mdebray/tvl-depot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(ops/nixos): Use database password for Panettone

Browse source 
It appears this didn't even *work* without a password, so we've been
forced into being more secure.

Change-Id: I4ff9d04961a703a85299dafb79e8447b0a933fc1
Reviewed-on: https://cl.tvl.fyi/c/depot/+/1491
Tested-by: BuildkiteCI
Reviewed-by: tazjin <mail@tazj.in>
This commit is contained in:
Griffin Smith 2020-07-27 21:30:47 -04:00 committed by glittershark
parent b2c34c4ba3
commit d9262bd6c6
2 changed files with 18 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
ops/nixos/panettone.nix
View file

@ -15,21 +15,29 @@ in {
dbHost = mkOption {
description = "Postgresql host to connect to for Panettone";
type = types.string;
type = types.str;
default = "localhost";
};
dbName = mkOption {
description = "Name of the database for Panettone";
type = types.string;
type = types.str;
default = "panettone";
};
dbUser = mkOption {
description = "Name of the database user for Panettone";
type = types.string;
type = types.str;
default = "panettone";
};
secretsFile = mkOption {
description = ''
Path to a file containing secrets, in the format accepted
by systemd's EnvironmentFile
'';
type = types.str;
};
};
config = lib.mkIf cfg.enable {
@ -63,6 +71,7 @@ in {
DynamicUser = true;
Restart = "always";
StateDirectory = "panettone";
EnvironmentFile = cfg.secretsFile;
};
environment = {

9
ops/nixos/whitby/default.nix
View file

@ -221,6 +221,7 @@ in lib.fix(self: {
enable = true;
dbUser = "panettone";
dbName = "panettone";
secretsFile = "/etc/secrets/panettone";
};
};
@ -228,10 +229,12 @@ in lib.fix(self: {
enable = true;
enableTCPIP = true;
authentication = lib.mkOverride 10 ''
authentication = lib.mkForce ''
local all all trust
host all all ::1/128 trust
hostnossl all all ::1/128 trust
host all all 127.0.0.1/32 password
host all all ::1/128 password
hostnossl all all 127.0.0.1/32 password
hostnossl all all ::1/128 password
'';
ensureDatabases = [