privatevoid.net/depot
1
1
Fork 0
Code Issues 23 Pull requests 2 Projects 3 Releases Packages Wiki Activity Actions

cluster/services/ipfs: split remote api, rework gateway

Browse source
This commit is contained in:
Max Headroom 2023-06-02 18:06:34 +02:00
parent 4fb9373f1f
commit a714c37cec
3 changed files with 40 additions and 32 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
cluster/services/ipfs/default.nix
View file

@ -1,4 +1,4 @@
{ config, depot, lib, tools, ... }:
{ config, depot, lib, ... }:
{
hostLinks = lib.genAttrs config.services.ipfs.nodes.node (name: let
@ -25,8 +25,9 @@
nodes = {
node = [ "VEGAS" "prophet" ];
clusterPeer = [ "VEGAS" "prophet" ];
gateway = [ "VEGAS" ];
gateway = [ "VEGAS" "prophet" ];
io-tweaks = [ "VEGAS" ];
remote-api = [ "VEGAS" ];
};
nixos = {
node = [
@ -40,6 +41,7 @@
./cluster.nix
];
io-tweaks = ./io-tweaks.nix;
remote-api = ./remote-api.nix;
};
};
}

46
cluster/services/ipfs/gateway.nix
View file

@ -1,13 +1,19 @@
{ config, depot, tools, ... }:
{ config, lib, tools, ... }:
with tools.nginx;
let
inherit (tools.meta) domain;
cfg = config.services.ipfs;
gw = config.links.ipfsGateway;
cfg = config.services.ipfs;
metrics = config.links.ipfsMetrics;
in
{
users.users.nginx.extraGroups = [ cfg.group ];
links.ipfsMetrics = {
protocol = "http";
path = "/debug/metrics/prometheus";
};
services.nginx.virtualHosts = {
"top-level.${domain}".locations = {
"~ ^/ip[fn]s" = {
@ -18,37 +24,17 @@ in
'';
};
};
"lain-ipfs.${domain}" = vhosts.basic // {
locations = {
"= /".return = "404";
"~ ^/ip[fn]s" = {
proxyPass = gw.url;
extraConfig = ''
add_header X-Content-Type-Options "";
add_header Access-Control-Allow-Origin *;
'';
ipfs-metrics = {
serverName = null;
listen = lib.singleton {
addr = metrics.ipv4;
inherit (metrics) port;
};
"/ipfs".extraConfig = "expires max;";
extraConfig = "access_log off;";
locations."/".return = "204";
locations."${metrics.path}".proxyPass = "http://unix:/run/ipfs/ipfs-api.sock:";
};
};
"ipfs.admin.${domain}" = vhosts.basic // {
locations."/api".proxyPass = "http://unix:/run/ipfs/ipfs-api.sock:";
locations."/ipns/webui.ipfs.${domain}".proxyPass = "${gw.url}/ipns/webui.ipfs.${domain}";
locations."= /".return = "302 /ipns/webui.ipfs.${domain}";
locations."/debug/metrics/prometheus" = {
proxyPass = "http://unix:/run/ipfs/ipfs-api.sock:";
extraConfig = ''
access_log off;
auth_request off;
allow ${depot.config.hours.VEGAS.interfaces.primary.addr};
deny all;
'';
};
};
};
services.oauth2_proxy.nginx.virtualHosts = [ "ipfs.admin.${domain}" ];
security.acme.certs."ipfs.${domain}" = {
domain = "*.ipfs.${domain}";
extraDomainNames = [ "*.ipns.${domain}" ];

20
cluster/services/ipfs/remote-api.nix Normal file
View file

@ -0,0 +1,20 @@
{ config, tools, ... }:
with tools.nginx;
let
inherit (tools.meta) domain;
cfg = config.services.ipfs;
gw = config.links.ipfsGateway;
in
{
users.users.nginx.extraGroups = [ cfg.group ];
services.nginx.virtualHosts = {
"ipfs.admin.${domain}" = vhosts.basic // {
locations."/api".proxyPass = "http://unix:/run/ipfs/ipfs-api.sock:";
locations."/ipns/webui.ipfs.io".proxyPass = "${gw.url}/ipns/webui.ipfs.io";
locations."= /".return = "302 /ipns/webui.ipfs.io";
};
};
services.oauth2_proxy.nginx.virtualHosts = [ "ipfs.admin.${domain}" ];
}