From 5deba06fb014ad2c20ba25774b8c7a530a740535 Mon Sep 17 00:00:00 2001 From: Ivan Malison Date: Mon, 7 Oct 2024 15:00:14 -0600 Subject: [PATCH] [NixOS] Trying to mount bucket --- nixos/k3s.nix | 36 ++++++++++++++++-- .../secrets/api_service_account_key.json.age | Bin 4262 -> 4926 bytes 2 files changed, 33 insertions(+), 3 deletions(-) diff --git a/nixos/k3s.nix b/nixos/k3s.nix index d13475ed..7c614795 100644 --- a/nixos/k3s.nix +++ b/nixos/k3s.nix @@ -1,6 +1,13 @@ -{ pkgs, config, lib, ... }: -with lib; -let cfg = config.myModules.railbird-k3s; +{ + pkgs, + config, + lib, + ... +}: +with lib; let + cfg = config.myModules.railbird-k3s; + mount-path = "/var/lib/railbird/bucket"; + bucket-name = "railbird-dev-videos"; in { options = { myModules.railbird-k3s = { @@ -14,6 +21,11 @@ in { config = mkIf cfg.enable { age.secrets."1896Folsom-k3s-token.age".file = ./secrets/1896Folsom-k3s-token.age; age.secrets."k3s-registry.yaml.age".file = ./secrets/k3s-registry.yaml.age; + age.secrets.api-service-key = { + file = ./secrets/api_service_account_key.json.age; + owner = "railbird"; + group = "users"; + }; environment.etc."rancher/k3s/registries.yaml".source = config.age.secrets."k3s-registry.yaml.age".path; services.dockerRegistry = { enable = true; @@ -22,6 +34,24 @@ in { enableDelete = true; enableGarbageCollect = true; }; + systemd.services.mount-railbird-bucket = { + after = ["agenix.service"]; + description = "Mount railbird bucket"; + serviceConfig = { + Type = "simple"; + RemainAfterExit = true; + # ExecStartPre runs as root (the default), to perform the setup steps + ExecStartPre = [ + "-${pkgs.util-linux}/bin/umount -f ${mount-path}" + "${pkgs.coreutils}/bin/mkdir -p ${mount-path}" + "${pkgs.coreutils}/bin/chown -R railbird ${mount-path}" + "${pkgs.coreutils}/bin/chmod 0777 ${mount-path}" + ]; + # Use su to run the main command as the railbird user + ExecStart = "${pkgs.su}/bin/su -c '${pkgs.gcsfuse}/bin/gcsfuse --implicit-dirs --key-file ${config.age.secrets.api-service-key.path} ${bucket-name} ${mount-path}' railbird"; + }; + }; + services.k3s = { enable = true; clusterInit = cfg.serverAddr == ""; diff --git a/nixos/secrets/api_service_account_key.json.age b/nixos/secrets/api_service_account_key.json.age index 29aa33e763aa7295191f8da11e83c59fab5e572c..9770c2367502696f154e924715885c82cae7524e 100644 GIT binary patch literal 4926 zcmZY9=X(@o+XnDRXAz=w1aV^^gbc~n*#c5#d+%))1ZK};9co!yc8! zTR;#EArO%kAw(pQP#%y@0I8xxpV`x=PmSx-LZ5e?kB=U zM9jxXvS@{4=p>01dOd6qWC`g`U(6DP=x!DcLF$a!L{V`97pa60Xu;8xRird&2r?XS zL|wv|$tIAPV4BjS2)hJm#zbk<5FU>Q{d}ufM+z0VSxVVab2wsS2GTN-g>e5%Lqs04 zj}FGU>4?~g+I>+iWZ|K>DkP4X)EYOY^YYWWI2;xDjGm|v5C>?Wj_q(G;+O&ra-1N< zb~+4<0F-uVC2SVSCNUMClU9aVu$v^`*0c&|I!Mv^Fq@?8Qi~3wL>YU4!wC8KAlm?C zs5H)S*{z6N2ZJ~!w2R%elokNJYOc|z1>9+YmBWrJtvVRR?J+(_m-Zp*xHBBjMB{{& zdRrrvRv*ttCzML24n}Y=;^u%-GcV*%Bwzze>;~f+o!lm6$9*=HD;)94j5MQ3sEn!k zVxF6DTO53?Q18)2?06)h3UJ+&HGadoT0$D4 z*p`5cWn!cNuOsQxYFRc{%pp`8ct}P|h*X0B zEKDm&AVR4Bf0Hp1q5CLRifN>I0HZ{eG0L0Z zP;vt!lrc%!OqeT?U}}!qtf2&Q92?azqMO-`#2Sq?!DYIf0SQ?Zk6>K$w>*ATr89c+spbQE-dGer?rl!D{ zPQsJ;#i1BTi2*kw739BpjDx(C8&N+&(MdKpSET=;G6|29czTx>^D6iJ)qPDli#v5b{rOIUIRG|JRU(JWF(DPr8I*ZLt_q%nUrXyZYv*B zNQGw16<|7iV3LCqIOc#gDCS7}jM}#~wGs4NA-c_^Pe~93(@wI(1SJiz^$NBe^Rl=E zXm*&yARxs!nN&h=z?d`*i$da2u0za6sI-$r{45+W003yR3e}+5?QvLfEy!{?V-oAz z8l;v7BorNsB^4@>Nf&o(TrnOiiQCn2ky-DiEHGfCOiUL;lP1j36q6mG#S=zIY=Bu2 z9cE41`Che7<`j@R2$R7f#A_zCNE`@S!E^@r*WH+2GYCL*6!xU_?5My)M%Yf4h`{ZH zI*m@k^;i#Q~s+%@h@we2$OE}V!eY)ETfRT`~oRM+{MYLLWkL30vSq*fKf6b#dR;m?1c&LPjk!XdsPJC82iyt0yfHrjuo)%k0*KR}zlCNx(qJ;^HU(B#sRlG zUYk>S>)8`U_Qra79hknJMK;?Y-XH%|t*ZL8`|o#%E?pC=1w%(ah|TTgxwcHbY}EaN zW{V16u)cA8@9yPK&%6Fw=w5xgJUhDWa_;x0N3;&zTIrQv&%n2RvbVy)nlfknj!UI` zU+>VW?r};N_*d6%h~^v<6v2Q3;}sbY8qkh>-@2UG@;=|&nDgb@anU@SZU3;ocV^syoCq9Tba191_$y5s!sQRKVf~puCmv~ z{q1pU@yOyQ5olY@{@YP~`-3~Owi+{KuP0nOOyf;XOk^AevaZ^%_v@r7c>hyl$${?9 zu9LId=qIzhgPUglV4HMr-s9^N{-~zaPuJZqJ-hH%bVdK=cP>V*%70t-A1ti!Hx6YM z*4FNuy!yFw;K2Foe-yO-^lRkE{SiZ!52(!feY&aSpI;``o@4$w-M_fN_j*;QUg1T- zqN)e`!5xW%dPDUo9?