diff options
Diffstat (limited to 'modules/private/databases/redis.nix')
-rw-r--r-- | modules/private/databases/redis.nix | 133 |
1 files changed, 0 insertions, 133 deletions
diff --git a/modules/private/databases/redis.nix b/modules/private/databases/redis.nix deleted file mode 100644 index 685fa46..0000000 --- a/modules/private/databases/redis.nix +++ /dev/null | |||
@@ -1,133 +0,0 @@ | |||
1 | { lib, config, pkgs, ... }: | ||
2 | let | ||
3 | cfg = config.myServices.databases.redis; | ||
4 | in { | ||
5 | options.myServices.databases.redis = { | ||
6 | enable = lib.mkOption { | ||
7 | default = false; | ||
8 | example = true; | ||
9 | description = "Whether to enable redis database"; | ||
10 | type = lib.types.bool; | ||
11 | }; | ||
12 | socketsDir = lib.mkOption { | ||
13 | type = lib.types.path; | ||
14 | default = "/run/redis"; | ||
15 | description = '' | ||
16 | The directory where Redis puts sockets. | ||
17 | ''; | ||
18 | }; | ||
19 | # Output variables | ||
20 | sockets = lib.mkOption { | ||
21 | type = lib.types.attrsOf lib.types.path; | ||
22 | default = { | ||
23 | redis = "${cfg.socketsDir}/redis.sock"; | ||
24 | }; | ||
25 | readOnly = true; | ||
26 | description = '' | ||
27 | Redis sockets | ||
28 | ''; | ||
29 | }; | ||
30 | }; | ||
31 | |||
32 | config = lib.mkIf cfg.enable { | ||
33 | users.users.redis.uid = config.ids.uids.redis; | ||
34 | users.groups.redis.gid = config.ids.gids.redis; | ||
35 | services.redis = rec { | ||
36 | enable = true; | ||
37 | bind = "127.0.0.1"; | ||
38 | unixSocket = cfg.sockets.redis; | ||
39 | extraConfig = '' | ||
40 | unixsocketperm 777 | ||
41 | maxclients 1024 | ||
42 | ''; | ||
43 | }; | ||
44 | systemd.services.redis.serviceConfig.Slice = "redis.slice"; | ||
45 | |||
46 | services.spiped = { | ||
47 | enable = true; | ||
48 | config.redis = { | ||
49 | decrypt = true; | ||
50 | source = "0.0.0.0:16379"; | ||
51 | target = "/run/redis/redis.sock"; | ||
52 | keyfile = config.secrets.fullPaths."redis/spiped_keyfile"; | ||
53 | }; | ||
54 | }; | ||
55 | systemd.services.spiped_redis = { | ||
56 | description = "Secure pipe 'redis'"; | ||
57 | after = [ "network.target" ]; | ||
58 | wantedBy = [ "multi-user.target" ]; | ||
59 | |||
60 | serviceConfig = { | ||
61 | Slice = "redis.slice"; | ||
62 | Restart = "always"; | ||
63 | User = "spiped"; | ||
64 | PermissionsStartOnly = true; | ||
65 | SupplementaryGroups = "keys"; | ||
66 | }; | ||
67 | |||
68 | script = "exec ${pkgs.spiped}/bin/spiped -F `cat /etc/spiped/redis.spec`"; | ||
69 | }; | ||
70 | |||
71 | services.filesWatcher.predixy = { | ||
72 | restart = true; | ||
73 | paths = [ config.secrets.fullPaths."redis/predixy.conf" ]; | ||
74 | }; | ||
75 | |||
76 | networking.firewall.allowedTCPPorts = [ 7617 16379 ]; | ||
77 | secrets.keys = { | ||
78 | "redis/predixy.conf" = { | ||
79 | user = "redis"; | ||
80 | group = "redis"; | ||
81 | permissions = "0400"; | ||
82 | text = '' | ||
83 | Name Predixy | ||
84 | Bind 127.0.0.1:7617 | ||
85 | ClientTimeout 300 | ||
86 | WorkerThreads 1 | ||
87 | |||
88 | Authority { | ||
89 | Auth "${config.myEnv.databases.redis.predixy.read}" { | ||
90 | Mode read | ||
91 | } | ||
92 | } | ||
93 | |||
94 | StandaloneServerPool { | ||
95 | Databases 16 | ||
96 | RefreshMethod fixed | ||
97 | Group shard001 { | ||
98 | + ${config.myEnv.databases.redis.socket} | ||
99 | } | ||
100 | } | ||
101 | ''; | ||
102 | }; | ||
103 | "redis/spiped_keyfile" = { | ||
104 | user = "spiped"; | ||
105 | group = "spiped"; | ||
106 | permissions = "0400"; | ||
107 | text = config.myEnv.databases.redis.spiped_key; | ||
108 | }; | ||
109 | }; | ||
110 | |||
111 | systemd.slices.redis = { | ||
112 | description = "Redis slice"; | ||
113 | }; | ||
114 | |||
115 | systemd.services.predixy = { | ||
116 | description = "Redis proxy"; | ||
117 | wantedBy = [ "multi-user.target" ]; | ||
118 | after = [ "redis.service" ]; | ||
119 | |||
120 | serviceConfig = { | ||
121 | Slice = "redis.slice"; | ||
122 | User = "redis"; | ||
123 | Group = "redis"; | ||
124 | SupplementaryGroups = "keys"; | ||
125 | Type = "simple"; | ||
126 | |||
127 | ExecStart = "${pkgs.predixy}/bin/predixy ${config.secrets.fullPaths."redis/predixy.conf"}"; | ||
128 | }; | ||
129 | |||
130 | }; | ||
131 | }; | ||
132 | } | ||
133 | |||