blob: 54a8f6ce87ed5f4660954f31d321323c666d7204 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
|
{
options,
lib,
config,
pkgs,
...
}: let
cfg = config.services.deployer;
in {
options.services.deployer = {
enable = lib.mkEnableOption "Enable the deployer mini-PaaS service";
package = lib.mkOption {
type = lib.types.package;
description = "The biz-deployer package to use";
};
manifestPackage = lib.mkOption {
type = lib.types.package;
description = "The deploy-manifest package for CLI operations";
};
interval = lib.mkOption {
type = lib.types.int;
default = 300;
description = "Interval in seconds between reconciliation cycles";
};
stateDir = lib.mkOption {
type = lib.types.path;
default = "/var/lib/biz-deployer";
description = "Directory for deployer state and generated unit files";
};
secretsDir = lib.mkOption {
type = lib.types.path;
default = "/var/lib/biz-secrets";
description = "Directory containing service secret .env files";
};
gcrootsDir = lib.mkOption {
type = lib.types.path;
default = "/nix/var/nix/gcroots/biz";
description = "Directory for GC roots to prevent closure garbage collection";
};
enableCaddy = lib.mkOption {
type = lib.types.bool;
default = true;
description = "Enable Caddy reverse proxy for HTTP services";
};
};
config = lib.mkIf cfg.enable {
# Create required directories
systemd.tmpfiles.rules = [
"d ${cfg.stateDir} 0755 root root -"
"d ${cfg.stateDir}/services 0755 root root -"
"d ${cfg.secretsDir} 0700 root root -"
"d ${cfg.gcrootsDir} 0755 root root -"
];
# The deployer service runs as a timer-triggered oneshot
systemd.services.deployer = {
description = "Mini-PaaS deployment agent";
after = ["network-online.target"];
wants = ["network-online.target"];
path = [cfg.package cfg.manifestPackage pkgs.nix pkgs.awscli2];
serviceConfig = {
Type = "oneshot";
ExecStart = "${cfg.package}/bin/biz-deployer once";
Environment = [
"HOME=/root"
"AWS_SHARED_CREDENTIALS_FILE=/root/.aws/credentials"
];
# Note: Hardening disabled because deployer needs write access to
# /etc/systemd/system, /nix/store, /nix/var, /root/.cache/nix
PrivateTmp = true;
};
};
# Timer to run deployer every N seconds
systemd.timers.deployer = {
description = "Timer for deployer reconciliation";
wantedBy = ["timers.target"];
timerConfig = {
OnBootSec = "1min";
OnUnitActiveSec = "${toString cfg.interval}s";
Unit = "deployer.service";
};
};
# Caddy reverse proxy for deployed services (optional)
# TODO: Generate this dynamically from manifest in the future
services.caddy = lib.mkIf cfg.enableCaddy {
enable = true;
globalConfig = ''
admin localhost:2019
'';
virtualHosts."podcastitlater.bensima.com".extraConfig = ''
reverse_proxy localhost:8000
'';
};
# Open firewall for HTTP/HTTPS (only if Caddy enabled)
networking.firewall.allowedTCPPorts = lib.mkIf cfg.enableCaddy [80 443];
};
}
|
