Compare commits
1 commit
master
...
pr-flake-u
Author | SHA1 | Date | |
---|---|---|---|
46164098c2 |
23 changed files with 130 additions and 185 deletions
|
@ -3,14 +3,12 @@
|
|||
{
|
||||
hostLinks = lib.pipe config.services [
|
||||
(lib.filterAttrs (_: svc: svc.meshLinks != {}))
|
||||
(lib.mapAttrsToList (svcName: svc:
|
||||
lib.mapAttrsToList (groupName: links:
|
||||
lib.genAttrs svc.nodes.${groupName} (hostName: lib.mapAttrs (_: cfg: { ... }: {
|
||||
(lib.mapAttrsToList (svcName: svc: lib.mapAttrsToList (name: cfg: lib.genAttrs svc.nodes.${name} (hostName: {
|
||||
${cfg.name} = { ... }: {
|
||||
imports = [ cfg.link ];
|
||||
ipv4 = config.vars.mesh.${hostName}.meshIp;
|
||||
}) links)
|
||||
) svc.meshLinks
|
||||
))
|
||||
};
|
||||
})) svc.meshLinks))
|
||||
(map lib.mkMerge)
|
||||
lib.mkMerge
|
||||
];
|
||||
|
|
|
@ -38,8 +38,12 @@ in
|
|||
};
|
||||
meshLinks = mkOption {
|
||||
description = "Create host links on the mesh network.";
|
||||
type = types.attrsOf (types.attrsOf (types.submodule {
|
||||
type = types.attrsOf (types.submodule ({ name, ... }: {
|
||||
options = {
|
||||
name = mkOption {
|
||||
type = types.str;
|
||||
default = "${serviceName}-${name}";
|
||||
};
|
||||
link = mkOption {
|
||||
type = types.deferredModule;
|
||||
default = {};
|
||||
|
|
|
@ -74,7 +74,7 @@ in
|
|||
serviceConfig = {
|
||||
Restart = "on-failure";
|
||||
RestartMaxDelaySec = 30;
|
||||
RestartSteps = 5;
|
||||
RestartStesp = 5;
|
||||
RestartMode = "direct";
|
||||
};
|
||||
};
|
||||
|
|
|
@ -16,7 +16,10 @@
|
|||
./nar-serve.nix
|
||||
];
|
||||
};
|
||||
meshLinks.server.attic.link.protocol = "http";
|
||||
meshLinks.server = {
|
||||
name = "attic";
|
||||
link.protocol = "http";
|
||||
};
|
||||
secrets = let
|
||||
inherit (config.services.attic) nodes;
|
||||
in {
|
||||
|
|
|
@ -80,7 +80,6 @@ in
|
|||
mode = if isMonolith then "manual" else "direct";
|
||||
definition = {
|
||||
name = "atticd";
|
||||
id = "atticd-${config.services.atticd.mode}";
|
||||
address = link.ipv4;
|
||||
inherit (link) port;
|
||||
checks = [
|
||||
|
|
|
@ -4,7 +4,10 @@
|
|||
services.forge = {
|
||||
nodes.server = [ "VEGAS" ];
|
||||
nixos.server = ./server.nix;
|
||||
meshLinks.server.forge.link.protocol = "http";
|
||||
meshLinks.server = {
|
||||
name = "forge";
|
||||
link.protocol = "http";
|
||||
};
|
||||
secrets = with config.services.forge.nodes; {
|
||||
oidcSecret = {
|
||||
nodes = server;
|
||||
|
|
|
@ -33,9 +33,6 @@ in
|
|||
ldapbindaddress = "${ldapLink.ipv4}:${ldapLink.portStr}";
|
||||
origin = frontendLink.url;
|
||||
inherit domain;
|
||||
online_backup = {
|
||||
versions = 7;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
@ -29,7 +29,10 @@
|
|||
io-tweaks = [ "VEGAS" ];
|
||||
remote-api = [ "VEGAS" ];
|
||||
};
|
||||
meshLinks.gateway.ipfsGateway.link.protocol = "http";
|
||||
meshLinks.gateway = {
|
