move

nix/modules/garage/README.md

@@ -0,0 +1,34 @@
+# garage
+
+## layout
+
+- co-ka -> Contabo Karlsruhe
+- co-du -> Contabo Düsseldorf
+- he-nu -> Hetzner Nürnberg
+
+## buckets
+
+- `caddy-store`: Store for Caddy webservers
+    - key `caddy` RW
+- `docker-registry`
+    - key `docker-registry` RW
+- `loki`
+    - key `loki` RW
+- `backups`
+    - key `backups` RW
+- `forgejo`
+    - key `forgejo` RW
+- `files.noratrieb.dev`
+    - key `upload-files` RW
+
+## keys
+
+- `caddy`: `GK25e33d4ba20d54231e513b80`
+- `docker-registry`: `GK48011ee5b5ccbaf4233c0e40`
+- `loki`: `GK84ffae2a0728abff0f96667b`
+- `backups`: `GK8cb8454a6f650326562bff2f`
+- `forgejo`: `GKc8bfd905eb7f85980ffe84c9`
+- `upload-files`: `GK607464882f6e29fb31e0f553`
+
+- `admin`: `GKaead6cf5340e54a4a19d9490`
+    - RW permissions on ~every bucket

nix/modules/garage/default.nix

@@ -0,0 +1,49 @@
+{ config, pkgs, name, ... }: {
+  age.secrets.garage_secrets.file = ../../secrets/garage_secrets.age;
+
+  environment.systemPackages = with pkgs; [
+    minio-client
+  ];
+
+  networking.firewall.interfaces.wg0.allowedTCPPorts = [
+    3901 # RPC
+    3903 # admin for metrics
+  ];
+
+  services.garage = {
+    enable = true;
+    package = pkgs.garage_1_1_0;
+    settings = {
+      metadata_dir = "/var/lib/garage/meta";
+      data_dir = "/var/lib/garage/data";
+      db_engine = "sqlite";
+      metadata_auto_snapshot_interval = "6h";
+
+      replication_factor = 3;
+
+      # arbitrary, but a bit higher as disk space matters more than time. she says, cluelessly.
+      compression-level = 5;
+
+      rpc_bind_addr = "[::]:3901";
+      rpc_public_addr = "${name}.local:3901";
+
+      s3_api = {
+        s3_region = "garage";
+        api_bind_addr = "[::]:3900";
+        root_domain = ".s3.garage.localhost";
+      };
+
+      s3_web = {
+        bind_addr = "[::]:3902";
+        root_domain = ".web.garage.localhost";
+        index = "index.html";
+      };
+
+      admin = {
+        api_bind_addr = "[::]:3903";
+      };
+    };
+    environmentFile = config.age.secrets.garage_secrets.path;
+  };
+}
+