blob: bd048aa498d252088b791602d1e386ab8a7c80d2 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
{
config,
lib,
pkgs,
options,
...
}:
let
cfg = config.services.ipfs-cluster;
# secret is by envvar, not flag
initFlags = toString [
(lib.optionalString (cfg.initPeers != [ ]) "--peers")
(lib.strings.concatStringsSep "," cfg.initPeers)
];
in
{
options = {
services.ipfs-cluster = {
enable = lib.mkEnableOption "Pinset orchestration for IPFS - requires ipfs daemon to be useful";
consensus = lib.mkOption {
type = lib.types.enum [
"raft"
"crdt"
];
description = "Consensus protocol - 'raft' or 'crdt'. <https://cluster.ipfs.io/documentation/guides/consensus/>";
};
dataDir = lib.mkOption {
type = lib.types.str;
default = "/var/lib/ipfs-cluster";
description = "The data dir for ipfs-cluster.";
};
initPeers = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ ];
description = "Peer addresses to initialize with on first run.";
};
openSwarmPort = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Open swarm port, secured by the cluster secret. This does not expose the API or proxy. <https://cluster.ipfs.io/documentation/guides/security/>";
};
secretFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
description = ''
File containing the cluster secret in the format of EnvironmentFile as described by
{manpage}`systemd.exec(5)`. For example:
<programlisting>
CLUSTER_SECRET=<replaceable>...</replaceable>
</programlisting>
If null, a new secret will be generated on first run and stored in the data directory.
A secret in the correct format can also be generated by: `openssl rand -hex 32`
'';
};
};
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = cfg.enable -> config.services.kubo.enable;
message = "ipfs-cluster requires ipfs - configure and enable services.kubo";
}
];
environment.systemPackages = [ pkgs.ipfs-cluster ];
systemd.tmpfiles.rules = [
"d '${cfg.dataDir}' - ${config.services.kubo.user} ${config.services.kubo.group} - -"
];
systemd.services.ipfs-cluster-init = {
path = [
"/run/wrappers"
pkgs.ipfs-cluster
];
environment.IPFS_CLUSTER_PATH = cfg.dataDir;
wantedBy = [ "default.target" ];
serviceConfig = {
ExecStart = [
"${lib.getExe' pkgs.ipfs-cluster "ipfs-cluster-service"} init --consensus ${cfg.consensus} ${initFlags}"
];
Type = "oneshot";
RemainAfterExit = true;
User = config.services.kubo.user;
Group = config.services.kubo.group;
EnvironmentFile = lib.mkIf (cfg.secretFile != null) cfg.secretFile;
};
# only run once (= when the data directory is empty)
unitConfig.ConditionDirectoryNotEmpty = "!${cfg.dataDir}";
};
systemd.services.ipfs-cluster = {
environment.IPFS_CLUSTER_PATH = cfg.dataDir;
wantedBy = [ "multi-user.target" ];
wants = [ "ipfs-cluster-init.service" ];
after = [ "ipfs-cluster-init.service" ];
serviceConfig = {
Type = "notify";
ExecStart = [ "${lib.getExe' pkgs.ipfs-cluster "ipfs-cluster-service"} daemon" ];
User = config.services.kubo.user;
Group = config.services.kubo.group;
};
};
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openSwarmPort [ 9096 ];
};
meta = {
maintainers = with lib.maintainers; [
sorki
];
};
}
|
