privatevoid.net/depot
1
1
Fork 0
Code Issues 25 Pull requests 2 Projects 3 Releases Packages Wiki Activity Actions

Compare commits

base: privatevoid.net:6082b222a832f3c5b767553c87e0666aaa0e5bcd
Branches Tags
privatevoid.net:master
privatevoid.net:pr-simulacrum-performance
privatevoid.net:pr-drop-gitlab
privatevoid.net:pr-s3ql-5.2.2-fix
privatevoid.net:staging
privatevoid.net:pr-hyprspace-libp2p-0.37-test
privatevoid.net:pr-consul-acl
privatevoid.net:pr-hci-no-ifd
privatevoid.net:pr-frangiclave
privatevoid.net:attic-ha
privatevoid.net:pg-auto-migrations
privatevoid.net:pkg-ircbot
privatevoid.net:d2n-bug-symlink-bin
..
compare: privatevoid.net:69a6e1a57746e40feceb332ff5aa779b33637a4c
Branches Tags
privatevoid.net:master
privatevoid.net:pr-simulacrum-performance
privatevoid.net:pr-drop-gitlab
privatevoid.net:pr-s3ql-5.2.2-fix
privatevoid.net:staging
privatevoid.net:pr-hyprspace-libp2p-0.37-test
privatevoid.net:pr-consul-acl
privatevoid.net:pr-hci-no-ifd
privatevoid.net:pr-frangiclave
privatevoid.net:attic-ha
privatevoid.net:pg-auto-migrations
privatevoid.net:pkg-ircbot
privatevoid.net:d2n-bug-symlink-bin

No commits in common. "6082b222a832f3c5b767553c87e0666aaa0e5bcd" and "69a6e1a57746e40feceb332ff5aa779b33637a4c" have entirely different histories.
6082b222a8 ... 69a6e1a577

11 changed files with 9 additions and 419 deletions
Show stats Expand all files Collapse all files

1
cluster/services/chant/default.nix
View file

@ -6,6 +6,5 @@
nixos.listener = [ nixos.listener = [
./listener.nix ./listener.nix
]; ];
simulacrum.deps = [ "consul" ];
}; };
} }

20
cluster/services/incandescence/default.nix
View file

@ -1,20 +0,0 @@
{ config, ... }:
{
imports = [
./options.nix
];
services.incandescence = {
nodes = {
provider = config.services.consul.nodes.agent;
};
nixos = {
provider = [
./provider.nix
./provider-options.nix
];
};
simulacrum.deps = [ "consul" ];
};
}

22
cluster/services/incandescence/options.nix
View file

@ -1,22 +0,0 @@
{ lib, ... }:
let
inherit (lib) mkOption;
inherit (lib.types) attrsOf listOf submodule str;
in
{
options.incandescence = {
providers = mkOption {
type = attrsOf (submodule ({ name, ... }: {
options = {
objects = mkOption {
type = attrsOf (listOf str);
default = { };
};
};
}));
default = { };
};
};
}

72
cluster/services/incandescence/provider-options.nix
View file

@ -1,72 +0,0 @@
{ lib, ... }:
let
inherit (lib) mkEnableOption mkOption;
inherit (lib.types) attrsOf functionTo ints listOf nullOr package submodule str;
in
{
options.services.incandescence = {
providers = mkOption {
type = attrsOf (submodule ({ name, ... }: {
options = {
locksmith = mkEnableOption "Locksmith integration";
wantedBy = mkOption {
type = listOf str;
};
partOf = mkOption {
type = listOf str;
};
wants = mkOption {
type = listOf str;
default = [ ];
};
after = mkOption {
type = listOf str;
default = [ ];
};
packages = mkOption {
type = listOf package;
default = [ ];
};
formulae = mkOption {
type = attrsOf (submodule ({ ... }: {
options = {
deps = mkOption {
type = listOf str;
default = [ ];
};
create = mkOption {
type = functionTo str;
};
change = mkOption {
type = nullOr (functionTo str);
default = null;
};
destroy = mkOption {
type = str;
};
destroyAfterDays = mkOption {
type = ints.unsigned;
default = 0;
};
};
}));
default = { };
};
};
}));
default = { };
};
};
}

