nixos/shill: Add MinIO container

nixos/boxes/colony/vms/default.nix

@@ -149,6 +149,19 @@
                 };
                 frontend = "virtio-blk";
               }
+              {
+                name = "minio";
+                backend = {
+                  driver = "host_device";
+                  filename = "/dev/ssds/minio";
+                  discard = "unmap";
+                };
+                format = {
+                  driver = "raw";
+                  discard = "unmap";
+                };
+                frontend = "virtio-blk";
+              }
             ]);
           };
         };

nixos/boxes/colony/vms/shill/containers/default.nix

@@ -5,5 +5,6 @@
     ./colony-psql.nix
     ./chatterbox.nix
     ./jackflix
+    ./object.nix
   ];
 }

nixos/boxes/colony/vms/shill/containers/middleman/default.nix

@@ -162,6 +162,7 @@
                 "${lib.my.pubDomain}" = {
                   extraDomainNames = [
                     "*.${lib.my.pubDomain}"
+                    "*.s3.${lib.my.pubDomain}"
                   ];
                   dnsProvider = "cloudflare";
                   credentialsFile = config.age.secrets."middleman/cloudflare-credentials.conf".path;

nixos/boxes/colony/vms/shill/containers/middleman/vhosts.nix

@@ -279,6 +279,26 @@ in
         };
         useACMEHost = lib.my.pubDomain;
       };
+
+      "minio.${lib.my.pubDomain}" = {
+        extraConfig = ''
+          chunked_transfer_encoding off;
+        '';
+        locations = {
+          "/".proxyPass = "http://object-ctr.${config.networking.domain}:9001";
+        };
+        useACMEHost = lib.my.pubDomain;
+      };
+      "s3.${lib.my.pubDomain}" = {
+        serverAliases = [ "*.s3.${lib.my.pubDomain}" ];
+        extraConfig = ''
+          chunked_transfer_encoding off;
+        '';
+        locations = {
+          "/".proxyPass = "http://object-ctr.${config.networking.domain}:9000";
+        };
+        useACMEHost = lib.my.pubDomain;
+      };
     };
   in
   mkMerge [

nixos/boxes/colony/vms/shill/containers/object.nix

@@ -0,0 +1,74 @@
+{ lib, ... }: {
+  nixos.systems.object = {
+    system = "x86_64-linux";
+    nixpkgs = "mine";
+
+    assignments = {
+      internal = {
+        name = "object-ctr";
+        domain = lib.my.colony.domain;
+        ipv4.address = "${lib.my.colony.start.ctrs.v4}7";
+        ipv6 = {
+          iid = "::7";
+          address = "${lib.my.colony.start.ctrs.v6}7";
+        };
+      };
+    };
+
+    configuration = { lib, config, assignments, ... }:
+    let
+      inherit (lib) mkMerge mkIf;
+      inherit (lib.my) networkdAssignment;
+    in
+    {
+      config = mkMerge [
+        {
+          my = {
+            deploy.enable = false;
+            server.enable = true;
+
+            secrets = {
+              key = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFdHbZErWLmTPO/aEWB1Fup/aGMf31Un5Wk66FJwTz/8";
+              files."minio.env" = {};
+            };
+
+            firewall = {
+              tcp.allowed = [ 9000 9001 ];
+            };
+          };
+
+          systemd = {
+            network.networks."80-container-host0" = networkdAssignment "host0" assignments.internal;
+            services = {
+              minio = {
+                environment = {
+                  MINIO_ROOT_USER = "minioadmin";
+                  MINIO_DOMAIN = "s3.nul.ie";
+                  MINIO_SERVER_URL = "https://s3.nul.ie";
+                  MINIO_BROWSER_REDIRECT_URL = "https://minio.nul.ie";
+                };
+              };
+            };
+          };
+
+          services = {
+            minio = {
+              enable = true;
+              region = "eu-central-1";
+              browser = true;
+              rootCredentialsFile = config.age.secrets."minio.env".path;
+            };
+          };
+        }
+        (mkIf config.my.build.isDevVM {
+          virtualisation = {
+            forwardPorts = [
+              { from = "host"; host.port = 9000; guest.port = 9000; }
+              { from = "host"; host.port = 9001; guest.port = 9001; }
+            ];
+          };
+        })
+      ];
+    };
+  };
+}

nixos/boxes/colony/vms/shill/default.nix

@@ -70,9 +70,14 @@
                 device = "/dev/disk/by-label/media";
                 fsType = "ext4";
               };
+              "/mnt/minio" = {
+                device = "/dev/disk/by-label/minio";
+                fsType = "xfs";
+              };
             };
 
             services = {
+              fstrim.enable = true;
               netdata.enable = true;
             };
 
@@ -140,6 +145,11 @@
                       "/mnt/media".readOnly = false;
                     };
                   };
+                  object = {
+                    bindMounts = {
+                      "/mnt/minio".readOnly = false;
+                    };
+                  };
                 };
               in
               mkMerge [

nixos/modules/tmproot.nix

@@ -298,6 +298,15 @@ in
       (persistSimpleSvc "jackett")
       (persistSimpleSvc "radarr")
       (persistSimpleSvc "sonarr")
+      (mkIf config.services.minio.enable {
+        my.tmproot.persistence.config.directories = [
+          {
+            directory = config.services.minio.configDir;
+            user = "minio";
+            group = "minio";
+          }
+        ];
+      })
       (mkIf config.my.build.isDevVM {
         fileSystems = mkVMOverride {
           # Hijack the "root" device for persistence in the VM

