Tobserver/modules/bitcoin-pulse.nix
2026-07-28 17:12:28 +07:00

301 lines
9.1 KiB
Nix

{ bitcoin-pulse, config, lib, pkgs, ... }:
let
containerName = "bitcoin-pulse-postgres";
databaseUrl = "jdbc:postgresql://127.0.0.1:5432/bitcoin_pulse?tcpKeepAlive=true";
migrationServiceName = "bitcoin-pulse-migrate";
serviceName = "podman-${containerName}";
runtimeDirectory = "/run/${containerName}";
secretFiles = {
admin = config.sops.secrets."bitcoin-pulse/postgres/admin-password".path;
app = config.sops.secrets."bitcoin-pulse/postgres/app-password".path;
migration = config.sops.secrets."bitcoin-pulse/postgres/migration-password".path;
};
prepareSecrets = pkgs.writeShellApplication {
name = "bitcoin-pulse-postgresql-prepare-secrets";
runtimeInputs = [
config.virtualisation.podman.package
pkgs.coreutils
];
text = ''
copy_secret() {
source="$1"
destination="$2"
podman unshare rm -f "$destination"
# PostgreSQL runs as uid 999 in the container. Store each runtime copy
# with the corresponding rootless subordinate uid and a private mode.
podman unshare install -m 0400 -o 999 -g 999 "$source" "$destination"
}
copy_secret ${lib.escapeShellArg secretFiles.admin} \
${lib.escapeShellArg "${runtimeDirectory}/admin-password"}
copy_secret ${lib.escapeShellArg secretFiles.app} \
${lib.escapeShellArg "${runtimeDirectory}/app-password"}
copy_secret ${lib.escapeShellArg secretFiles.migration} \
${lib.escapeShellArg "${runtimeDirectory}/migration-password"}
'';
};
cleanupSecrets = pkgs.writeShellApplication {
name = "bitcoin-pulse-postgresql-cleanup-secrets";
runtimeInputs = [
config.virtualisation.podman.package
pkgs.coreutils
];
text = ''
podman unshare rm -f \
${lib.escapeShellArg "${runtimeDirectory}/admin-password"} \
${lib.escapeShellArg "${runtimeDirectory}/app-password"} \
${lib.escapeShellArg "${runtimeDirectory}/migration-password"}
'';
};
waitForPostgresql = pkgs.writeShellApplication {
name = "bitcoin-pulse-wait-for-postgresql";
runtimeInputs = [
pkgs.coreutils
pkgs.postgresql_18
];
text = ''
deadline=$((SECONDS + 60))
echo "Waiting up to 60 seconds for PostgreSQL on 127.0.0.1:5432"
while (( SECONDS < deadline )); do
if pg_isready \
--host=127.0.0.1 \
--port=5432 \
--username=bitcoin_pulse_migration \
--dbname=bitcoin_pulse \
--timeout=2 \
--quiet; then
echo "PostgreSQL is accepting connections"
exit 0
fi
sleep 2
done
echo "PostgreSQL did not become ready on 127.0.0.1:5432 within 60 seconds" >&2
pg_isready \
--host=127.0.0.1 \
--port=5432 \
--username=bitcoin_pulse_migration \
--dbname=bitcoin_pulse \
--timeout=2 || true
exit 1
'';
};
in
{
imports = [ bitcoin-pulse.nixosModules.default ];
services.bitcoin-pulse = {
enable = true;
bindAddress = "127.0.0.1";
port = 3000;
mempool.baseUrl = "http://127.0.0.1:8999";
database = {
url = databaseUrl;
username = "bitcoin_pulse_app";
passwordFile = secretFiles.app;
};
};
users.groups = {
bitcoin-pulse = { };
bitcoin-pulse-migration = { };
bitcoin-pulse-postgres.gid = 400;
};
users.users = {
bitcoin-pulse-migration = {
description = "Bitcoin Pulse database migration account";
isSystemUser = true;
group = "bitcoin-pulse-migration";
};
bitcoin-pulse-postgres = {
description = "Rootless PostgreSQL container account for Bitcoin Pulse";
isSystemUser = true;
uid = 400;
group = "bitcoin-pulse-postgres";
extraGroups = [
"bitcoin-pulse"
"bitcoin-pulse-migration"
];
home = "/var/lib/bitcoin-pulse-postgres";
homeMode = "0700";
createHome = true;
linger = true;
autoSubUidGidRange = true;
};
};
sops.secrets = {
"bitcoin-pulse/postgres/admin-password" = {
group = "bitcoin-pulse-postgres";
mode = "0440";
};
"bitcoin-pulse/postgres/app-password" = {
group = "bitcoin-pulse";
mode = "0440";
};
"bitcoin-pulse/postgres/migration-password" = {
group = "bitcoin-pulse-migration";
mode = "0440";
};
};
virtualisation.oci-containers = {
backend = "podman";
