modules/private/databases/mariadb_replication.nix

   1 { pkgs, config, lib, ... }:
   2 let
   3   cfg = config.myServices.databasesReplication.mariadb;
   4 in
   5 {
   6   options.myServices.databasesReplication.mariadb = {
   7     enable = lib.mkEnableOption "Enable mariadb replication";
   8     base = lib.mkOption {
   9       type = lib.types.path;
  10       description = ''
  11         Base path to put the replications
  12         '';
  13     };
  14     hosts = lib.mkOption {
  15       default = {};
  16       description = ''
  17         Hosts to backup
  18         '';
  19       type = lib.types.attrsOf (lib.types.submodule {
  20         options = {
  21           package = lib.mkOption {
  22             type = lib.types.package;
  23             default = pkgs.mariadb;
  24             description = ''
  25               Mariadb package for this host
  26             '';
  27           };
  28           serverId = lib.mkOption {
  29             type = lib.types.int;
  30             description = ''
  31               Server id to use for replication cluster (must be unique among the cluster!)
  32             '';
  33           };
  34           host = lib.mkOption {
  35             type = lib.types.str;
  36             description = ''
  37               Host to connect to
  38               '';
  39           };
  40           port = lib.mkOption {
  41             type = lib.types.str;
  42             description = ''
  43               Port to connect to
  44               '';
  45           };
  46           user = lib.mkOption {
  47             type = lib.types.str;
  48             description = ''
  49               User to connect as
  50               '';
  51           };
  52           password = lib.mkOption {
  53             type = lib.types.str;
  54             description = ''
  55               Password to use
  56               '';
  57           };
  58           dumpUser = lib.mkOption {
  59             type = lib.types.str;
  60             description = ''
  61               User who can do a dump
  62               '';
  63           };
  64           dumpPassword = lib.mkOption {
  65             type = lib.types.str;
  66             description = ''
  67               Password for the dump user
  68               '';
  69           };
  70         };
  71       });
  72     };
  73   };
  74
  75   config = lib.mkIf cfg.enable {
  76     users.users.mysql = {
  77       description = "MySQL server user";
  78       group = "mysql";
  79       uid = config.ids.uids.mysql;
  80       extraGroups = [ "keys" ];
  81     };
  82     users.groups.mysql.gid = config.ids.gids.mysql;
  83
  84     secrets.keys = lib.flatten (lib.mapAttrsToList (name: hcfg: [
  85       {
  86         dest = "mysql_replication/${name}/slave_init_commands";
  87         user = "mysql";
  88         group = "mysql";
  89         permissions = "0400";
  90         text = ''
  91           CHANGE MASTER TO master_host="${hcfg.host}", master_port=${hcfg.port}, master_user="${hcfg.user}", master_password="${hcfg.password}", master_ssl=1, master_use_gtid=slave_pos;
  92           START SLAVE;
  93           '';
  94       }
  95       {
  96         dest = "mysql_replication/${name}/mysqldump_remote";
  97         permissions = "0400";
  98         user = "root";
  99         group = "root";
 100         text = ''
 101           [mysqldump]
 102           user = ${hcfg.user}
 103           password = ${hcfg.password}
 104         '';
 105       }
 106       {
 107         dest = "mysql_replication/${name}/mysqldump";
 108         permissions = "0400";
 109         user = "root";
 110         group = "root";
 111         text = ''
 112           [mysqldump]
 113           user = ${hcfg.dumpUser}
 114           password = ${hcfg.dumpPassword}
 115         '';
 116       }
 117       {
 118         dest = "mysql_replication/${name}/client";
 119         permissions = "0400";
 120         user = "mysql";
 121         group = "mysql";
 122         text = ''
 123           [client]
 124           user = ${hcfg.dumpUser}
 125           password = ${hcfg.dumpPassword}
 126         '';
 127       }
 128     ]) cfg.hosts);
 129
 130     services.cron = {
 131       enable = true;
 132       systemCronJobs = lib.flatten (lib.mapAttrsToList (name: hcfg:
 133         let
 134           dataDir = "${cfg.base}/${name}/mysql";
 135           backupDir = "${cfg.base}/${name}/mysql_backup";
 136           backup_script = pkgs.writeScript "backup_mysql_${name}" ''
 137               #!${pkgs.stdenv.shell}
 138
 139               set -euo pipefail
 140