&cfv(~)x#pub3dHsG4_6k^x$H%S6Tvt`Hi1zR{^x}oZ7q{dz z^Q=?KKVr;(aq0Qe&gze?Q;g!(nGr!3=BC@n^ z&L<}~_1+4VRaC}CJb*sPemU#XHxPksA4>Y#>8eS`gHFM=s#iC^ zd8zI{4ZN7s^vjDzH)}@0=7#+%JFWb-_>cajExm`u*YuseaoMQ9u725fX6nDkwB1`r zO&eHYmXznL_>Iut`d%69SZCk|?R&CWZ3AXLUH9TDddbn!c}w`g;aFjZ$|YAD#_eU# z?N{)y@%iFosg4b?5#xV6{g_v@JjBp`A=6vab${eNjLz2G&l3M#-J-j)9Nga-W?OiV z)?GaJWWvMK?Is9+elYS6!Ef33*HwU4>-v|%_U|seqxT+aDlP5Vthn)MApdpl)RDVd z6JwjG*Dqr|-ktX7`P7;TuDvg&F*>c`>IYo-%i3w3`N8^B!I`nc4~Yz9!39&l+vK|+ z-~RN6$2H=4YlVBuf84Qe8k1f*YoP0Tr?GQS|MvJ>=%1ZyPpGf7jxFl6E%{FUPJ>~R zCG%k(*=3J+_IL>{zUEDHu8thOyxX_EJd?fC)9+O*>b61n$x$xcdaY&T9iW|W-*f-{ z^7_8I!5fJ|!**?YRI)q&46SqZo-PHCuZ}5Sv#I#2`O2zE6E!a)cfQ&F;BK_woz9_W zvLi!u`=Fe+D?7;Q^EEaaJIVLmBsu(-&=>Dt|wi=G$aKeRtdaiaZwk0J(QY``+<(IIU8ir%{>RwA?QZMWeH(6$ zkL=fX_^waO>+Nm9qstrE--ic&HhspcZdH92fjdth{`F|~*FAbI5bwQqPhNZYLEybX z(oHu4M>gNj3GAo|=G=RFH`TG=;R$J~^0`xxb8^X<87o(vyi$fV4Y-~AJPSJ$+2q_b zz;n9nz`ZX7c^`V~GOxzGDyw@;@7p8zz27tpA3F0$I#5tEyR>V;2B2U5poj52i#jfA zzRzf@vP_*&=2|l4d`=IeXYk9H=9+&7SC>)MIn$8I#0Sq51A*j`L8Y@!j2!vFNr~QO zas19Z)u-Kx+uJikJ~OT{|D7GWTUx$l4>7LfFjLbs{3)`u{)((AZ+=@l<0ip?&u4EP zp4yr`XMUOZQ#B8MekbR~7TVen`J8^IrhW!Gnn!Eyw`=9#Kg{}%@}jPtKkxdw%ShHR z%e)Tnn?{T~UfsWB_r(0mvl>(1yqfUokRG<=hm{SgLwWg6h~wvqBZ<{{yxcWV^QD~| zMv1l+eKd36ZgfF0^*&R`KDnBCWLnF?qu8X*L+&@`=U?R;KPxIeUOjEgl>vrEMm*>uXo!z@H`^2`(Q&-TwRX?l_H0+|#W3E2U72&}Az`A~|3r}9#pH(o* zC(-Qt$$cs{@9CmC=-Axeue;Q}K%phaTmPY#o)TX`8jS$NEys+M9OQ$L)MG{pVn`bNin|qcsqPW#rm(ie+Nt%UK_G`od;U+yd@ip;6)|#xC>sG>qk{AxQJNT wd#xq%s&0R+`21_tsqUNlOrJPXJi$@%s7|pV`104P)s=g`xx>k+J@N7X07=x#jsO4v literal 4262 zcmZXV=bsaW+J+IN1w>FOQVwB75#y4XOp-}JftmE4Nir#;3#3dYeOi*q1Xx&C6p-d& z0asmQsj>Npf`SMLh~hz5iu5A*`r-Bc0Dr;td+y)$+;^BFE6H4x6PbLH z&JCeCN?rsdmBXbxpQt2b3Y7}fN(qYdv51rsy`nlDGn=hWb%yr)m7FKTWpL7=5#7EJ zf;t6nfYzpYZw`?75_&URfGw)DJ8o9T!