privatevoid.net/depot
1
1
Fork 0
Code Issues 23 Pull requests 2 Projects 3 Releases Packages Wiki Activity Actions

services/object-storage: use built-in console

Browse source
This commit is contained in:
Max Headroom 2022-05-26 22:52:49 +02:00
parent 6936c17c02
commit bcc2f53914
3 changed files with 9 additions and 35 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

43
hosts/VEGAS/services/object-storage/default.nix
View file

@ -1,16 +1,11 @@
{ config, inputs, lib, pkgs, tools, ... }: { config, inputs, lib, pkgs, tools, ... }:
with tools.nginx; with tools.nginx;
let let
addrSplit' = builtins.split ":" config.services.minio.listenAddress; minioPort = config.portsStr.minio;
addrSplit = builtins.filter builtins.isString addrSplit'; consolePort = config.portsStr.minioConsole;
host' = builtins.head addrSplit;
host = if host' == "" then "127.0.0.1" else host';
port = builtins.head (builtins.tail addrSplit);
minioConsole = inputs.self.packages.${pkgs.system}.minio-console;
in in
{ {
reservePortsFor = [ "minioConsole" ]; reservePortsFor = [ "minio" "minioConsole" ];
age.secrets.minio-root-credentials = { age.secrets.minio-root-credentials = {
file = ../../../../secrets/minio-root-credentials.age; file = ../../../../secrets/minio-root-credentials.age;
@ -18,17 +13,13 @@ in
group = "root"; group = "root";
mode = "0400"; mode = "0400";
}; };
age.secrets.minio-console-secrets = {
file = ../../../../secrets/minio-console-secrets.age;
owner = "root";
group = "root";
mode = "0400";
};
services.minio = { services.minio = {
enable = true; enable = true;
rootCredentialsFile = config.age.secrets.minio-root-credentials.path; rootCredentialsFile = config.age.secrets.minio-root-credentials.path;
dataDir = [ "/srv/storage/objects" ]; dataDir = [ "/srv/storage/objects" ];
browser = true; browser = true;
listenAddress = "127.0.0.1:${minioPort}";
consoleAddress = "127.0.0.1:${consolePort}";
}; };
systemd.services.minio.serviceConfig = { systemd.services.minio.serviceConfig = {
Slice = "remotefshost.slice"; Slice = "remotefshost.slice";
@ -37,35 +28,19 @@ in
# TODO: vhosts.proxy? # TODO: vhosts.proxy?
"object-storage" = vhosts.basic // { "object-storage" = vhosts.basic // {
locations = { locations = {
"/".proxyPass = "http://${host}:${port}"; "/".proxyPass = "http://127.0.0.1:${minioPort}";
"= /dashboard".proxyPass = "http://${host}:${port}"; "= /dashboard".proxyPass = "http://127.0.0.1:${minioPort}";
}; };
extraConfig = "client_max_body_size 4G;"; extraConfig = "client_max_body_size 4G;";
}; };
"console.object-storage" = vhosts.basic // { "console.object-storage" = vhosts.basic // {
locations = { locations = {
"/".proxyPass = "http://127.0.0.1:${config.portsStr.minioConsole}"; "/".proxyPass = "http://127.0.0.1:${consolePort}";
}; };
}; };
"cdn" = lib.recursiveUpdate (vhosts.proxy "http://${host}:${port}/content-delivery$request_uri") { "cdn" = lib.recursiveUpdate (vhosts.proxy "http://127.0.0.1:${minioPort}/content-delivery$request_uri") {
locations."= /".return = "302 /index.html"; locations."= /".return = "302 /index.html";
}; };
}; };
services.oauth2_proxy.nginx.virtualHosts = [ "console.object-storage.${tools.meta.domain}" ]; services.oauth2_proxy.nginx.virtualHosts = [ "console.object-storage.${tools.meta.domain}" ];
systemd.services.minio-console = {
enable = true;
wantedBy = [ "default.target" ];
serviceConfig = {
ExecStart = "${minioConsole}/bin/console server --port ${config.portsStr.minioConsole}";
EnvironmentFile = config.age.secrets.minio-console-secrets.path;
DynamicUser = true;
User = "minio-console";
};
environment = {
CONSOLE_MINIO_REGION = "us-east-1";
# TODO: external or internal?
CONSOLE_MINIO_SERVER = "https://object-storage.${tools.meta.domain}";
};
path = [ pkgs.glibc.bin ];
};
} }

BIN
secrets/minio-console-secrets.age
View file

Binary file not shown.

1
secrets/secrets.nix
View file

@ -29,7 +29,6 @@ in with hosts;
"ipfs-swarm-key.age".publicKeys = max ++ map systemKeys [ VEGAS prophet ]; "ipfs-swarm-key.age".publicKeys = max ++ map systemKeys [ VEGAS prophet ];
"keycloak-dbpass.age".publicKeys = max ++ map systemKeys [ VEGAS ]; "keycloak-dbpass.age".publicKeys = max ++ map systemKeys [ VEGAS ];
"matrix-appservice-discord-token.age".publicKeys = max ++ map systemKeys [ VEGAS ]; "matrix-appservice-discord-token.age".publicKeys = max ++ map systemKeys [ VEGAS ];
"minio-console-secrets.age".publicKeys = max ++ map systemKeys [ VEGAS ];
"minio-root-credentials.age".publicKeys = max ++ map systemKeys [ VEGAS ]; "minio-root-credentials.age".publicKeys = max ++ map systemKeys [ VEGAS ];
"nextcloud-adminpass.age".publicKeys = max ++ map systemKeys [ VEGAS ]; "nextcloud-adminpass.age".publicKeys = max ++ map systemKeys [ VEGAS ];
"nextcloud-dbpass.age".publicKeys = max ++ map systemKeys [ VEGAS ]; "nextcloud-dbpass.age".publicKeys = max ++ map systemKeys [ VEGAS ];