||||
name = "ipfsGateway";
|
||||
link.protocol = "http";
|
||||
};
|
||||
nixos = {
|
||||
node = [
|
||||
./node.nix
|
||||
|
|
|
@ -9,7 +9,7 @@ in
|
|||
environment = {
|
||||
OTEL_TRACES_EXPORTER = "otlp";
|
||||
OTEL_EXPORTER_OTLP_PROTOCOL = "grpc";
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT = "${cluster.config.ways.ingest-traces-otlp.url}:443";
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT = cluster.config.links.tempo-otlp-grpc.url;
|
||||
OTEL_TRACES_SAMPLER = "parentbased_traceidratio";
|
||||
OTEL_TRACES_SAMPLER_ARG = "0.50";
|
||||
};
|
||||
|
|
|
@ -26,7 +26,7 @@ in {
|
|||
name = "logging";
|
||||
positions.filename = "\${STATE_DIRECTORY:/tmp}/logging-positions.yaml";
|
||||
clients = singleton {
|
||||
url = "${cluster.config.ways.ingest-logs.url}/loki/api/v1/push";
|
||||
url = "${cluster.config.ways.monitoring-logs.url}/loki/api/v1/push";
|
||||
};
|
||||
scrape_configs = singleton {
|
||||
job_name = "journal";
|
||||
|
|
|
@ -18,6 +18,26 @@ in
|
|||
protocol = "http";
|
||||
ipv4 = meshIpFor "server";
|
||||
};
|
||||
tempo = {
|
||||
protocol = "http";
|
||||
ipv4 = meshIpFor "server";
|
||||
};
|
||||
tempo-grpc = {
|
||||
protocol = "http";
|
||||
ipv4 = "127.0.0.1";
|
||||
};
|
||||
tempo-otlp-http = {
|
||||
protocol = "http";
|
||||
ipv4 = meshIpFor "server";
|
||||
};
|
||||
tempo-otlp-grpc = {
|
||||
protocol = "http";
|
||||
ipv4 = meshIpFor "server";
|
||||
};
|
||||
tempo-zipkin-http = {
|
||||
protocol = "http";
|
||||
ipv4 = meshIpFor "server";
|
||||
};
|
||||
};
|
||||
hostLinks = lib.genAttrs config.services.monitoring.nodes.grafana (name: {
|
||||
grafana = {
|
||||
|
@ -31,7 +51,6 @@ in
|
|||
blackbox = [ "checkmate" "grail" "prophet" ];
|
||||
grafana = [ "VEGAS" "prophet" ];
|
||||
logging = [ "VEGAS" "grail" ];
|
||||
tracing = [ "VEGAS" "grail" ];
|
||||
server = [ "VEGAS" ];
|
||||
};
|
||||
nixos = {
|
||||
|
@ -42,19 +61,14 @@ in
|
|||
./provisioning/dashboards.nix
|
||||
];
|
||||
logging = ./logging.nix;
|
||||
tracing = ./tracing.nix;
|
||||
server = [
|
||||
./server.nix
|
||||
./tracing.nix
|
||||
];
|
||||
};
|
||||
meshLinks = {
|
||||
logging.loki.link.protocol = "http";
|
||||
tracing = {
|
||||
tempo.link.protocol = "http";
|
||||
tempo-otlp-http.link.protocol = "http";
|
||||
tempo-otlp-grpc.link.protocol = "grpc";
|
||||
tempo-zipkin-http.link.protocol = "http";
|
||||
};
|
||||
meshLinks.logging = {
|
||||
name = "loki";
|
||||
link.protocol = "http";
|
||||
};
|
||||
};
|
||||
|
||||
|
@ -68,51 +82,29 @@ in
|
|||
nodes = config.services.monitoring.nodes.logging;
|
||||
format = "envFile";
|
||||
};
|
||||
tempo-ingest.locksmith = {
|
||||
nodes = config.services.monitoring.nodes.tracing;
|
||||
format = "envFile";
|
||||
};
|
||||
tempo-query.locksmith = {
|
||||
nodes = config.services.monitoring.nodes.tracing;
|
||||
format = "envFile";
|
||||
};
|
||||
