121 lines
3.7 KiB
Nix
121 lines
3.7 KiB
Nix
## From https://github.com/NixOS/nixpkgs/pull/100871
|
|
{ config, lib, pkgs, ... }:
|
|
with lib;
|
|
let
|
|
cfg = config.services.ipfs-cluster;
|
|
|
|
# secret is by envvar, not flag
|
|
initFlags = toString [
|
|
(optionalString (cfg.initPeers != [ ]) "--peers")
|
|
(lib.strings.concatStringsSep "," cfg.initPeers)
|
|
];
|
|
in
|
|
{
|
|
###### interface
|
|
options = {
|
|
services.ipfs-cluster = {
|
|
enable = mkEnableOption
|
|
"Pinset orchestration for IPFS - requires ipfs daemon to be useful";
|
|
|
|
user = mkOption {
|
|
type = types.str;
|
|
default = "ipfs";
|
|
description = "User under which the ipfs-cluster daemon runs.";
|
|
};
|
|
|
|
group = mkOption {
|
|
type = types.str;
|
|
default = "ipfs";
|
|
description = "Group under which the ipfs-cluster daemon runs.";
|
|
};
|
|
|
|
consensus = mkOption {
|
|
type = types.enum [ "raft" "crdt" ];
|
|
description = "Consensus protocol - 'raft' or 'crdt'. https://cluster.ipfs.io/documentation/guides/consensus/";
|
|
};
|
|
|
|
dataDir = mkOption {
|
|
type = types.str;
|
|
default = "/var/lib/ipfs-cluster";
|
|
description = "The data dir for ipfs-cluster.";
|
|
};
|
|
|
|
initPeers = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [ ];
|
|
description = "Peer addresses to initialize with on first run.";
|
|
};
|
|
|
|
openSwarmPort = mkOption {
|
|
type = types.bool;
|
|
description = "Open swarm port, secured by the cluster secret. This does not expose the API or proxy. https://cluster.ipfs.io/documentation/guides/security/";
|
|
};
|
|
|
|
secretFile = mkOption {
|
|
type = types.nullOr types.path;
|
|
default = null;
|
|
description = ''
|
|
File containing the cluster secret in the format of EnvironmentFile as described by
|
|
<citerefentry><refentrytitle>systemd.exec</refentrytitle>
|
|
<manvolnum>5</manvolnum></citerefentry>. For example:
|
|
<programlisting>
|
|
CLUSTER_SECRET=<replaceable>...</replaceable>
|
|
</programlisting>
|
|
|
|
if null, a new secret will be generated on first run.
|
|
A secret in the correct format can also be generated by: openssl rand -hex 32
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
|
|
###### implementation
|
|
|
|
config = mkIf cfg.enable {
|
|
environment.systemPackages = [ pkgs.ipfs-cluster ];
|
|
systemd = {
|
|
tmpfiles.rules =
|
|
[ "d '${cfg.dataDir}' - ${cfg.user} ${cfg.group} - -" ];
|
|
|
|
services.ipfs-cluster-init = {
|
|
path = [ "/run/wrappers" pkgs.ipfs-cluster ];
|
|
environment.IPFS_CLUSTER_PATH = cfg.dataDir;
|
|
wantedBy = [ "default.target" ];
|
|
|
|
serviceConfig = {
|
|
# "" clears exec list (man systemd.service -> execStart)
|
|
ExecStart = [
|
|
""
|
|
"${pkgs.ipfs-cluster}/bin/ipfs-cluster-service init --consensus ${cfg.consensus} ${initFlags}"
|
|
];
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
User = cfg.user;
|
|
Group = cfg.group;
|
|
} // optionalAttrs (cfg.secretFile != null) {
|
|
EnvironmentFile = cfg.secretFile;
|
|
};
|
|
unitConfig.ConditionDirectoryNotEmpty = "!${cfg.dataDir}";
|
|
};
|
|
|
|
services.ipfs-cluster = {
|
|
environment.IPFS_CLUSTER_PATH = cfg.dataDir;
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
wants = [ "ipfs-cluster-init.service" ];
|
|
after = [ "ipfs-cluster-init.service" ];
|
|
|
|
serviceConfig = {
|
|
ExecStart =
|
|
[ "" "${pkgs.ipfs-cluster}/bin/ipfs-cluster-service daemon" ];
|
|
User = cfg.user;
|
|
Group = cfg.group;
|
|
} // optionalAttrs (cfg.secretFile != null) {
|
|
EnvironmentFile = cfg.secretFile;
|
|
};
|
|
};
|
|
};
|
|
networking.firewall.allowedTCPPorts = mkIf cfg.openSwarmPort [ 9094 9096 ];
|
|
};
|
|
}
|