|FmQK(Pje+y!t20}TuLm^|k+216kI2rZ1p zyp*)e7s{+EMWjka4VQz$C1)g=VX{_2i!+5{!NKMdZh;5G7>G&yDDKe6J$BGu4Cw4O zzM%8jogks1NP;Yr8mizTP@gO4F=`&6In0EZ5u^%@t5goL5R*iyK*n#w%OGsFn|);s z#Oh!h&a-YW;#b;~8A`&UOj1FxB$o?Ev$22$kc&K%MhIUK%d&z_8*|%Sb_ycY2E)U* z@fMs?Q__F}RnRtyH**=i#c2@oUexN0hfpB^Wf(;;SM=)1RM2h9>qC-g+{%>{4q3{D zdyG1F*bpjf&@_x-g|Lc_=ya)=M;=Moz(h3kFwK_>=LAgZ&gYDgEL1YY7|~ER1A<&G zSWRM#$|qSf1c|&iQE;aVAf_-#A`oRP$Pip6L@{U33NxSqQR+j0=;ShnL^7H82wK#@ z>$L**4~^r)QcAFv08A23i`lSC=fUJ@8dc^9r_aKoPKabpDz`DnM*~5aX3T!2F`r6n zO9E43IM@?*$fBqkQo==@#A?r@M#P!rJt8hDQ|X*tPub&Q7BLYnUkET!9y}KJh6660 z%dSho6bM?)eml#%Jce=!rZW5?-5m`}YkProD$r=l}O2(W=V{rPTrc@+p(nR8gU_KHTf@qwJ zAr5)M8dN!Dtb&L|QoIg#xq}E}HyP8U1S<&&PqG;OTP2!SYmKmpG0H)_6w)gqCcVy{ zK}yMpoI>p(pCYBxSePV+6+xa(>QcsFlt&~)$se%<@KiC7)G8dJPgQmiLFAvb|M|&~ z(L$RMsVu9`>2f+d1}FK!(XB9*ghTt0Kwl+Zj(vtjWhEl7D+(4tN=de#Z>rZATzl5URx zYM2~?p~b8sKr$)H7YJ}6A1+Bb&2}!4$8;1bcW5Y`)na3qJWG}eUO9jnNOL5KF#_R= zIHC{J(%z`0L`e${KWk!O(!wH2!pC4S2VB%B3XIhuA{Z1EOn{A~ykRDv#U(O=MO=^x zMq^eVmmqmm=>~bDRWBAYpfaozFm2J`COstYQa(&GmxEwgkZN$f!(oX)v<^3yElvmT zD%&mkLIJk=^IC;BLolA0%!~UNGcUpOX|sSAa)DU5WYQzNBdb>kb{KQzfgqT`tbl}_q7CrEbP07uoJ^$XmKSogN|_YWCNcygTFOA>MaUv4V7Rv! zM~o28b3ihy;e)h|)0b47hU0Q}G>HN+E}RS%;lK5LsJTH}5d;KjKCic9L8}o@X0^D? zXNu~4F;fsOvjD;*EDS27T}p+H(%7@KL?s%mR=qnIr<0`Jp@ijPB3ppuE^U+sJsBJC z@ufJenT%>h%fmDqrb^<7G{RA^0gW3HwsI6oxZGUSud`6BQzuyUML}NXp`4j;K*qQ) zD)EVcLz{)8xWOw#g3d$%m6M*lx?t8pr9eSm4ud*XK$CW;m`9o$v6<3(LF&TwkW6r- za2Jr_R2jnUX9&3-RdN=&%B)7cnAfWjL=^NUloCraWiM)Jx2P|16vx=Cu-n4~y|E%4 zu)yvj8w`hGb2%K$h9CJifb^$>Sy@YUL9u z5O=B!fJDe3I2bG|C@@aN(s_ANZ{m2bJLHxJ6@W;|-71DMhRiWl;So!;a;2LSq)bK* zW^h-6)1>Hxf#YQyttrKT0BMcW4j`3xIzfLVmq}<1yd+Pm{Th>pjfrB4g0cZRZFG@x zqdryEG8P!f7l1%n0m?;`e`F^pBn`;?V%7%8 zc;Jzq^f3SdVp2HiPnnaT!3uI5t5cOA9OR0mFQhB@xkNFbje8S-Pe4_W36sdYMl)i= zg9)$Bk@Hh3O*SLu?4kwC8B&lki^?MzpGO5l2ITJ~D=VcU3g_{1K8UFF6p%|0etX8r z%HjZnW=Y(hb)bGlhDU5FG+~h3vCjTZe7EyDL*p62| zcq9KuXy=z_yUv{a@4ue-%4)evd>e~3^?P~FQM3Q;_Vu>ySC1~c`SXZ`;n+Zb)8xGi z`_{LaH*Em^iGuv{*vu7EcAu(g41G4U=jm0i<6Bzonl`0F_wqYSsz>d(GElPq3;V5? zPhF|M9sG9K7VI6*mL5&fHHQ|658iB)!dI&Hv^hAq=hTz!