This repository has no description
3.4 kB
96 lines
1{
2 config,
3 pkgs,
4 ...
5}:
6let
7 api = "/ip4/127.0.0.1/tcp/5001";
8 ipfs = "${pkgs.kubo}/bin/ipfs";
9 uploadServer = pkgs.writers.writePython3Bin "ipfs-upload-server" {
10 flakeIgnore = [ "E501" ];
11 } ./ipfs_upload.py;
12in
13{
14 imports = [ ../../configs/nginx.nix ];
15
16 # scratch area for in-flight uploads (extracted, added, then deleted)
17 systemd.tmpfiles.rules = [
18 "d /var/lib/ipfs/incoming 0700 ${config.services.kubo.user} ${config.services.kubo.group} -"
19 ];
20
21 # anonymous tarball -> `ipfs add` (into the blockstore) -> pinned -> returns CID
22 systemd.services.ipfs-upload = {
23 description = "Anonymous tarball -> IPFS pinning endpoint";
24 after = [ "ipfs.service" ];
25 requires = [ "ipfs.service" ];
26 wantedBy = [ "multi-user.target" ];
27 serviceConfig = {
28 Environment = [
29 "IPFS_BIN=${pkgs.kubo}/bin/ipfs"
30 "IPFS_API=${api}"
31 "STAGING=/var/lib/ipfs/incoming"
32 "ROOTS_FILE=/var/lib/ipfs/gc-roots"
33 "GATEWAY_BASE=https://starkstrom.lassul.us"
34 "BIND=127.0.0.1"
35 "PORT=8090"
36 "MAX_BYTES=8589934592" # 8 GiB compressed upload
37 "MAX_EXTRACT_BYTES=21474836480" # 20 GiB extracted
38 "DISK_PATH=/var/lib/ipfs"
39 "MIN_FREE_BYTES=322122547200" # refuse uploads with <300 GiB free
40 ];
41 ExecStart = "${uploadServer}/bin/ipfs-upload-server";
42 Restart = "always";
43 RestartSec = "10s";
44 User = config.services.kubo.user;
45 Group = config.services.kubo.group;
46 };
47 };
48
49 # public vhost (starkstrom's own name): writable upload at /, read-only gateway at /ipfs/
50 services.nginx.virtualHosts."starkstrom.lassul.us" = {
51 enableACME = true;
52 forceSSL = true;
53 locations."/ipfs/".extraConfig = ''
54 proxy_pass http://127.0.0.1:8089;
55 proxy_set_header Host $host;
56 '';
57 locations."/".extraConfig = ''
58 proxy_pass http://127.0.0.1:8090;
59 client_max_body_size 8g;
60 # Stream multi-GB bodies straight through instead of spooling to disk.
61 proxy_request_buffering off;
62 # With unbuffered proxying over HTTP/2, nginx sizes the per-stream flow
63 # control window to max(client_body_buffer_size, http2_body_preread_size)
64 # (ngx_http_v2_read_request_body). The 64 KiB default capped uploads at
65 # 64 KiB / RTT (~1.2 MB/s at 55 ms) whenever the backend read slower than
66 # the client sent. 8 MiB in-flight per upload lifts the ceiling to
67 # ~150 MB/s at that RTT.
68 client_body_buffer_size 8m;
69 # The backend hashes/pins for minutes before answering.
70 proxy_read_timeout 3600s;
71 proxy_send_timeout 3600s;
72 '';
73 };
74
75 # Explicit GC + gc-root management. Pins are the GC roots (persisted by kubo);
76 # `ipfs-gc` reclaims everything not reachable from a pin. Prune first with
77 # `ipfs-roots rm <cid>`, then `ipfs-gc`.
78 environment.systemPackages = [
79 (pkgs.writeShellScriptBin "ipfs-gc" ''
80 exec ${ipfs} --api ${api} repo gc "$@"
81 '')
82 (pkgs.writeShellScriptBin "ipfs-roots" ''
83 cmd="''${1-list}"
84 shift || true
85 case "$cmd" in
86 list) exec ${ipfs} --api ${api} pin ls --type=recursive ;;
87 ledger) exec ${pkgs.coreutils}/bin/cat /var/lib/ipfs/gc-roots ;;
88 rm) exec ${ipfs} --api ${api} pin rm "$@" ;;
89 *)
90 echo "usage: ipfs-roots [list|ledger|rm <cid>...]" >&2
91 exit 1
92 ;;
93 esac
94 '')
95 ];
96}