m3ta-chiron
f1481dc256
- port registry: atrocore = 3058 - oci-container atrocore: Gitea-registry image, 127.0.0.1:3058:80, web network, static ip 10.89.0.16, db alias to host pg, env-file from agenix, named volume for instance data, registry login via token secret - agenix secrets: atrocore-env (ATRO_DB_*) + atrocore-registry-token, age-encrypted to AZ-PRM-1 + user, non-interactive creation - host postgres 17: idempotent atrocore-db-init oneshot (psql peer, secret only at runtime), pg_hba 10.89.0.0/24 scram-sha-256, atrocore in 03:10 backup list - traefik: pim.l.az-gruppe.com -> localhost:3058 (ionos, websecure)
78 lines
2.5 KiB
Nix
78 lines
2.5 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
...
|
|
}: {
|
|
services.postgresql = {
|
|
enable = true;
|
|
enableTCPIP = true;
|
|
package = pkgs.postgresql_17;
|
|
settings = {
|
|
ssl = true;
|
|
ssl_cert_file = config.age.secrets.pg-cert.path;
|
|
ssl_key_file = config.age.secrets.pg-key.path;
|
|
};
|
|
extensions = with pkgs.postgresql17Packages; [
|
|
pgvector
|
|
];
|
|
initialScript = pkgs.writeText "backend-initScript" ''
|
|
CREATE USER baserow WITH ENCRYPTED PASSWORD 'baserow';
|
|
CREATE DATABASE baserow;
|
|
ALTER DATABASE baserow OWNER to baserow;
|
|
|
|
CREATE USER kestra WITH ENCRYPTED PASSWORD 'kestra';
|
|
CREATE DATABASE kestra;
|
|
ALTER DATABASE kestra OWNER to kestra;
|
|
|
|
CREATE USER n8n WITH ENCRYPTED PASSWORD 'n8n';
|
|
CREATE DATABASE n8n;
|
|
ALTER DATABASE n8n OWNER to n8n;
|
|
|
|
CREATE USER vaultwarden WITH ENCRYPTED PASSWORD 'n8n';
|
|
CREATE DATABASE vaultwarden;
|
|
ALTER DATABASE vaultwarden OWNER to vaultwarden;
|
|
|
|
CREATE USER grafana WITH ENCRYPTED PASSWORD 'grafana';
|
|
CREATE DATABASE grafana;
|
|
ALTER DATABASE grafana OWNER to grafana;
|
|
'';
|
|
authentication = pkgs.lib.mkOverride 10 ''
|
|
# Local connections (Unix socket)
|
|
local all postgres peer
|
|
local netbox netbox peer
|
|
local n8n n8n scram-sha-256
|
|
|
|
# Localhost connections (IPv4 and IPv6)
|
|
host all postgres 127.0.0.1/32 scram-sha-256
|
|
host all postgres ::1/128 scram-sha-256
|
|
|
|
host n8n n8n 127.0.0.1/32 scram-sha-256
|
|
host n8n n8n ::1/128 scram-sha-256
|
|
|
|
# Podman network connections
|
|
host baserow baserow 10.89.0.0/24 scram-sha-256
|
|
host kestra kestra 10.89.0.0/24 scram-sha-256
|
|
host atrocore atrocore 10.89.0.0/24 scram-sha-256
|
|
|
|
# Grafana (local socket / localhost only)
|
|
host grafana grafana 127.0.0.1/32 scram-sha-256
|
|
host grafana grafana ::1/128 scram-sha-256
|
|
|
|
# Deny all other connections
|
|
host all all 0.0.0.0/0 reject
|
|
host all all ::/0 reject
|
|
'';
|
|
};
|
|
services.postgresqlBackup = {
|
|
enable = true;
|
|
startAt = "03:10:00";
|
|
databases = ["atrocore" "baserow" "kestra" "n8n" "netbox"];
|
|
};
|
|
networking.firewall = {
|
|
extraCommands = ''
|
|
iptables -A INPUT -p tcp -s 127.0.0.1 --dport 5432 -j ACCEPT
|
|
iptables -A INPUT -p tcp -s 10.89.0.0/24 --dport 5432 -j ACCEPT
|
|
'';
|
|
};
|
|
}
|