dotfiles/nixos/systems/blowhole/consul.nix
magic_rb aff0158ef7
Reformat the whole flake using alejandra
Signed-off-by: magic_rb <magic_rb@redalder.org>
2024-03-02 22:17:03 +01:00

90 lines
2.1 KiB
Nix

{
inputs',
lib,
config,
pkgs,
pkgs-hashicorp,
secret,
...
}: let
inherit
(lib)
singleton
mkForce
;
in {
services.hashicorp.vault-agent = {
settings.template = singleton {
source =
pkgs.writeText "consul.json.vtmpl"
''
{
"encrypt": "{{ with secret "kv/data/homelab-1/blowhole/consul/encryption_key" }}{{ or .Data.data.key "" }}{{ end }}",
"acl": {
"tokens": {
"agent": "{{ with secret "kv/data/homelab-1/blowhole/consul/agent_token" }}{{ or .Data.data.secret "" }}{{ end }}",
"default": "{{ with secret "kv/data/homelab-1/blowhole/consul/anonymous_token" }}{{ or .Data.data.secret "" }}{{ end }}"
}
}
}
'';
destination = "/run/secrets/consul.json";
command = pkgs.writeShellScript "consul-command" ''
sudo systemctl try-reload-or-restart hashicorp-consul.service
'';
};
};
systemd.services."hashicorp-consul" = {
requires = ["vault-unsealed.service"];
after = ["vault-unsealed.service"];
};
services.hashicorp.consul = {
enable = true;
extraSettingsPaths = singleton "/run/secrets/consul.json";
package = pkgs-hashicorp.consul;
settings = {
datacenter = "homelab-1";
data_dir = "/var/lib/consul";
log_level = "INFO";
server = true;
bind_addr = secret.network.ips.blowhole.ip or "";
client_addr = secret.network.ips.blowhole.ip or "";
primary_datacenter = "homelab-1";
acl = {
enabled = true;
default_policy = "deny";
enable_token_persistence = true;
};
ports = {
http = 8500;
grpc = 8502;
};
connect.enabled = true;
ca_file = "/var/secrets/consul-ca.crt";
# cert_file = ""
# key_file = ""
verify_incoming = false;
verify_outgoing = false;
verify_server_hostname = false;
ui_config.enabled = true;
domain = "consul.in.redalder.org";
};
};
systemd.services.hashicorp-consul.serviceConfig = {
LimitNOFILE = mkForce "infinity";
LimitNPROC = mkForce "infinity";
};
}