81 lines
2.2 KiB
Nix
81 lines
2.2 KiB
Nix
|
{ config, lib, pkgs, ... }:
|
||
|
|
with lib;
|
||
|
|
let
|
||
|
|
cfg = config.services.kes;
|
||
|
|
format = pkgs.formats.yaml { };
|
||
|
|
configFile = format.generate "config.yaml" cfg.settings;
|
||
|
|
port = strings.toInt (lists.last (strings.splitString ":" cfg.settings.address));
|
||
|
|
in
|
||
|
|
{
|
||
|
|
options.services.kes = {
|
||
|
|
enable = mkEnableOption (mdDoc "Minio's Key Managament Server");
|
||
|
|
package = mkOption {
|
||
|
|
type = types.package;
|
||
|
|
description = mdDoc "Which package to use for the kes instance.";
|
||
|
|
default = pkgs.minio-kes;
|
||
|
|
};
|
||
|
|
environmentFile = mkOption {
|
||
|
|
type = with types; nullOr str;
|
||
|
|
default = null;
|
||
|
|
description = lib.mdDoc ''
|
||
|
|
File in the format of an EnvironmentFile as described by systemd.exec(5).
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
settings = mkOption {
|
||
|
|
type = format.type;
|
||
|
|
default = { address = "0.0.0.0:7373"; };
|
||
|
|
example = literalExpression ''
|
||
|
|
{
|
||
|
|
address = "0.0.0.0:7373";
|
||
|
|
cache = {
|
||
|
|
expiry = {
|
||
|
|
any = "5m0s";
|
||
|
|
unused = "20s";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|
||
|
|
'';
|
||
|
|
description = mdDoc ''
|
||
|
|
KES Configuration.
|
||
|
|
Refer to <https://github.com/minio/kes/blob/master/server-config.yaml>
|
||
|
|
for details on supported values.
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
};
|
||
|
|
config = mkIf cfg.enable {
|
||
|
|
systemd.services.kes = {
|
||
|
|
description = "KES";
|
||
|
|
wantedBy = [ "multi-user.target" ];
|
||
|
|
wants = [ "network-online.target" ];
|
||
|
|
after = [ "network-online.target" ];
|
||
|
|
path = [ cfg.package ];
|
||
|
|
serviceConfig = {
|
||
|
|
Type = "simple";
|
||
|
|
Restart = "always";
|
||
|
|
ExecStart = "${cfg.package}/bin/kes server --config ${configFile}";
|
||
|
|
User = "kes";
|
||
|
|
Group = "kes";
|
||
|
|
# WorkingDirectory = "/etc/kes";
|
||
|
|
|
||
|
|
AmbientCapabilities = mkIf (port < 1024) ["CAP_NET_BIND_SERVICE"];
|
||
|
|
LimitNOFILE = 65536;
|
||
|
|
ProtectProc = "invisible";
|
||
|
|
SendSIGKILL = "no";
|
||
|
|
TasksMax = "infinity";
|
||
|
|
TimeoutStopSec = "infinity";
|
||
|
|
} // optionalAttrs (cfg.environmentFile != null) {
|
||
|
|
EnvironmentFile = cfg.environmentFile;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
environment.systemPackages = [ cfg.package ];
|
||
|
|
|
||
|
|
users.groups.kes = { };
|
||
|
|
users.users.kes = {
|
||
|
|
description = "KES user";
|
||
|
|
group = "kes";
|
||
|
|
isSystemUser = true;
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|