Something went wrong. Try again.
What happens if I push all of nixpkgs
Something went wrong. Try again.
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247{ config, lib, options, pkgs, ...}:let cfg = config.services.etcd; opt = options.services.etcd;
in{
options.services.etcd = { enable = lib.mkOption { description = "Whether to enable etcd."; default = false; type = lib.types.bool; };
package = lib.mkPackageOption pkgs "etcd" { };
name = lib.mkOption { description = "Etcd unique node name."; default = config.networking.hostName; defaultText = lib.literalExpression "config.networking.hostName"; type = lib.types.str; };
advertiseClientUrls = lib.mkOption { description = "Etcd list of this member's client URLs to advertise to the rest of the cluster."; default = cfg.listenClientUrls; defaultText = lib.literalExpression "config.${opt.listenClientUrls}"; type = lib.types.listOf lib.types.str; };
listenClientUrls = lib.mkOption { description = "Etcd list of URLs to listen on for client traffic."; default = [ "http://127.0.0.1:2379" ]; type = lib.types.listOf lib.types.str; };
listenPeerUrls = lib.mkOption { description = "Etcd list of URLs to listen on for peer traffic."; default = [ "http://127.0.0.1:2380" ]; type = lib.types.listOf lib.types.str; };
initialAdvertisePeerUrls = lib.mkOption { description = "Etcd list of this member's peer URLs to advertise to rest of the cluster."; default = cfg.listenPeerUrls; defaultText = lib.literalExpression "config.${opt.listenPeerUrls}"; type = lib.types.listOf lib.types.str; };
initialCluster = lib.mkOption { description = "Etcd initial cluster configuration for bootstrapping."; default = [ "${cfg.name}=http://127.0.0.1:2380" ]; defaultText = lib.literalExpression ''["''${config.${opt.name}}=http://127.0.0.1:2380"]''; type = lib.types.listOf lib.types.str; };
initialClusterState = lib.mkOption { description = "Etcd initial cluster configuration for bootstrapping."; default = "new"; type = lib.types.enum [ "new" "existing" ]; };
initialClusterToken = lib.mkOption { description = "Etcd initial cluster token for etcd cluster during bootstrap."; default = "etcd-cluster"; type = lib.types.str; };
discovery = lib.mkOption { description = "Etcd discovery url"; default = ""; type = lib.types.str; };
clientCertAuth = lib.mkOption { description = "Whether to use certs for client authentication"; default = false; type = lib.types.bool; };
trustedCaFile = lib.mkOption { description = "Certificate authority file to use for clients"; default = null; type = lib.types.nullOr lib.types.path; };
certFile = lib.mkOption { description = "Cert file to use for clients"; default = null; type = lib.types.nullOr lib.types.path; };
keyFile = lib.mkOption { description = "Key file to use for clients"; default = null; type = lib.types.nullOr lib.types.path; };
openFirewall = lib.mkOption { type = lib.types.bool; default = false; description = '' Open etcd ports in the firewall. Ports opened: - 2379/tcp for client requests - 2380/tcp for peer communication ''; };
peerCertFile = lib.mkOption { description = "Cert file to use for peer to peer communication"; default = cfg.certFile; defaultText = lib.literalExpression "config.${opt.certFile}"; type = lib.types.nullOr lib.types.path; };
peerKeyFile = lib.mkOption { description = "Key file to use for peer to peer communication"; default = cfg.keyFile; defaultText = lib.literalExpression "config.${opt.keyFile}"; type = lib.types.nullOr lib.types.path; };
peerTrustedCaFile = lib.mkOption { description = "Certificate authority file to use for peer to peer communication"; default = cfg.trustedCaFile; defaultText = lib.literalExpression "config.${opt.trustedCaFile}"; type = lib.types.nullOr lib.types.path; };
peerClientCertAuth = lib.mkOption { description = "Whether to check all incoming peer requests from the cluster for valid client certificates signed by the supplied CA"; default = false; type = lib.types.bool; };
extraConf = lib.mkOption { description = '' Etcd extra configuration. See <https://github.com/coreos/etcd/blob/master/Documentation/op-guide/configuration.md#configuration-flags> ''; type = lib.types.attrsOf lib.types.str; default = { }; example = lib.literalExpression '' { "CORS" = "*"; "NAME" = "default-name"; "MAX_RESULT_BUFFER" = "1024"; "MAX_CLUSTER_SIZE" = "9"; "MAX_RETRY_ATTEMPTS" = "3"; } ''; };
dataDir = lib.mkOption { type = lib.types.path; default = "/var/lib/etcd"; description = "Etcd data directory."; }; };
config = lib.mkIf cfg.enable { systemd.tmpfiles.settings."10-etcd".${cfg.dataDir}.d = { user = "etcd"; mode = "0700"; };
systemd.services.etcd = { description = "etcd key-value store"; wantedBy = [ "multi-user.target" ]; after = [ "network-online.target" ] ++ lib.optional config.networking.firewall.enable "firewall.service"; wants = [ "network-online.target" ] ++ lib.optional config.networking.firewall.enable "firewall.service";
environment = (lib.filterAttrs (n: v: v != null) { ETCD_NAME = cfg.name; ETCD_DISCOVERY = cfg.discovery; ETCD_DATA_DIR = cfg.dataDir; ETCD_ADVERTISE_CLIENT_URLS = lib.concatStringsSep "," cfg.advertiseClientUrls; ETCD_LISTEN_CLIENT_URLS = lib.concatStringsSep "," cfg.listenClientUrls; ETCD_LISTEN_PEER_URLS = lib.concatStringsSep "," cfg.listenPeerUrls; ETCD_INITIAL_ADVERTISE_PEER_URLS = lib.concatStringsSep "," cfg.initialAdvertisePeerUrls; ETCD_PEER_CLIENT_CERT_AUTH = toString cfg.peerClientCertAuth; ETCD_PEER_TRUSTED_CA_FILE = cfg.peerTrustedCaFile; ETCD_PEER_CERT_FILE = cfg.peerCertFile; ETCD_PEER_KEY_FILE = cfg.peerKeyFile; ETCD_CLIENT_CERT_AUTH = toString cfg.clientCertAuth; ETCD_TRUSTED_CA_FILE = cfg.trustedCaFile; ETCD_CERT_FILE = cfg.certFile; ETCD_KEY_FILE = cfg.keyFile; }) // (lib.optionalAttrs (cfg.discovery == "") { ETCD_INITIAL_CLUSTER = lib.concatStringsSep "," cfg.initialCluster; ETCD_INITIAL_CLUSTER_STATE = cfg.initialClusterState; ETCD_INITIAL_CLUSTER_TOKEN = cfg.initialClusterToken; }) // (lib.mapAttrs' (n: v: lib.nameValuePair "ETCD_${n}" v) cfg.extraConf);
unitConfig = { Documentation = "https://github.com/coreos/etcd"; };
serviceConfig = { Type = "notify"; Restart = "always"; RestartSec = "30s"; ExecStart = "${cfg.package}/bin/etcd"; User = "etcd"; LimitNOFILE = 40000; }; };
environment.systemPackages = [ cfg.package ];
networking.firewall = lib.mkIf cfg.openFirewall { allowedTCPPorts = [ 2379 # for client requests 2380 # for peer communication ]; };
users.users.etcd = { isSystemUser = true; group = "etcd"; description = "Etcd daemon user"; home = cfg.dataDir; }; users.groups.etcd = { }; };}