nix

commit 1e63968049606ffb086d9503159cf68463084793
parent 78cfbb69124b56a4a5d273aeede2956cad2ae1f4
Author: mtmn <miro@haravara.org>
Date:   Thu,  9 Apr 2026 17:16:55 +0200

flake.nix hosts/nixaran/configuration.nix modules/services/attic.nix secrets.nix

Diffstat:
M
flake.nix
 | 
1
+
M
hosts/nixaran/configuration.nix
 | 
0

A
modules/services/attic.nix
 | 
73
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
M
secrets.nix
 | 
1
+

4 files changed, 75 insertions(+), 0 deletions(-)
diff --git a/flake.nix b/flake.nix
@@ -167,6 +167,7 @@
       headscale = import ./modules/services/headscale.nix;
       searxng = import ./modules/services/searxng.nix;
       harmonia = import ./modules/services/harmonia.nix;
+      attic = import ./modules/services/attic.nix;
       static = import ./modules/services/static.nix;
     };
 
diff --git a/hosts/nixaran/configuration.nix b/hosts/nixaran/configuration.nix
Binary files differ.
diff --git a/modules/services/attic.nix b/modules/services/attic.nix
@@ -0,0 +1,73 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.services.haravara.attic;
+in {
+  options.services.haravara.attic = {
+    enable = lib.mkEnableOption "Attic Nix binary cache";
+    domain = lib.mkOption {
+      type = lib.types.str;
+      description = "Domain name for the Attic server";
+    };
+    s3Endpoint = lib.mkOption {
+      type = lib.types.str;
+      default = "https://estri.saatana.cat";
+      description = "S3 endpoint for Attic";
+    };
+    s3Bucket = lib.mkOption {
+      type = lib.types.str;
+      default = "attic";
+      description = "S3 bucket name for Attic";
+    };
+    s3Region = lib.mkOption {
+      type = lib.types.str;
+      default = "us-east-1";
+      description = "S3 region for Attic";
+    };
+    credentialsFile = lib.mkOption {
+      type = lib.types.path;
+      description = "Path to environment file with ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64 and AWS credentials";
+    };
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8081;
+      description = "Port for Attic to listen on";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.attic-server = {
+      enable = true;
+      package = pkgs.attic-server;
+      settings = {
+        listen = "127.0.0.1:${toString cfg.port}";
+        storage = {
+          type = "s3";
+          bucket = cfg.s3Bucket;
+          endpoint = cfg.s3Endpoint;
+          region = cfg.s3Region;
+        };
+        database.url = "postgres:///attic_server?host=/run/postgresql";
+      };
+      environmentFile = cfg.credentialsFile;
+    };
+
+    services.postgresql = {
+      enable = true;
+      ensureDatabases = ["attic_server"];
+      ensureUsers = [
+        {
+          name = "attic-server";
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
+      reverse_proxy 127.0.0.1:${toString cfg.port}
+    '';
+  };
+}
diff --git a/secrets.nix b/secrets.nix
@@ -12,4 +12,5 @@ in {
   "secrets/couchdb-admin-pass.age".publicKeys = allKeys;
   "secrets/searx-secret-key.age".publicKeys = allKeys;
   "secrets/headscale-api-key.age".publicKeys = allKeys;
+  "secrets/attic-credentials.age".publicKeys = allKeys;
 }