infrastructure/machines/nixos/compute01/nimbolus.nix

# SPDX-FileCopyrightText: 2025 Lubin Bailly <lubin@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2

{ pkgs, sources, ... }:
let
  host = "nimbolus.dgnum.eu";
  port = 9008;
in
{
  services.nimbolus-tf = {
    enable = true;
    package = (import sources.kat-pkgs { inherit pkgs; }).nimbolus-tf-backend;
    environment = {
      LISTEN_ADDR = "127.0.0.1:${toString port}";
      STORAGE_BACKEND = "s3";
      STORAGE_S3_ENDPOINT = "s3.dgnum.eu";
      STORAGE_S3_USE_SSL = "true";
      STORAGE_S3_BUCKET = "monorepo-terraform-state";

      # TODO: configure openBAO
      # AUTH_BASIC_ENABLED = "false";
      # AUTH_JWT_OIDC_ISSUER_URL = "https://vault.dgnum.eu/v1/identity/oidc";
    };
    secretEnvironment = {
      # FIXME: use agenix and real secrets
      KMS_KEY = pkgs.writeText "nimbolus-kms-unsecure" "nVbFN9o4rIP2qi0SWtcgNZlWolrF61/Drx3YxeQTSZk=";
      STORAGE_S3_ACCESS_KEY = pkgs.writeText "unsecure" "KEYID";
      STORAGE_S3_SECRET_KEY = pkgs.writeText "unsecure" "KEYSECRET";
    };
  };
  dgn-web.simpleProxies.nimbolus = {
    inherit host port;
  };
}