X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fdatabases%2Fpostgresql.nix;h=c442a63c01b727913b41f5e275c130fd918497db;hb=8a05c7fb2e7aad81ce4eb31b5173f4dabf353e31;hp=1932a824ac9f73072f700e9cd98256ea9e43d4e0;hpb=ec9b656476d4af2784aea29b846bead85dc46e16;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/databases/postgresql.nix b/modules/private/databases/postgresql.nix
index 1932a82..c442a63 100644
--- a/modules/private/databases/postgresql.nix
+++ b/modules/private/databases/postgresql.nix
@@ -91,16 +91,6 @@ in {
           '';
         readOnly = true;
       };
-      systemdRuntimeDirectory = lib.mkOption {
-        type = lib.types.str;
-        # Use ReadWritePaths= instead if socketsDir is outside of /run
-        default = assert lib.strings.hasPrefix "/run/" cfg.socketsDir;
-          lib.strings.removePrefix "/run/" cfg.socketsDir;
-        description = ''
-        Adjusted Postgresql sockets directory for systemd
-        '';
-        readOnly = true;
-      };
     };
   };
 
@@ -110,7 +100,6 @@ in {
     security.acme.certs."postgresql" = config.myServices.databasesCerts // {
       user = "postgres";
       group = "postgres";
-      plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
       domain = "db-1.immae.eu";
       postRun = ''
         systemctl reload postgresql.service
@@ -119,7 +108,6 @@ in {
 
     systemd.services.postgresql.serviceConfig = {
       SupplementaryGroups = "keys";
-      RuntimeDirectory = cfg.systemdRuntimeDirectory;
     };
     systemd.services.postgresql.postStart = lib.mkAfter ''
       # This line is already defined in 19.09
@@ -161,9 +149,12 @@ in {
         lc_numeric = 'en_US.UTF-8'
         lc_time = 'en_US.UTF-8'
         default_text_search_config = 'pg_catalog.english'
+        # this introduces a small delay before storing on disk, but
+        # makes it order of magnitudes quicker
+        synchronous_commit = off
         ssl = on
-        ssl_cert_file = '${config.security.acme.directory}/postgresql/fullchain.pem'
-        ssl_key_file = '${config.security.acme.directory}/postgresql/key.pem'
+        ssl_cert_file = '${config.security.acme.certs.postgresql.directory}/fullchain.pem'
+        ssl_key_file = '${config.security.acme.certs.postgresql.directory}/key.pem'
         '';
       authentication = let
         hosts = builtins.concatStringsSep "\n" (
@@ -220,22 +211,20 @@ in {
 
     security.pam.services = let
       pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
-    in [
-      {
-        name = "postgresql";
+    in {
+      postgresql = {
         text = ''
           auth    required ${pam_ldap} config=${config.secrets.location}/postgresql/pam
           account required ${pam_ldap} config=${config.secrets.location}/postgresql/pam
           '';
-      }
-      {
-        name = "postgresql_replication";
+      };
+      postgresql_replication = {
         text = ''
           auth    required ${pam_ldap} config=${config.secrets.location}/postgresql/pam_replication
           account required ${pam_ldap} config=${config.secrets.location}/postgresql/pam_replication
           '';
-      }
-    ];
+      };
+    };
   };
 }