infrastructure/machines/storage01/garage.nix

121 lines
2.5 KiB
Nix
Raw Normal View History

{ config, pkgs, ... }:
2023-09-11 11:17:52 +02:00
let
host = "s3.dgnum.eu";
webHost = "cdn.dgnum.eu";
data_dir = "/data/slow/garage/data";
metadata_dir = "/data/fast/garage/meta";
domains = [
2024-09-22 00:52:04 +02:00
"bandarretdurgence.ens.fr"
"boussole-sante.normalesup.eu"
2024-09-22 00:52:04 +02:00
"lanuit.ens.fr"
"simi.normalesup.eu"
];
buckets = [
2024-09-22 00:52:04 +02:00
"banda-website"
"castopod-dgnum"
2024-09-22 00:52:04 +02:00
"hackens-website"
"nuit-website"
"peertube-videos-dgnum"
] ++ domains;
mkHosted = host: builtins.map (b: "${b}.${host}");
in
{
2023-09-11 11:17:52 +02:00
services.garage = {
enable = true;
2024-10-06 15:29:20 +02:00
package = pkgs.garage_1_0_1;
2023-09-11 11:17:52 +02:00
settings = {
inherit data_dir metadata_dir;
db_engine = "lmdb";
2024-10-02 19:20:17 +02:00
replication_mode = "none"; # TODO: deprecated
2023-09-11 11:17:52 +02:00
compression_level = 7;
rpc_bind_addr = "[::]:3901";
rpc_public_addr = "127.0.0.1:3901";
s3_api = {
s3_region = "garage";
api_bind_addr = "127.0.0.1:3900";
2023-09-11 11:17:52 +02:00
root_domain = ".${host}";
};
s3_web = {
bind_addr = "127.0.0.1:3902";
2023-09-11 11:17:52 +02:00
root_domain = ".${webHost}";
index = "index.html";
};
k2v_api.api_bind_addr = "[::]:3904";
2023-09-11 11:17:52 +02:00
2024-04-23 23:22:28 +02:00
admin.api_bind_addr = "127.0.0.1:3903";
2023-09-11 11:17:52 +02:00
};
environmentFile = config.age.secrets."garage-environment_file".path;
2023-09-11 11:17:52 +02:00
};
systemd.services.garage.serviceConfig = {
User = "garage";
ReadWriteDirectories = [
data_dir
metadata_dir
];
2024-10-02 19:20:17 +02:00
TimeoutSec = 600;
};
users.users.garage = {
isSystemUser = true;
group = "garage";
};
users.groups.garage = { };
services.nginx.virtualHosts = {
"s3-admin.dgnum.eu" = {
enableACME = true;
forceSSL = true;
locations."/".extraConfig = ''
proxy_pass http://127.0.0.1:3902;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
'';
};
${host} = {
enableACME = true;
forceSSL = true;
serverAliases = mkHosted host buckets;
locations."/".extraConfig = ''
proxy_pass http://127.0.0.1:3900;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
# Disable buffering to a temporary file.
proxy_max_temp_file_size 0;
client_max_body_size 5G;
'';
};
${webHost} = {
enableACME = true;
forceSSL = true;
serverAliases = domains ++ (mkHosted webHost buckets);
locations."/".extraConfig = ''
proxy_pass http://127.0.0.1:3902;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
'';
};
2023-09-11 11:17:52 +02:00
};
}