foodogsquared/nixos-config
1
0
Fork 0
mirror of https://github.com/foo-dogsquared/nixos-config.git synced 2025-01-30 22:57:55 +00:00
Code Issues Actions 1 Packages Projects Releases Wiki Activity

hosts/plover: add TLS support for PostgreSQL

Browse Source
This commit is contained in:
Gabriel Arazas 2023-06-22 18:05:54 +08:00
parent 4e23ffa6c4
commit 2688064651
No known key found for this signature in database
GPG Key ID: ADE0C41DAB221FCC
1 changed files with 28 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
hosts/plover/modules/services/postgresql.nix
View File

@ -2,6 +2,9 @@
# (thankfully).
{ config, lib, pkgs, ... }:
let
postgresqlDomain = "postgres.${config.networking.domain}";
in
{
services.postgresql = {
enable = true;
@ -30,9 +33,15 @@
${lib.concatStringsSep "\n" perUserSchemas}
'';
settings = {
settings = let
credsDir = path: "/run/credentials/postgresql.service/${path}";
in {
# Still doing the secure schema usage pattern.
search_path = "\"$user\"";
ssl_cert_file = credsDir "cert.pem";
ssl_key_file = credsDir "key.pem";
ssl_ca_file = credsDir "fullchain.pem";
};
};
@ -45,4 +54,22 @@
# Start at every 3 days starting from the first day of the month.
startAt = "*-*-1/3";
};
# Setting this up for TLS.
systemd.services.postgresql = {
requires = [ "acme-finished-${postgresqlDomain}.target" ];
serviceConfig.LoadCredential = let
certDirectory = config.security.acme.certs."${postgresqlDomain}".directory;
certCredentialPath = path: "${path}:${certDirectory}/${path}";
in
[
(certCredentialPath "cert.pem")
(certCredentialPath "key.pem")
(certCredentialPath "fullchain.pem")
];
};
security.acme.certs."${postgresqlDomain}".reloadServices = [
"postgresql.service"
];
}