From 646b58298429e696e37632824bb30d00c0065a8c Mon Sep 17 00:00:00 2001 From: Jack O'Sullivan Date: Mon, 6 Jun 2022 17:52:36 +0100 Subject: [PATCH] nixos/shill: Add postgres container --- .../vms/shill/containers/colony-psql.nix | 69 ++++++++++++++++++ .../colony/vms/shill/containers/default.nix | 1 + nixos/boxes/colony/vms/shill/default.nix | 1 + nixos/modules/tmproot.nix | 10 +++ secrets/cloudflare-credentials.conf.age | 18 ++--- secrets/dhparams.pem.age | Bin 1127 -> 1126 bytes secrets/pdns-file-records.key.age | Bin 876 -> 760 bytes secrets/user-passwd.txt.age | 36 +++++---- secrets/vaultwarden.env.age | 22 +++--- 9 files changed, 121 insertions(+), 36 deletions(-) create mode 100644 nixos/boxes/colony/vms/shill/containers/colony-psql.nix diff --git a/nixos/boxes/colony/vms/shill/containers/colony-psql.nix b/nixos/boxes/colony/vms/shill/containers/colony-psql.nix new file mode 100644 index 0000000..7d1cf21 --- /dev/null +++ b/nixos/boxes/colony/vms/shill/containers/colony-psql.nix @@ -0,0 +1,69 @@ +{ lib, ... }: { + nixos.systems.colony-psql = { + system = "x86_64-linux"; + nixpkgs = "mine"; + + assignments = { + internal = { + name = "colony-psql-ctr"; + domain = lib.my.colony.domain; + ipv4.address = "${lib.my.colony.start.ctrs.v4}4"; + ipv6 = { + iid = "::4"; + address = "${lib.my.colony.start.ctrs.v6}4"; + }; + }; + }; + + configuration = { lib, pkgs, config, assignments, ... }: + let + inherit (lib) mkMerge mkIf; + inherit (lib.my) networkdAssignment; + in + { + config = mkMerge [ + { + my = { + deploy.enable = false; + server.enable = true; + + secrets = { + key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICkly/tnPmoX05lDjEpQOkllPqYA0PY92pOKqvx8Po02"; + }; + + firewall = { + tcp.allowed = [ 5432 ]; + }; + }; + + systemd = { + network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal; + }; + + services = { + postgresql = { + package = pkgs.postgresql_14; + enable = true; + enableTCPIP = true; + ensureUsers = [ + { + name = "root"; + ensurePermissions = { + "ALL TABLES IN SCHEMA public" = "ALL PRIVILEGES"; + }; + } + ]; + }; + }; + } + (mkIf config.my.build.isDevVM { + virtualisation = { + forwardPorts = [ + { from = "host"; host.port = 55432; guest.port = 5432; } + ]; + }; + }) + ]; + }; + }; +} diff --git a/nixos/boxes/colony/vms/shill/containers/default.nix b/nixos/boxes/colony/vms/shill/containers/default.nix index 4425b90..4e17621 100644 --- a/nixos/boxes/colony/vms/shill/containers/default.nix +++ b/nixos/boxes/colony/vms/shill/containers/default.nix @@ -2,5 +2,6 @@ imports = [ ./middleman ./vaultwarden.nix + ./colony-psql.nix ]; } diff --git a/nixos/boxes/colony/vms/shill/default.nix b/nixos/boxes/colony/vms/shill/default.nix index cf82a7e..8f432ea 100644 --- a/nixos/boxes/colony/vms/shill/default.nix +++ b/nixos/boxes/colony/vms/shill/default.nix @@ -101,6 +101,7 @@ }) { middleman = {}; vaultwarden = {}; + colony-psql = {}; }; }; } diff --git a/nixos/modules/tmproot.nix b/nixos/modules/tmproot.nix index 5440e42..da5f14a 100644 --- a/nixos/modules/tmproot.nix +++ b/nixos/modules/tmproot.nix @@ -235,6 +235,16 @@ in } ]; }) + (mkIf config.services.postgresql.enable { + my.tmproot.persistence.config.directories = [ + { + directory = "/var/lib/postgresql"; + mode = "0750"; + user = "postgres"; + group = "postgres"; + } + ]; + }) (mkIf config.my.build.isDevVM { fileSystems = mkVMOverride { # Hijack the "root" device for persistence in the VM diff --git a/secrets/cloudflare-credentials.conf.age b/secrets/cloudflare-credentials.conf.age index 628f2e2..5fc75c3 100644 --- a/secrets/cloudflare-credentials.conf.age +++ b/secrets/cloudflare-credentials.conf.age @@ -1,10 +1,10 @@ age-encryption.org/v1 --> ssh-ed25519 H162lQ a/oJHGIB43DHpX/EUdal2ZyOlf+zYUbNwztGSP1iuGE -W8bd1I0rgDMEc18zjpP0d4dyp4PGd19/8vJFlVOsGSs --> X25519 cjqYOE0e9IHvWvcGyOPDNTcNR6Ynv8TdRCoHiBx4UzI -/EzNz/SSzvs9DbCGr28B4/jwZMnpUxoBtDOt9Ombv4Y --> x]-grease -fRt2HHsTmZbotWaLfgPZ4PT76A ---- M2/lLzEUiSmSuoPhtO/QAg+CPPvnBBMQhisX66A/aKE -bDl Γ -Gg-2JbtI:B1?Vۗz}3qI> { =H')U")HS1--pYƅHtn[ݟ-l|Uolg \ No newline at end of file +-> ssh-ed25519 H162lQ /adzwW9x7USsH5CdsioRijyAty8oWd/+cAMwUjIUlFc +wZ37SG3kMPAFv6b7XUsQODXJyf0+2UGYO4W4ZYITIx4 +-> X25519 hgS0FxBoQ+aE8XPP9C+py9MG6olCCX2MNo8ySfdI3S4 +0MFoKWao1FSvPSSbvgPvoW/9IhenHbcFfRdF8QCiX6Y +-> W-r]SXB-grease #sr)tHY s)\!y phJi@. +i9yJp2IczY7G/4sEX5Lmzyn3KOxca7/pDQ +--- UAo0KfTO0IzWS7mj5vWRzMLT3wrrgIpr2PYUYKSDSIQ +D%I5 b awqS(Vj_]=D󂻱 +Y2_ uz> 6bywaOB>f$Xq%_cѬVe[0pbَno}`0|0ӌkȟ \ No newline at end of file diff --git a/secrets/dhparams.pem.age b/secrets/dhparams.pem.age index 0dde440a963fb5ef6a95bd21f93c9a188beedafb..9b78b664250f7168d761271f9edf8969877e279b 100644 GIT binary patch delta 1097 zcmV-P1h)I<2<8ZoEPr`WXmwRysgX>vH^5adKjJSU5sxbboh6Ic`Q(VsukDH%(V> z3S}^MNO)#-H8pH7ad<~&H&9S7M{G<*dN^})RzgcuG)!c3FG*K2IATO|3N1b$S1dXs zYb|GTWnpt=AS!S|a5+y`3U66PQdK!=S8PU3MrcNDK~QFOGGk{7EiEk|X;VxwRCiKt zZAnjNa7cD&H-9&EVNO{!I9OuRmtZRL3u{Bj&S^=W_^?N|u{~)X;fVw!zmzlX zmPNpv+o)s1kCEcm<;i3?gRY!Ru(P)hbE(}Wvs=&xPa@h7?6%7LGEY87jFzXpU>$!N=z@NPxESSdMhRh;vqWi z92WTibfh32lXk~vvLLpad$m^T%I(ityn08U>*$2Fvh6FZ-Ksb}5otT8<|F!R&hb`e zY{%Rb0PKZU<;>D4z~7Bz{s}q`JU#vAg&dbBt$)53D03J3l{TBM>BDZ~3*NidBU&=6 zVxAJTsi2ze;W6CsVv2=7j+o)h06gL22uN{T0j&`ijdM2>qMb|yGt>#C^bLboyVgDJV z{(pprA1YdJhWop~VRHbq)FoaTeuiz|yKlUwt1h58sm&y!L-(o15hx!;r^MH>@-Xy7 zrdXV_Zq+<&UB)DCBei3%8FgOrzwb_nli);flU?+&7vVR&?ZAyOX^-76O7L0Xg6Mlz zp^HbDP=Z1!t{; z6dK1H2*pF^g+p*Tzl~Da3(~b3|G9!JmcKY!Yf1tV^E4ulFHQ3g^fL6)i^{QLZR06ld*vfEy*E-O$&Fsm633EiZA@r PMf2BqXQUx*a-7pFd}sFm delta 1098 zcmV-Q1hxC-27dJRxxTebaOR0S~)j$VrgP{Xn0aLcM2^& zAXqXrH8D9LPEj;fdQU_~L1<7|cT;jJQA$!{X>3e3LNirHFn>cuWJpJJLuzbQF<~-m z3Qa_3FhOl*M{Rd@cuz$+bzxIea(GsDYF15QXE#VSR5Ua+a!_(NVqtGt3N1b$OFwZb zGej+Ca%Ew2Wgsw2ePtkhDo#l}AZsZuN+%&8VkmG;X9_TNcWX&!3N0-yAWl|HR%BR8 zQburVbw^5ZM}JU6Okr78Q#n&GFjz}Md1O{kV?<_cFmy&pa|$M*()J}lb)gEK0Zm@$ z=gsq=2$=1|0X|l22NtoA5zQ6Pc5m0?)6@uQj@42E3yLpz8*$bz#YEFCBabc^^5=UK=448+}_YhO+GJg~2bQ;Z4F~pQk>es&2vz0e!YZ-z+ z_uZEFJRn>h)4k(4JN9XoX#R$tu`}!siMznrk2wpt+=?}a%1`t)nO{PVfJK&2c+zz_ zTUk6WsegrFf;RZ=hGXuRNZ=f>URM!4!D6(fdrTN_x1|Lq*Y8uoB_x~DW^Tcj;#Ptw zJtTa7%;1H*+aKVvf+zConM0>=vYQbdm9Jc{Kxrc*pz9sQn{8u@w!B1Cc>njQzZx#V z+xrIa;<&#TgLoybcS0`#h%Z>i7nH`aU_^WKmwzIHp^7x&-hwGxdJA@A?