kubernetes-deployments/modules/attic.nix

{ pkgs, lib, config, globals, ... }: {
  options.attic.enable = lib.mkEnableOption "attic";

  config = lib.mkIf config.attic.enable {
    kubernetes.resources =
      let
        atticSettings = {
          # The '+" is to explicitly denote the end of the Vals expression.
          # This is done because we quote the template for the INI file.
          # See: https://github.com/helmfile/vals?tab=readme-ov-file#expression-syntax
          database.url = "ref+sops://secrets.yml#attic/databaseURL+";

          storage = {
            type = "local";
            path = "/var/lib/atticd/storage";
          };

          listen = "[::]:8080";

          # Data chunking
          #
          # Warning: If you change any of the values here, it will be
          # difficult to reuse existing chunks for newly-uploaded NARs
          # since the cutpoints will be different. As a result, the
          # deduplication ratio will suffer for a while after the change.
          chunking = {
            # The minimum NAR size to trigger chunking
            #
            # If 0, chunking is disabled entirely for newly-uploaded NARs.
            # If 1, all NARs are chunked.
            nar-size-threshold = 64 * 1024; # 64 KiB

            # The preferred minimum size of a chunk, in bytes
            min-size = 16 * 1024; # 16 KiB

            # The preferred average size of a chunk, in bytes
            avg-size = 64 * 1024; # 64 KiB

            # The preferred maximum size of a chunk, in bytes
            max-size = 256 * 1024; # 256 KiB
          };
        };
        generatedConfig = (pkgs.formats.toml { }).generate "attic.toml" atticSettings;
      in
      {
        secrets = {
          server.stringData = {
            token = "ref+sops://secrets.yml#attic/jwtToken";
            config = builtins.readFile generatedConfig;
          };

          database.stringData.password = "ref+sops://secrets.yml#/attic/databasePassword";
        };

        deployments = {
          attic.spec = {
            selector.matchLabels = {
              app = "attic";
              component = "website";
            };

            strategy = {
              type = "RollingUpdate";

              rollingUpdate = {
                maxSurge = 0;
                maxUnavailable = 1;
              };
            };

            template = {
              metadata.labels = {
                app = "attic";
                component = "website";
              };

              spec = {
                containers.attic = {
                  image = globals.images.attic;
                  ports.web.containerPort = 8080;
                  args = [ "-f" "/etc/atticd/config.toml" ];

                  env.ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64.valueFrom.secretKeyRef = {
                    name = "server";
                    key = "token";
                  };

                  volumeMounts = [
                    {
                      name = "data";
                      mountPath = "/var/lib/atticd/storage";
                    }
                    {
                      name = "config";
                      mountPath = "/etc/atticd/config.toml";
                      subPath = "config";
                    }
                  ];
                };

                volumes = {
                  data.persistentVolumeClaim.claimName = "data";
                  config.secret.secretName = "server";
                };

                securityContext = {
                  fsGroup = 0;
                  fsGroupChangePolicy = "OnRootMismatch";
                };
              };
            };
          };

          attic-db.spec = {
            selector.matchLabels = {
              app = "attic";
              component = "database";
            };

            template = {
              metadata.labels = {
                app = "attic";
                component = "database";
              };

              spec = {
                containers.postgres = {
                  image = globals.images.postgres15;
                  imagePullPolicy = "IfNotPresent";
                  ports.postgres.containerPort = 5432;

                  env = {
                    POSTGRES_DB.value = "attic";
                    POSTGRES_USER.value = "attic";
                    PGDATA.value = "/pgdata/data";

                    POSTGRES_PASSWORD.valueFrom.secretKeyRef = {
                      name = "database";
                      key = "password";
                    };
                  };

                  volumeMounts = [{
                    name = "data";
                    mountPath = "/pgdata";
                  }];
                };

                volumes.data.persistentVolumeClaim.claimName = "database";
              };
            };
          };
        };

        services = {
          attic.spec = {
            selector = {
              app = "attic";
              component = "website";
            };

            ports.web = {
              port = 80;
              targetPort = "web";
            };
          };

          database.spec = {
            selector = {
              app = "attic";
              component = "database";
            };

            ports.postgres = {
              port = 5432;
              targetPort = "postgres";
            };
          };
        };
      };

    lab = {
      ingresses.attic = {
        host = "attic.kun.is";

        service = {
          name = "attic";
          portName = "web";
        };
      };

      longhorn.persistentVolumeClaim = {
        data = {
          volumeName = "attic";
          storage = "15Gi";
        };

        database = {
          volumeName = "attic-db";
          storage = "150Mi";
        };
      };
    };
  };
}