tempo = { };
|
||||
};
|
||||
buckets = {
|
||||
loki-chunks.allow = {
|
||||
loki-ingest = [ "read" "write" ];
|
||||
loki-query = [ "read" ];
|
||||
};
|
||||
tempo-chunks.allow = {
|
||||
tempo-ingest = [ "read" "write" ];
|
||||
tempo-query = [ "read" ];
|
||||
};
|
||||
tempo-chunks.allow.tempo = [ "read" "write" ];
|
||||
};
|
||||
};
|
||||
|
||||
ways = let
|
||||
query = consulService: {
|
||||
inherit consulService;
|
||||
internal = true;
|
||||
extras.extraConfig = ''
|
||||
proxy_read_timeout 3600s;
|
||||
'';
|
||||
ways = config.lib.forService "monitoring" {
|
||||
monitoring = {
|
||||
consulService = "grafana";
|
||||
extras.locations."/".proxyWebsockets = true;
|
||||
};
|
||||
ingest = consulService: {
|
||||
inherit consulService;
|
||||
monitoring-logs = {
|
||||
internal = true;
|
||||
consulService = "loki";
|
||||
extras.extraConfig = ''
|
||||
client_max_body_size 4G;
|
||||
proxy_read_timeout 3600s;
|
||||
'';
|
||||
};
|
||||
in config.lib.forService "monitoring" {
|
||||
monitoring = {
|
||||
consulService = "grafana";
|
||||
extras.locations."/".proxyWebsockets = true;
|
||||
};
|
||||
monitoring-logs = query "loki";
|
||||
monitoring-traces = query "tempo";
|
||||
ingest-logs = ingest "loki";
|
||||
ingest-traces-otlp = ingest "tempo-ingest-otlp-grpc" // { grpc = true; };
|
||||
};
|
||||
}
|
||||
|
|
|
@ -73,16 +73,6 @@ in
|
|||
inherit (cluster.config.ways.monitoring-logs) url;
|
||||
type = "loki";
|
||||
}
|
||||
{
|
||||
name = "Tempo";
|
||||
uid = "P214B5B846CF3925F";
|
||||
inherit (cluster.config.ways.monitoring-traces) url;
|
||||
type = "tempo";
|
||||
jsonData = {
|
||||
serviceMap.datasourceUid = "PBFA97CFB590B2093";
|
||||
nodeGraph.enabled = true;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
|
16
cluster/services/monitoring/secrets/tempo-secrets.age
Normal file
16
cluster/services/monitoring/secrets/tempo-secrets.age
Normal file
|
@ -0,0 +1,16 @@
|
|||
age-encryption.org/v1
|
||||
-> ssh-ed25519 NO562A KhCGp7PAMGrEdzRxBrsW4tRk30JwpI+4lPzrRCUhSw4
|
||||
8s7WqA5c3zS1euN5R+jfFNBdvr8OQW8P4NFeqtNsIKo
|
||||
-> ssh-ed25519 5/zT0w 79hJQ2H76EZTW7YcQFCtKaS5Kbssx4Z8dPFjIVzRgFk
|
||||
A1fDJbUnyIRy+kWa3PhJNj/SdRPlcEy6FYsAfnuZ2AQ
|
||||
-> ssh-ed25519 d3WGuA aylkdL1KliM1NfrYDGlG8X6YjXvVUCU4sV90I+a840U
|
||||
6sXdqIPjtoNSylZRh1DCghHOwDo+fC7WB4QWQoWmG48
|
||||
-> //gd+2-grease baUWA$3 z-qs3W O/2.1W
|
||||
Sfq3+rkMJhpUTTmcos5TaaUtX2Ip9pciHAZLiWPix+C9N7ccac/1W5RNedMJCLsq
|
||||
MQ+xKzexf8+hgNVhKOksvbKBBROXqk1bUOKk8w3OgFPmmByzmCBUwkdkeu5DFTYR
|
||||
rg
|
||||
--- kUl1uIPRkM5y7C68kdN22pMKXP7gazyha4PE+ap0Jqw
|
||||
w>×Àè¥
|
||||
<15>CÈ,\‰ßœI¯ˆúHxG@^Çá“PåÃþÙÏlw6µŽ{þ’rb‘é5æ†T>Êñ
|
||||
ÚWܤX4Kp(ß?9ˆß^^oP3f </v3N$ê¤sÓbŽ¾>O™÷œ+òN0άïµàDtêŽ5Vº#è ¶³‘Uã îŸ#y|›@ŒGzSi»ô*·HùüŽ]
|
||||
ꎀ5›
|
|
@ -1,16 +1,14 @@
|
|||
{ cluster, config, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (cluster.config.links) prometheus-ingest;
