host(renko, koumakan): move minio

Changed files
+40 -57
creds
sops
koumakan
renko
systems
koumakan
services
proxies
renko
+6 -3
creds/sops/koumakan/default.yaml
···
s3:
access_key: ENC[AES256_GCM,data:dwV+xA+2MYAizNMuHZptqDFv62s=,iv:MDmcEGAA3gdhDBA4ie4A5nlBwJElek/7qSvzFrGP9FI=,tag:pDIU8LTNagJrVwPw700XQQ==,type:str]
access_secret: ENC[AES256_GCM,data:ID9NA21++yUNmF/UGWudyxXuZXbMPfViGnariYe8H06aKZias9OK2A==,iv:PMXdLwkz+JpBJ0ZrVwaUdcqDxew/+Yv9AbVrX1EUfWE=,tag:4puu4oyZVGdfvaZpkdKFFQ==,type:str]
+
minio:
+
root_user: ENC[AES256_GCM,data:q+w4FgnCA2QxWsxM,iv:NojzSMmZ2yq7VyPn7fOYauLpgMOE0NGCyTUQ6slGN2Q=,tag:5FfjO4KH8XfLuymxDgV2iA==,type:str]
+
root_pass: ENC[AES256_GCM,data:oh/VQDU1dR9YLribrhZeVJxMoY9/7Ri8bloM650j6Ut/vHF6BB4NYY94RngkBYRVkHplF9oKx+Ey13kMyIPvC+EvPczoWKCHJ4pJqq3GgWigFp7ufUDdvY4hBjW7SU7fk0wYOjZYH2JlLqjmU0MsVKSqt66Rq9Si0MU7VACNrJzYDe6KbCbL/YT3DmTvBpPR6ysLCE525rH7Tg2LVyn775Si+vo+KGC5gqGMlw==,iv:8pbJMeuDIcvkI8Uda30i8ote/PRUSSAmaua22gQmbHc=,tag:6hNvVytKXbjrKZMKkQ5pEA==,type:str]
sops:
age:
- recipient: age1l3qxt6630dzesdclfm3eqgw3uuhwj09dh6typwlwr6clcv0qhfrqgtj2fk
···
QUlVNExmVGd2QXJwVmRGa0JvMmtocEUK7Zo0Mtj3oZm5Etp61cGbLs+2XP97pjR6
rtfHnuxceJj0+yBugfwgFD1TGJ+6M7z5YCwTx+GAvbPDrmSm2TGrwg==
-----END AGE ENCRYPTED FILE-----
-
lastmodified: "2025-04-07T08:00:02Z"
-
mac: ENC[AES256_GCM,data:q0y16grUnIP1EteFS0UrAQN77U6IM00ADbTMoPZek2gklsc9EQnRMfne1sRFfAxxVB9lWRVrmIfWFAZ9SdyQs/sGPrbbzqNT1gGggvgCTcATNUprybMnno4iUDhWjn2B2d6sM4Y9HdcDEKuEnz9JjvVfOQyd95uvMjA8rBAt7rE=,iv:yT9icU+kQUUdBtmLnCQIfk5xSqHfsr1y2XZxIgCqtxY=,tag:bqxuI/KSmnLWODsB6830CQ==,type:str]
+
lastmodified: "2025-05-10T16:10:38Z"
+
mac: ENC[AES256_GCM,data:HZAsp6PS6k8Boz95d4zU+14fY2KEpVXIcLRkQXFiXYaaA3lN1i7onh4E5tjcDLFGD7qHOzDjlgRVkNwxpCjKg4LB587eJG1umviClFvZOf/vbkF+fSn2dtwUFRgW5SRIHRsMJ0NL6N+uKM51qWmjAoLxvUMbl/A5zeh0TJeMdEs=,iv:yPZGnF7C6fYImugWMhOpd88nTmBCI+0e128Ssz8oB34=,tag:cJN7BmmgRvEHKu8CDfLwVw==,type:str]
unencrypted_suffix: _unencrypted
-
version: 3.10.0
+
version: 3.10.2
+3 -11
creds/sops/renko/default.yaml
···
vmetrics:
