diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index d4f48fbe..7043af25 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -31,7 +31,7 @@ jobs: github_access_token: ${{ secrets.GITHUB_TOKEN }} extra_nix_config: | extra-substituters = https://cache.zx.dev/main - extra-trusted-public-keys = main:sbkS1Xz6P4g66iyttRGj/o8aPODE6bVG9oKT98/ULKI= + extra-trusted-public-keys = main:mu0jkxdJTGWC3djDSEQb3rvZgqlhA8WVMulcTo5IW6c= - name: Configure Attic cache run: | nix profile install --inputs-from . attic#attic-client diff --git a/flake.nix b/flake.nix index c324045d..72d01cf6 100644 --- a/flake.nix +++ b/flake.nix @@ -122,7 +122,7 @@ "https://cache.zx.dev/main" ]; extra-trusted-public-keys = [ - "main:sbkS1Xz6P4g66iyttRGj/o8aPODE6bVG9oKT98/ULKI=" + "main:mu0jkxdJTGWC3djDSEQb3rvZgqlhA8WVMulcTo5IW6c=" ]; }; }; diff --git a/hosts/glyph/services/attic.nix b/hosts/glyph/services/attic.nix index 19e2d1ae..946937c7 100644 --- a/hosts/glyph/services/attic.nix +++ b/hosts/glyph/services/attic.nix @@ -1,10 +1,5 @@ {config, ...}: { - age.secrets.attic-credentials = { - file = ./../secrets/attic-credentials.age; - mode = "440"; - owner = "atticd"; - group = "atticd"; - }; + age.secrets.attic-credentials.file = ./../secrets/attic-credentials.age; services.atticd = { enable = true; @@ -13,7 +8,7 @@ settings = { listen = "[::]:8199"; - database.url = "sqlite:///var/lib/atticd/server.db?mode=rwc"; + database.url = "postgresql:///atticd?host=/run/postgresql"; storage = { type = "local"; diff --git a/hosts/spore/services/db.nix b/hosts/glyph/services/db.nix similarity index 52% rename from hosts/spore/services/db.nix rename to hosts/glyph/services/db.nix index ab8d59e8..21a22c95 100644 --- a/hosts/spore/services/db.nix +++ b/hosts/glyph/services/db.nix @@ -1,15 +1,9 @@ -{ - config, - pkgs, - ... -}: { +{pkgs, ...}: { services.postgresql = { enable = true; package = pkgs.postgresql_16; enableTCPIP = true; authentication = pkgs.lib.mkOverride 10 '' - # Any user can connect to any database via Unix socket, local loopback, - # or Tailscale local all all trust host all all 127.0.0.1/32 trust host all all 100.64.0.0/10 trust @@ -18,5 +12,21 @@ port = 5432; max_connections = 150; }; + ensureDatabases = ["atticd" "pocketid"]; + ensureUsers = [ + { + name = "atticd"; + ensureDBOwnership = true; + } + { + name = "pocketid"; + ensureDBOwnership = true; + } + ]; + }; + + services.postgresqlBackup = { + enable = true; + databases = ["atticd" "pocketid"]; }; } diff --git a/hosts/glyph/services/default.nix b/hosts/glyph/services/default.nix index be23d643..860b1cb4 100644 --- a/hosts/glyph/services/default.nix +++ b/hosts/glyph/services/default.nix @@ -5,6 +5,7 @@ }: { imports = [ ./attic.nix + ./db.nix ./avahi.nix ./dns.nix ./filebrowser.nix @@ -85,7 +86,7 @@ rc.backup = { enable = true; paths = [ - "/var/lib/atticd/server.db" + config.services.postgresqlBackup.location "/var/lib/basic-memory" "/var/lib/open-webui" "/var/lib/roon-server/backup" diff --git a/hosts/spore/backup.nix b/hosts/spore/backup.nix deleted file mode 100644 index 381ff47b..00000000 --- a/hosts/spore/backup.nix +++ /dev/null @@ -1,8 +0,0 @@ -{config, ...