athens/nix/services/ipfs-cluster.nix
2024-09-02 10:47:02 -04:00

121 lines
3.7 KiB
Nix

## From https://github.com/NixOS/nixpkgs/pull/100871
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.ipfs-cluster;
# secret is by envvar, not flag
initFlags = toString [
(optionalString (cfg.initPeers != [ ]) "--peers")
(lib.strings.concatStringsSep "," cfg.initPeers)
];
in
{
###### interface
options = {
services.ipfs-cluster = {
enable = mkEnableOption
"Pinset orchestration for IPFS - requires ipfs daemon to be useful";
user = mkOption {
type = types.str;
default = "ipfs";
description = "User under which the ipfs-cluster daemon runs.";
};
group = mkOption {
type = types.str;
default = "ipfs";
description = "Group under which the ipfs-cluster daemon runs.";
};
consensus = mkOption {
type = types.enum [ "raft" "crdt" ];
description = "Consensus protocol - 'raft' or 'crdt'. https://cluster.ipfs.io/documentation/guides/consensus/";
};
dataDir = mkOption {
type = types.str;
default = "/var/lib/ipfs-cluster";
description = "The data dir for ipfs-cluster.";
};
initPeers = mkOption {
type = types.listOf types.str;
default = [ ];
description = "Peer addresses to initialize with on first run.";
};
openSwarmPort = mkOption {
type = types.bool;
description = "Open swarm port, secured by the cluster secret. This does not expose the API or proxy. https://cluster.ipfs.io/documentation/guides/security/";
};
secretFile = mkOption {
type = types.nullOr types.path;
default = null;
description = ''
File containing the cluster secret in the format of EnvironmentFile as described by
<citerefentry><refentrytitle>systemd.exec</refentrytitle>
<manvolnum>5</manvolnum></citerefentry>. For example:
<programlisting>
CLUSTER_SECRET=<replaceable>...</replaceable>
</programlisting>
if null, a new secret will be generated on first run.
A secret in the correct format can also be generated by: openssl rand -hex 32
'';
};
};
};
###### implementation
config = mkIf cfg.enable {
environment.systemPackages = [ pkgs.ipfs-cluster ];
systemd = {
tmpfiles.rules =
[ "d '${cfg.dataDir}' - ${cfg.user} ${cfg.group} - -" ];
services.ipfs-cluster-init = {
path = [ "/run/wrappers" pkgs.ipfs-cluster ];
environment.IPFS_CLUSTER_PATH = cfg.dataDir;
wantedBy = [ "default.target" ];
serviceConfig = {
# "" clears exec list (man systemd.service -> execStart)
ExecStart = [
""
"${pkgs.ipfs-cluster}/bin/ipfs-cluster-service init --consensus ${cfg.consensus} ${initFlags}"
];
Type = "oneshot";
RemainAfterExit = true;
User = cfg.user;
Group = cfg.group;
} // optionalAttrs (cfg.secretFile != null) {
EnvironmentFile = cfg.secretFile;
};
unitConfig.ConditionDirectoryNotEmpty = "!${cfg.dataDir}";
};
services.ipfs-cluster = {
environment.IPFS_CLUSTER_PATH = cfg.dataDir;
wantedBy = [ "multi-user.target" ];
wants = [ "ipfs-cluster-init.service" ];
after = [ "ipfs-cluster-init.service" ];
serviceConfig = {
ExecStart =
[ "" "${pkgs.ipfs-cluster}/bin/ipfs-cluster-service daemon" ];
User = cfg.user;
Group = cfg.group;
} // optionalAttrs (cfg.secretFile != null) {
EnvironmentFile = cfg.secretFile;
};
};
};
networking.firewall.allowedTCPPorts = mkIf cfg.openSwarmPort [ 9094 9096 ];
};
}