✨ aristotle: ipfs cluster
This commit is contained in:
parent
c71f520e09
commit
b1c4c29678
GPG Key ID:
3C127179D6086E93
10
.sops.yaml
10
.sops.yaml
@ -1,9 +1,17 @@
|
||||
keys:
|
||||
- &walkah age16yv7atd8n880ja98pksqqvunu2yw00660lkh4n0sg39j5vt3dujshyu95j
|
||||
- &plato age12m47c7xvqttncps0e79pwamzqa4nmnxekwumtwcv5ju6q74fufaqp9d0xh
|
||||
- &agent age1vc8svd5277rjkgzg7frf04uaa45w3crhfvg628rqyrqmxul3q9nsjz6yxk
|
||||
- &form age1ulmzprdmcd8r0w47a0nrrlg8melkjk6evl2rc54yh6lxkcfas36q6wrsv9
|
||||
- &matter age1lfjkch3pqaq3uwmjxyucpm2tws6llxqqjglj4yn49jkwkf50xvmqrl974e
|
||||
- &purpose age1jnf94uq5ap96vk7nfk3qkr38ylhletc6pskj0ypc470d7gmt0qeqskdy5z
|
||||
creation_rules:
|
||||
- path_regex: secrets/[^/]+\.yaml$
|
||||
key_groups:
|
||||
- age:
|
||||
- *walkah
|
||||
- *plato
|
||||
- *plato
|
||||
- *agent
|
||||
- *form
|
||||
- *matter
|
||||
- *purpose
|
||||
@ -6,6 +6,7 @@
|
||||
./rpi-poe.nix
|
||||
|
||||
../../modules/ipfs/cluster.nix
|
||||
../../modules/sops
|
||||
];
|
||||
|
||||
# Use the extlinux boot loader. (NixOS wants to enable GRUB by default)
|
||||
|
||||
@ -1,7 +1,11 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
{
|
||||
imports = [ ./default.nix ];
|
||||
imports = [
|
||||
./default.nix
|
||||
../../services/ipfs-cluster.nix
|
||||
];
|
||||
|
||||
services = {
|
||||
ipfs = {
|
||||
enable = true;
|
||||
@ -17,5 +21,15 @@
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
ipfs-cluster = {
|
||||
enable = true;
|
||||
consensus = "crdt";
|
||||
secretFile = config.sops.secrets.ipfs-cluster-secret.path;
|
||||
};
|
||||
};
|
||||
|
||||
sops.secrets.ipfs-cluster-secret = {
|
||||
owner = "ipfs";
|
||||
};
|
||||
}
|
||||
|
||||
@ -1,4 +1,5 @@
|
||||
matrix-registration-secret: ENC[AES256_GCM,data:w/rq68h8VU7oivm9in8CuMPWipX76LqJwq4A2lWANZgAxK3KwOdRAmH81O0W9v5xNTFYf/JJmfLXrBf8mLyLT6Ng8tcJwkZmNrwpEf91gO6jK0bwKz9RBKmwBeg=,iv:W2zqyrsQb2XHcPZZ5W4evmbSex4v3RRiP+fF0AU2EB0=,tag:OJDk1DbAYY8ucH1JIoA6ew==,type:str]
|
||||
matrix-registration-secret: ENC[AES256_GCM,data:Sn3pGBq4U3Tgw0pYaetnBLRiNdFGnMxAxyfrxhF9kFDMFijKSy9XBj71M5XxV4shYQyPvu2WDnPR1YvyoQVlv8cEoXhX7++JlYsp/2ZfKIzp4iMxh24z57Cw8vg=,iv:/zxlIeI9gWWCHbejYgz8pjjOrukKome0/bmcXuG3/yE=,tag:3fc3c96H3pO1FUO7p3T4gw==,type:str]
|
||||
ipfs-cluster-secret: ENC[AES256_GCM,data:Z9i7ZLhlXw4m8myNUSiY5ej2/6UIwCwIe0bvbCttVLdv8cAHwzR2f22poKD6KnPBe9yaym+X3YtrHTCM4pVIbiSzMsHwYZ00vRQi35ZmYg==,iv:9PBz/olzA4X7JEL1xG8ACUaH1WDHSzApzlG5q0ZqSYk=,tag:9I4PGf91MHAKNeG4fVKIow==,type:str]
|
||||
sops:
|
||||
kms: []
|
||||
gcp_kms: []
|
||||
@ -8,23 +9,59 @@ sops:
|
||||
- recipient: age16yv7atd8n880ja98pksqqvunu2yw00660lkh4n0sg39j5vt3dujshyu95j
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBzMW9GbTVQWjdOaUVJNjJH
|
