2023-05-21 17:32:58 +00:00
{
config ,
lib ,
pkgs ,
utils ,
. . .
} :
with lib ; let
cfg = config . services . kubo ;
settingsFormat = pkgs . formats . json { } ;
rawDefaultConfig = lib . importJSON ( pkgs . runCommand " k u b o - d e f a u l t - c o n f i g " {
nativeBuildInputs = [ cfg . package ] ;
} ''
export IPFS_PATH = " $ T M P D I R "
ipfs init - - empty-repo - - profile = $ { profile }
ipfs - - offline config show > " $ o u t "
'' ) ;
# Remove the PeerID (an attribute of "Identity") of the temporary Kubo repo.
# The "Pinning" section contains the "RemoteServices" section, which would prevent
# the daemon from starting as that setting can't be changed via ipfs config replace.
defaultConfig = builtins . removeAttrs rawDefaultConfig [ " I d e n t i t y " " P i n n i n g " ] ;
customizedConfig = lib . recursiveUpdate defaultConfig cfg . settings ;
configFile = settingsFormat . generate " k u b o - c o n f i g . j s o n " customizedConfig ;
# Create a fake repo containing only the file "api".
# $IPFS_PATH will point to this directory instead of the real one.
# For some reason the Kubo CLI tools insist on reading the
# config file when it exists. But the Kubo daemon sets the file
# permissions such that only the ipfs user is allowed to read
# this file. This prevents normal users from talking to the daemon.
# To work around this terrible design, create a fake repo with no
# config file, only an api file and everything should work as expected.
fakeKuboRepo = pkgs . writeTextDir " a p i " ''
/unix/run/ipfs.sock
'' ;
kuboFlags = utils . escapeSystemdExecArgs (
optional cfg . autoMount " - - m o u n t "
++ optional cfg . enableGC " - - e n a b l e - g c "
++ optional ( cfg . serviceFdlimit != null ) " - - m a n a g e - f d l i m i t = f a l s e "
++ optional ( cfg . defaultMode == " o f f l i n e " ) " - - o f f l i n e "
++ optional ( cfg . defaultMode == " n o r o u t i n g " ) " - - r o u t i n g = n o n e "
++ cfg . extraFlags
) ;
profile =
if cfg . localDiscovery
then " l o c a l - d i s c o v e r y "
else " s e r v e r " ;
splitMulitaddr = addrRaw : lib . tail ( lib . splitString " / " addrRaw ) ;
multiaddrsToListenStreams = addrIn : let
addrs =
if builtins . typeOf addrIn == " l i s t "
then addrIn
else [ addrIn ] ;
unfilteredResult = map multiaddrToListenStream addrs ;
in
builtins . filter ( addr : addr != null ) unfilteredResult ;
multiaddrsToListenDatagrams = addrIn : let
addrs =
if builtins . typeOf addrIn == " l i s t "
then addrIn
else [ addrIn ] ;
unfilteredResult = map multiaddrToListenDatagram addrs ;
in
builtins . filter ( addr : addr != null ) unfilteredResult ;
multiaddrToListenStream = addrRaw : let
addr = splitMulitaddr addrRaw ;
s = builtins . elemAt addr ;
in
if s 0 == " i p 4 " && s 2 == " t c p "
then " ${ s 1 } : ${ s 3 } "
else if s 0 == " i p 6 " && s 2 == " t c p "
then " [ ${ s 1 } ] : ${ s 3 } "
else if s 0 == " u n i x "
then " / ${ lib . concatStringsSep " / " ( lib . tail addr ) } "
else null ; # not valid for listen stream, skip
multiaddrToListenDatagram = addrRaw : let
addr = splitMulitaddr addrRaw ;
s = builtins . elemAt addr ;
in
if s 0 == " i p 4 " && s 2 == " u d p "
then " ${ s 1 } : ${ s 3 } "
else if s 0 == " i p 6 " && s 2 == " u d p "
then " [ ${ s 1 } ] : ${ s 3 } "
else null ; # not valid for listen datagram, skip
in {
###### interface
options = {
services . kubo = {
enable = mkEnableOption ( lib . mdDoc " I n t e r p l a n e t a r y F i l e S y s t e m ( W A R N I N G : m a y c a u s e s e v e r e n e t w o r k d e g r a d a t i o n ) " ) ;
package = mkOption {
type = types . package ;
default = pkgs . kubo ;
defaultText = literalExpression " p k g s . k u b o " ;
description = lib . mdDoc " W h i c h K u b o p a c k a g e t o u s e . " ;
} ;
user = mkOption {
