X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fdatabases%2Fredis.nix;h=46025105c64b4318a3a9332508cb5c118d48985f;hb=5400b9b6f65451d41a9106fae6fc00f97d83f4ef;hp=a1c2c75a32585736e6cc3a0520f627c52f4b865f;hpb=182ae57f53731be220075bc87aff4d47a35563b8;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/databases/redis.nix b/modules/private/databases/redis.nix
index a1c2c75..4602510 100644
--- a/modules/private/databases/redis.nix
+++ b/modules/private/databases/redis.nix
@@ -1,10 +1,10 @@
-{ lib, config, myconfig,  ... }:
+{ lib, config, pkgs, ... }:
 let
     cfg = config.myServices.databases.redis;
 in {
   options.myServices.databases.redis = {
     enable = lib.mkOption {
-      default = cfg.enable;
+      default = false;
       example = true;
       description = "Whether to enable redis database";
       type = lib.types.bool;
@@ -17,16 +17,6 @@ in {
         '';
     };
     # Output variables
-    systemdRuntimeDirectory = lib.mkOption {
-      type = lib.types.str;
-      # Use ReadWritePaths= instead if socketsDir is outside of /run
-      default = assert lib.strings.hasPrefix "/run/" cfg.socketsDir;
-        lib.strings.removePrefix "/run/" cfg.socketsDir;
-      description = ''
-      Adjusted redis sockets directory for systemd
-      '';
-      readOnly = true;
-    };
     sockets = lib.mkOption {
       type = lib.types.attrsOf lib.types.path;
       default = {
@@ -51,7 +41,88 @@ in {
         maxclients 1024
         '';
     };
-    systemd.services.redis.serviceConfig.RuntimeDirectory = cfg.systemdRuntimeDirectory;
+
+    services.spiped = {
+      enable = true;
+      config.redis = {
+        decrypt = true;
+        source = "0.0.0.0:16379";
+        target = "/run/redis/redis.sock";
+        keyfile = "${config.secrets.location}/redis/spiped_keyfile";
+      };
+    };
+    systemd.services.spiped_redis = {
+      description = "Secure pipe 'redis'";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Restart   = "always";
+        User      = "spiped";
+        PermissionsStartOnly = true;
+        SupplementaryGroups = "keys";
+      };
+
+      script = "exec ${pkgs.spiped}/bin/spiped -F `cat /etc/spiped/redis.spec`";
+    };
+
+    services.filesWatcher.predixy = {
+      restart = true;
+      paths = [ "${config.secrets.location}/redis/predixy.conf" ];
+    };
+
+    networking.firewall.allowedTCPPorts = [ 7617 16379 ];
+    secrets.keys = [
+      {
+        dest = "redis/predixy.conf";
+        user = "redis";
+        group = "redis";
+        permissions = "0400";
+        text = ''
+          Name Predixy
+          Bind 127.0.0.1:7617
+          ClientTimeout 300
+          WorkerThreads 1
+
+          Authority {
+              Auth "${config.myEnv.databases.redis.predixy.read}" {
+                  Mode read
+              }
+          }
+
+          StandaloneServerPool {
+            Databases 16
+            RefreshMethod fixed
+            Group shard001 {
+              + ${config.myEnv.databases.redis.socket}
+            }
+          }
+          '';
+      }
+      {
+        dest = "redis/spiped_keyfile";
+        user = "spiped";
+        group = "spiped";
+        permissions = "0400";
+        text = config.myEnv.databases.redis.spiped_key;
+      }
+    ];
+
+    systemd.services.predixy = {
+      description = "Redis proxy";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "redis.service" ];
+
+      serviceConfig = {
+        User = "redis";
+        Group = "redis";
+        SupplementaryGroups = "keys";
+        Type = "simple";
+
+        ExecStart = "${pkgs.predixy}/bin/predixy ${config.secrets.location}/redis/predixy.conf";
+      };
+
+    };
   };
 }