privatevoid.net/depot
1
1
Fork 0
Code Issues 25 Pull requests 2 Projects 3 Releases Packages Wiki Activity Actions

VEGAS/ipfs: use a protected UDS for API access

Browse source
This commit is contained in:
Max Headroom 2021-12-04 02:51:21 +01:00
parent 1e8246dad4
commit c31f061a65
1 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
hosts/VEGAS/services/ipfs/default.nix
View file

@ -3,7 +3,8 @@ with tools.nginx;
let let
inherit (tools.meta) domain; inherit (tools.meta) domain;
cfg = config.services.ipfs; cfg = config.services.ipfs;
ipfsApi = pkgs.writeTextDir "api" "/ip4/127.0.0.1/tcp/5001"; apiAddress = "/unix/run/ipfs/ipfs-api.sock";
ipfsApi = pkgs.writeTextDir "api" apiAddress;
gwPort = config.portsStr.ipfsGateway; gwPort = config.portsStr.ipfsGateway;
in in
{ {
@ -19,6 +20,7 @@ in
startWhenNeeded = false; startWhenNeeded = false;
autoMount = true; autoMount = true;
inherit apiAddress;
gatewayAddress = "/ip4/127.0.0.1/tcp/${gwPort}"; gatewayAddress = "/ip4/127.0.0.1/tcp/${gwPort}";
dataDir = "/srv/storage/ipfs/repo"; dataDir = "/srv/storage/ipfs/repo";
localDiscovery = false; localDiscovery = false;
@ -60,9 +62,13 @@ in
ipfs-gateway.enable = false; ipfs-gateway.enable = false;
}; };
systemd.tmpfiles.rules = [ "d '/run/ipfs' 0750 ${cfg.user} ${cfg.group} - -" ];
systemd.services.ipfs = { systemd.services.ipfs = {
environment.LIBP2P_FORCE_PNET = "1"; environment.LIBP2P_FORCE_PNET = "1";
serviceConfig.Slice = "remotefshost.slice"; serviceConfig.Slice = "remotefshost.slice";
postStart = "chmod 660 /run/ipfs/ipfs-api.sock";
}; };
environment.variables.IPFS_PATH = lib.mkForce "${ipfsApi}"; environment.variables.IPFS_PATH = lib.mkForce "${ipfsApi}";
@ -71,6 +77,8 @@ in
ipfs-admin = "sudo -u ${cfg.user} env IPFS_PATH=${cfg.dataDir} ipfs"; ipfs-admin = "sudo -u ${cfg.user} env IPFS_PATH=${cfg.dataDir} ipfs";
}; };
users.users.nginx.extraGroups = [ cfg.group ];
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
"top-level.${domain}".locations = { "top-level.${domain}".locations = {
"~ ^/ip[fn]s" = { "~ ^/ip[fn]s" = {
@ -96,7 +104,7 @@ in
}; };
}; };
"ipfs.admin.${domain}" = vhosts.basic // { "ipfs.admin.${domain}" = vhosts.basic // {
locations."/api".proxyPass = "http://127.0.0.1:5001"; locations."/api".proxyPass = "http://unix:/run/ipfs/ipfs-api.sock:";
locations."/ipns/webui.ipfs.${domain}".proxyPass = "http://127.0.0.1:${gwPort}/ipns/webui.ipfs.${domain}"; locations."/ipns/webui.ipfs.${domain}".proxyPass = "http://127.0.0.1:${gwPort}/ipns/webui.ipfs.${domain}";
locations."= /".return = "302 /ipns/webui.ipfs.${domain}"; locations."= /".return = "302 /ipns/webui.ipfs.${domain}";
}; };