76 lines
1.9 KiB
Nix
76 lines
1.9 KiB
Nix
|
{ config, pkgs, lib, flat_hosts, ... }:
|
||
|
with lib;
|
||
|
let
|
||
|
cfg = config.services.v.vault;
|
||
|
hostIP = config.deployment.targetHost;
|
||
|
|
||
|
vault_hosts =
|
||
|
filter ({ tags ? [ ], ip ? "", ... }: (elem "vault" tags) && (ip != hostIP))
|
||
|
flat_hosts;
|
||
|
cluster_config = concatStrings (map ({ ip, ... }: ''
|
||
|
retry_join {
|
||
|
leader_api_addr = "http://${ip}:${toString cfg.port}"
|
||
|
}
|
||
|
'') vault_hosts);
|
||
|
in {
|
||
|
options.services.v.vault = {
|
||
|
enable = mkEnableOption "v.vault";
|
||
|
|
||
|
node_id = mkOption {
|
||
|
type = types.str;
|
||
|
description = ''
|
||
|
The cluster node id of this node
|
||
|
'';
|
||
|
};
|
||
|
|
||
|
openFirewall = mkOption {
|
||
|
type = types.bool;
|
||
|
default = false;
|
||
|
description = ''
|
||
|
Whether to open port port and clusterPort in the firewall for vault
|
||
|
'';
|
||
|
};
|
||
|
|
||
|
port = mkOption {
|
||
|
type = types.int;
|
||
|
default = 8200;
|
||
|
description = ''
|
||
|
The port vault listens on
|
||
|
**note:** this has to be the same for all nodes in a cluster
|
||
|
'';
|
||
|
};
|
||
|
|
||
|
clusterPort = mkOption {
|
||
|
type = types.int;
|
||
|
default = 8201;
|
||
|
description = ''
|
||
|
The cluster port vault listens on
|
||
|
**note:** this has to be the same for all nodes in a cluster
|
||
|
'';
|
||
|
};
|
||
|
};
|
||
|
|
||
|
config = mkIf cfg.enable {
|
||
|
networking.firewall.allowedTCPPorts =
|
||
|
mkIf cfg.openFirewall [ cfg.port cfg.clusterPort ];
|
||
|
|
||
|
services.vault = {
|
||
|
enable = true;
|
||
|
# bin version includes the UI
|
||
|
package = pkgs.vault-bin;
|
||
|
address = "0.0.0.0:${toString cfg.port}";
|
||
|
storageBackend = "raft";
|
||
|
storagePath = "/var/lib/vault-raft";
|
||
|
storageConfig = ''
|
||
|
node_id = "${cfg.node_id}"
|
||
|
'' + cluster_config;
|
||
|
extraConfig = ''
|
||
|
ui = true
|
||
|
disable_mlock = true
|
||
|
api_addr = "http://${hostIP}:${toString cfg.port}"
|
||
|
cluster_addr = "http://${hostIP}:${toString cfg.clusterPort}"
|
||
|
'';
|
||
|
};
|
||
|
};
|
||
|
}
|