 141               filename=${backupDir}/$(${pkgs.coreutils}/bin/date -Iminutes).sql
 142               ${hcfg.package}/bin/mysqldump \
 143                 --defaults-file=${config.secrets.location}/mysql_replication/${name}/mysqldump \
 144                 -S /run/mysqld_${name}/mysqld.sock \
 145                 --gtid \
 146                 --master-data \
 147                 --flush-privileges \
 148                 --all-databases > $filename
 149               ${pkgs.gzip}/bin/gzip $filename
 150             '';
 151           u = pkgs.callPackage ./utils.nix {};
 152           cleanup_script = pkgs.writeScript "cleanup_mysql_${name}" (u.exponentialDumps "sql.gz" backupDir);
 153         in [
 154           "0 22,4,10,16 * * * root ${backup_script}"
 155           "0 3 * * * root ${cleanup_script}"
 156         ]) cfg.hosts);
 157     };
 158
 159     system.activationScripts = lib.attrsets.mapAttrs' (name: hcfg:
 160       lib.attrsets.nameValuePair "mysql_replication_${name}" {
 161         deps = [ "users" "groups" ];
 162         text = ''
 163           install -m 0700 -o mysql -g mysql -d ${cfg.base}/${name}/mysql
 164           install -m 0700 -o mysql -g mysql -d ${cfg.base}/${name}/mysql_backup
 165           '';
 166       }) cfg.hosts;
 167
 168     environment.etc = lib.attrsets.mapAttrs' (name: hcfg:
 169       lib.attrsets.nameValuePair "mysql/${name}_my.cnf" {
 170         text = ''
 171           [mysqld]
 172           skip-networking
 173           socket = /run/mysqld_${name}/mysqld.sock
 174           datadir = ${cfg.base}/${name}/mysql/
 175           log-bin = mariadb-bin
 176           server-id = ${builtins.toString hcfg.serverId}
 177           '';
 178       }
 179     ) cfg.hosts;
 180
 181     systemd.services = lib.attrsets.mapAttrs' (name: hcfg:
 182       let
 183         dataDir = "${cfg.base}/${name}/mysql";
 184       in
 185       lib.attrsets.nameValuePair "mysql_backup_${name}" {
 186         description = "Mysql replication for ${name}";
 187         wantedBy = [ "multi-user.target" ];
 188         after = [ "network.target" ];
 189         restartTriggers = [ config.environment.etc."mysql/${name}_my.cnf".source ];
 190         unitConfig.RequiresMountsFor = dataDir;
 191
 192         preStart = ''
 193           if ! test -e ${dataDir}/mysql; then
 194             ${hcfg.package}/bin/mysqldump \
 195               --defaults-file=${config.secrets.location}/mysql_replication/${name}/mysqldump_remote \
 196               -h ${hcfg.host} \
 197               -P ${hcfg.port} \
 198               --ssl \
 199               --gtid \
 200               --flush-privileges \
 201               --master-data \
 202               --all-databases > ${dataDir}/initial.sql
 203
 204             ${hcfg.package}/bin/mysql_install_db \
 205               --defaults-file=/etc/mysql/${name}_my.cnf \
 206               --user=mysql \
 207               --datadir=${dataDir} \
 208               --basedir=${hcfg.package}
 209           fi
 210           '';
 211
 212         serviceConfig = {
 213           User = "mysql";
 214           Group = "mysql";
 215           RuntimeDirectory = "mysqld_${name}";
 216           RuntimeDirectoryMode = "0755";
 217           SupplementaryGroups = "keys";
 218           PermissionsStartOnly = true;
 219           Type = "notify";
 220
 221           ExecStart = "${hcfg.package}/bin/mysqld --defaults-file=/etc/mysql/${name}_my.cnf --user=mysql --datadir=${dataDir} --basedir=${hcfg.package}";
 222           ExecStartPost =
 223             let
 224               sql_before = pkgs.writeText "mysql-initial-before" ''
 225                 DROP DATABASE test;
 226                 '';
 227               setupScript = pkgs.writeScript "mysql-setup" ''
 228                 #!${pkgs.runtimeShell} -e
 229
 230                 if test -e ${dataDir}/initial.sql; then
 231                   cat \
 232                     ${sql_before} \
 233                     ${dataDir}/initial.sql \
 234                     ${config.secrets.location}/mysql_replication/${name}/slave_init_commands \
 235                     | ${hcfg.package}/bin/mysql \
 236                     --defaults-file=/etc/mysql/${name}_my.cnf \
 237                     -S /run/mysqld_${name}/mysqld.sock \
 238                     --user=root
 239                   rm -f ${dataDir}/initial.sql
 240                 fi
 241                 '';
 242             in
 243               "+${setupScript}";
 244           # initial dump can take a long time
 245           TimeoutStartSec="infinity";
 246           TimeoutStopSec = 120;
 247         };
 248     }) cfg.hosts;
 249   };
 250 }
 251