jackos1998
5171a10079
Rebase the fork branches and refresh nixpkgs, home-manager, and the approved ancillary inputs. Update kernel and release metadata, adapt removed package and Home Assistant options, and keep Determinate Nix on its tested nixpkgs revision to avoid duplicate Boost patches. Retire Sharry and its public endpoint because copyparty replaces it. Document the GitHub mirror gate and require real devshell and system builds in the upgrade validation workflow.
38 lines
2.3 KiB
Markdown
38 lines
2.3 KiB
Markdown
# object
|
|
|
|
Object storage and the Nix binary cache, plus HedgeDoc and wastebin.
|
|
|
|
- **Source:** [`shill/containers/object.nix`](../../../../../nixos/boxes/colony/vms/shill/containers/object.nix)
|
|
- **Host:** NixOS container on [`shill`](../README.md) (bind-mounts `/mnt/minio` and
|
|
`/mnt/nix-cache` read-write)
|
|
- **nixpkgs:** `mine`
|
|
|
|
## Role
|
|
|
|
| Service | Port | Purpose |
|
|
| --- | --- | --- |
|
|
| MinIO | `9000` (S3) / `9001` (console) | S3-compatible object storage, `s3.nul.ie` + `*.s3.nul.ie` (virtual-host style via `MINIO_DOMAIN`), console at `minio.nul.ie`; region `eu-central-1`; data on the `/mnt/minio` XFS volume |
|
|
| Harmonia | `5000` | Nix binary cache at `nix-cache.nul.ie` — `harmonia-dev` cache serves `shill`'s `/nix/store` out of a dedicated store view rooted at `/var/lib/harmonia` (bind-mounted from `/mnt/nix-cache`), signed with the `nix-cache.key` secret; a `harmonia` user with authorized keys exists for cache pushes |
|
|
| HedgeDoc | `3000` | collaborative markdown notes at `md.nul.ie`; Postgres on [colony-psql](colony-psql.md); anonymous edits but no anonymous notes, email login, no open email registration |
|
|
| wastebin | `8088` | pastebin at `pb.nul.ie` |
|
|
| atticd | `8069` | **currently disabled** (`services.atticd.enable = false`) — an alternative Nix cache that would store locally and sit behind `nix-cache.nul.ie`; config (including the `object/atticd.env` secret) is kept around |
|
|
|
|
Everything public is fronted by [middleman](middleman.md) (see its vhost table). The
|
|
`minio-client` is installed and the user's `~/.mc/config.json` points at an age-secret config.
|
|
`minio-2025-10-15T17-29-55Z` is allowlisted via `permittedInsecurePackages` (flagged as a TODO).
|
|
|
|
## Network assignments
|
|
|
|
See the consolidated [network assignments](../../../../networking.md#box-assignments) table (this box: `object`).
|
|
|
|
## Backing services
|
|
|
|
- [colony-psql](colony-psql.md) — HedgeDoc's database (atticd too, when enabled).
|
|
- MinIO buckets back other boxes' services: Gitea LFS/packages (with the `middleman` MIME hack
|
|
for Docker manifests), Mastodon's `mastodon` bucket and the Bluesky PDS `pds` bucket on
|
|
[toot](toot.md).
|
|
|
|
## Notable config files
|
|
|
|
- [`nixos/boxes/colony/vms/shill/containers/object.nix`](../../../../../nixos/boxes/colony/vms/shill/containers/object.nix) — container definition and all services
|