138
cluster/services/incandescence/provider.nix
View file

@ -1,138 +0,0 @@
{ cluster, config, lib, ... }:
let
inherit (lib) concatStringsSep escapeShellArg flatten filter filterAttrs length mapAttrs mapAttrs' mapAttrsToList mkIf mkMerge pipe stringToCharacters;
cfg = config.services.incandescence;
clusterCfg = cluster.config.incandescence;
in
{
systemd.services = pipe cfg.providers [
(mapAttrsToList (provider: providerConfig: pipe providerConfig.formulae [
(mapAttrsToList (formula: formulaConfig: let
kvRoot = "services/incandescence/providers/${provider}/formulae/${formula}";
time = "$(date +%s)";
in {
"ignite-${provider}-${formula}-create" = {
description = "Ignite Creation: ${provider} - ${formula}";
wantedBy = [ "incandescence-${provider}.target" ];
before = [ "incandescence-${provider}.target" ];
wants = providerConfig.wants ++ map (dep: "ignite-${provider}-${dep}-create.service") formulaConfig.deps;
after = providerConfig.after ++ map (dep: "ignite-${provider}-${dep}-create.service") formulaConfig.deps;
serviceConfig.Type = "oneshot";
distributed.enable = true;
path = [ config.services.consul.package ] ++ providerConfig.packages;
script = pipe clusterCfg.providers.${provider}.objects.${formula} [
(map (object: ''
if ! consul kv get ${kvRoot}/${object}/alive >/dev/null; then
echo "Create ${formula}: ${object}"
if (
${formulaConfig.create object}
)
then
consul kv put ${kvRoot}/${object}/alive true
consul kv delete ${kvRoot}/${object}/destroyOn
else
echo "Creation failed: ${object}"
fi
fi
''))
(concatStringsSep "\n")
];
};
"ignite-${provider}-${formula}-change" = mkIf (formulaConfig.change != null) {
description = "Ignite Change: ${provider} - ${formula}";
wantedBy = [ "incandescence-${provider}.target" ];
before = [ "incandescence-${provider}.target" ];
wants = providerConfig.wants ++ [ "ignite-${provider}-${formula}-create.service" ] ++ map (dep: "ignite-${provider}-${dep}-change.service") formulaConfig.deps;
after = providerConfig.after ++ [ "ignite-${provider}-${formula}-create.service" ] ++ map (dep: "ignite-${provider}-${dep}-change.service") formulaConfig.deps;
serviceConfig.Type = "oneshot";
distributed.enable = true;
path = [ config.services.consul.package ] ++ providerConfig.packages;
script = pipe clusterCfg.providers.${provider}.objects.${formula} [
(map (object: ''
echo "Change ${formula}: ${object}"
(
${formulaConfig.change object}
) || echo "Change failed: ${object}"
''))
(concatStringsSep "\n")
];
};
"ignite-${provider}-${formula}-destroy" = {
description = "Ignite Destruction: ${provider} - ${formula}";
wantedBy = [ "incandescence-${provider}.target" ] ++ map (dep: "ignite-${provider}-${dep}-destroy.service") formulaConfig.deps;
before = [ "incandescence-${provider}.target" ] ++ map (dep: "ignite-${provider}-${dep}-destroy.service") formulaConfig.deps;
wants = providerConfig.wants ++ [ "ignite-${provider}-${formula}-change.service" ];
after = providerConfig.after ++ [ "ignite-${provider}-${formula}-change.service" ];
serviceConfig.Type = "oneshot";
distributed.enable = true;
path = [ config.services.consul.package ] ++ providerConfig.packages;
script = let
fieldNum = pipe kvRoot [
stringToCharacters
(filter (x: x == "/"))
length
(builtins.add 2)
toString
];
keyFilter = pipe clusterCfg.providers.${provider}.objects.${formula} [
(map (x: escapeShellArg "^${x}$"))
(concatStringsSep " \\\n -e ")
];
destroyAfterDays = toString formulaConfig.destroyAfterDays;
in ''
consul kv get --keys ${kvRoot}/ | cut -d/ -f${fieldNum} | grep -v -e ${keyFilter} | while read object; do
if consul kv get ${kvRoot}/$object/alive >/dev/null; then
destroyOn="$(consul kv get ${kvRoot}/$object/destroyOn || true)"
if [[ -z "$destroyOn" && "${destroyAfterDays}" -ne 0 ]]; then
echo "Schedule ${formula} for destruction in ${destroyAfterDays} days: $object"
consul kv put ${kvRoot}/$object/destroyOn "$((${time} + 86400 * ${destroyAfterDays}))"
elif [[ "${destroyAfterDays}" -eq 0 || "${time}" -ge "$destroyOn" ]]; then
echo "Destroy ${formula}: $object"
export OBJECT="$object"
if (
${formulaConfig.destroy}
)
then
consul kv delete --recurse ${kvRoot}/$object
else
echo "Destruction failed: $object"
fi
else
echo "Scheduled for destruction on $destroyOn (now: ${time})"
fi
fi
done
'';
};
}))
]))
flatten
mkMerge
];
systemd.targets = mapAttrs' (provider: providerConfig: {
name = "incandescence-${provider}";
value = {
description = "An Incandescence | ${provider}";
inherit (providerConfig) wantedBy partOf;
};
}) cfg.providers;
services.locksmith.providers = mapAttrs (provider: providerConfig: {
wantedBy = [ "incandescence-${provider}.target" ];
after = [ "incandescence-${provider}.target" ];
}) (filterAttrs (_: providerConfig: providerConfig.locksmith) cfg.providers);
system.ascensions = mapAttrs' (provider: providerConfig: {
name = "incandescence-${provider}";
value = {
distributed = true;
requiredBy = map (formula: "ignite-${provider}-${formula}-create.service") (lib.attrNames providerConfig.formulae);
before = map (formula: "ignite-${provider}-${formula}-create.service") (lib.attrNames providerConfig.formulae);
incantations = lib.mkDefault (i: []);
};
}) cfg.providers;
}

