jan-leila/nix-config
1
0
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fixed postgres config for forgejo

Browse source
This commit is contained in:
Leyla Becker 2025-01-02 17:22:05 -06:00
parent 9ecba48dcf
commit 8f59f8aeca
5 changed files with 55 additions and 52 deletions
Download patch file Download diff file Expand all files Collapse all files

59
modules/nixos-modules/server/postgres.nix
View file

@ -5,38 +5,29 @@
...
}: let
dataDir = "/var/lib/postgresql/15";
adminUsers = lib.lists.filter (user: user.isAdmin) (lib.attrsets.mapAttrsToList (_: user: user) config.host.postgres.extraUsers);
clientUsers = lib.lists.filter (user: user.isClient) (lib.attrsets.mapAttrsToList (_: user: user) config.host.postgres.extraUsers);
in {
options = {
host.postgres = {
enable = lib.mkEnableOption "enable postgres";
extraAdminUsers = lib.mkOption {
type = lib.types.attrsOf lib.types.submodule ({name, ...}: {
extraUsers = lib.mkOption {
type = lib.types.attrsOf (lib.types.submodule ({name, ...}: {
options = {
name = lib.mkOption {
type = lib.types.str;
default = name;
description = ''
What should this users name on the system be
'';
defaultText = lib.literalExpression "config.host.users.\${name}.name";
};
isAdmin = lib.mkOption {
type = lib.types.bool;
default = false;
};
isClient = lib.mkOption {
type = lib.types.bool;
default = false;
};
};
});
default = {};
};
extraDatabaseUsers = lib.mkOption {
type = lib.types.attrsOf lib.types.submodule ({name, ...}: {
options = {
name = lib.mkOption {
type = lib.types.str;
default = name;
description = ''
What should this users name on the system be
'';
defaultText = lib.literalExpression "config.host.users.\${name}.name";
};
};
});
}));
default = {};
};
};
@ -47,18 +38,12 @@ in {
services = {
postgresql = {
enable = true;
ensureUsers =
[
{
name = "postgres";
}
]
+ (lib.attrsets.mapAttrsToList (user: {
name = user.name;
ensureDBOwnership = true;
})
config.host.postgres.extraDatabaseUsers);
ensureDatabases = lib.attrsets.mapAttrsToList (user: user.name) config.host.postgres.extraDatabaseUsers;
package = pkgs.postgresql_15;
ensureUsers = [
{
name = "postgres";
}
];
identMap =
''
# ArbitraryMapName systemUser DBUser
@ -68,14 +53,14 @@ in {
superuser_map postgres postgres
''
+ (
lib.strings.concatLines (lib.attrsets.mapAttrsToList (user: "superuser_map ${user.name} postgres") config.host.postgres.extraAdminUsers)
lib.strings.concatLines (builtins.map (user: "superuser_map ${user.name} postgres") adminUsers)
)
+ ''
# Client Users
''
+ (
lib.strings.concatLines (lib.attrsets.mapAttrsToList (user: "superuser_map ${user.name} ${user.name}") config.host.postgres.extraDatabaseUsers)
lib.strings.concatLines (builtins.map (user: "superuser_map ${user.name} ${user.name}") clientUsers)
);
# configuration here lets users access the db that matches their name and lets user postgres access everything
authentication = pkgs.lib.mkOverride 10 ''
@ -91,7 +76,7 @@ in {
assertions = [
{
assertion = config.services.postgresql.dataDir == dataDir;
description = "postgres data directory does not match persistence";
message = "postgres data directory does not match persistence";
}
];
environment.persistence."/persist/system/root" = {