121 lines
3.6 KiB
Nix
121 lines
3.6 KiB
Nix
{ config, lib, inputs, ... }:
|
|
let
|
|
minio-secret = {
|
|
owner = "minio";
|
|
mode = "0400";
|
|
sopsFile = inputs.self.secretsDir + /home-hypervisor/minio.yaml;
|
|
restartUnits = [ "minio.service" ];
|
|
};
|
|
kes-secret = {
|
|
owner = "kes";
|
|
mode = "0400";
|
|
sopsFile = inputs.self.secretsDir + /home-hypervisor/minio.yaml;
|
|
restartUnits = [ "kes.service" ];
|
|
};
|
|
in {
|
|
imports = [ inputs.ataraxiasjel-nur.nixosModules.kes ];
|
|
|
|
sops.secrets.minio-credentials = minio-secret;
|
|
sops.secrets.kes-vault-env = kes-secret;
|
|
sops.secrets.kes-key = kes-secret;
|
|
sops.secrets.kes-cert = kes-secret // {
|
|
group = "minio";
|
|
mode = "0440";
|
|
restartUnits = [ "kes.service" "minio.service" ];
|
|
};
|
|
|
|
services.minio = {
|
|
enable = true;
|
|
browser = true;
|
|
configDir = "/media/nas/minio/config";
|
|
dataDir = [ "/media/nas/minio/data" ];
|
|
listenAddress = "127.0.0.1:9600";
|
|
consoleAddress = "127.0.0.1:9601";
|
|
rootCredentialsFile = config.sops.secrets.minio-credentials.path;
|
|
};
|
|
|
|
systemd.services.minio = {
|
|
environment = lib.mkAfter {
|
|
MINIO_SERVER_URL = "https://s3.ataraxiadev.com";
|
|
MINIO_BROWSER_REDIRECT_URL = "https://s3.ataraxiadev.com/ui";
|
|
MINIO_IDENTITY_OPENID_COMMENT = "Authentik";
|
|
MINIO_IDENTITY_OPENID_CONFIG_URL =
|
|
"https://auth.ataraxiadev.com/application/o/minio/.well-known/openid-configuration";
|
|
MINIO_IDENTITY_OPENID_REDIRECT_URI =
|
|
"https://s3.ataraxiadev.com/ui/oauth_callback";
|
|
MINIO_IDENTITY_OPENID_SCOPES = "openid,profile,email,minio";
|
|
# KMS
|
|
MINIO_KMS_KES_ENDPOINT = "https://${config.services.kes.settings.address}";
|
|
MINIO_KMS_KES_CAPATH = config.sops.secrets.kes-cert.path;
|
|
MINIO_KMS_KES_KEY_NAME = "minio-default-key";
|
|
MINIO_KMS_KES_ENCLAVE = "minio-hypervisor";
|
|
};
|
|
};
|
|
systemd.services.minio.after =
|
|
lib.mkIf config.services.authentik.enable [
|
|
"authentik-server.service"
|
|
"authentik-worker.service"
|
|
"nginx.service"
|
|
"kes.service"
|
|
];
|
|
|
|
services.kes = {
|
|
enable = true;
|
|
environmentFile = config.sops.secrets.kes-vault-env.path;
|
|
settings = {
|
|
address = "127.0.0.1:7373";
|
|
admin.identity = "disabled";
|
|
tls = {
|
|
key = config.sops.secrets.kes-key.path;
|
|
cert = config.sops.secrets.kes-cert.path;
|
|
};
|
|
policy.minio = {
|
|
allow = [
|
|
"/v1/key/create/minio-*"
|
|
"/v1/key/generate/minio-*"
|
|
"/v1/key/decrypt/minio-*"
|
|
"/v1/key/bulk/decrypt"
|
|
"/v1/key/list/*"
|
|
"/v1/status"
|
|
"/v1/metrics"
|
|
"/v1/log/audit"
|
|
"/v1/log/errot"
|
|
];
|
|
identities = [
|
|
"d76b126754bd382de969e18ab71c3ba3fe1fdf9bb89927b3f16e08ebae07d242"
|
|
];
|
|
};
|
|
keystore.vault = {
|
|
endpoint = "http://${config.services.vault.address}";
|
|
engine = "kv/";
|
|
version = "v1";
|
|
approle = {
|
|
id = ''''${KES_APPROLE_ID}'';
|
|
secret = ''''${KES_APPROLE_SECRET}'';
|
|
retry = "15s";
|
|
};
|
|
status.ping = "10s";
|
|
};
|
|
};
|
|
};
|
|
systemd.services.kes.after = [ "vault.service" "vault-unseal.service" ];
|
|
|
|
# Sync local minio buckets to remote s3 storage
|
|
sops.secrets.rclone-s3-sync.sopsFile = inputs.self.secretsDir + /rustic.yaml;
|
|
backups.rclone-sync.minio = {
|
|
rcloneConfigFile = config.sops.secrets.rclone-s3-sync.path;
|
|
syncTargets =
|
|
let buckets = [
|
|
"authentik-media"
|
|
# "ocis"
|
|
"outline"
|
|
"obsidian-ataraxia"
|
|
"obsidian-doste"
|
|
"obsidian-kpoxa"
|
|
]; in map (bucket: {
|
|
source = "minio:${bucket}";
|
|
target = "backblaze:ataraxia-minio-${bucket}";
|
|
}) buckets;
|
|
};
|
|
}
|