64 lines
2.3 KiB
Nix
64 lines
2.3 KiB
Nix
# swarm-services: the forge, the matrix homeserver, SSO, the queue, and the
|
|
# metrics and log stack.
|
|
{ config, lib, ... }:
|
|
let
|
|
hyperhive = config.services.hyperhive;
|
|
|
|
# The secret store runs on swarm-central, so each service here reads it with
|
|
# a leaf copied from there. `pair "grafanaOidc" "grafana-oidc"` names the
|
|
# options `deploy.bao.grafanaOidcClientCertFile` and `…KeyFile` and the files
|
|
# `grafana-oidc.pem` and `grafana-oidc-key.pem`.
|
|
pki = "/var/lib/swarm-pki";
|
|
pair = option: stem: {
|
|
"${option}ClientCertFile" = "${pki}/${stem}.pem";
|
|
"${option}ClientKeyFile" = "${pki}/${stem}-key.pem";
|
|
};
|
|
in
|
|
{
|
|
services.hyperhive = {
|
|
# Everything once-per-swarm that is not placed elsewhere below.
|
|
deploy.allSwarmServices = true;
|
|
|
|
# The forge and the matrix homeserver are public, and so is the SSO login
|
|
# they send browsers to.
|
|
gateway.openFirewall = true;
|
|
|
|
deploy.bao = lib.mergeAttrsList [
|
|
{ enable = false; }
|
|
(pair "forgePublisher" "forge-publisher")
|
|
(pair "servicesIssuer" "services-issuer")
|
|
(pair "grafanaOidc" "grafana-oidc")
|
|
(pair "otelOidc" "otel-oidc")
|
|
(pair "forwarderOidc" "forwarder-oidc")
|
|
(pair "reviewClassifier" "review-classifier")
|
|
(pair "notifyRouter" "notify-router")
|
|
(pair "claudeLogin" "claude-login")
|
|
(pair "ciMetrics" "ci-metrics")
|
|
];
|
|
deploy.matrix = {
|
|
ctlBaoClientCertFile = "${pki}/matrix-ctl.pem";
|
|
ctlBaoClientKeyFile = "${pki}/matrix-ctl-key.pem";
|
|
};
|
|
deploy.nats = {
|
|
baoClientCertFile = "${pki}/nats.pem";
|
|
baoClientKeyFile = "${pki}/nats-key.pem";
|
|
authBaoClientCertFile = "${pki}/nats-auth.pem";
|
|
authBaoClientKeyFile = "${pki}/nats-auth-key.pem";
|
|
};
|
|
deploy.swarm-secret-publisher = {
|
|
baoClientCertFile = "${pki}/secret-publisher.pem";
|
|
baoClientKeyFile = "${pki}/secret-publisher-key.pem";
|
|
};
|
|
deploy.victoriametrics = {
|
|
authBaoClientCertFile = "${pki}/metrics-auth.pem";
|
|
authBaoClientKeyFile = "${pki}/metrics-auth-key.pem";
|
|
};
|
|
deploy.victorialogs = {
|
|
authBaoClientCertFile = "${pki}/logs-auth.pem";
|
|
authBaoClientKeyFile = "${pki}/logs-auth-key.pem";
|
|
};
|
|
};
|
|
|
|
# The queue is reachable over the VPN only.
|
|
networking.firewall.interfaces.wg0.allowedTCPPorts = [ hyperhive.swarm.nats.port ];
|
|
}
|