···
1
+
# TODO: create a common module generator for Taler and Libeufin?
10
+
options.services.libeufin.${libeufinComponent} = {
11
+
enable = lib.mkEnableOption "libeufin core banking system and web interface";
12
+
package = lib.mkPackageOption pkgs "libeufin" { };
13
+
debug = lib.mkEnableOption "debug logging";
14
+
createLocalDatabase = lib.mkEnableOption "automatic creation of a local postgres database";
15
+
openFirewall = lib.mkOption {
16
+
type = lib.types.bool;
18
+
description = "Whether to open ports in the firewall";
24
+
cfg = cfgMain.${libeufinComponent};
25
+
cfgMain = config.services.libeufin;
27
+
configFile = config.environment.etc."libeufin/libeufin.conf".source;
28
+
serviceName = "libeufin-${libeufinComponent}";
29
+
isNexus = libeufinComponent == "nexus";
31
+
# get database name from config
32
+
# TODO: should this always be the same db? In which case, should this be an option directly under `services.libeufin`?
34
+
lib.removePrefix "postgresql:///"
35
+
cfg.settings."libeufin-${libeufinComponent}db-postgres".CONFIG;
37
+
bankPort = cfg.settings."${if isNexus then "nexus-httpd" else "libeufin-bank"}".PORT;
39
+
lib.mkIf cfg.enable {
40
+
services.libeufin.settings = cfg.settings;
42
+
# TODO add system-libeufin.slice?
43
+
systemd.services = {
45
+
"${serviceName}" = {
50
+
args = lib.cli.toGNUCommandLineShell { } {
52
+
L = if cfg.debug then "debug" else null;
55
+
"${lib.getExe' cfg.package "libeufin-${libeufinComponent}"} serve ${args}";
56
+
Restart = "on-failure";
59
+
requires = [ "libeufin-dbinit.service" ];
60
+
after = [ "libeufin-dbinit.service" ];
61
+
wantedBy = [ "multi-user.target" ];
64
+
# Database Initialisation
67
+
dbScript = pkgs.writers.writeText "libeufin-db-permissions.sql" ''
68
+
GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA libeufin_bank TO "${serviceName}";
69
+
GRANT SELECT,INSERT,UPDATE,DELETE ON ALL TABLES IN SCHEMA libeufin_nexus TO "${serviceName}";
70
+
GRANT USAGE ON SCHEMA libeufin_bank TO "${serviceName}";
71
+
GRANT USAGE ON SCHEMA libeufin_nexus TO "${serviceName}";
74
+
# Accounts to be created after the bank database initialization.
76
+
# For example, if the bank's currency conversion is enabled, it's
77
+
# required that the exchange account is registered before the
79
+
initialAccountRegistration = lib.concatMapStringsSep "\n" (
82
+
args = lib.cli.toGNUCommandLineShell { } {
84
+
inherit (account) username password name;
85
+
payto_uri = "payto://x-taler-bank/bank:${toString bankPort}/${account.username}?receiver-name=${account.name}";
86
+
exchange = lib.toLower account.username == "exchange";
89
+
"${lib.getExe' cfg.package "libeufin-bank"} create-account ${args}"
90
+
) cfg.initialAccounts;
92
+
args = lib.cli.toGNUCommandLineShell { } {
94
+
L = if cfg.debug then "debug" else null;
98
+
path = [ config.services.postgresql.package ];
101
+
DynamicUser = true;
102
+
StateDirectory = "libeufin-dbinit";
103
+
StateDirectoryMode = "0750";
106
+
script = lib.optionalString cfg.enable ''
107
+
${lib.getExe' cfg.package "libeufin-${libeufinComponent}"} dbinit ${args}
109
+
# Grant DB permissions after schemas have been created
112
+
psql -U "${dbName}" -f "${dbScript}"
114
+
+ lib.optionalString ((!isNexus) && (cfg.initialAccounts != [ ])) ''
115
+
# only register initial accounts once
116
+
if [ ! -e /var/lib/libeufin-dbinit/init ]; then
117
+
${initialAccountRegistration}
119
+
touch /var/lib/libeufin-dbinit/init
120
+
echo "Bank initialisation complete"
123
+
requires = lib.optionals cfg.createLocalDatabase [ "postgresql.service" ];
124
+
after = [ "network.target" ] ++ lib.optionals cfg.createLocalDatabase [ "postgresql.service" ];
128
+
networking.firewall = lib.mkIf cfg.openFirewall {
129
+
allowedTCPPorts = [
134
+
environment.systemPackages = [ cfg.package ];
136
+
services.postgresql = lib.mkIf cfg.createLocalDatabase {
138
+
ensureDatabases = [ dbName ];
140
+
{ name = serviceName; }
143
+
ensureDBOwnership = true;
151
+
cfg.createLocalDatabase || (cfg.settings."libeufin-${libeufinComponent}db-postgres" ? CONFIG);
152
+
message = "Libeufin ${libeufinComponent} database is not configured.";