feat: lab: +attic cache

2026-06-04 18:58:03 +00:00
parent df19d16269
commit c50d274ae1
5 changed files with 97 additions and 10 deletions
@@ -0,0 +1,67 @@
+{ ... }: {
+  pkgs,
+  lib,
+  config,
+  ...
+}: let
+  cfg = config.hectic.services.attic;
+  environmentFile = "/var/lib/atticd/credentials.env";
+in {
+  options.hectic.services.attic = {
+    enable = lib.mkEnableOption "Attic binary cache server";
+
+    hostName = lib.mkOption {
+      type = lib.types.str;
+      description = "Public hostname used by clients to reach this Attic server.";
+    };
+
+    listenAddress = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      description = "Local address atticd binds to behind the reverse proxy.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8080;
+      description = "Local port atticd binds to behind the reverse proxy.";
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.atticd-credentials = {
+      description = "Generate persistent atticd credentials";
+      before      = [ "atticd.service" ];
+      wantedBy    = [ "atticd.service" ];
+      serviceConfig = {
+        Type = "oneshot";
+        StateDirectory = "atticd";
+        UMask = "0077";
+      };
+      script = ''
+        if [ -s ${environmentFile} ]; then
+          exit 0
+        fi
+
+        install -m 0700 -d /var/lib/atticd
+        secret="$(${lib.getExe pkgs.openssl} genrsa -traditional 4096 | ${pkgs.coreutils}/bin/base64 -w0)"
+        cat > ${environmentFile} <<EOF
+        ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64="$secret"
+        EOF
+        chmod 0600 ${environmentFile}
+      '';
+    };
+
+    services.atticd = {
+      enable          = true;
+      environmentFile = environmentFile;
+      settings = {
+        listen = "${cfg.listenAddress}:${toString cfg.port}";
+        allowed-hosts = [ cfg.hostName ];
+        api-endpoint = "https://${cfg.hostName}/";
+        compression.type = "zstd";
+      };
+    };
+  };
+}