type = types . str ;
default = " i p f s " ;
description = lib . mdDoc " U s e r u n d e r w h i c h t h e K u b o d a e m o n r u n s " ;
} ;
group = mkOption {
type = types . str ;
default = " i p f s " ;
description = lib . mdDoc " G r o u p u n d e r w h i c h t h e K u b o d a e m o n r u n s " ;
} ;
dataDir = mkOption {
type = types . str ;
default =
if versionAtLeast config . system . stateVersion " 1 7 . 0 9 "
then " / v a r / l i b / i p f s "
else " / v a r / l i b / i p f s / . i p f s " ;
defaultText = literalExpression ''
if versionAtLeast config . system . stateVersion " 1 7 . 0 9 "
then " / v a r / l i b / i p f s "
else " / v a r / l i b / i p f s / . i p f s "
'' ;
description = lib . mdDoc " T h e d a t a d i r f o r K u b o " ;
} ;
defaultMode = mkOption {
type = types . enum [ " o n l i n e " " o f f l i n e " " n o r o u t i n g " ] ;
default = " o n l i n e " ;
description = lib . mdDoc " s y s t e m d s e r v i c e t h a t i s e n a b l e d b y d e f a u l t " ;
} ;
autoMount = mkOption {
type = types . bool ;
default = false ;
description = lib . mdDoc " W h e t h e r K u b o s h o u l d t r y t o m o u n t / i p f s a n d / i p n s a t s t a r t u p . " ;
} ;
autoMigrate = mkOption {
type = types . bool ;
default = true ;
description = lib . mdDoc " W h e t h e r K u b o s h o u l d t r y t o r u n t h e f s - r e p o - m i g r a t i o n a t s t a r t u p . " ;
} ;
ipfsMountDir = mkOption {
type = types . str ;
default = " / i p f s " ;
description = lib . mdDoc " W h e r e t o m o u n t t h e I P F S n a m e s p a c e t o " ;
} ;
ipnsMountDir = mkOption {
type = types . str ;
default = " / i p n s " ;
description = lib . mdDoc " W h e r e t o m o u n t t h e I P N S n a m e s p a c e t o " ;
} ;
enableGC = mkOption {
type = types . bool ;
default = false ;
description = lib . mdDoc " W h e t h e r t o e n a b l e a u t o m a t i c g a r b a g e c o l l e c t i o n " ;
} ;
emptyRepo = mkOption {
type = types . bool ;
default = false ;
description = lib . mdDoc " I f s e t t o t r u e , t h e r e p o w o n ' t b e i n i t i a l i z e d w i t h h e l p f i l e s " ;
} ;
settings = mkOption {
type = lib . types . submodule {
freeformType = settingsFormat . type ;
options = {
Addresses . API = mkOption {
type = types . oneOf [ types . str ( types . listOf types . str ) ] ;
default = [ ] ;
description = lib . mdDoc ''
Multiaddr or array of multiaddrs describing the address to serve the local HTTP API on .
In addition to the multiaddrs listed here , the daemon will also listen on a Unix domain socket .
To allow the ipfs CLI tools to communicate with the daemon over that socket ,
add your user to the correct group , e . g . ` users . users . alice . extraGroups = [ config . services . kubo . group ] ; `
'' ;
} ;
Addresses . Gateway = mkOption {
type = types . oneOf [ types . str ( types . listOf types . str ) ] ;
default = " / i p 4 / 1 2 7 . 0 . 0 . 1 / t c p / 8 0 8 0 " ;
description = lib . mdDoc " W h e r e t h e I P F S G a t e w a y c a n b e r e a c h e d " ;
} ;
Addresses . Swarm = mkOption {
type = types . listOf types . str ;
default = [
" / i p 4 / 0 . 0 . 0 . 0 / t c p / 4 0 0 1 "
" / i p 6 / : : / t c p / 4 0 0 1 "
" / i p 4 / 0 . 0 . 0 . 0 / u d p / 4 0 0 1 / q u i c "
" / i p 4 / 0 . 0 . 0 . 0 / u d p / 4 0 0 1 / q u i c - v 1 "
" / i p 4 / 0 . 0 . 0 . 0 / u d p / 4 0 0 1 / q u i c - v 1 / w e b t r a n s p o r t "
" / i p 6 / : : / u d p / 4 0 0 1 / q u i c "
" / i p 6 / : : / u d p / 4 0 0 1 / q u i c - v 1 "
" / i p 6 / : : / u d p / 4 0 0 1 / q u i c - v 1 / w e b t r a n s p o r t "
] ;
description = lib . mdDoc " W h e r e K u b o l i s t e n s f o r i n c o m i n g p 2 p c o n n e c t i o n s " ;
} ;
} ;
} ;
description = lib . mdDoc ''
Attrset of daemon configuration .