1
cluster/services/locksmith/default.nix
View file

@ -14,6 +14,5 @@
./provider.nix ./provider.nix
]; ];
}; };
simulacrum.deps = [ "chant" "consul" ];
}; };
} }

27
cluster/services/locksmith/provider.nix
View file

@ -28,10 +28,6 @@ in
command = mkOption { command = mkOption {
type = types.coercedTo types.package (package: "${package}") types.str; type = types.coercedTo types.package (package: "${package}") types.str;
}; };
checkUpdate = mkOption {
type = types.coercedTo types.package (package: "${package}") types.str;
default = "true";
};
owner = mkOption { owner = mkOption {
type = types.str; type = types.str;
default = "root"; default = "root";
@ -76,27 +72,20 @@ in
activeNodes = lib.unique (lib.flatten (lib.mapAttrsToList (_: secret: secret.nodes) activeSecrets)); activeNodes = lib.unique (lib.flatten (lib.mapAttrsToList (_: secret: secret.nodes) activeSecrets));
secretNames = map (name: "${providerRoot}-${name}/") (lib.attrNames activeSecrets); secretNames = map (name: "${providerRoot}-${name}/") (lib.attrNames activeSecrets);
createSecret = { path, nodes, owner, mode, group, command, checkUpdate }: '' createSecret = { path, nodes, owner, mode, group, command }: ''
if (${checkUpdate}); then consul kv put ${lib.escapeShellArg path}/mode ${lib.escapeShellArg mode}
consul kv put ${lib.escapeShellArg path}/mode ${lib.escapeShellArg mode} consul kv put ${lib.escapeShellArg path}/owner ${lib.escapeShellArg owner}
consul kv put ${lib.escapeShellArg path}/owner ${lib.escapeShellArg owner} consul kv put ${lib.escapeShellArg path}/group ${lib.escapeShellArg group}
consul kv put ${lib.escapeShellArg path}/group ${lib.escapeShellArg group} ${lib.concatStringsSep "\n" (map (node: ''
secret="$(mktemp -ut)" consul kv put ${lib.escapeShellArg path}/recipient/${node} "$( (${command}) | age --encrypt --armor -r ${lib.escapeShellArg depot.hours.${node}.ssh.id.publicKey})"
(${command}) > "$secret" '') nodes)}
${lib.concatStringsSep "\n" (map (node: ''
consul kv put ${lib.escapeShellArg path}/recipient/${node} "$(age < "$secret" --encrypt --armor -r ${lib.escapeShellArg depot.hours.${node}.ssh.id.publicKey})"
'') nodes)}
else
echo Skipping update for ${lib.escapeShellArg path}
fi
''; '';
in '' in ''
# create/update secrets # create/update secrets
umask 77
${lib.pipe activeSecrets [ ${lib.pipe activeSecrets [
(lib.mapAttrsToList (secretName: secretConfig: createSecret { (lib.mapAttrsToList (secretName: secretConfig: createSecret {
path = "${providerRoot}-${secretName}"; path = "${providerRoot}-${secretName}";
inherit (secretConfig) nodes mode owner group command checkUpdate; inherit (secretConfig) nodes mode owner group command;
})) }))
(lib.concatStringsSep "\n") (lib.concatStringsSep "\n")
]} ]}

