Merge pull request #221096 from awakesecurity/minio-paths
nixos/minio: gracefully handle root credentials file
This commit is contained in:
Pascal Bach
GitHub
commit
7c166f412b
@ -60,7 +60,7 @@ in
|
||||
'';
|
||||
};
|
||||
|
||||
rootCredentialsFile = mkOption {
|
||||
rootCredentialsFile = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
description = lib.mdDoc ''
|
||||
@ -96,29 +96,62 @@ in
|
||||
config = mkIf cfg.enable {
|
||||
warnings = optional ((cfg.accessKey != "") || (cfg.secretKey != "")) "services.minio.`accessKey` and services.minio.`secretKey` are deprecated, please use services.minio.`rootCredentialsFile` instead.";
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d '${cfg.configDir}' - minio minio - -"
|
||||
] ++ (map (x: "d '" + x + "' - minio minio - - ") cfg.dataDir);
|
||||
systemd = lib.mkMerge [{
|
||||
tmpfiles.rules = [
|
||||
"d '${cfg.configDir}' - minio minio - -"
|
||||
] ++ (map (x: "d '" + x + "' - minio minio - - ") cfg.dataDir);
|
||||
|
||||
systemd.services.minio = {
|
||||
description = "Minio Object Storage";
|
||||
after = [ "network-online.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart = "${cfg.package}/bin/minio server --json --address ${cfg.listenAddress} --console-address ${cfg.consoleAddress} --config-dir=${cfg.configDir} ${toString cfg.dataDir}";
|
||||
Type = "simple";
|
||||
User = "minio";
|
||||
Group = "minio";
|
||||
LimitNOFILE = 65536;
|
||||
EnvironmentFile = if (cfg.rootCredentialsFile != null) then cfg.rootCredentialsFile
|
||||
else if ((cfg.accessKey != "") || (cfg.secretKey != "")) then (legacyCredentials cfg)
|
||||
else null;
|
||||
services.minio = {
|
||||
description = "Minio Object Storage";
|
||||
after = [ "network-online.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
ExecStart = "${cfg.package}/bin/minio server --json --address ${cfg.listenAddress} --console-address ${cfg.consoleAddress} --config-dir=${cfg.configDir} ${toString cfg.dataDir}";
|
||||
Type = "simple";
|
||||
User = "minio";
|
||||
Group = "minio";
|
||||
LimitNOFILE = 65536;
|
||||
EnvironmentFile =
|
||||
if (cfg.rootCredentialsFile != null) then cfg.rootCredentialsFile
|
||||
else if ((cfg.accessKey != "") || (cfg.secretKey != "")) then (legacyCredentials cfg)
|
||||
else null;
|
||||
};
|
||||
environment = {
|
||||
MINIO_REGION = "${cfg.region}";
|
||||
MINIO_BROWSER = "${if cfg.browser then "on" else "off"}";
|
||||
};
|
||||
};
|
||||
environment = {
|
||||
MINIO_REGION = "${cfg.region}";
|
||||
MINIO_BROWSER = "${if cfg.browser then "on" else "off"}";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
(lib.mkIf (cfg.rootCredentialsFile != null) {
|
||||
# The service will fail if the credentials file is missing
|
||||
services.minio.unitConfig.ConditionPathExists = cfg.rootCredentialsFile;
