nixos/hosts/hadouken/modules/database.nix at master · noisesfromspace/nixos · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
{
  config,
  lib,
  inputs,
  ...
}:
with lib;
let
  cfg = config.hosts.database;
in
{
  options.hosts.database = {
    enable = mkEnableOption "PostgreSQL";
  };

  config = mkIf cfg.enable {
    services.caddy.virtualHosts = {
      "pgadmin.thuis".extraConfig = ''
        import headscale
        import mtls

        handle @internal {
          reverse_proxy http://localhost:${toString config.services.pgadmin.port}
        }
        respond 403
      '';
      "minio.thuis".extraConfig = ''
        import headscale
        handle @internal {
          reverse_proxy http://${toString config.services.minio.listenAddress}
        }
        respond 403
      '';
      "minio-admin.thuis".extraConfig = ''
        import headscale
        import mtls

        handle @internal {
          reverse_proxy http://${toString config.services.minio.consoleAddress}
        }
        respond 403
      '';
    };

    services.postgresql = {
      enable = true;
      enableTCPIP = true;
      authentication = lib.mkOverride 10 ''
        #type database  DBuser  range		        auth-method
        local all       all                     trust
        host  all       all     100.64.0.0/10   trust
      '';
    };

    age.secrets = {
      pgadmin.file = "${inputs.secrets}/pgadmin.age";
      minio.file = "${inputs.secrets}/minio.age";
    };

    services.minio = {
      enable = true;
      region = "thuis";
      listenAddress = "0.0.0.0:5554";
      consoleAddress = "localhost:9901";
      rootCredentialsFile = config.age.secrets.minio.path;
      dataDir = [ "/mnt/zwembad/games/minio" ];
    };

    services.pgadmin = {
      enable = true;
      initialEmail = "m@b.com";
      initialPasswordFile = config.age.secrets.pgadmin.path;
    };

    services.postgresqlBackup = {
      enable = true;
      databases = [
        "mastodon"
        "atuin"
        "immich"
        "pgrok"
        "fluidcalendar"
        "stalwart"
      ];
    };

    services.borgbackup.jobs.default.paths = [
      config.services.postgresqlBackup.location
      config.services.minio.configDir
    ];
  };
}