23 lines
670 B
Nix
23 lines
670 B
Nix
# swarm-central: the swarm controller (and the swarm UI it serves) and the
|
|
# secret store.
|
|
{ config, ... }:
|
|
let
|
|
mesh = import ./mesh.nix;
|
|
hyperhive = config.services.hyperhive;
|
|
in
|
|
{
|
|
services.hyperhive = {
|
|
deploy.swarm-controller.enable = true;
|
|
deploy.bao.enable = true;
|
|
|
|
# The store also listens on this machine's VPN address, for the services
|
|
# and hives on other machines.
|
|
deploy.bao.extraListenAddresses = [ mesh.swarm-central.address ];
|
|
|
|
# The swarm UI is public.
|
|
gateway.openFirewall = true;
|
|
};
|
|
|
|
# The store is reachable over the VPN only.
|
|
networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.swarm.bao.port ];
|
|
}
|