%|i2mD!wp zl^3nG>{Cz#ihIej3~HuwsrHFWI;YmFWQIV_e3Q|*&59jmeYz^UJ2I%~vD$=pd&)&( zUG)EiYBL~Dc(5}%#W1R9W>=t$EY$96+dnNs?JIo2hZcaXrP~tuY277nF|e}STYOsk zwtubWMAAdZo6Tch8GQ<=d3AWSAzi@JFeD&)(b_=SkhwCu7m8rwE|~DFM~byhIj48D zHNz3~6wnNnl2Q-CJ4a@dbD>e~|^sWsAW)4{QwD1O7Mf< z4&G$mDCZhjpH1a?cJ9i}cAW2wa;iv>n8<|rB>mKF7A0BMjQ||9nSq`smLUXh8AICg zLLB|$y#|-tILN#D(ELlf|5ozT?24C$DN)AY#}AD@b_;Tv60($q?Q#5`s95lAX#vDc Qm(4erA`itH*0=XwVXQdydjJ3c diff --git a/secrets/pdns-file-records.key.age b/secrets/pdns-file-records.key.age index 8faa5cf9e6ad365e1227c4eb989c4fce085c7fd4..1da9c9f5bf68c447596c0824b7eb78b86aa277dd 100644 GIT binary patch delta 728 zcmV;}0w?|K2KWV#EPqLHbwhb_Yb#P{c5Pu|Gi6FxI9D}wO;>3*W;sDacuZ_(Rdh%< zFf~I{K?-_9L2qzbD^N&vZB#{OD{)LOQ$uPmb4p5iYHDdVIWtssRxfgEK|)q-Sqd#a zAXqXrH8D9LD_K=_Oi)sBQDH)QMKWeedT(%2Y-veMNJ>aJP=8NjZhBIBF?UaROI9;5 z3Ti`fN@+o4Xk}JWD{xa-GJ1DnD|lu_YdJ7+HFq#JcW-S|PE=DzS!!fB3N1b$MJIPH zXL4m>b7cxeX=_YmG&E*+cXmfqH(5AjGB$EaaBB)JEiE8wLRLXoH*-;ALuhGOT0>1j zL}E5!YiMt4Ykx~CbxA>JPcdP7MK(idYHc(M3oAbLUkWEZ3l0L>hV=Ejo#y#iqUPM@ zO%v)CFC%5qNIf?iY@}GVa>h4GTOD<`zb^=@>Bmck1EdHOWA+|?HQL6jl6TSl6xV&j z2k~~ABK4gCqPy^*vc|HmMVoCucPZ`?G zKHNH#7k}Ogd;nbq=&5~`_6kSPB-`?WI4&JQCnBira`5|yi`5iQ*6S#}tnGR-WJOq}1H;!(3EOUnv+G&DFKl6yXn4m=zB`07Ogi#;J1 K_&y3eIu;@}PBf+f delta 845 zcmV-T1G4=11?&cpEPrHcFZM>JI{SXMA~MK@MCHF8;KSy)bV za&m1pQf^Oaa8WRNVlzQvbz)0pFECC?Wkh;uWpi>kabbFJWO)i@Mp8=(EiEk|SvE3D zcvUuLPB1xVYIZ|XGedDfR#aA0WodFTPE#;+LUKhoSbu48G_wS>$E;{4~~*gE@cVh&Y&V2mBSm(-sE_y2}P!1AyRb|K(M0;>Y4c8L7b9v_*)e0lGLc1oY% z{<8(xX+2&1Dqs7w6e9CAHhs1;Ll ssh-ed25519 SKXJUw fW7jrhrKwP6iyzZmVgb7vJ2UcNJF/5WD4yMdIAHkmjY -2oxq2j4imOCs+SS7X8B6l+lfyxS1oc2pP9Yn5xH2TYg --> ssh-ed25519 B9K/XQ k2wmCaqbN607JztgylqS0HnB0VDDirJdTT0A/YcWmDc -p50mr15TcNSosXhqOp1piJ4zovntXupDN0wKyuQcLOI --> ssh-ed25519 H162lQ gB7vN1QOBBwgGnQm01/Qgi5BOKROqiGUeRhl5o0Fshs -RahbmvQtsVZqWp0Aw+p5nNPiiLy9Bx5CIUlNBDUHqvk --> ssh-ed25519 b6YMqg GRHZS+hPYYtvmdWjubBWHWRcW6tN1CH8ad/uQIy94UY -YoW/7nXuDsFRpHfz0gxHcq86yp28k36jeDeE5rgWbu0 --> ssh-ed25519 Lqn0Yw QMRSGRz5JwLBxTHP2rcG13IUvQzB+0hlWDqYZFvC1n4 -Nn/4hg59WRT6/89nS7i+gQ8lH/xnPV5U8tVL7jzqrQU --> X25519 GStCgfxXuAFeZEZi0REzF57PASJgsUjJKqhbxOWGMG4 -P13cOlKyoec4dxraCm/FYNbkSQiG13X2qqLeYJNxb8w --> o-grease -9eVgGIr20m1qCUJk3smZBflaLXQrMcMM ---- 2Z86MUDSQR+ZsPLWzR8zO74BFfmy9C5HDd6mabW7fuY -THیቍ;VjD?