81 lines
2.8 KiB
Nix
81 lines
2.8 KiB
Nix
# swarm-services: the forge, the matrix homeserver, SSO, the queue, and the
|
|
# metrics and log stack.
|
|
{ config, lib, ... }:
|
|
let
|
|
hyperhive = config.services.hyperhive;
|
|
|
|
# The secret store runs on swarm-central, so each service here checks it
|
|
# against the CA (`ca.pem`) and reads it with a leaf, both copied from there.
|
|
# `pair "grafanaOidc" "grafana-oidc"` names the options
|
|
# `deploy.bao.grafanaOidcClientCertFile` and `…KeyFile` and the files
|
|
# `grafana-oidc.pem` and `grafana-oidc-key.pem`.
|
|
pki = "/var/lib/swarm-pki";
|
|
pair = option: stem: {
|
|
"${option}ClientCertFile" = "${pki}/${stem}.pem";
|
|
"${option}ClientKeyFile" = "${pki}/${stem}-key.pem";
|
|
};
|
|
in
|
|
{
|
|
services.hyperhive = {
|
|
# Everything once-per-swarm that is not placed elsewhere below.
|
|
deploy.allSwarmServices = true;
|
|
|
|
# The gateway's ports are open to everyone. The forge and the matrix
|
|
# homeserver answer there, and so does the SSO login they send browsers
|
|
# to. Every other vhost here answers on the private addresses only.
|
|
gateway.openFirewall = true;
|
|
gateway.vhosts =
|
|
lib.genAttrs
|
|
(with hyperhive.swarm; [
|
|
nats.domain
|
|
otel.domain
|
|
grafana.domain
|
|
victoriametrics.domain
|
|
victorialogs.domain
|
|
])
|
|
(_: {
|
|
public = false;
|
|
});
|
|
|
|
deploy.bao = lib.mergeAttrsList [
|
|
{
|
|
enable = false;
|
|
serverCaFile = "${pki}/ca.pem";
|
|
}
|
|
(pair "forgePublisher" "forge-publisher")
|
|
(pair "servicesIssuer" "services-issuer")
|
|
(pair "grafanaOidc" "grafana-oidc")
|
|
(pair "otelOidc" "otel-oidc")
|
|
(pair "forwarderOidc" "forwarder-oidc")
|
|
(pair "reviewClassifier" "review-classifier")
|
|
(pair "notifyRouter" "notify-router")
|
|
(pair "claudeLogin" "claude-login")
|
|
(pair "ciMetrics" "ci-metrics")
|
|
];
|
|
deploy.matrix = {
|
|
ctlBaoClientCertFile = "${pki}/matrix-ctl.pem";
|
|
ctlBaoClientKeyFile = "${pki}/matrix-ctl-key.pem";
|
|
};
|
|
deploy.nats = {
|
|
baoClientCertFile = "${pki}/nats.pem";
|
|
baoClientKeyFile = "${pki}/nats-key.pem";
|
|
authBaoClientCertFile = "${pki}/nats-auth.pem";
|
|
authBaoClientKeyFile = "${pki}/nats-auth-key.pem";
|
|
};
|
|
deploy.swarm-secret-publisher = {
|
|
baoClientCertFile = "${pki}/secret-publisher.pem";
|
|
baoClientKeyFile = "${pki}/secret-publisher-key.pem";
|
|
};
|
|
deploy.victoriametrics = {
|
|
authBaoClientCertFile = "${pki}/metrics-auth.pem";
|
|
authBaoClientKeyFile = "${pki}/metrics-auth-key.pem";
|
|
};
|
|
deploy.victorialogs = {
|
|
authBaoClientCertFile = "${pki}/logs-auth.pem";
|
|
authBaoClientKeyFile = "${pki}/logs-auth-key.pem";
|
|
};
|
|
};
|
|
|
|
# The queue is reachable over the VPN only.
|
|
networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.swarm.nats.port ];
|
|
}
|