|
||||
inherit (config.links) tempo-grpc;
|
||||
links = cluster.config.hostLinks.${config.networking.hostName};
|
||||
inherit (cluster.config) links;
|
||||
dataDir = "/srv/storage/private/tempo";
|
||||
tempoConfig = {
|
||||
server = {
|
||||
http_listen_address = links.tempo.ipv4;
|
||||
http_listen_port = links.tempo.port;
|
||||
grpc_listen_address = tempo-grpc.ipv4;
|
||||
grpc_listen_port = tempo-grpc.port;
|
||||
grpc_listen_address = links.tempo-grpc.ipv4;
|
||||
grpc_listen_port = links.tempo-grpc.port;
|
||||
};
|
||||
distributor.receivers = {
|
||||
otlp = {
|
||||
|
@ -21,7 +19,7 @@ let
|
|||
};
|
||||
zipkin.endpoint = links.tempo-zipkin-http.tuple;
|
||||
};
|
||||
querier.frontend_worker.frontend_address = tempo-grpc.tuple;
|
||||
querier.frontend_worker.frontend_address = links.tempo-grpc.tuple;
|
||||
ingester = {
|
||||
trace_idle_period = "30s";
|
||||
max_block_bytes = 1000000;
|
||||
|
@ -58,7 +56,7 @@ let
|
|||
path = "${dataDir}/generator/wal";
|
||||
remote_write = [
|
||||
{
|
||||
url = "${prometheus-ingest.url}/api/v1/write";
|
||||
url = "${links.prometheus-ingest.url}/api/v1/write";
|
||||
send_exemplars = true;
|
||||
}
|
||||
];
|
||||
|
@ -70,11 +68,7 @@ let
|
|||
];
|
||||
};
|
||||
in {
|
||||
links.tempo-grpc.protocol = "http";
|
||||
|
||||
services.locksmith.waitForSecrets.tempo = [
|
||||
"garage-tempo-ingest"
|
||||
];
|
||||
age.secrets.tempoSecrets.file = ./secrets/tempo-secrets.age;
|
||||
|
||||
users.users.tempo = {
|
||||
isSystemUser = true;
|
||||
|
@ -87,53 +81,24 @@ in {
|
|||
|
||||
systemd.services.tempo = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
distributed = {
|
||||
enable = true;
|
||||
registerServices = [
|
||||
"tempo"
|
||||
"tempo-ingest-otlp-grpc"
|
||||
];
|
||||
};
|
||||
serviceConfig = {
|
||||
User = "tempo";
|
||||
Group = "tempo";
|
||||
ExecStart = "${pkgs.tempo}/bin/tempo -config.file=${pkgs.writeText "tempo.yaml" (builtins.toJSON tempoConfig)}";
|
||||
PrivateTmp = true;
|
||||
EnvironmentFile = "/run/locksmith/garage-tempo-ingest";
|
||||
EnvironmentFile = config.age.secrets.tempoSecrets.path;
|
||||
};
|
||||
};
|
||||
|
||||
consul.services = {
|
||||
tempo = {
|
||||
mode = "manual";
|
||||
definition = {
|
||||
name = "tempo";
|
||||
address = links.tempo.ipv4;
|
||||
inherit (links.tempo) port;
|
||||
checks = [
|
||||
services.grafana.provision.datasources.settings.datasources = [
|
||||
{
|
||||
name = "Tempo";
|
||||
id = "service:tempo:backend";
|
||||
interval = "5s";
|
||||
http = "${links.tempo.url}/ready";
|
||||
uid = "P214B5B846CF3925F";
|
||||
inherit (links.tempo) url;
|
||||
type = "tempo";
|
||||
jsonData = {
|
||||
serviceMap.datasourceUid = "PBFA97CFB590B2093"; # prometheus
|
||||
nodeGraph.enabled = true;
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
tempo-ingest-otlp-grpc = {
|
||||
mode = "manual";
