This repository has no description
2.8 kB
87 lines
1{
2 config,
3 pkgs,
4 ...
5}:
6let
7 api = "/ip4/127.0.0.1/tcp/5001";
8 ipfs = "${pkgs.kubo}/bin/ipfs";
9 uploadServer = pkgs.writers.writePython3Bin "ipfs-upload-server" {
10 flakeIgnore = [ "E501" ];
11 } ./ipfs_upload.py;
12in
13{
14 imports = [ ../../2configs/nginx.nix ];
15
16 # scratch area for in-flight uploads (extracted, added, then deleted)
17 systemd.tmpfiles.rules = [
18 "d /var/lib/ipfs/incoming 0700 ${config.services.kubo.user} ${config.services.kubo.group} -"
19 ];
20
21 # anonymous tarball -> `ipfs add` (into the blockstore) -> pinned -> returns CID
22 systemd.services.ipfs-upload = {
23 description = "Anonymous tarball -> IPFS pinning endpoint";
24 after = [ "ipfs.service" ];
25 requires = [ "ipfs.service" ];
26 wantedBy = [ "multi-user.target" ];
27 serviceConfig = {
28 Environment = [
29 "IPFS_BIN=${pkgs.kubo}/bin/ipfs"
30 "IPFS_API=${api}"
31 "STAGING=/var/lib/ipfs/incoming"
32 "ROOTS_FILE=/var/lib/ipfs/gc-roots"
33 "GATEWAY_BASE=https://starkstrom.lassul.us"
34 "BIND=127.0.0.1"
35 "PORT=8090"
36 "MAX_BYTES=8589934592" # 8 GiB compressed upload
37 "MAX_EXTRACT_BYTES=21474836480" # 20 GiB extracted
38 "DISK_PATH=/var/lib/ipfs"
39 "MIN_FREE_BYTES=322122547200" # refuse uploads with <300 GiB free
40 ];
41 ExecStart = "${uploadServer}/bin/ipfs-upload-server";
42 Restart = "always";
43 RestartSec = "10s";
44 User = config.services.kubo.user;
45 Group = config.services.kubo.group;
46 };
47 };
48
49 # public vhost (starkstrom's own name): writable upload at /, read-only gateway at /ipfs/
50 services.nginx.virtualHosts."starkstrom.lassul.us" = {
51 enableACME = true;
52 forceSSL = true;
53 locations."/ipfs/".extraConfig = ''
54 proxy_pass http://127.0.0.1:8089;
55 proxy_set_header Host $host;
56 '';
57 locations."/".extraConfig = ''
58 proxy_pass http://127.0.0.1:8090;
59 client_max_body_size 8g;
60 proxy_request_buffering off;
61 proxy_read_timeout 3600s;
62 proxy_send_timeout 3600s;
63 '';
64 };
65
66 # Explicit GC + gc-root management. Pins are the GC roots (persisted by kubo);
67 # `ipfs-gc` reclaims everything not reachable from a pin. Prune first with
68 # `ipfs-roots rm <cid>`, then `ipfs-gc`.
69 environment.systemPackages = [
70 (pkgs.writeShellScriptBin "ipfs-gc" ''
71 exec ${ipfs} --api ${api} repo gc "$@"
72 '')
73 (pkgs.writeShellScriptBin "ipfs-roots" ''
74 cmd="''${1-list}"
75 shift || true
76 case "$cmd" in
77 list) exec ${ipfs} --api ${api} pin ls --type=recursive ;;
78 ledger) exec ${pkgs.coreutils}/bin/cat /var/lib/ipfs/gc-roots ;;
79 rm) exec ${ipfs} --api ${api} pin rm "$@" ;;
80 *)
81 echo "usage: ipfs-roots [list|ledger|rm <cid>...]" >&2
82 exit 1
83 ;;
84 esac
85 '')
86 ];
87}