containers.${containerName} = {
# Official PostgreSQL 18.4 Bookworm multi-architecture image, pinned to
# the immutable digest tested by BitcoinPulseAPI on 2026-07-16.
image = "docker.io/library/postgres@sha256:1961f96e6029a02c3812d7cb329a3b03a3ac2bb067058dec17b0f5596aca9296";
pull = "missing";
autoStart = true;
autoRemoveOnStop = true;
podman = {
user = "bitcoin-pulse-postgres";
sdnotify = "healthy";
};
environment = {
POSTGRES_DB = "bitcoin_pulse";
POSTGRES_USER = "bitcoin_pulse_admin";
POSTGRES_PASSWORD_FILE = "/run/secrets/admin-password";
POSTGRES_HOST_AUTH_METHOD = "scram-sha-256";
POSTGRES_INITDB_ARGS = "--auth-host=scram-sha-256 --data-checksums";
};
ports = [ "127.0.0.1:5432:5432" ];
volumes = [
"bitcoin-pulse-db:/var/lib/postgresql"
"${runtimeDirectory}/admin-password:/run/secrets/admin-password:ro"
"${runtimeDirectory}/app-password:/run/secrets/app-password:ro"
"${runtimeDirectory}/migration-password:/run/secrets/migration-password:ro"
"${bitcoin-pulse}/resources/postgres/initdb/010-roles.sql:/docker-entrypoint-initdb.d/010-roles.sql:ro"
];
extraOptions = [
"--health-cmd=pg_isready --host=127.0.0.1 --port=5432 --username=bitcoin_pulse_admin --dbname=bitcoin_pulse"
"--health-interval=10s"
"--health-timeout=5s"
"--health-retries=6"
"--health-start-period=60s"
"--stop-signal=SIGINT"
"--stop-timeout=60"
"--pids-limit=256"
"--security-opt=no-new-privileges"
];
};
};
systemd.services = {
${serviceName}.serviceConfig = {
ExecStartPre = lib.mkAfter [ "${prepareSecrets}/bin/bitcoin-pulse-postgresql-prepare-secrets" ];
ExecStartPost = [ "${cleanupSecrets}/bin/bitcoin-pulse-postgresql-cleanup-secrets" ];
ExecStopPost = lib.mkAfter [ "${cleanupSecrets}/bin/bitcoin-pulse-postgresql-cleanup-secrets" ];
RuntimeDirectoryMode = "0700";
RestartSec = "5s";
TimeoutStopSec = lib.mkForce "90s";
UMask = "0077";
};
${migrationServiceName} = {
description = "Migrate the Bitcoin Pulse PostgreSQL database";
requires = [ "${serviceName}.service" ];
after = [ "${serviceName}.service" ];
before = [ "bitcoin-pulse.service" ];
environment = {
MIGRATUS_DATABASE_URL = databaseUrl;
MIGRATUS_USERNAME = "bitcoin_pulse_migration";
MIGRATUS_PASSWORD_FILE = secretFiles.migration;
};
serviceConfig = {
Type = "oneshot";
ExecStartPre = [ "${waitForPostgresql}/bin/bitcoin-pulse-wait-for-postgresql" ];
ExecStart = "${config.services.bitcoin-pulse.package}/bin/bitcoin-pulse-migrate migrate";
User = "bitcoin-pulse-migration";
Group = "bitcoin-pulse-migration";
Restart = "no";
TimeoutStartSec = "5min";
AmbientCapabilities = "";
CapabilityBoundingSet = "";
LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateTmp = true;
ProcSubset = "pid";
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectProc = "invisible";
ProtectSystem = "strict";
RemoveIPC = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
RestrictNamespaces = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
SystemCallArchitectures = "native";
UMask = "0077";
};
};
bitcoin-pulse = {
requires = [ "${migrationServiceName}.service" ];
after = [ "${migrationServiceName}.service" ];
};
};
services.nginx = {
appendHttpConfig = ''
limit_req_zone $binary_remote_addr zone=bitcoin_pulse_api:10m rate=300r/m;
'';
virtualHosts."bitcoin-pulse.tobiasostner.de" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:3000";
extraConfig = ''
limit_req zone=bitcoin_pulse_api burst=50 nodelay;
limit_req_status 429;
client_max_body_size 16k;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Connection "";
proxy_connect_timeout 2s;
proxy_read_timeout 10s;
proxy_send_timeout 10s;
proxy_next_upstream off;
'';
};
};
};
environment.systemPackages = [ pkgs.postgresql_18 ];
}