|
||||
definition = {
|
||||
name = "tempo-ingest-otlp-grpc";
|
||||
address = links.tempo-otlp-grpc.ipv4;
|
||||
inherit (links.tempo-otlp-grpc) port;
|
||||
checks = [
|
||||
{
|
||||
name = "Tempo Service Status";
|
||||
id = "service:tempo-ingest-otlp-grpc:tempo";
|
||||
alias_service = "tempo";
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
@ -1,4 +1,4 @@
|
|||
{ config, depot, ... }:
|
||||
{ depot, ... }:
|
||||
|
||||
{
|
||||
services.sso = {
|
||||
|
@ -18,12 +18,4 @@
|
|||
login.target = ssoAddr;
|
||||
account.target = ssoAddr;
|
||||
};
|
||||
|
||||
patroni = config.lib.forService "sso" {
|
||||
databases.keycloak = {};
|
||||
users.keycloak.locksmith = {
|
||||
nodes = config.services.sso.nodes.host;
|
||||
format = "raw";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
@ -8,10 +8,12 @@ in
|
|||
{
|
||||
links.keycloak.protocol = "http";
|
||||
|
||||
services.locksmith.waitForSecrets.keycloak = [
|
||||
"patroni-keycloak"
|
||||
];
|
||||
|
||||
age.secrets.keycloak-dbpass = {
|
||||
file = ../../../secrets/keycloak-dbpass.age;
|
||||
owner = "root";
|
||||
group = "root";
|
||||
mode = "0400";
|
||||
};
|
||||
services.nginx.virtualHosts = {
|
||||
"${login}" = lib.recursiveUpdate (vhosts.proxy kc.url) {
|
||||
locations = {
|
||||
|
@ -34,7 +36,7 @@ in
|
|||
host = patroni.ipv4;
|
||||
inherit (patroni) port;
|
||||
useSSL = false;
|
||||
passwordFile = "/run/locksmith/patroni-keycloak";
|
||||
passwordFile = config.age.secrets.keycloak-dbpass.path;
|
||||
};
|
||||
settings = {
|
||||
http-host = kc.ipv4;
|
||||
|
@ -52,7 +54,7 @@ in
|
|||
"-Dotel.traces.exporter=otlp"
|
||||
];
|
||||
OTEL_EXPORTER_OTLP_PROTOCOL = "grpc";
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT = cluster.config.ways.ingest-traces-otlp.url;
|
||||
OTEL_EXPORTER_OTLP_ENDPOINT = cluster.config.links.tempo-otlp-grpc.url;
|
||||
OTEL_TRACES_SAMPLER = "parentbased_traceidratio";
|
||||
OTEL_TRACES_SAMPLER_ARG = "0.50";
|
||||
};
|
||||
|
|
|
@ -36,9 +36,10 @@ in
|
|||
inherit (linkWeb) port;
|
||||
checks = [
|
||||
{
|
||||
name = "Garage Service Status";
|
||||
id = "service:garage-web:garage";
|
||||
alias_service = "garage";
|
||||
name = "Garage Node";
|
||||
id = "service:garage-web:node";
|
||||
interval = "5s";
|
||||
http = "${config.links.garageMetrics.url}/health";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
|
|
@ -25,14 +25,7 @@ in
|
|||
];
|
||||
locations = lib.mkMerge [
|
||||
{
|
||||
"/" = if cfg.grpc then {
|
||||
extraConfig = ''
|
||||
set $nix_proxy_grpc_target ${cfg.target};
|
||||
grpc_pass $nix_proxy_grpc_target;
|
||||
'';
|
||||
} else {
|
||||
proxyPass = cfg.target;
|
||||
};
|
||||
"/".proxyPass = cfg.target;
|
||||
"${cfg.healthCheckPath}".extraConfig = "access_log off;";
|
||||
}
|
||||
{
|
||||
|
|
|
@ -35,12 +35,6 @@ with lib;
|
|||
};
|
||||
};
|
||||
|
||||
grpc = mkOption {
