90 lines
2.5 KiB
Nix
90 lines
2.5 KiB
Nix
{ pkgs, lib, config, ... }: {
|
|
options = {
|
|
custom = {
|
|
dataDisk.enable = lib.mkOption {
|
|
default = false;
|
|
type = lib.types.bool;
|
|
description = ''
|
|
Whether to automatically mount /dev/sda1 on /mnt/data
|
|
'';
|
|
};
|
|
|
|
ssh = {
|
|
hostCert = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = ''
|
|
SSH host certificate
|
|
'';
|
|
};
|
|
|
|
userCert = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = ''
|
|
SSH user certificate
|
|
'';
|
|
};
|
|
|
|
hostKey = lib.mkOption {
|
|
default = ../secrets/${config.networking.hostName}_host_ed25519.age;
|
|
type = lib.types.path;
|
|
description = ''
|
|
SSH host key
|
|
'';
|
|
};
|
|
|
|
userKey = lib.mkOption {
|
|
default = ../secrets/${config.networking.hostName}_user_ed25519.age;
|
|
type = lib.types.path;
|
|
description = ''
|
|
SSH user key
|
|
'';
|
|
};
|
|
};
|
|
|
|
terraformDatabase.enable = lib.mkOption {
|
|
default = false;
|
|
type = lib.types.bool;
|
|
description = ''
|
|
Whether to start a postgreSQL database for Terraform states
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
config = {
|
|
fileSystems."/mnt/data" =
|
|
lib.mkIf config.custom.dataDisk.enable { device = "/dev/sda1"; };
|
|
|
|
services.postgresql = lib.mkIf config.custom.terraformDatabase.enable {
|
|
enable = true;
|
|
ensureDatabases = [ "terraformstates" ];
|
|
package = pkgs.postgresql_15;
|
|
enableTCPIP = true;
|
|
dataDir =
|
|
"/mnt/data/postgresql/${config.services.postgresql.package.psqlSchema}";
|
|
# TODO: for now trust, replace this with client certificate later
|
|
authentication = ''
|
|
hostssl terraformstates all all trust
|
|
'';
|
|
settings = {
|
|
ssl = true;
|
|
# TODO: create key pair for server
|
|
ssl_cert_file = builtins.toFile "postgresql_server.crt"
|
|
(builtins.readFile ../postgresql_server.crt);
|
|
ssl_key_file = config.age.secrets."postgresql_server.key".path;
|
|
};
|
|
};
|
|
|
|
age.secrets."postgresql_server.key" = {
|
|
file = ../secrets/postgresql_server.key.age;
|
|
mode = "400";
|
|
owner = builtins.toString config.ids.uids.postgres;
|
|
group = builtins.toString config.ids.gids.postgres;
|
|
};
|
|
|
|
# age.secrets."postgresql_server.key" =
|
|
# lib.mkIf config.custom.terraformDatabase.enable {
|
|
# file = ../secrets/postgresql_server.key.age;
|
|
# };
|
|
};
|
|
}
|