aboutsummaryrefslogtreecommitdiff
path: root/virtual/modules/databases
diff options
context:
space:
mode:
Diffstat (limited to 'virtual/modules/databases')
-rw-r--r--virtual/modules/databases/default.nix180
-rw-r--r--virtual/modules/databases/postgresql_run_socket_path.patch12
2 files changed, 192 insertions, 0 deletions
diff --git a/virtual/modules/databases/default.nix b/virtual/modules/databases/default.nix
new file mode 100644
index 0000000..de4ace6
--- /dev/null
+++ b/virtual/modules/databases/default.nix
@@ -0,0 +1,180 @@
1{ lib, pkgs, config, mylibs, ... }:
2let
3 cfg = config.services.myDatabases;
4in {
5 options.services.myDatabases = {
6 enable = lib.mkEnableOption "my databases service";
7 postgresql = {
8 enable = lib.mkOption {
9 default = cfg.enable;
10 example = true;
11 description = "Whether to enable postgresql database";
12 type = lib.types.bool;
13 };
14 };
15
16 mariadb = {
17 enable = lib.mkOption {
18 default = cfg.enable;
19 example = true;
20 description = "Whether to enable mariadb database";
21 type = lib.types.bool;
22 };
23 };
24
25 redis = {
26 enable = lib.mkOption {
27 default = cfg.enable;
28 example = true;
29 description = "Whether to enable redis database";
30 type = lib.types.bool;
31 };
32 };
33 };
34
35 config = lib.mkIf cfg.enable {
36 nixpkgs.config.packageOverrides = oldpkgs: rec {
37 postgresql = postgresql111;
38 postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec {
39 passthru = old.passthru // { psqlSchema = "11.0"; };
40 name = "postgresql-11.1";
41 src = pkgs.fetchurl {
42 url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
43 sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
44 };
45 configureFlags = old.configureFlags ++ [ "--with-pam" ];
46 buildInputs = (old.buildInputs or []) ++ [ pkgs.pam ];
47 patches = old.patches ++ [
48 ./postgresql_run_socket_path.patch
49 ];
50 });
51 mariadb = mariadbPAM;
52 mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec {
53 cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
54 buildInputs = old.buildInputs ++ [ pkgs.pam ];
55 });
56 };
57
58 networking.firewall.allowedTCPPorts = [ 3306 5432 ];
59
60 # FIXME: initial sync
61 # FIXME: backup
62 # FIXME: restart after pam
63 # FIXME: pam access doesn’t work (because of php module)
64 # FIXME: ssl
65 services.mysql = rec {
66 enable = cfg.mariadb.enable;
67 package = pkgs.mariadb;
68 };
69
70 # Cannot use eldiron: psql complains too much rights on the key, and
71 # setfacl cannot work properly because of acme prestart script
72 security.acme.certs."postgresql" = config.services.myCertificates.certConfig // {
73 user = "postgres";
74 group = "postgres";
75 plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
76 domain = "db-1.immae.eu";
77 postRun = ''
78 systemctl reload postgresql.service
79 '';
80 };
81
82 system.activationScripts.postgresql = ''
83 install -m 0755 -o postgres -g postgres -d /run/postgresql
84 '';
85
86 # FIXME: initial sync
87 services.postgresql = rec {
88 enable = cfg.postgresql.enable;
89 package = pkgs.postgresql;
90 enableTCPIP = true;
91 extraConfig = ''
92 max_connections = 100
93 wal_level = logical
94 shared_buffers = 128MB
95 max_wal_size = 1GB
96 min_wal_size = 80MB
97 log_timezone = 'Europe/Paris'
98 datestyle = 'iso, mdy'
99 timezone = 'Europe/Paris'
100 lc_messages = 'en_US.UTF-8'
101 lc_monetary = 'en_US.UTF-8'
102 lc_numeric = 'en_US.UTF-8'
103 lc_time = 'en_US.UTF-8'
104 default_text_search_config = 'pg_catalog.english'
105 ssl = on
106 ssl_cert_file = '/var/lib/acme/postgresql/fullchain.pem'
107 ssl_key_file = '/var/lib/acme/postgresql/key.pem'
108 '';
109 authentication = ''
110 local all postgres ident
111 local all all md5
112 hostssl all all samehost md5
113 hostssl all all 178.33.252.96/32 md5
114 hostssl all all 188.165.209.148/32 md5
115 hostssl all all all pam
116 hostssl replication backup-1 2001:41d0:302:1100::9:e5a9/128 pam pamservice=postgresql_replication
117 hostssl replication backup-1 54.37.151.137/32 pam pamservice=postgresql_replication
118 '';
119 };
120
121 security.pam.services = let
122 pam_ldap = pkgs.pam_ldap;
123 pam_ldap_mysql = assert mylibs.checkEnv "NIXOPS_MYSQL_PAM_PASSWORD";
124 pkgs.writeText "mysql.conf" ''
125 host ldap.immae.eu
126 base dc=immae,dc=eu
127 binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
128 bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
129 pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
130 '';
131 pam_ldap_postgresql_replication = assert mylibs.checkEnv "NIXOPS_ELDIRON_LDAP_PASSWORD";
132 pkgs.writeText "postgresql.conf" ''
133 host ldap.immae.eu
134 base dc=immae,dc=eu
135 binddn cn=eldiron,ou=hosts,dc=immae,dc=eu
136 bindpw ${builtins.getEnv "NIXOPS_ELDIRON_LDAP_PASSWORD"}
137 pam_login_attribute cn
138 '';
139 in [
140 {
141 name = "mysql";
142 text = ''
143 # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
144 auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
145 account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
146 '';
147 }
148 {
149 name = "postgresql";
150 text = ''
151 auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
152 account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
153 '';
154 }
155 {
156 name = "postgresql_replication";
157 text = ''
158 auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
159 account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
160 '';
161 }
162 ];
163
164 # FIXME: backup
165 # Nextcloud: 14
166 services.redis = rec {
167 enable = config.services.myDatabases.redis.enable;
168 bind = "127.0.0.1";
169 unixSocket = "/run/redis/redis.sock";
170 extraConfig = ''
171 unixsocketperm 777
172 maxclients 1024
173 '';
174 };
175 system.activationScripts.redis = ''
176 mkdir -p /run/redis
177 chown redis /run/redis
178 '';
179 };
180}
diff --git a/virtual/modules/databases/postgresql_run_socket_path.patch b/virtual/modules/databases/postgresql_run_socket_path.patch
new file mode 100644
index 0000000..b558c7b
--- /dev/null
+++ b/virtual/modules/databases/postgresql_run_socket_path.patch
@@ -0,0 +1,12 @@
1diff -Naur postgresql-9.2.0.sockets/src/include/pg_config_manual.h postgresql-9.2.0/src/include/pg_config_manual.h
2--- postgresql-9.2.0.sockets/src/include/pg_config_manual.h 2012-09-06 17:26:17.000000000 -0400
3+++ postgresql-9.2.0/src/include/pg_config_manual.h 2012-09-06 18:13:18.183092471 -0400
4@@ -144,7 +144,7 @@
5 * here's where to twiddle it. You can also override this at runtime
6 * with the postmaster's -k switch.
7 */
8-#define DEFAULT_PGSOCKET_DIR "/tmp"
9+#define DEFAULT_PGSOCKET_DIR "/run/postgresql"
10
11 /*
12 * The random() function is expected to yield values between 0 and
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-18 13:58:38 +0000