auth: ENC[AES256_GCM,data:oxbj18DlfPJ+PEdIj6YEdF66ZZNar1l9Mak0Bmqu2AOZWlhCo2aRlrcGfvs7mORplvQmcfh5MwjTqGExjQX4ke28SZ7pszoLMGM3XR2BdedPNsO0KcI/zV19dAL1wijBr1c2qqDJGqqO1P0UzLaUbonl9bskG8L9+lB2pr8aU7z1Unejd/Qq2Ae/3x9Ku82deeP5jGWJkeUae9wADEsBPdbqRbv1bpW5zzmc2A==,iv:x65jPFbodvp3/v09OJ0BIgxMUFOLBkpiKRVMoB8seP4=,tag:wz5UVNBJoSl2994GYjVgpA==,type:str]
minio_token: ENC[AES256_GCM,data:2joZcYZKcPv7jAlFP+r2xr1840Nv62vWjgE+VvkaIoYlA0Pjg4HWp8qZyEjeJTIOBvmS91RDgooZ7aOmXtZL7venWeMiMyR8k/58+uic3aNg+u5hen461qfYnseQa5bNv2zxXAMVpJG/cAVbnDAk5L1XIX5+GOnGCHC1BXH+xoyp+5ue3DGKeCitJgDBiuEfg68/UiJnQXGAjFe7ZzZX5NTSeb0ktBkxSKHT/Zk7pfoVjY+nzd0he2LVaLKu/qzmSMs3eew2pCHL2BHX7VmF7fDlDfg=,iv:akHyfu47u5luyfzfyFBrkMVmuw+S89LI0wVKNbbHOnQ=,tag:FFVBVNoY3h42c6fUL/v7oQ==,type:str]
-
minio:
-
root_user: ENC[AES256_GCM,data:yOb0rhdGKjvFe1vX,iv:cKpsXvA660YL0+ut6cOOmXunFhserBOJslVehITNyog=,tag:7Ak5YnVxlGl7bacFWuoyyg==,type:str]
-
root_pass: ENC[AES256_GCM,data:WR1nmwMZSKyiB+hG9zsYeDIlwLU5evSplS+F8hWnK/F8OdlrUgdgpAr6hHSHNv7k82cOtycKRUq0JlhKFVzQTcjvvGOPt5ftg1lteGJ+Nc0MYm5MHs+jfh3G5M+/9w7wnWgi6pYjWSjGKBPL0pIdR/bTYkzNbPGrYOIqhUjeaKYOXJTF77OypJAkCGijeKcTLkrf0j+5My1k4GiVHWbo09o9EryiJT+YuDdoBw==,iv:wWIk7CuOeN0V1qrICoKNGuXZdbXmK0niFFQvgJJdKNw=,tag:7KS2x+/qkqy5y4LqWNIsVw==,type:str]
sops:
-
kms: []
-
gcp_kms: []
-
azure_kv: []
-
hc_vault: []
age:
- recipient: age1l3qxt6630dzesdclfm3eqgw3uuhwj09dh6typwlwr6clcv0qhfrqgtj2fk
enc: |
···
S2duS3ZmMVZJYW9HOERMc1FadlZIekEKaXDFW+Szv9WlqQMIr6Mc5qYlMyt8M19u
DmMZu5Mzl2bLQK5LQvT/iLktWZZidYKfOuP73HpAFf8iIhYXBOLKMQ==
-----END AGE ENCRYPTED FILE-----
-
lastmodified: "2025-03-25T02:16:32Z"
-
mac: ENC[AES256_GCM,data:gpy2VdrwuRrcv00wdB5JTxwMelOmoj00Uim754mqGHUMHNpf85e3UJPH5YxzKcchzx1ArV6T1k+US5BwVpuiTJiUwqeusugg7iuzzz1+NNkNC4lQbVsH439a+r6tvNL53VOVu2eLYZLcKJAJOpcSnQ/QjBhqiP1+0hqjXfnz1MY=,iv:a8eSM2QVT75RHu5aw40IrG4pOYvkoSfm5KMlNLwaKCc=,tag:OQ4jpDQFzyDDtb7uzNMc4w==,type:str]
-
pgp: []
+
lastmodified: "2025-05-10T16:10:22Z"
+
mac: ENC[AES256_GCM,data:PoMbrYVUes8rLfPFnSmFLRSSYieIqe/A7vvNoaKiGah5B6JANkGSI33r/4cJJ+I6k0PXgg3fKJ10c4iA36PlJrp8Jn0KljJbhAQjYtjQEmmvjZ6YMkL26R/I5m9FlqzZwCxv4pMmB7Npzo3LDa4plVdYEVHlQHGS8jFGr3miqJI=,iv:9hV4cacbPFu6HEXHogg/WL9o5rIIENisSVdTq9fpvkU=,tag:0PgsrN6eVQK3lxQqy5yLfw==,type:str]
