68 lines
1.7 KiB
Nix
68 lines
1.7 KiB
Nix
|
{
|
||
|
|
pkgs,
|
||
|
|
system,
|
||
|
|
chir-rs,
|
||
|
|
config,
|
||
|
|
...
|
||
|
|
}: let
|
||
|
|
d = "$";
|
||
|
|
dhallConfig = ''
|
||
|
|
let password = ${config.sops.secrets."services/chir-rs/auth/password".path} as Text
|
||
|
|
let BaseConfig =
|
||
|
|
{ Type =
|
||
|
|
{ database_url : Text
|
||
|
|
, listen_addr : Text
|
||
|
|
, redis_url : Text
|
||
|
|
}
|
||
|
|
, default.listen_addr = "[::1]:5621"
|
||
|
|
}
|
||
|
|
|
||
|
|
in BaseConfig::{
|
||
|
|
, database_url = "postgres://auth_chir_rs:${d}{password}@nixos-8gb-fsn1-1.int.chir.rs",
|
||
|
|
, listen_addr = "[::1]:7954"
|
||
|
|
, redis_url = "redis://localhost:53538/0"
|
||
|
|
}
|
||
|
|
'';
|
||
|
|
in {
|
||
|
|
systemd.services.auth-chir-rs = {
|
||
|
|
description = "auth.chir.rs";
|
||
|
|
after = ["network.target"];
|
||
|
|
wantedBy = ["multi-user.target"];
|
||
|
|
script = ''
|
||
|
|
export CONFIG_FILE=${pkgs.writeText "config.dhall" dhallConfig}
|
||
|
|
exec ${chir-rs.packages.${system}.chir-rs-auth}/bin/chir-rs-auth
|
||
|
|
'';
|
||
|
|
serviceConfig = {
|
||
|
|
Type = "simple";
|
||
|
|
User = "auth-chir-rs";
|
||
|
|
Group = "auth-chir-rs";
|
||
|
|
Restart = "always";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
sops.secrets."services/chir-rs/auth/password".owner = "auth-chir-rs";
|
||
|
|
users.users.auth-chir-rs = {
|
||
|
|
description = "auth.chir.rs";
|
||
|
|
home = "/var/empty";
|
||
|
|
useDefaultShell = true;
|
||
|
|
group = "auth-chir-rs";
|
||
|
|
isSystemUser = true;
|
||
|
|
};
|
||
|
|
users.groups.auth-chir-rs = {};
|
||
|
|
services.postgresql.ensureDatabases = [
|
||
|
|
"auth_chir_rs"
|
||
|
|
];
|
||
|
|
services.postgresql.ensureUsers = [
|
||
|
|
{
|
||
|
|
name = "auth_chir_rs";
|
||
|
|
ensurePermissions = {
|
||
|
|
"DATABASE auth_chir_rs" = "ALL PRIVILEGES";
|
||
|
|
};
|
||
|
|
}
|
||
|
|
];
|
||
|
|
services.redis.servers."auth_chir_rs" = {
|
||
|
|
enable = true;
|
||
|
|
port = 53538;
|
||
|
|
save = [];
|
||
|
|
};
|
||
|
|
}
|