<`:ƨ*yAӁs/Zf?;QhwY N9U/0wBq.O8, U/7T_NVzyU/F:Hu5 \ No newline at end of file +-> ssh-ed25519 SKXJUw CsKtHFHS/9MNiNGT/O+bxx+btotr9riXwJWgHAplcXQ +W6kL/S4y1aFstYGOIhrwJfXx2uhswH3uSdyJzRCAtHM +-> ssh-ed25519 wbGjmA 7em05wqUq9PA9CZ9MlnNSxdeknvN0lrS0yYxUTtGawE +TyAI9Pu0DJodhdT5sBodIaBxPg3VBmXcq18IIHtFs3I +-> ssh-ed25519 B9K/XQ ZAVd8XBFPOJ6hC2WunnkGmEifYOHcUhYQIi4gvsLajc +5hPdqVBWi9OtqQPyq4gz4CX6vVpuLGQURufTCnDNYgM +-> ssh-ed25519 H162lQ wKj8wzesVAOzm5o4VB9NEBSr+xlr0VjR/A48NL+6uls +lpmijvrflnMeVT6R2YcUmLFljFxZsTeVziErcQ7GKuk +-> ssh-ed25519 b6YMqg ykVDRMnyBsh6+HN/A/5lT3K36wgJZggIcjlsPSc3byM +HF5qzv2Lf2s87OHi/0++shAjF4+xr5NAHL/9lncMHRU +-> ssh-ed25519 Lqn0Yw 4+F3gxpsI9QnbCHWpLz29CUj3RAeXSH7PHkuFw3E7T8 +yzZAylZ7QAV7ufljd4VEBys8sNd8JodWqN5f0JzRI/g +-> X25519 YMeCBP/yDOGPs04ihx7NkZSpqEotUHKs3yMRkg9JWAI +Li1FOGm6NIAPGVQRj3HYiyKiR/ZSk35vnOK/ia59IQU +-> tjxC(g-grease +817wn107V7X7yjCXvKBMt/55PWcEYdm6ZDOdoZC5A3s+iRFVpLvGmxlkEVxQCqsA +K4WG/Ye5PC/raEjsS8/6AqHs4E+JSfuZjm47fVclbu3kp8Yu3BaLEa9glucxBQbc +X0A +--- C/lfT3RLOrCR2mOv6Q0aDyEVUrq4GzdVpHhj7Ly2ov4 +&Ǩq) Wh&3M}]REe%tX*Xl 0hl[@]8'G>peSfݙPJY۔FLz1?"ݲε)G_ \ No newline at end of file diff --git a/secrets/vaultwarden.env.age b/secrets/vaultwarden.env.age index 9fc3560..e4f548f 100644 --- a/secrets/vaultwarden.env.age +++ b/secrets/vaultwarden.env.age @@ -1,12 +1,12 @@ age-encryption.org/v1 --> ssh-ed25519 Lqn0Yw ybVbnUjgm3QGOZPv9A/q6zPXjZbuYe4krqe+qjrkziw -SIEEGlziouUT3pzxw+C7p2IO2sDJ3xmaTrHaDGFgLOs --> X25519 bq/2lRh9a3BwhwR6o9TXeuXA5AGdtlrQm8/JOyAzUEU -I5xRPDb6rUcNBXqOXefFkO2HvlYIJAG+OFkZygywkqg --> 0g#WDK-grease .DWBEk* -Vf8DHmVCY3bfTT+CPPm5dELSid+aZJquOxjEccmkZXVKtefHlwLRx6Dh3HT5IZqR -Pl2j/4SQvVf1MrPjtbkMwBhxh9zPZa7WQIBGeF6oB2kl9vyc65lXpaxRSMs2eVsv - ---- /eCT0Rqu+we6CXUSP3dpd+blpQxwOG0t5rDiGfffXPs -F -f~"[%?}1P~ҋ$Nrnh*y _Ʌ!*h\MߑxsFd3u/$9  Р&iv \ No newline at end of file +-> ssh-ed25519 Lqn0Yw 527NE0GoR6SQTwb1hmgpxn4APXMb2oW3/VNjjbwtnx8 +9jWxt9FYx8G4pyPVtU8mp33QuurzQHI4Npt+79ej2qU +-> X25519 wW5ClCuDyZvFJOA/aeitGr5yr29DOdULnUlPRz1sDk0 +db70JP2sIH3T8NsMHqnTCGNE1tY7PyjGKOKmzNE632Q +-> zGd-grease * _!K!a] 3C\vn +sOkK0VjY4v3j6XcG +--- CHljgmb9kcrECrIM2Ve+Wp5AkGWeIQb0Bhh9sgEtD5U +K=XK9 ,qj)=Gau{N V,2N$w +kzO @#Fǝ +̻CF3PzNG,3Pw]-VʞoԞmz +e \ No newline at end of file