|
||||
description = "Whether this endpoint is a gRPC service.";
|
||||
type = types.bool;
|
||||
default = false;
|
||||
};
|
||||
|
||||
target = mkOption {
|
||||
type = types.str;
|
||||
};
|
||||
|
@ -107,7 +101,7 @@ with lib;
|
|||
(lib.mkIf options.consulService.isDefined {
|
||||
useConsul = true;
|
||||
nginxUpstreamName = "ways_upstream_${builtins.hashString "md5" options.consulService.value}";
|
||||
target = "${if config.grpc then "grpc" else "http"}://${options.nginxUpstreamName.value}";
|
||||
target = "http://${options.nginxUpstreamName.value}";
|
||||
})
|
||||
(lib.mkIf options.bucket.isDefined {
|
||||
consulService = "garage-web";
|
||||
|
|
36
flake.lock
36
flake.lock
|
@ -10,11 +10,11 @@
|
|||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1722339003,
|
||||
"narHash": "sha256-ZeS51uJI30ehNkcZ4uKqT4ZDARPyqrHADSKAwv5vVCU=",
|
||||
"lastModified": 1723293904,
|
||||
"narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
|
||||
"owner": "ryantm",
|
||||
"repo": "agenix",
|
||||
"rev": "3f1dae074a12feb7327b4bf43cbac0d124488bb7",
|
||||
"rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -40,11 +40,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1722472866,
|
||||
"narHash": "sha256-GJIz4M5HDB948Ex/8cPvbkrNzl/eKUE7/c21JBu4lb8=",
|
||||
"lastModified": 1724226964,
|
||||
"narHash": "sha256-cltFh4su2vcFidxKp7LuEgX3ZGLfPy0DCdrQZ/QTe68=",
|
||||
"owner": "zhaofengli",
|
||||
"repo": "attic",
|
||||
"rev": "e127acbf9a71ebc0c26bc8e28346822e0a6e16ba",
|
||||
"rev": "6d9aeaef0a067d664cb11bb7704f7ec373d47fb2",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -76,11 +76,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1717025063,
|
||||
"narHash": "sha256-dIubLa56W9sNNz0e8jGxrX3CAkPXsq7snuFA/Ie6dn8=",
|
||||
"lastModified": 1722960479,
|
||||
"narHash": "sha256-NhCkJJQhD5GUib8zN9JrmYGMwt4lCRp6ZVNzIiYCl0Y=",
|
||||
"owner": "ipetkov",
|
||||
"repo": "crane",
|
||||
"rev": "480dff0be03dac0e51a8dfc26e882b0d123a450e",
|
||||
"rev": "4c6c77920b8d44cd6660c1621dea6b3fc4b4c4f4",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -268,11 +268,11 @@
|
|||
"nixpkgs": "nixpkgs"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1720223941,
|
||||
"narHash": "sha256-QDbU8LZzcUSqBp1CBqDj/f5Wd/sdgQ8pZwRWueoMUL4=",
|
||||
"lastModified": 1723736589,
|
||||
"narHash": "sha256-/Vdg5ZKtP71ZEKVV6JXlrOEu0CM2Flcs+nwDmWRzgjQ=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "hercules-ci-agent",
|
||||
"rev": "2e10fb21fc2e07edf40763b73443e5934bd40947",
|
||||
"rev": "c303cc8e437c0fd26b9452472e7df5aa374e9177",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -399,11 +399,11 @@
|
|||
"systems": "systems_2"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1722409392,
|
||||
"narHash": "sha256-8QuMS00EutmqzAIPxyJEPxM8EHiWlSKs6E2Htoh3Kes=",
|
||||
"lastModified": 1723717449,
|
||||
"narHash": "sha256-i+9i1D5zEz2c3o5RuH+X/jDRmA12vgU8UxxE0/TPvtE=",