||||
VUhsSGxLb1NlU2NXTjRqYklLUlYxRnpkbm44CjRZU2lNTTlERmFHYTRoL0dRWjRq
|
||||
QUhkYjBsK2NyWDMzL004aDZBMGJrNjgKLS0tIFNHbEl2ejZJK0tGeEcyRTk3TU9S
|
||||
MmFZc29kdEFlL202emU3cUhwMytUeXMK429JtnxnZfDl8Op2NSz40xUXKO2XWICY
|
||||
I0Z2xOATxOq9N1MvNbD6HheT8ngUtu/LQJXcsDIHk0MkzBJRe8u79A==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXNkhRdXhFTVkxVTNVTlhK
|
||||
d0xiQ3VmcURreWFzVGxVb0RPK2RNMGVob2g0CnBkZzF4U0FrWVVVbW03Umliby9P
|
||||
djNUKzFWbW0xR1QyOUh3d2g5SjNsUW8KLS0tIGRhamZvOERxUmxDdDNHM1ZUbzdZ
|
||||
UjJUQS9vL2ZkQ3NCd1VwLzRMQS9Xc0EKKcGxURwN3ejTk41W/q5VVrhalPO4GOdr
|
||||
JvdxH7OIn+u/8KNNXgKOPV8Iss35Mu4geSh1zJXPVf+YhTZNq8C2jQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age12m47c7xvqttncps0e79pwamzqa4nmnxekwumtwcv5ju6q74fufaqp9d0xh
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZNklPdm52OHVzL0cxOHRI
|
||||
cVdFcW0zL0RuYXJJbzlTZjI0dkxoQThjVG5zCldCLzE3cGF0ZGJTZ0dBajFaMktr
|
||||
ZDA3WHFaQzJONmlUSXBrNzY5MHJTT1EKLS0tIHczU2JVc2RhVmc1Y01NOWZHclly
|
||||
QXJkUkFMS1ZCcXl1ZCsvUmdqeVVvc0EK9xP+VkSN61gLwMwwlOFCpLsfL6Jzk7CB
|
||||
5LfW5lsyWCMqnw00W52h177kHZdf/nLmnoLDz2jZ7hPXiDpS7G9MrA==
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCTkxOWEo0Nk9iMy8zUGFP
|
||||
endwS2NQQWJnVmo3RTNyYiszMndtSGNZUjFJCmZzUTZidmNWVGxVWDduUldMaXV4
|
||||
SnZTMTZaU3FUNFpwbjBTQk94azhRZ2sKLS0tIDU1R1cwZDJQZW5qcXkyLzZIQitV
|
||||
ZUptMXcvcXhkNUdRZDc2WmF3c2tLeXMKnicAN5U1KO/vhJxGgv/oHGPJ4mEoVogL
|
||||
Gv5RTCKMwfHgdEHOUPbq/kPz0eTc9R57XsfhA7DHpgZAxo86gZNqOg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2021-11-15T03:21:59Z"
|
||||
mac: ENC[AES256_GCM,data:XpHNSRFlPz/6IhAZ+GDiGinLFRNxrxoBQEXesJX2qnhD0qYE03429zt0MUpH+/0SCXQ3zEd+nbUYSP3+ZMW1K3qb4QcWgnyQUelZFZ7INjz0ljGSplphA+/eLbgh/PnwgsWhoGsbcLLIUv6FGkQNDLL0Y+wFBCr9mDfz5vbjbTs=,iv:3qUeFgrbdhHWu4/S0Z6uutvEtvVYYBI2/yjDo/YJ4Kw=,tag:2joVAJE/QV+xaRArL7G1EA==,type:str]
|
||||
- recipient: age1vc8svd5277rjkgzg7frf04uaa45w3crhfvg628rqyrqmxul3q9nsjz6yxk
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBNcjdmckwyVVJkQXpScTU2
|
||||
WWt1MHFhTExxbCtwT1ZGWlZRZ3orRmZpYUZjCmNySmRVWkV4TEIyU09SUXNLdGFZ
|
||||
VjN5RFhwelFvVW1PR04rQ3NyU0trVHcKLS0tIDVZZGt5TnZNU21PbE9PZVVtTUdI
|
||||
eXhsWlkwa3l2Zk9KTkc0dzZpajFxVmcKTmhGMdS0Uq32P5I+X+8h4ve/KHvHWA/a
|
||||
Juu+VjGRe7hm0pWOutDQPbL6o8l+wij2ugDsNy3LKHbWs4lM5VZEHg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1ulmzprdmcd8r0w47a0nrrlg8melkjk6evl2rc54yh6lxkcfas36q6wrsv9
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5MFRGVllUM0R2VXB0bmtj
|
||||
dXV2bDFvbmpjTktZRlpKUXRPMXdwdmRxL3o4Cmg2WjRFdTgydkd5OHp2dS9TRlhG
|
||||
Y29NOUVEeXptYWhzMGVJOENrTjdpdUEKLS0tIEZzOGlsWGJPMitkTVpwTC82Uzdh
|
||||
NDhRVGQweXhEdFk4bHQxOWFOSmxNYVkKlb9KvHfUnM7uApzed5zvFPh7X8QMbdE/
|
||||
