipfs.admin.${domain}" = vhosts.basic // {
locations."/api".proxyPass = "http://unix:/run/ipfs/ipfs-api.sock:";
2022-06-18 03:44:51 +03:00
locations."/ipns/webui.ipfs.${domain}".proxyPass = "${gw.url}/ipns/webui.ipfs.${domain}";
2021-10-16 20:36:25 +03:00
locations."= /".return = "302 /ipns/webui.ipfs.${domain}";
2022-05-16 01:10:58 +03:00
locations."/debug/metrics/prometheus" = {
proxyPass = "http://unix:/run/ipfs/ipfs-api.sock:";
extraConfig = ''
access_log off;
auth_request off;
allow ${hosts.VEGAS.interfaces.primary.addr};
deny all;
'';
};
2021-10-16 20:36:25 +03:00
};
};
services.oauth2_proxy.nginx.virtualHosts = [ "ipfs.admin.${domain}" ];
inherit (tools.acme.dns01) age;
security.acme.certs."ipfs.${domain}" = {
domain = "*.ipfs.${domain}";
extraDomainNames = [ "*.ipns.${domain}" ];
dnsProvider = "rfc2136";
group = "nginx";
inherit (tools.acme.dns01) credentialsFile;
};
services.nginx.virtualHosts."ipfs.${domain}" = vhosts.basic // {
serverName = "~^(.+)\.(ip[fn]s)\.${domain}$";
enableACME = false;
useACMEHost = "ipfs.${domain}";
locations = {
"/" = {
2022-06-18 03:44:51 +03:00
proxyPass = gw.url;
extraConfig = ''
add_header X-Content-Type-Options "";
add_header Access-Control-Allow-Origin *;
'';
};
};
};
2021-10-16 20:36:25 +03:00
}