28 lines
921 B
Nix
28 lines
921 B
Nix
# swarm-central: the swarm controller (and the swarm UI it serves) and the
|
|
# secret store.
|
|
{ config, lib, ... }:
|
|
let
|
|
mesh = import ./mesh.nix;
|
|
hyperhive = config.services.hyperhive;
|
|
in
|
|
{
|
|
services.hyperhive = {
|
|
deploy.swarm-controller.enable = true;
|
|
deploy.bao.enable = true;
|
|
|
|
# The store also listens on this machine's VPN address, for the services
|
|
# and hives on other machines.
|
|
deploy.bao.extraListenAddresses = [ mesh.swarm-central.address ];
|
|
|
|
# The gateway's ports are open to everyone. The swarm UI is the one vhost
|
|
# that answers there; the store's browser UI answers on the private
|
|
# addresses only.
|
|
gateway.openFirewall = true;
|
|
gateway.vhosts = lib.genAttrs [ hyperhive.swarm.bao.ui.domain ] (_: {
|
|
public = false;
|
|
});
|
|
};
|
|
|
|
# The store is reachable over the VPN only.
|
|
networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.swarm.bao.port ];
|
|
}
|