cluster/services/attic: init

cluster/services/attic/attic-server-token.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> ssh-ed25519 NO562A mLMev+YA6zSxAWIIlwseZk8Skl4hfNNsWQPmLV7DxTo
+AEi55ZXzyYbZyludcP5Yywx7QDgFODh6z8+M2nxMAl4
+-> ssh-ed25519 5/zT0w 91baPvXx4UdmyYCCIqc1M+Cb7pqdSx3/cgmfuexeUgY
+kePQp8flAsXPMLxJiQPoJuHEPPI+FzaSF+VL9U9jhwI
+-> ssh-ed25519 d3WGuA U8Q68hN+5fI4xto/lpCiVyts00ezCzftfLvFFew7aiY
+B4wv05Y2gpl5qjV1Rbc6JSJk3coN6TFMB5FspwzLnlI
+-> :0eX-grease
+ghW6iCUZj0e04I8Ba3CHzg
+--- aHnzzTi1WxtHXGcQO1hNgmy04wyyObmYBcSq5fmbnAg
+Ñdï<EFBFBD>ÎÁŽ#¹<>¬sä®nƒŒó¤ž§–F#5IZ<49><5A>¯áË2wb®×¨âÑÞüË›oœkm÷ÒåN&"¤ü0LeÑzIjx—µzxF€´>ršúEq´Ý¤¥A‘nx¿šB!@‰ÕŸÆò2r©:ïm5í-Xl5çAåð*ëÌSV¿R3`Ð艨{ÿò<C3BF>ï©#ÍJgHÖ‡ÊÉg

cluster/services/attic/default.nix

@@ -0,0 +1,10 @@
+{
+  services.attic = {
+    nodes = {
+      server = [ "VEGAS" ];
+    };
+    nixos = {
+      server = ./server.nix;
+    };
+  };
+}

cluster/services/attic/server.nix

@@ -0,0 +1,53 @@
+{ config, depot, lib, tools, ... }:
+
+let
+  dataDir = "/srv/storage/private/attic";
+in
+
+{
+  imports = [
+    depot.inputs.attic.nixosModules.atticd
+  ];
+
+  age.secrets.atticServerToken.file = ./attic-server-token.age;
+
+  links.atticServer.protocol = "http";
+
+  services.atticd = {
+    enable = true;
+
+    credentialsFile = config.age.secrets.atticServerToken.path;
+
+    settings = {
+      listen = config.links.atticServer.tuple;
+
+      chunking = {
+        nar-size-threshold = 512 * 1024;
+        min-size = 64 * 1024;
+        avg-size = 512 * 1024;
+        max-size = 1024 * 1024;
+      };
+
+      database.url = "sqlite://${dataDir}/server.db?mode=rwc";
+
+      storage = {
+        type = "local";
+        path = "${dataDir}/chunks";
+      };
+    };
+  };
+
+  users = {
+    users.atticd = {
+      isSystemUser = true;
+      group = "atticd";
+      home = dataDir;
+      createHome = true;
+    };
+    groups.atticd = {};
+  };
+
+  systemd.services.atticd.serviceConfig.DynamicUser = lib.mkForce false;
+
+  services.nginx.virtualHosts."cache-api.${tools.meta.domain}" = tools.nginx.vhosts.proxy config.links.atticServer.url;
+}

secrets.nix

@@ -5,6 +5,7 @@ let
   systemKeys = x: x.ssh.id.publicKey or null;
 in with hosts;
 {
+  "cluster/services/attic/attic-server-token.age".publicKeys = max ++ map systemKeys [ VEGAS ];
   "cluster/services/dns/pdns-admin-oidc-secrets.age".publicKeys = max ++ map systemKeys [ VEGAS ];
   "cluster/services/dns/pdns-admin-salt.age".publicKeys = max ++ map systemKeys [ VEGAS ];
   "cluster/services/dns/pdns-admin-secret.age".publicKeys = max ++ map systemKeys [ VEGAS ];