|
||||
"owner": "numtide",
|
||||
"repo": "nar-serve",
|
||||
"rev": "9d0eff868d328fe67c60c26c8ba50e0b9d8de867",
|
||||
"rev": "846cb9d55aee9af7c7a1eaf7016f2c5b9e01cc6e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
@ -504,11 +504,11 @@
|
|||
},
|
||||
"nixpkgs_4": {
|
||||
"locked": {
|
||||
"lastModified": 1722539632,
|
||||
"narHash": "sha256-g4L+I8rDl7RQy5x8XcEMqNO49LFhrHTzVBqXtG2+FGo=",
|
||||
"lastModified": 1724221631,
|
||||
"narHash": "sha256-zf3gNf0nX2yOb++h4jW9l4iG8R/LfazWZD+KhmW6fcc=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "f2d6c7123138044e0c68902268bd8f37dd7e2fa7",
|
||||
"rev": "ac2df85f4d5c580786c7b4db031c199554152681",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
@ -26,13 +26,11 @@ in
|
|||
|
||||
cfg = v.distributed;
|
||||
|
||||
svcs = map (x: config.consul.services.${x}) cfg.registerServices;
|
||||
svc = config.consul.services.${cfg.registerService};
|
||||
|
||||
runWithRegistration = pkgs.writeShellScript "run-with-registration" ''
|
||||
trap '${lib.concatStringsSep ";" (map (svc: svc.commands.deregister) svcs)}' EXIT
|
||||
${lib.concatStringsSep "\n" (
|
||||
map (svc: svc.commands.register) svcs
|
||||
)}
|
||||
trap '${svc.commands.deregister}' EXIT
|
||||
${svc.commands.register}
|
||||
''${@}
|
||||
'';
|
||||
|
||||
|
@ -51,10 +49,10 @@ in
|
|||
[Service]
|
||||
ExecStartPre=${waitForConsul} 'services/${n}%i'
|
||||
ExecStart=
|
||||
ExecStart=${consul}/bin/consul lock --name=${n} --n=${toString cfg.replicas} --shell=false --child-exit-code 'services/${n}%i' ${optionalString (cfg.registerServices != []) runWithRegistration} ${ExecStart}
|
||||
ExecStart=${consul}/bin/consul lock --name=${n} --n=${toString cfg.replicas} --shell=false --child-exit-code 'services/${n}%i' ${optionalString (cfg.registerService != null) runWithRegistration} ${ExecStart}
|
||||
Environment="CONSUL_HTTP_ADDR=${consulHttpAddr}"
|
||||
${optionalString (v.serviceConfig ? RestrictAddressFamilies) "RestrictAddressFamilies=AF_NETLINK"}
|
||||
${optionalString (cfg.registerServices != []) (lib.concatStringsSep "\n" (map (svc: "ExecStopPost=${svc.commands.deregister}") svcs))}
|
||||
${optionalString (cfg.registerService != null) "ExecStopPost=${svc.commands.deregister}"}
|
||||
''))
|
||||
];
|
||||
}
|
||||
|
|
|
@ -17,11 +17,6 @@ with lib;
|
|||
type = with types; nullOr str;
|
||||
default = null;
|
||||
};
|
||||
registerServices = mkOption {
|
||||
description = "Consul services to register when this service gets started.";
|
||||
type = with types; listOf str;
|
||||
default = if config.distributed.registerService == null then [ ] else [ config.distributed.registerService ];
|
||||
};
|
||||
};
|
||||
}));
|
||||
};
|
||||
|
|
BIN
secrets/keycloak-dbpass.age
Normal file
BIN
secrets/keycloak-dbpass.age
Normal file
Binary file not shown.
Loading…
Reference in a new issue