}: { - rc.backup = { - enable = true; - paths = [ - config.services.postgresqlBackup.location - ]; - }; -} diff --git a/hosts/spore/default.nix b/hosts/spore/default.nix index 753e9fcc..e18f6537 100644 --- a/hosts/spore/default.nix +++ b/hosts/spore/default.nix @@ -9,7 +9,6 @@ (modulesPath + "/installer/scan/not-detected.nix") (modulesPath + "/profiles/qemu-guest.nix") ./disk-config.nix - ./backup.nix ./services ]; diff --git a/hosts/spore/services/default.nix b/hosts/spore/services/default.nix index 10e7554e..114b2c36 100644 --- a/hosts/spore/services/default.nix +++ b/hosts/spore/services/default.nix @@ -4,7 +4,6 @@ ... }: { imports = [ - ./db.nix ./grafana.nix ./homepage-dashboard.nix ./mastodon.nix diff --git a/hosts/spore/services/mastodon.nix b/hosts/spore/services/mastodon.nix index b407ed20..b65f61d7 100644 --- a/hosts/spore/services/mastodon.nix +++ b/hosts/spore/services/mastodon.nix @@ -48,7 +48,7 @@ in { configureNginx = true; database = { createLocally = false; - host = "127.0.0.1"; + host = "glyph.rove-duck.ts.net"; port = 5432; user = "mastodon"; passwordFile = "/dev/null"; # Not needed @@ -84,19 +84,7 @@ in { ]; }; - services.postgresql = lib.mkIf enable { - ensureUsers = [ - { - name = "mastodon"; - ensureDBOwnership = true; - } - ]; - ensureDatabases = ["mastodon"]; - }; - services.postgresqlBackup = { - #inherit enable; - databases = ["mastodon"]; - }; + # Database managed on glyph when re-enabled services.redis.servers.mastodon = { inherit enable; port = 31637; diff --git a/hosts/spore/services/web/auth.nix b/hosts/spore/services/web/auth.nix index 51b9a81c..db83b0df 100644 --- a/hosts/spore/services/web/auth.nix +++ b/hosts/spore/services/web/auth.nix @@ -22,6 +22,8 @@ host = "id.zx.dev"; useACMEHost = "zx.dev"; encryptionKeyFile = config.age.secrets.pocket-id-encryption-key.path; + databaseURL = "postgres://pocketid@glyph.rove-duck.ts.net/pocketid"; + localDatabase = false; }; authProxy = { host = "oauth.zx.dev"; diff --git a/modules/nixos/web/auth.nix b/modules/nixos/web/auth.nix index d51fb437..213deca4 100644 --- a/modules/nixos/web/auth.nix +++ b/modules/nixos/web/auth.nix @@ -30,6 +30,25 @@ in { example = "id.example.org"; }; + databaseURL = lib.mkOption { + type = lib.types.str; + default = "postgres://pocketid@/pocketid?host=/run/postgresql"; + description = '' + PostgreSQL connection string for pocket-id. + ''; + example = "postgres://pocketid@glyph.rove-duck.ts.net/pocketid"; + }; + + localDatabase = lib.mkOption { + type = lib.types.bool; + default = true; + description = '' + Whether the database is managed locally. When true, PostgreSQL + is configured with the pocketid database and user, and pocket-id + depends on postgresql.service. + ''; + }; + encryptionKeyFile = lib.mkOption { type = lib.types.nullOr lib.types.path; default = null; @@ -122,29 +141,17 @@ in { settings = { APP_URL = "https://${cfg.issuer.host}"; TRUST_PROXY = true; - DB_CONNECTION_STRING = "postgres://pocketid@/pocketid?host=/run/postgresql"; + DB_CONNECTION_STRING = cfg.issuer.databaseURL; ENCRYPTION_KEY_FILE = cfg.issuer.encryptionKeyFile; }; }; - services.postgresql = { - ensureDatabases = ["pocketid"]; - ensureUsers = [ - { - name = "pocketid"; - ensureDBOwnership = true; - } - ]; - }; - services.postgresqlBackup = { - enable = lib.mkDefault true; - databases = ["pocketid"]; - }; - systemd.services.pocket-id = { wants = ["network-online.target"]; - after = ["postgresql.service" "network-online.target"]; - requires = ["postgresql.service"]; + after = + ["network-online.target"] + ++ lib.optionals cfg.issuer.localDatabase ["postgresql.service"]; + requires = lib.optionals cfg.issuer.localDatabase ["postgresql.service"]; }; services.oauth2-proxy = { @@ -205,6 +212,21 @@ in { }; }; }) + (mkIf (cfg.enable && cfg.issuer.localDatabase) { + services.postgresql = { + ensureDatabases = ["pocketid"]; + ensureUsers = [ + { + name = "pocketid"; + ensureDBOwnership = true; + } + ]; + }; + services.postgresqlBackup = { + enable = lib.mkDefault true; + databases = ["pocketid"]; + }; + }) (let vhosts = config.services.nginx.virtualHosts; vhostsRequiringAuth = mapNames (lib.filter (set: set.value.requireAuth) (lib.attrsToList vhosts));