VSlmccOG1zlbstbr4mU/Xu+52FMBsp8UEkK29y07uhZQEh/txI9Wwg==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1lfjkch3pqaq3uwmjxyucpm2tws6llxqqjglj4yn49jkwkf50xvmqrl974e
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiSWRSdGUvRnFuZUtPcG9T
|
||||
N3FsWldiOTBLUXQ0SHd1UTk2T3ArNkpaN3l3CnBtN1o0SGY5S1Z3WnVhcVYrRUYr
|
||||
S0htZUh3RlQvYkV4Rmg2b3NPOFdCQkkKLS0tIEVUdVNxRnFZVlFKd3R4d1dCZk9N
|
||||
cHo2empQdDd4TTZJckczdzU3YVJZeW8K0tFG5fMFiVqAw0HqEV3F8yV6tLV/XY2e
|
||||
R8Rp2kAcPvBNdHZ52oKyGZNgblg5uia4mBjbvB8iXkX/z8Bddo/vCQ==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
- recipient: age1jnf94uq5ap96vk7nfk3qkr38ylhletc6pskj0ypc470d7gmt0qeqskdy5z
|
||||
enc: |
|
||||
-----BEGIN AGE ENCRYPTED FILE-----
|
||||
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwYk5PazQ2U2ZiYU03K28v
|
||||
elhtQjllbThwOE5Ockd4S1B6Z1AvNmNjcXlrCmZyTzMyUWFmcEZGazRWTG40bmJI
|
||||
TXkvOXpWVW1TYkcxckRtT3N6Y1BuZEUKLS0tIDBPRkJ0M3Y2T1NxN0RtbW1aNUhL
|
||||
alB4LzZGSTJmUEt0TFBkUTdzR1pOOTQKG8T65JhLKx602YnEmG/Gqi/rY8X/9XgF
|
||||
61ejhZ1DucTrM3sfUKjTFwaNVJLJgGEoPRioZW0SJkckjm5NNlutLw==
|
||||
-----END AGE ENCRYPTED FILE-----
|
||||
lastmodified: "2021-11-16T01:39:44Z"
|
||||
mac: ENC[AES256_GCM,data:fDm9ReOiKh0QpKXxL+1BBj8Ewa0rGNeeacRr2L2IWeb51i6KhE+9q/9s6/x3m1z9NcR3BFrdw/yhOakYjcfrMiBtgZMwkJ+17KieKrgPz95lKD/udZeiemlimUQZn6E2HuTj8lGRw1mJLGdlSgZrAtTKYzuUezcvqtX/zmMahmw=,iv:ju81TbXRZRhGI6oGn2NSpXCMnK7PtcaHH8RmDAOjP8k=,tag:z8pt/6a1WXVOB3hndZPGJw==,type:str]
|
||||
pgp: []
|
||||
unencrypted_suffix: _unencrypted
|
||||
version: 3.7.1
|
||||
|
||||
122
services/ipfs-cluster.nix
Normal file
122
services/ipfs-cluster.nix
Normal file
@ -0,0 +1,122 @@
|
||||
## From https://github.com/NixOS/nixpkgs/pull/100871
|
||||
{ config, lib, pkgs, options, ... }:
|
||||
with lib;
|
||||
let
|
||||
cfg = config.services.ipfs-cluster;
|
||||
opt = options.services.ipfs-cluster;
|
||||
|
||||
# secret is by envvar, not flag
|
||||
initFlags = toString [
|
||||
(optionalString (cfg.initPeers != [ ]) "--peers")
|
||||
(lib.strings.concatStringsSep "," cfg.initPeers)
|
||||
];
|
||||
in {
|
||||
|
||||
###### interface
|
||||
|
||||
options = {
|
||||
|
||||
services.ipfs-cluster = {
|
||||
|
||||
enable = mkEnableOption
|
||||
"Pinset orchestration for IPFS - requires ipfs daemon to be useful";
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = "ipfs";
|
||||
description = "User under which the ipfs-cluster daemon runs.";
|
||||
};
|
||||
|
||||
group = mkOption {
|
||||
type = types.str;
|
||||
default = "ipfs";
|
||||
description = "Group under which the ipfs-cluster daemon runs.";
|
||||
};
|
||||
|
||||
consensus = mkOption {
|
||||
type = types.enum [ "raft" "crdt" ];
|
||||
description = "Consensus protocol - 'raft' or 'crdt'. https://cluster.ipfs.io/documentation/guides/consensus/";