See [ https://github.com/ipfs/kubo/blob/master/docs/config.md ] ( https://github.com/ipfs/kubo/blob/master/docs/config.md ) for reference .
You can't set ` Identity ` or ` Pinning ` .
'' ;
default = { } ;
example = {
Datastore . StorageMax = " 1 0 0 G B " ;
Discovery . MDNS . Enabled = false ;
Bootstrap = [
" / i p 4 / 1 2 8 . 1 9 9 . 2 1 9 . 1 1 1 / t c p / 4 0 0 1 / i p f s / Q m S o L S a f T M B s P K a d T E g a X c t D Q V c q N 8 8 C N L H X M k T N w M K P n u "
" / i p 4 / 1 6 2 . 2 4 3 . 2 4 8 . 2 1 3 / t c p / 4 0 0 1 / i p f s / Q m S o L u e R 4 x B e U b Y 9 W Z 9 x G U U x u n b K W c r N F T D A a d Q J m o c n W m "
] ;
Swarm . AddrFilters = null ;
} ;
} ;
extraFlags = mkOption {
type = types . listOf types . str ;
description = lib . mdDoc " E x t r a f l a g s p a s s e d t o t h e K u b o d a e m o n " ;
default = [ ] ;
} ;
localDiscovery = mkOption {
type = types . bool ;
description = lib . mdDoc '' W h e t h e r t o e n a b l e l o c a l d i s c o v e r y f o r t h e K u b o d a e m o n .
This will allow Kubo to scan ports on your local network . Some hosting services will ban you if you do this .
'' ;
default = false ;
} ;
serviceFdlimit = mkOption {
type = types . nullOr types . int ;
default = null ;
description = lib . mdDoc " T h e f d l i m i t f o r t h e K u b o s y s t e m d u n i t o r ` n u l l ` t o h a v e t h e d a e m o n a t t e m p t t o m a n a g e i t " ;
example = 64 * 1024 ;
} ;
startWhenNeeded = mkOption {
type = types . bool ;
default = false ;
description = lib . mdDoc " W h e t h e r t o u s e s o c k e t a c t i v a t i o n t o s t a r t K u b o w h e n n e e d e d . " ;
} ;
} ;
} ;
###### implementation
disabledModules = [ " s e r v i c e s / n e t w o r k - f i l e s y s t e m s / k u b o . n i x " ] ;
config = mkIf cfg . enable {
assertions = [
{
assertion = ! builtins . hasAttr " I d e n t i t y " cfg . settings ;
message = ''
You can't set services . kubo . settings . Identity because the ` ` config replace ` ` subcommand used at startup does not support modifying any of the Identity settings .
'' ;
}
{
assertion = ! ( ( builtins . hasAttr " P i n n i n g " cfg . settings ) && ( builtins . hasAttr " R e m o t e S e r v i c e s " cfg . settings . Pinning ) ) ;
message = ''
You can't set services . kubo . settings . Pinning . RemoteServices because the ` ` config replace ` ` subcommand used at startup does not work with it .