unencrypted_suffix: _unencrypted
-
version: 3.9.4
+
version: 3.10.2
+31 -1
systems/koumakan/services/proxies/minio.nix
···
{
_utils,
+
config,
inputs,
...
}:
+
let
+
secrets = _utils.setupSecrets config {
+
namespace = "minio";
+
secrets = [
+
"root_user"
+
"root_pass"
+
];
+
};
+
in
{
+
imports = [
+
secrets.generate
+
(secrets.mkTemplate "minio.env" ''
+
MINIO_ROOT_USER=${secrets.placeholder "root_user"}
+
MINIO_ROOT_PASSWORD=${secrets.placeholder "root_pass"}
+
'')
+
];
+
+
services.minio = {
+
enable = true;
+
region = "ap-east-1";
+
listenAddress = "127.0.0.1:26531";
+
rootCredentialsFile = secrets.getTemplate "minio.env";
+
};
+
+
# stupid module design
+
systemd.services.minio.environment = {
+
MINIO_BROWSER_REDIRECT_URL = "https://s3.soopy.moe/_static";
+
MINIO_BROWSER_LOGIN_ANIMATION = "false";
+
};
+
services.nginx.virtualHosts = {
"s3.soopy.moe" = _utils.mkSimpleProxy {
-
host = "renko.mist-nessie.ts.net";
port = 26531;
extraConfig = {
extraConfig = ''
-5
systems/renko/hardware-configuration.nix
···
fsType = "btrfs";
};
-
fileSystems."/var/lib/minio/data" = {
-
label = "MINIO0";
-
fsType = "xfs";
-
};
-
boot.initrd.luks.devices."gock".device = "/dev/disk/by-uuid/9d57daa1-f152-443d-992c-b58cbfa57ec1";
fileSystems."/efi" = {
-1
systems/renko/services/default.nix
···
{
imports = [
./vmagent.nix
-
./minio.nix
];
}
-36
systems/renko/services/minio.nix
···
-
{
-
_utils,
-
config,
-
...
-
}:
-
let
-
secrets = _utils.setupSecrets config {
-
namespace = "minio";
-
secrets = [
-
"root_user"
-
"root_pass"
-
];
-
};
-
in
-
{
-
imports = [
-
secrets.generate
-
(secrets.mkTemplate "minio.env" ''
-
MINIO_ROOT_USER=${secrets.placeholder "root_user"}
-
MINIO_ROOT_PASSWORD=${secrets.placeholder "root_pass"}
-
'')
-
];
-
-
services.minio = {
-
enable = true;
-
region = "ap-east-1";
-
listenAddress = ":26531"; # will be proxied by koumakan
-
rootCredentialsFile = secrets.getTemplate "minio.env";
-
};
-
-
# stupid module design
-
systemd.services.minio.environment = {
-
MINIO_BROWSER_REDIRECT_URL = "https://s3.soopy.moe/_static";
-
MINIO_BROWSER_LOGIN_ANIMATION = "false";
-
};
-
}