privatevoid.net/depot
1
1
Fork 0
Code Issues 25 Pull requests 2 Projects 3 Releases Packages Wiki Activity Actions

cluster/services/ipfs: split remote api, rework gateway

Browse source
This commit is contained in:
Max Headroom 2023-06-02 18:06:34 +02:00
parent 4fb9373f1f
commit a714c37cec
3 changed files with 40 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
cluster/services/ipfs/default.nix
View file

@ -1,4 +1,4 @@
{ config, depot, lib, tools, ... }: { config, depot, lib, ... }:
{ {
hostLinks = lib.genAttrs config.services.ipfs.nodes.node (name: let hostLinks = lib.genAttrs config.services.ipfs.nodes.node (name: let
@ -25,8 +25,9 @@
nodes = { nodes = {
node = [ "VEGAS" "prophet" ]; node = [ "VEGAS" "prophet" ];
clusterPeer = [ "VEGAS" "prophet" ]; clusterPeer = [ "VEGAS" "prophet" ];
gateway = [ "VEGAS" ]; gateway = [ "VEGAS" "prophet" ];
io-tweaks = [ "VEGAS" ]; io-tweaks = [ "VEGAS" ];
remote-api = [ "VEGAS" ];
}; };
nixos = { nixos = {
node = [ node = [
@ -40,6 +41,7 @@
./cluster.nix ./cluster.nix
]; ];
io-tweaks = ./io-tweaks.nix; io-tweaks = ./io-tweaks.nix;
remote-api = ./remote-api.nix;
}; };
}; };
} }

46
cluster/services/ipfs/gateway.nix
View file

@ -1,13 +1,19 @@
{ config, depot, tools, ... }: { config, lib, tools, ... }:
with tools.nginx; with tools.nginx;
let let
inherit (tools.meta) domain; inherit (tools.meta) domain;
cfg = config.services.ipfs;
gw = config.links.ipfsGateway; gw = config.links.ipfsGateway;
cfg = config.services.ipfs;
metrics = config.links.ipfsMetrics;
in in
{ {
users.users.nginx.extraGroups = [ cfg.group ]; users.users.nginx.extraGroups = [ cfg.group ];
links.ipfsMetrics = {
protocol = "http";
path = "/debug/metrics/prometheus";
};
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
"top-level.${domain}".locations = { "top-level.${domain}".locations = {
"~ ^/ip[fn]s" = { "~ ^/ip[fn]s" = {
@ -18,37 +24,17 @@ in
''; '';
}; };
}; };
ipfs-metrics = {
"lain-ipfs.${domain}" = vhosts.basic // { serverName = null;
locations = { listen = lib.singleton {
"= /".return = "404"; addr = metrics.ipv4;
"~ ^/ip[fn]s" = { inherit (metrics) port;
proxyPass = gw.url;
extraConfig = ''
add_header X-Content-Type-Options "";
add_header Access-Control-Allow-Origin *;
'';
};
"/ipfs".extraConfig = "expires max;";
};
};
"ipfs.admin.${domain}" = vhosts.basic // {
locations."/api".proxyPass = "http://unix:/run/ipfs/ipfs-api.sock:";
locations."/ipns/webui.ipfs.${domain}".proxyPass = "${gw.url}/ipns/webui.ipfs.${domain}";
locations."= /".return = "302 /ipns/webui.ipfs.${domain}";
locations."/debug/metrics/prometheus" = {
proxyPass = "http://unix:/run/ipfs/ipfs-api.sock:";
extraConfig = ''
access_log off;
auth_request off;
allow ${depot.config.hours.VEGAS.interfaces.primary.addr};
deny all;
'';
}; };
extraConfig = "access_log off;";
locations."/".return = "204";
locations."${metrics.path}".proxyPass = "http://unix:/run/ipfs/ipfs-api.sock:";
}; };
}; };
services.oauth2_proxy.nginx.virtualHosts = [ "ipfs.admin.${domain}" ];
security.acme.certs."ipfs.${domain}" = { security.acme.certs."ipfs.${domain}" = {
domain = "*.ipfs.${domain}"; domain = "*.ipfs.${domain}";
extraDomainNames = [ "*.ipns.${domain}" ]; extraDomainNames = [ "*.ipns.${domain}" ];

20
cluster/services/ipfs/remote-api.nix Normal file
View file

@ -0,0 +1,20 @@
{ config, tools, ... }:
with tools.nginx;
let
inherit (tools.meta) domain;
cfg = config.services.ipfs;
gw = config.links.ipfsGateway;
in
{
users.users.nginx.extraGroups = [ cfg.group ];
services.nginx.virtualHosts = {
"ipfs.admin.${domain}" = vhosts.basic // {
locations."/api".proxyPass = "http://unix:/run/ipfs/ipfs-api.sock:";
locations."/ipns/webui.ipfs.io".proxyPass = "${gw.url}/ipns/webui.ipfs.io";
locations."= /".return = "302 /ipns/webui.ipfs.io";
};
};
services.oauth2_proxy.nginx.virtualHosts = [ "ipfs.admin.${domain}" ];
}