49 lines
1.4 KiB
Nix
49 lines
1.4 KiB
Nix
{ pkgs, lib, config, ... }:
|
|
let cfg = config.lab.terraformDatabase;
|
|
in {
|
|
options.lab.terraformDatabase.enable = lib.mkOption {
|
|
default = false;
|
|
type = lib.types.bool;
|
|
description = ''
|
|
Whether to start a postgreSQL database for Terraform states
|
|
'';
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
networking.firewall.interfaces.${config.lab.networking.mainNicNamePattern}.allowedTCPPorts = [ 5432 ];
|
|
|
|
services.postgresql = {
|
|
enable = true;
|
|
ensureDatabases = [ "terraformstates" ];
|
|
package = pkgs.postgresql_15;
|
|
enableTCPIP = true;
|
|
|
|
dataDir = "${config.lab.storage.dataMountPoint}/postgresql/${config.services.postgresql.package.psqlSchema}";
|
|
|
|
authentication = ''
|
|
hostssl terraformstates terraform all cert
|
|
'';
|
|
|
|
settings =
|
|
let
|
|
serverCert = builtins.toFile "postgresql_server.crt"
|
|
(builtins.readFile ./postgresql_server.crt);
|
|
in
|
|
{
|
|
ssl = true;
|
|
ssl_cert_file = serverCert;
|
|
ssl_key_file = config.age.secrets."postgresql_server.key".path;
|
|
ssl_ca_file = serverCert;
|
|
};
|
|
|
|
ensureUsers = [{ name = "terraform"; }];
|
|
};
|
|
|
|
age.secrets."postgresql_server.key" = {
|
|
file = ../../secrets/postgresql_server.key.age;
|
|
mode = "400";
|
|
owner = builtins.toString config.ids.uids.postgres;
|
|
group = builtins.toString config.ids.gids.postgres;
|
|
};
|
|
};
|
|
}
|