blob: 46025105c64b4318a3a9332508cb5c118d48985f (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
|
{ lib, config, pkgs, ... }:
let
cfg = config.myServices.databases.redis;
in {
options.myServices.databases.redis = {
enable = lib.mkOption {
default = false;
example = true;
description = "Whether to enable redis database";
type = lib.types.bool;
};
socketsDir = lib.mkOption {
type = lib.types.path;
default = "/run/redis";
description = ''
The directory where Redis puts sockets.
'';
};
# Output variables
sockets = lib.mkOption {
type = lib.types.attrsOf lib.types.path;
default = {
redis = "${cfg.socketsDir}/redis.sock";
};
readOnly = true;
description = ''
Redis sockets
'';
};
};
config = lib.mkIf cfg.enable {
users.users.redis.uid = config.ids.uids.redis;
users.groups.redis.gid = config.ids.gids.redis;
services.redis = rec {
enable = true;
bind = "127.0.0.1";
unixSocket = cfg.sockets.redis;
extraConfig = ''
unixsocketperm 777
maxclients 1024
'';
};
services.spiped = {
enable = true;
config.redis = {
decrypt = true;
source = "0.0.0.0:16379";
target = "/run/redis/redis.sock";
keyfile = "${config.secrets.location}/redis/spiped_keyfile";
};
};
systemd.services.spiped_redis = {
description = "Secure pipe 'redis'";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Restart = "always";
User = "spiped";
PermissionsStartOnly = true;
SupplementaryGroups = "keys";
};
script = "exec ${pkgs.spiped}/bin/spiped -F `cat /etc/spiped/redis.spec`";
};
services.filesWatcher.predixy = {
restart = true;
paths = [ "${config.secrets.location}/redis/predixy.conf" ];
};
networking.firewall.allowedTCPPorts = [ 7617 16379 ];
secrets.keys = [
{
dest = "redis/predixy.conf";
user = "redis";
group = "redis";
permissions = "0400";
text = ''
Name Predixy
Bind 127.0.0.1:7617
ClientTimeout 300
WorkerThreads 1
Authority {
Auth "${config.myEnv.databases.redis.predixy.read}" {
Mode read
}
}
StandaloneServerPool {
Databases 16
RefreshMethod fixed
Group shard001 {
+ ${config.myEnv.databases.redis.socket}
}
}
'';
}
{
dest = "redis/spiped_keyfile";
user = "spiped";
group = "spiped";
permissions = "0400";
text = config.myEnv.databases.redis.spiped_key;
}
];
systemd.services.predixy = {
description = "Redis proxy";
wantedBy = [ "multi-user.target" ];
after = [ "redis.service" ];
serviceConfig = {
User = "redis";
Group = "redis";
SupplementaryGroups = "keys";
Type = "simple";
ExecStart = "${pkgs.predixy}/bin/predixy ${config.secrets.location}/redis/predixy.conf";
};
};
};
}
|
