91 lines
3.7 KiB
Nix
91 lines
3.7 KiB
Nix
{config, ...}: let
|
|
sandboxApiPort = config.m3ta.ports.get "n8n-sandbox-api";
|
|
tlsDir = "/var/lib/n8n-sandbox/tls";
|
|
apiImage = "ghcr.io/n8n-io/n8n-sandbox-service-api:1.2.0";
|
|
runnerImage = "ghcr.io/n8n-io/n8n-sandbox-service-runner-dind:1.2.0";
|
|
sandboxImage = "ghcr.io/n8n-io/n8n-sandbox-service-sandbox:latest";
|
|
in {
|
|
virtualisation.oci-containers.containers = {
|
|
sandbox-api = {
|
|
image = apiImage;
|
|
environmentFiles = [config.age.secrets.n8n-sandbox-env.path];
|
|
environment = {
|
|
SANDBOX_API_GRPC_TLS_CERT_FILE = "/tls/api/grpc-server.crt";
|
|
SANDBOX_API_GRPC_TLS_KEY_FILE = "/tls/api/grpc-server.key";
|
|
SANDBOX_API_GRPC_TLS_CLIENT_CA_FILE = "/tls/api/ca.crt";
|
|
SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_CA_FILE = "/tls/api/ca.crt";
|
|
SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_CERT_FILE = "/tls/api/control-grpc-api-client.crt";
|
|
SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_KEY_FILE = "/tls/api/control-grpc-api-client.key";
|
|
SANDBOX_API_RUNNER_CONTROL_GRPC_TLS_SERVER_NAME = "sandbox-runner-1";
|
|
};
|
|
volumes = ["${tlsDir}:/tls:ro"];
|
|
ports = ["127.0.0.1:${toString sandboxApiPort}:8080"];
|
|
extraOptions = ["--network=n8n-sandbox"];
|
|
};
|
|
|
|
sandbox-runner-1 = {
|
|
image = runnerImage;
|
|
environmentFiles = [config.age.secrets.n8n-sandbox-env.path];
|
|
environment = {
|
|
SANDBOX_RUNNER_API_GRPC_ADDR = "sandbox-api:9090";
|
|
SANDBOX_RUNNER_HTTP_BASE_URL = "http://sandbox-runner-1:8080";
|
|
SANDBOX_RUNNER_CONTROL_GRPC_LISTEN_ADDR = ":9091";
|
|
SANDBOX_RUNNER_CONTROL_GRPC_ADVERTISE_ADDR = "sandbox-runner-1:9091";
|
|
SANDBOX_RUNNER_ID = "runner-1";
|
|
SANDBOX_RUNNER_DOCKER_SANDBOX_IMAGE = sandboxImage;
|
|
SANDBOX_RUNNER_REGISTRATION_GRPC_CA_FILE = "/tls/runner/ca.crt";
|
|
SANDBOX_RUNNER_REGISTRATION_GRPC_CERT_FILE = "/tls/runner/grpc-client.crt";
|
|
SANDBOX_RUNNER_REGISTRATION_GRPC_KEY_FILE = "/tls/runner/grpc-client.key";
|
|
SANDBOX_RUNNER_REGISTRATION_GRPC_SERVER_NAME = "sandbox-api";
|
|
SANDBOX_RUNNER_CONTROL_GRPC_TLS_CERT_FILE = "/tls/runner/control-grpc-server.crt";
|
|
SANDBOX_RUNNER_CONTROL_GRPC_TLS_KEY_FILE = "/tls/runner/control-grpc-server.key";
|
|
SANDBOX_RUNNER_CONTROL_GRPC_TLS_CLIENT_CA_FILE = "/tls/runner/ca.crt";
|
|
};
|
|
volumes = ["${tlsDir}:/tls:ro"];
|
|
dependsOn = ["sandbox-api"];
|
|
extraOptions = ["--network=n8n-sandbox" "--privileged"];
|
|
};
|
|
};
|
|
|
|
systemd.services.n8n-sandbox-certs = {
|
|
description = "n8n sandbox: mTLS certificate bootstrap";
|
|
wantedBy = ["multi-user.target"];
|
|
after = ["network-online.target"];
|
|
wants = ["network-online.target"];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
ConditionPathExists = "!${tlsDir}/ca.crt";
|
|
};
|
|
path = [config.virtualisation.podman.package];
|
|
preStart = ''
|
|
mkdir -p ${tlsDir}
|
|
'';
|
|
script = ''
|
|
podman run --rm \
|
|
--name n8n-sandbox-certs \
|
|
--user 0:0 \
|
|
-e NUM_RUNNERS=1 \
|
|
-v ${tlsDir}:/tls \
|
|
--entrypoint sh \
|
|
${apiImage} \
|
|
-c 'bootstrap-mtls.sh --out-dir /tls --api-san sandbox-api --control-san-prefix sandbox-runner --world-readable && chown -R sandbox-api:sandbox-api /tls/api && chmod -R a+rX /tls'
|
|
'';
|
|
};
|
|
|
|
systemd.services."podman-sandbox-api" = {
|
|
after = ["n8n-sandbox-certs.service"];
|
|
requires = ["n8n-sandbox-certs.service"];
|
|
preStart = ''
|
|
${config.virtualisation.podman.package}/bin/podman rm -f sandbox-api 2>/dev/null || true
|
|
'';
|
|
};
|
|
systemd.services."podman-sandbox-runner-1" = {
|
|
after = ["n8n-sandbox-certs.service"];
|
|
requires = ["n8n-sandbox-certs.service"];
|
|
preStart = ''
|
|
${config.virtualisation.podman.package}/bin/podman rm -f sandbox-runner-1 2>/dev/null || true
|
|
'';
|
|
};
|
|
}
|