'' ;
}
] ;
environment . systemPackages = [ cfg . package ] ;
environment . variables . IPFS_PATH = fakeKuboRepo ;
# https://github.com/lucas-clemente/quic-go/wiki/UDP-Receive-Buffer-Size
boot . kernel . sysctl . " n e t . c o r e . r m e m _ m a x " = mkDefault 2500000 ;
programs . fuse = mkIf cfg . autoMount {
userAllowOther = true ;
} ;
users . users = mkIf ( cfg . user == " i p f s " ) {
ipfs = {
group = cfg . group ;
home = cfg . dataDir ;
createHome = false ;
uid = config . ids . uids . ipfs ;
description = " I P F S d a e m o n u s e r " ;
packages = [
pkgs . kubo-migrator
] ;
} ;
} ;
users . groups = mkIf ( cfg . group == " i p f s " ) {
ipfs . gid = config . ids . gids . ipfs ;
} ;
2023-05-29 18:44:51 +00:00
systemd . tmpfiles . rules = optionals cfg . autoMount [
" d ' ${ cfg . ipfsMountDir } ' - ${ cfg . user } ${ cfg . group } - - "
" d ' ${ cfg . ipnsMountDir } ' - ${ cfg . user } ${ cfg . group } - - "
] ;
2023-05-21 17:32:58 +00:00
# The hardened systemd unit breaks the fuse-mount function according to documentation in the unit file itself
systemd . packages =
if cfg . autoMount
then [ cfg . package . systemd_unit ]
else [ cfg . package . systemd_unit_hardened ] ;
services . kubo . settings = mkIf cfg . autoMount {
Mounts . FuseAllowOther = lib . mkDefault true ;
Mounts . IPFS = lib . mkDefault cfg . ipfsMountDir ;
Mounts . IPNS = lib . mkDefault cfg . ipnsMountDir ;
} ;
systemd . services . ipfs =
{
path = [ " / r u n / w r a p p e r s " cfg . package ] ;
environment . IPFS_PATH = cfg . dataDir ;
2023-05-23 05:54:19 +00:00
preStart = let
datastore_spec = pkgs . writeText " d a t a s t o r e _ s p e c " '' { " m o u n t s " : [ { " b u c k e t " : " i p f s " , " m o u n t p o i n t " : " / " } ] , " t y p e " : " m o u n t " } '' ;
in
2023-05-21 17:32:58 +00:00
''
2023-11-16 20:46:57 +00:00
mkdir - pv $ IPFS_PATH/.ipfs/plugins
ln - svf $ { pkgs . go-ds-s3 } /bin/go-ds-s3-plugin $ IPFS_PATH/.ipfs/plugins
2023-05-23 05:54:19 +00:00
# Update the datastore_spec
ln - svf $ { datastore_spec } $ IPFS_PATH/datastore_spec
2023-05-21 17:32:58 +00:00
if [ [ ! - f " $ I P F S _ P A T H / c o n f i g " ] ] ; then
ipfs init $ { optionalString cfg . emptyRepo " - e " }
else
# After an unclean shutdown this file may exist which will cause the config command to attempt to talk to the daemon. This will hang forever if systemd is holding our sockets open.
rm - vf " $ I P F S _ P A T H / a p i "
''
+ optionalString cfg . autoMigrate ''
$ { pkgs . kubo-migrator } /bin/fs-repo-migrations - to ' $ { cfg . package . repoVersion } ' - y
''
+ ''
fi
ipfs - - offline config show |
$ { pkgs . jq } /bin/jq - s ' . [ 0 ] . Pinning as $ Pinning | . [ 0 ] . Identity as $ Identity | . [ 1 ] + { $ Identity , $ Pinning } ' - ' $ { configFile } ' |
2023-11-16 20:46:57 +00:00
$ { pkgs . jq } /bin/jq " . D a t a s t o r e . S p e c . m o u n t s [ 0 ] . c h i l d . a c c e s s K e y = \" $ ( c a t ${ config . sops . secrets . " s e r v i c e s / i p f s / a c c e s s K e y " . path } ) \" " |
$ { pkgs . jq } /bin/jq " . D a t a s t o r e . S p e c . m o u n t s [ 0 ] . c h i l d . s e c r e t K e y = \" $ ( c a t ${ config . sops . secrets . " s e r v i c e s / i p f s / s e c r e t K e y " . path } ) \" " |
