1 files changed, 67 insertions, 0 deletions
diff --git a/nix/per-host/s3/configuration.nix b/nix/per-host/s3/configuration.nix
new file mode 100644
index 0000000..7af6d9d
--- /dev/null
+++ b/nix/per-host/s3/configuration.nix
@@ -0,0 +1,67 @@
+{ config, pkgs, modulesPath, lib, system, ... }:
+
+{
+  config = {
+    sops.age.sshKeyPaths = [ "/etc/ssh/ssh_host_ed25519_key" ];
+    sops.defaultSopsFile = ../../secrets/s3.yaml;
+    sops.secrets."garage/rpc-secret" = {
+      owner = "garage";
+      mode = "0400";
+    };
+    sops.secrets."garage/admin-token" = {
+      owner = "garage";
+      mode = "0400";
+    };
+    sops.secrets."garage/env" = { };
+
+    networking.hostName = "s3";
+    networking.firewall.allowedTCPPorts = [ 3900 3902 ];
+
+    users.users.garage = {
+      isSystemUser = true;
+      group = "garage";
+    };
+    users.groups.garage = { };
+
+    systemd.services.garage = {
+      serviceConfig = {
+        DynamicUser = false;
+        User = "garage";
+        Group = "garage";
+      };
+      unitConfig.RequiresMountsFor = "/mnt/data";
+    };
+
+    services.garage = {
+      enable = true;
+      package = pkgs.garage;
+      environmentFile = config.sops.secrets."garage/env".path;
+      settings = {
+        data_dir = "/mnt/data";
+        replication_factor = 1;
+        rpc_bind_addr = "[::]:3901";
+        rpc_secret_file = config.sops.secrets."garage/rpc-secret".path;
+        s3_api = {
+          s3_region = "garage";
+          api_bind_addr = "[::]:3900";
+        };
+        s3_web = {
+          bind_addr = "[::]:3902";
+          root_domain = ".s3web.kumardamani.net";
+          index = "index.html";
+        };
+        admin = {
+          api_bind_addr = "127.0.0.1:3901";
+          admin_token_file = config.sops.secrets."garage/admin-token".path;
+        };
+      };
+    };
+
+    fileSystems = {
+      "/mnt/data" = {
+        device = "nas.bacala:/mnt/tank/customers/lab/s3";
+        fsType = "nfs";
+      };
+    };
+  };
+}