|
||||
};
|
||||
|
||||
dataDir = mkOption {
|
||||
type = types.str;
|
||||
default = "/var/lib/ipfs-cluster";
|
||||
description = "The data dir for ipfs-cluster.";
|
||||
};
|
||||
|
||||
initPeers = mkOption {
|
||||
type = types.listOf types.str;
|
||||
default = [ ];
|
||||
description = "Peer addresses to initialize with on first run.";
|
||||
};
|
||||
|
||||
openSwarmPort = mkOption {
|
||||
type = types.bool;
|
||||
description = "Open swarm port, secured by the cluster secret. This does not expose the API or proxy. https://cluster.ipfs.io/documentation/guides/security/";
|
||||
};
|
||||
|
||||
secretFile = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
description = ''
|
||||
File containing the cluster secret in the format of EnvironmentFile as described by
|
||||
<citerefentry><refentrytitle>systemd.exec</refentrytitle>
|
||||
<manvolnum>5</manvolnum></citerefentry>. For example:
|
||||
<programlisting>
|
||||
CLUSTER_SECRET=<replaceable>...</replaceable>
|
||||
</programlisting>
|
||||
|
||||
if null, a new secret will be generated on first run.
|
||||
A secret in the correct format can also be generated by: openssl rand -hex 32
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
###### implementation
|
||||
|
||||
config = mkIf cfg.enable {
|
||||
environment.systemPackages = [ pkgs.ipfs-cluster ];
|
||||
|
||||
|
||||
systemd.tmpfiles.rules =
|
||||
[ "d '${cfg.dataDir}' - ${cfg.user} ${cfg.group} - -" ];
|
||||
|
||||
systemd.services.ipfs-cluster-init = {
|
||||
path = [ "/run/wrappers" pkgs.ipfs-cluster ];
|
||||
environment.IPFS_CLUSTER_PATH = cfg.dataDir;
|
||||
wantedBy = [ "default.target" ];
|
||||
|
||||
serviceConfig = {
|
||||
# "" clears exec list (man systemd.service -> execStart)
|
||||
ExecStart = [
|
||||
""
|
||||
"${pkgs.ipfs-cluster}/bin/ipfs-cluster-service init --consensus ${cfg.consensus} ${initFlags}"
|
||||
];
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
} // optionalAttrs (cfg.secretFile != null) {
|
||||
EnvironmentFile = cfg.secretFile;
|
||||
};
|
||||
unitConfig.ConditionDirectoryNotEmpty = "!${cfg.dataDir}";
|
||||
};
|
||||
|
||||
systemd.services.ipfs-cluster = {
|
||||
environment.IPFS_CLUSTER_PATH = cfg.dataDir;
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
wants = [ "ipfs-cluster-init.service" ];
|
||||
after = [ "ipfs-cluster-init.service" ];
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart =
|
||||
[ "" "${pkgs.ipfs-cluster}/bin/ipfs-cluster-service daemon" ];
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
};
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = mkIf cfg.openSwarmPort [ 9096 ];
|
||||
};
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user