91
cluster/services/patroni/create-databases.nix
View file

@ -1,91 +0,0 @@
{ cluster, config, lib, pkgs, ... }:
let
inherit (cluster.config.services.patroni) secrets;
patroni = cluster.config.links.patroni-pg-access;
cfg = cluster.config.patroni;
writeQueryFile = pkgs.writeText "patroni-query.sql";
psqlRunFile = file: ''
export PGPASSWORD="$(< ${secrets.PATRONI_SUPERUSER_PASSWORD.path})"
while ! ${config.services.patroni.postgresqlPackage}/bin/psql 'host=${patroni.ipv4} port=${patroni.portStr} dbname=postgres user=postgres' --tuples-only --csv --file="${file}"; do
sleep 3
done
'';
psql = query: psqlRunFile (writeQueryFile query);
psqlSecret = getSecret: queryTemplate: let
queryTemplateFile = writeQueryFile queryTemplate;
in ''
umask 77
secretFile="$(mktemp -ut patroniSecret.XXXXXXXXXXXXXXXX)"
queryFile="$(mktemp -ut patroniQuery.XXXXXXXXXXXXXXXX)"
trap "rm -f $secretFile $queryFile" EXIT
${getSecret} > "$secretFile"
cp --no-preserve=mode ${queryTemplateFile} "$queryFile"
${pkgs.replace-secret}/bin/replace-secret '@SECRET@' "$secretFile" "$queryFile"
${psqlRunFile "$queryFile"}
'';
genPassword = pkgs.writeShellScript "patroni-generate-user-password" ''
umask 77
base64 -w0 /dev/urandom | tr -d /+ | head -c256 | tee "/run/keys/locksmith-provider-patroni-$1"
'';
in
{
services.incandescence.providers.patroni = lib.mkIf config.services.haproxy.enable {
locksmith = true;
wantedBy = [ "patroni.service" "multi-user.target" ];
partOf = [ "patroni.service" ];
wants = [ "postgresql.service" ];
after = [ "postgresql.service" ];
formulae = {
user = {
destroyAfterDays = 0;
create = user: psqlSecret "${genPassword} ${user}" ''
CREATE USER ${user} PASSWORD '@SECRET@';
'';
destroy = psqlSecret "printenv OBJECT" ''
DROP USER @SECRET@;
'';
};
database = {
destroyAfterDays = 30;
deps = [ "user" ];
create = db: psql ''
CREATE DATABASE ${db} OWNER ${cfg.databases.${db}.owner};
'';
destroy = psqlSecret "printenv OBJECT" ''
DROP DATABASE @SECRET@;
'';
};
};
};
services.locksmith.providers.patroni = lib.mkIf config.services.haproxy.enable {
secrets = lib.mapAttrs (user: userConfig: {
command = {
envFile = ''
echo "PGPASSWORD=$(cat /run/keys/locksmith-provider-patroni-${user})"
rm -f /run/keys/locksmith-provider-patroni-${user}
'';
pgpass = ''
echo "*:*:*:${user}:$(cat /run/keys/locksmith-provider-patroni-${user})"
rm -f /run/keys/locksmith-provider-patroni-${user}
'';
raw = ''
cat /run/keys/locksmith-provider-patroni-${user}
rm -f /run/keys/locksmith-provider-patroni-${user}
'';
}.${userConfig.locksmith.format};
checkUpdate = "test -e /run/keys/locksmith-provider-patroni-${user}";
inherit (userConfig.locksmith) nodes;
}) cfg.users;
};
}

9
cluster/services/patroni/default.nix
View file

@ -1,11 +1,6 @@
{ config, ... }: { config, lib, ... }:
{ {
imports = [
./options.nix
./incandescence.nix
];
links = { links = {
patroni-pg-internal.ipv4 = "0.0.0.0"; patroni-pg-internal.ipv4 = "0.0.0.0";
patroni-api.ipv4 = "0.0.0.0"; patroni-api.ipv4 = "0.0.0.0";
@ -20,7 +15,6 @@
worker = [ worker = [
./worker.nix ./worker.nix
./metrics.nix ./metrics.nix
./create-databases.nix
]; ];
haproxy = ./haproxy.nix; haproxy = ./haproxy.nix;
}; };
@ -36,6 +30,5 @@
PATRONI_REWIND_PASSWORD = default; PATRONI_REWIND_PASSWORD = default;
metricsCredentials.nodes = nodes.worker; metricsCredentials.nodes = nodes.worker;
}; };
simulacrum.deps = [ "consul" "incandescence" "locksmith" ];
}; };
} }

10
cluster/services/patroni/incandescence.nix
View file

@ -1,10 +0,0 @@
{ config, lib, ... }:
{
incandescence.providers.patroni = {
objects = {
user = lib.attrNames config.patroni.users;
database = lib.attrNames config.patroni.databases;
};
};
}

37
cluster/services/patroni/options.nix
View file

@ -1,37 +0,0 @@
{ lib, ... }:
let
inherit (lib) mkOption;
inherit (lib.types) attrsOf enum listOf submodule str;
in
{
options.patroni = {
databases = mkOption {
type = attrsOf (submodule ({ name, ... }: {
options = {
owner = mkOption {
type = str;
default = name;
};
};
}));
};
users = mkOption {
type = attrsOf (submodule ({ ... }: {
options = {
locksmith = {
nodes = mkOption {
type = listOf str;
default = [];
};
format = mkOption {
type = enum [ "pgpass" "envFile" "raw" ];
default = "pgpass";
};
};
};
}));
};
};
}