2023-05-21 17:32:58 +00:00
# This command automatically injects the private key and other secrets from
# the old config file back into the new config file.
# Unfortunately, it doesn't keep the original `Identity.PeerID`,
# so we need `ipfs config show` and jq above.
# See https://github.com/ipfs/kubo/issues/8993 for progress on fixing this problem.
# Kubo also wants a specific version of the original "Pinning.RemoteServices"
# section (redacted by `ipfs config show`), such that that section doesn't
# change when the changes are applied. Whyyyyyy.....
ipfs - - offline config replace -
'' ;
postStop = mkIf cfg . autoMount ''
# After an unclean shutdown the fuse mounts at cfg.ipnsMountDir and cfg.ipfsMountDir are locked
umount - - quiet ' $ { cfg . ipnsMountDir } ' ' $ { cfg . ipfsMountDir } ' || true
'' ;
serviceConfig =
{
ExecStart = [ " " " ${ cfg . package } / b i n / i p f s d a e m o n ${ kuboFlags } " ] ;
User = cfg . user ;
Group = cfg . group ;
StateDirectory = " " ;
ReadWritePaths = optionals ( ! cfg . autoMount ) [ " " cfg . dataDir ] ;
}
// optionalAttrs ( cfg . serviceFdlimit != null ) { LimitNOFILE = cfg . serviceFdlimit ; } ;
}
// optionalAttrs ( ! cfg . startWhenNeeded ) {
wantedBy = [ " d e f a u l t . t a r g e t " ] ;
} ;
systemd . sockets . ipfs-gateway = {
wantedBy = [ " s o c k e t s . t a r g e t " ] ;
socketConfig = {
ListenStream =
[ " " ] ++ ( multiaddrsToListenStreams cfg . settings . Addresses . Gateway ) ;
ListenDatagram =
[ " " ] ++ ( multiaddrsToListenDatagrams cfg . settings . Addresses . Gateway ) ;
} ;
} ;
systemd . sockets . ipfs-api = {
wantedBy = [ " s o c k e t s . t a r g e t " ] ;
socketConfig = {
# We also include "%t/ipfs.sock" because there is no way to put the "%t"
# in the multiaddr.
ListenStream =
[ " " " % t / i p f s . s o c k " ] ++ ( multiaddrsToListenStreams cfg . settings . Addresses . API ) ;
SocketMode = " 0 6 6 0 " ;
SocketUser = cfg . user ;
SocketGroup = cfg . group ;
} ;
} ;
} ;
meta = {
maintainers = with lib . maintainers ; [ Luflosi ] ;
} ;
imports = [
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " e n a b l e " ] [ " s e r v i c e s " " k u b o " " e n a b l e " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " p a c k a g e " ] [ " s e r v i c e s " " k u b o " " p a c k a g e " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " u s e r " ] [ " s e r v i c e s " " k u b o " " u s e r " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " g r o u p " ] [ " s e r v i c e s " " k u b o " " g r o u p " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " d a t a D i r " ] [ " s e r v i c e s " " k u b o " " d a t a D i r " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " d e f a u l t M o d e " ] [ " s e r v i c e s " " k u b o " " d e f a u l t M o d e " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " a u t o M o u n t " ] [ " s e r v i c e s " " k u b o " " a u t o M o u n t " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " a u t o M i g r a t e " ] [ " s e r v i c e s " " k u b o " " a u t o M i g r a t e " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " i p f s M o u n t D i r " ] [ " s e r v i c e s " " k u b o " " i p f s M o u n t D i r " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " i p n s M o u n t D i r " ] [ " s e r v i c e s " " k u b o " " i p n s M o u n t D i r " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " g a t e w a y A d d r e s s " ] [ " s e r v i c e s " " k u b o " " s e t t i n g s " " A d d r e s s e s " " G a t e w a y " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " a p i A d d r e s s " ] [ " s e r v i c e s " " k u b o " " s e t t i n g s " " A d d r e s s e s " " A P I " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " s w a r m A d d r e s s " ] [ " s e r v i c e s " " k u b o " " s e t t i n g s " " A d d r e s s e s " " S w a r m " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " e n a b l e G C " ] [ " s e r v i c e s " " k u b o " " e n a b l e G C " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " e m p t y R e p o " ] [ " s e r v i c e s " " k u b o " " e m p t y R e p o " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " e x t r a C o n f i g " ] [ " s e r v i c e s " " k u b o " " s e t t i n g s " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " e x t r a F l a g s " ] [ " s e r v i c e s " " k u b o " " e x t r a F l a g s " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " l o c a l D i s c o v e r y " ] [ " s e r v i c e s " " k u b o " " l o c a l D i s c o v e r y " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " s e r v i c e F d l i m i t " ] [ " s e r v i c e s " " k u b o " " s e r v i c e F d l i m i t " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " i p f s " " s t a r t W h e n N e e d e d " ] [ " s e r v i c e s " " k u b o " " s t a r t W h e n N e e d e d " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " k u b o " " e x t r a C o n f i g " ] [ " s e r v i c e s " " k u b o " " s e t t i n g s " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " k u b o " " g a t e w a y A d d r e s s " ] [ " s e r v i c e s " " k u b o " " s e t t i n g s " " A d d r e s s e s " " G a t e w a y " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " k u b o " " a p i A d d r e s s " ] [ " s e r v i c e s " " k u b o " " s e t t i n g s " " A d d r e s s e s " " A P I " ] )
( mkRenamedOptionModule [ " s e r v i c e s " " k u b o " " s w a r m A d d r e s s " ] [ " s e r v i c e s " " k u b o " " s e t t i n g s " " A d d r e s s e s " " S w a r m " ] )
] ;
}