&NZ(2DF#iv+_L%GCjZOj zF5%UdOD~?Tt(m@hNmG+l^5UCg%l$6uIN7RM^XE*tWclU5H-iT>?dsGxaP!`Yva{Pi zng7L8$L{P|GsyOA^MOlWrIx%V-B?lB=IgCEcf#H?{2M*{>J;G$NaGRd-li8 ztDvgr;uYP`+_~B3a#HrSX4J18b~k==t?k~w`t3Czslt)w%I6wQg<}j|8}; zE*;-EwqeHA5r!GB4m-8Ka@@M$xbS!Xt!w^c&@&Es71#aaUdQgxA8pxPZ+QOXD=mGW z9uevJU*G+E!QO8EbjypdY@ZNjpg@t>jZEJ?EPKlDwVed!BUEcf= z&%N92w>GLVzE+EF8#kW4InU9h2fwv;S7V*lc;-m&gKsX-XW3iJ(+wTQ-jVn2TUmG| z)9+Bz&tu#5p)WA;fjci0Z_S(W`IR5u`s_y6>d~t%9)I!h@NfC)6HAxI{qX6u_>8$L z_f3ie6W8|23HNWg2K0HozL56aM#VXu*Y5kzq6w|%O`fq}apUUEudmuXcR+GquOEM( z^5Ie%zVKV7tNqY~bwA94B(3g_8Pd|K2i!2DTT!=ATYjnYxf9b>+p4Rt8+Yom2YW5M z{ItE>+(NhX^wIo$2mNAQlGudO+~2=BC-fHLsjx#1rh z-ukA2Ha>WJ1F`en_rBk6$}j4+P%~ZrHdAU|?!ReXYd0-uH6iI?&%CrA?s)y+)NcIt z8U)H5Bo?uD0jo#0sV z#*Z`a24*q`*BlvdY~HcukHO5IT^B5aRxaO=Uq1E8)eWyK>;GZsixYzTzZP`Rdv5A`VQ9r@V>fp;ZMfi0)}v{zB=1*bWkTh->cKJVE1{echp^O zUU_Nv{hLV719hjS=lK^==Mn!ii~Ii7uXnn3-Tb#!7L%Fh&>>4F5xZ6K*?s&co30*2 z#+GkQ?R-1DX!^*m*ZLo9Ayz%!uy*U?@98U!-04tl@88n;;MI*ommMGc0Xwbb6{b2p zebo7?DU-9^=F-Ej-Kbp(H7y=aZrr`-%1_PgF1zIH){(VKb04>_{&W17pH{#N6odbB zxlMFg)sP+Do&P>|6mEyvPM;Z(^0a{WfZJ0B&E9)&^w`CToYOw^Tt)QNmu1i2?M@AN zvPM1e>Ye`d;V1hX6#CwK_U`mUk(#Pq?A~ijm}w8%4y~w7u6&|bp()Yju{#Sdr*~CO z)>kyV*-wA6_Q?wq+V0C_g4*{jof#7`QoYtbtd!5#@}}Je{RX> zfj4Fop^g1&Ccg1Py50YbYWaFidm}e^9lf8Q+_1m0ewoSW^wzceb?f_m$Vu$g*0&ce zd#4M!u*XGx&EAy*OW8dQ<5kNm)@>hx8!tTVe&KKlzk0TJed^}IxASXTA35ZIyLNx& z*sQU@AwSWo&#((M6%Rh`y}G^b?(gf5uj+g(o7hVf z)=uc(GUQHqd0l(Osa5P+17h(n{w<$-_^ceNl-)o2+@b)zfxJ z4}9GF+U&%Uc_ZH?y41~RJ)tu*^&UUpv~8$*w#k`LoUR4ysy@Q1N5ye@)7! zNcSeHZseXbWG6qeAHB5rUVh8rUn-v)+$`aC_^%kQ4QfR;uH68~H#{b+dZFd1uT}Lc pCG&{-uix6&FwT#Rn>eK0>%_NRemdIirE~i2(s=`_#yig&{}