81 lines
1.9 KiB
Nix
81 lines
1.9 KiB
Nix
{ cluster, config, depot, lib, ... }:
|
|
|
|
let
|
|
inherit (cluster.config) vars;
|
|
inherit (config.networking) hostName;
|
|
|
|
links = cluster.config.hostLinks.${hostName};
|
|
|
|
cfg = config.services.garage;
|
|
|
|
# fixed uid so we know how to mount the underlay
|
|
uid = 777;
|
|
gid = 777;
|
|
in
|
|
|
|
{
|
|
age.secrets.garageRpcSecret = {
|
|
file = ./secrets/garage-rpc-secret.age;
|
|
owner = "garage";
|
|
group = "garage";
|
|
};
|
|
|
|
system.ascensions.garage-layout = {
|
|
distributed = true;
|
|
requiredBy = [ "garage.service" ];
|
|
after = [ "garage.service" "garage-layout-init.service" ];
|
|
};
|
|
|
|
services.garage = {
|
|
enable = true;
|
|
package = depot.packages.garage;
|
|
settings = {
|
|
replication_mode = 3;
|
|
block_size = 16 * 1024 * 1024;
|
|
db_engine = "lmdb";
|
|
metadata_dir = "/var/lib/garage-metadata";
|
|
rpc_bind_addr = links.garageRpc.tuple;
|
|
rpc_public_addr = links.garageRpc.tuple;
|
|
rpc_secret_file = config.age.secrets.garageRpcSecret.path;
|
|
consul_discovery = {
|
|
consul_http_addr = "http://127.0.0.1:8500";
|
|
service_name = "garage-discovery";
|
|
};
|
|
s3_api = {
|
|
api_bind_addr = links.garageS3.tuple;
|
|
s3_region = "us-east-1";
|
|
};
|
|
s3_web = {
|
|
bind_addr = links.garageWeb.tuple;
|
|
root_domain = cluster.config.links.garageWeb.hostname;
|
|
};
|
|
};
|
|
};
|
|
|
|
users = {
|
|
users.garage = {
|
|
inherit uid;
|
|
group = "garage";
|
|
};
|
|
groups.garage = {
|
|
inherit gid;
|
|
};
|
|
};
|
|
|
|
systemd.services.garage = {
|
|
unitConfig = {
|
|
RequiresMountsFor = [ cfg.settings.data_dir ];
|
|
};
|
|
serviceConfig = {
|
|
IPAddressDeny = [ "any" ];
|
|
IPAddressAllow = [ "127.0.0.1/8" vars.meshNet.cidr ];
|
|
DynamicUser = false;
|
|
PrivateTmp = true;
|
|
ProtectSystem = true;
|
|
User = "garage";
|
|
Group = "garage";
|
|
StateDirectory = lib.mkForce (lib.removePrefix "/var/lib/" cfg.settings.metadata_dir);
|
|
};
|
|
};
|
|
}
|