secrets/chatterbox/nul.ie.signing.key.age

@@ -1,11 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 ZB3e6Q o3nZEDuOm/JC/EhJ5uRnbMMHPNwRcKwfsPFNBVCjtHk
+-> ssh-ed25519 ZB3e6Q sQJFhvr8FRUhNhBMue77730wcbg28fTFnsszgerwEBo
-cYKUNgQmkpTRSEm9ZINYlslv9O6MM3ujb1rNO7p7gvc
+7VzmwSkllK2wbSyFSCClvjY4X6sT6vLLPBAcXSbmnRU
--> X25519 TQ2jWod+e0a3ylj+GL8gPoScvzFdBCZcaYauY2gtsDY
+-> X25519 DufjAOGVQtGU2oiDCymV7rv9bdw5Llk3KjbOj5wJxxs
-pP5q3ZYkRYqSeOEHxYXzQXCfltBGKi5jMpCfSP7PPSI
+9sOvYKIfp+fUKcW6zbhAU3kwaUrF9PCBlu56qmGhOss
--> `)-v-grease fr R1 W`Y
+-> m-grease s$ A ,2 =sKpm
-pjfwfNM9JTJe0/mYB6OC6LtgJeIvn4RVJogageAl/djWgMVZ4DDr2kakgF3V28xf
+lLRsEhRI4PsWw9K6uygWxFznKZSJUXesteKQ7hZ/wWJXkRHq
-0g
+--- XYl7iGPy1+YfKOWNoZoiYvfFjctfqhWWzR4hMCWmXYU
---- 4b27xLN78GCex7VdHqlJj8g+SuUlOOgZjZ4Qj8/RIsk
+”5à0K¥–Öïš2Rp)wÓ.(rh¡U~w|%jÍ‚<C38D>°¨‡®Ç 9Ïæ¡V<C2A1>žÃÒ 0d€{µì×î<C397>ê<EFBFBD>ìñEµ\Vag¶~"T-”À3\­)N®­ßS"I
--‹<>N/&±ÖË€ÙvÖÌEÖ¶`}œD² áO#ü`ZV·^DÂ"&˜¯Çp
-špÐ/ݹäáĬ–iqÆlï¿šj@÷i57O×,ë䇩ø”$F2ôh<03>S

secrets/estuary/pdns/auth.conf.age

@@ -1,9 +1,9 @@
 age-encryption.org/v1
--> ssh-ed25519 n8CpUw AcjQZzA4G7pdhn011TXFQmTdDIQuTEfFc0mKjmPWUho
+-> ssh-ed25519 n8CpUw ACIVtxzORRq2ptG0/MNlBt83MQZJu3Pc3R/5QRpgi2A
-tecWVMzkggw92meDkh2tZV+lbvQCvrYr0YSV5/fCTRs
+NSO8o2fL/EDLXegZ/kkzMW4/Za79q/6QfMQ1t0Sk9BM
--> X25519 JGc6LzCMH2LhJlUSyk4H5IDGfQNjtW9W6rz3SzoV/0Y
+-> X25519 nHYed6I+w6lIxgQNPUdeO35HlHmd0tKATpvnbtB5WzU
-vGNuHYO95z5i+OVkj4TRuCxF122V/shxvD6CnGCT+kw
+IWRKvT2csHQplib3ms1akiqdzGS37xQ2ev45yGW5d+w
--> g)n[I4U>-grease ^Tm {G saw
+-> %YW{-grease
-q/ODO7xmWIcsr2cMaVpEg38
+4/tMk8Gzztby5x5ojQXj3853G0V8t7AoZA
---- VHUzlGz2hT3SbnZ32S0SzBDCn3QwWxEohH9Cw3N2Je0
+--- 6vzp2wJk0Eh0O33xXCLrQiNbqeV7oMgvvqrgyRMK9Mg
-Ń.Ń=-›<>ÉfÓËŻÍc}Ă}SzaĽ˝“PŰ<50>űÜZ7&g,GH;WVčÇPŰ*»€cŃ<63>™'-Đs¦†çuh\ĂKJ4ä
z3áś
+2ŹŐ×ȬGh°¸élđâ)NËşźĚűÁ[N˝
Čß‚p–Ł„…<E2809E>çŚěŁ|3ő>ům'N 
I?î)Ł =6łý·`ĚŐ`
‚šŻ

secrets/minio.env.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 hkbtvg IrwZ+4sEJvFpB/zrFR/8Lu4GgpPppm84IYOAP7QWH0o
+Px7RM+aKmjRQKdr0Ta/v+s9M+rRvRTNs9YYaZnNeORk
+-> X25519 lSIE40xvHLkKFMCgsKjVhbxYfv7ddDJ3xyMlcDdxgxU
+sc+2ibxqyLtlcpFUPCab+x4imPjuedQadA4b1Qg63a4
+-> [J"78S~E-grease S||B(wq} suB8~I ~?E@d}
+/3IplD0a0o3phrEIX85CAVkFRvLcCh3ncK/0Reur0bvKsqOjg37KH+Az5dDh2h9D
+63kpJpGxwNKlRntnWQWxeYN2PN3cZrggH25/EJuJT3td2Q
+--- a+cb3+9Z7WWk6vGGaiXz11G2fKUqLbYuUPyzturVFXY
+ç—îúCEBÏ(c#€ƒY$Jñè4g*t„~Ïãƒ)ð£üh²:“Hñ`ûÙÝ·Ýa'›
óìÉ<øA‚råk½+“ÓD›ºw§c‘LK3<4B>Ÿ‘mĽäÿ‹