|
||||
|
||||
# The service will not restart if the credentials file has
|
||||
# been changed. This can cause stale root credentials.
|
||||
paths.minio-root-credentials = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
pathConfig = {
|
||||
PathChanged = [ cfg.rootCredentialsFile ];
|
||||
Unit = "minio-restart.service";
|
||||
};
|
||||
};
|
||||
|
||||
services.minio-restart = {
|
||||
description = "Restart MinIO";
|
||||
|
||||
script = ''
|
||||
systemctl restart minio.service
|
||||
'';
|
||||
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
Restart = "on-failure";
|
||||
RestartSec = 5;
|
||||
};
|
||||
};
|
||||
})];
|
||||
|
||||
users.users.minio = {
|
||||
group = "minio";
|
||||
|
||||
@ -1,5 +1,5 @@
|
||||
import ./make-test-python.nix ({ pkgs, ...} :
|
||||
let
|
||||
import ./make-test-python.nix ({ pkgs, ... }:
|
||||
let
|
||||
accessKey = "BKIKJAA5BMMU2RHO6IBB";
|
||||
secretKey = "V7f1CwQqAcwo80UEIJEjc5gVQUSSx5ohQ9GSrr12";
|
||||
minioPythonScript = pkgs.writeScript "minio-test.py" ''
|
||||
@ -18,41 +18,55 @@ let
|
||||
sio.seek(0)
|
||||
minioClient.put_object('test-bucket', 'test.txt', sio, sio_len, content_type='text/plain')
|
||||
'';
|
||||
in {
|
||||
name = "minio";
|
||||
meta = with pkgs.lib.maintainers; {
|
||||
maintainers = [ bachp ];
|
||||
};
|
||||
|
||||
nodes = {
|
||||
machine = { pkgs, ... }: {
|
||||
services.minio = {
|
||||
enable = true;
|
||||
rootCredentialsFile = pkgs.writeText "minio-credentials" ''
|
||||
MINIO_ROOT_USER=${accessKey}
|
||||
MINIO_ROOT_PASSWORD=${secretKey}
|
||||
'';
|
||||
};
|
||||
environment.systemPackages = [ pkgs.minio-client ];
|
||||
|
||||
# Minio requires at least 1GiB of free disk space to run.
|
||||
virtualisation.diskSize = 4 * 1024;
|
||||
rootCredentialsFile = "/etc/nixos/minio-root-credentials";
|
||||
credsPartial = pkgs.writeText "minio-credentials-partial" ''
|
||||
MINIO_ROOT_USER=${accessKey}
|
||||
'';
|
||||
credsFull = pkgs.writeText "minio-credentials-full" ''
|
||||
MINIO_ROOT_USER=${accessKey}
|
||||
MINIO_ROOT_PASSWORD=${secretKey}
|
||||
'';
|
||||
in
|
||||
{
|
||||
name = "minio";
|
||||
meta = with pkgs.lib.maintainers; {
|
||||
maintainers = [ bachp ];
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
start_all()
|
||||
machine.wait_for_unit("minio.service")
|
||||
machine.wait_for_open_port(9000)
|
||||
nodes = {
|
||||
machine = { pkgs, ... }: {
|
||||
services.minio = {
|
||||
enable = true;
|
||||
inherit rootCredentialsFile;
|
||||
};
|
||||
environment.systemPackages = [ pkgs.minio-client ];
|
||||
|
||||
# Create a test bucket on the server
|
||||
machine.succeed(
|
||||
"mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
|
||||
)
|
||||
machine.succeed("mc mb minio/test-bucket")
|
||||
machine.succeed("${minioPythonScript}")
|
||||
assert "test-bucket" in machine.succeed("mc ls minio")
|
||||
assert "Test from Python" in machine.succeed("mc cat minio/test-bucket/test.txt")
|
||||
machine.shutdown()
|
||||
'';
|
||||
})
|
||||
# Minio requires at least 1GiB of free disk space to run.
|
||||
virtualisation.diskSize = 4 * 1024;
|
||||
};
|
||||
};
|
||||
|
||||
testScript = ''
|
||||
import time
|
||||
|
||||
start_all()
|
||||
# simulate manually editing root credentials file
|
||||
machine.wait_for_unit("multi-user.target")
|
||||
machine.copy_from_host("${credsPartial}", "${rootCredentialsFile}")
|
||||
time.sleep(3)
|
||||
machine.copy_from_host("${credsFull}", "${rootCredentialsFile}")
|
||||
|
||||
machine.wait_for_unit("minio.service")
|
||||
machine.wait_for_open_port(9000)
|
||||
|
||||
# Create a test bucket on the server
|
||||
machine.succeed(
|
||||
"mc config host add minio http://localhost:9000 ${accessKey} ${secretKey} --api s3v4"
|
||||
)
|
||||
machine.succeed("mc mb minio/test-bucket")
|
||||
machine.succeed("${minioPythonScript}")
|
||||
assert "test-bucket" in machine.succeed("mc ls minio")
|
||||
assert "Test from Python" in machine.succeed("mc cat minio/test-bucket/test.txt")
|
||||
machine.shutdown()
|
||||
'';
|
||||
})
|
||||
|
||||
Loading…
Reference in New Issue
Block a user