nixpkgs/nixos/modules/services/search/opensearch.nix
Sarah Brofeldt 110828e412
Merge pull request #271243 from shyim/fix-opensearch-boot
nixos/opensearch: check plugins directory exists before checking content
2023-12-01 06:33:50 +01:00

268 lines
9.0 KiB
Nix

{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.opensearch;
settingsFormat = pkgs.formats.yaml {};
configDir = cfg.dataDir + "/config";
usingDefaultDataDir = cfg.dataDir == "/var/lib/opensearch";
usingDefaultUserAndGroup = cfg.user == "opensearch" && cfg.group == "opensearch";
opensearchYml = settingsFormat.generate "opensearch.yml" cfg.settings;
loggingConfigFilename = "log4j2.properties";
loggingConfigFile = pkgs.writeTextFile {
name = loggingConfigFilename;
text = cfg.logging;
};
in
{
options.services.opensearch = {
enable = mkEnableOption (lib.mdDoc "OpenSearch");
package = lib.mkPackageOption pkgs "OpenSearch" {
default = [ "opensearch" ];
};
settings = lib.mkOption {
type = lib.types.submodule {
freeformType = settingsFormat.type;
options."network.host" = lib.mkOption {
type = lib.types.str;
default = "127.0.0.1";
description = lib.mdDoc ''
Which port this service should listen on.
'';
};
options."cluster.name" = lib.mkOption {
type = lib.types.str;
default = "opensearch";
description = lib.mdDoc ''
The name of the cluster.
'';
};
options."discovery.type" = lib.mkOption {
type = lib.types.str;
default = "single-node";
description = lib.mdDoc ''
The type of discovery to use.
'';
};
options."http.port" = lib.mkOption {
type = lib.types.port;
default = 9200;
description = lib.mdDoc ''
The port to listen on for HTTP traffic.
'';
};
options."transport.port" = lib.mkOption {
type = lib.types.port;
default = 9300;
description = lib.mdDoc ''
The port to listen on for transport traffic.
'';
};
options."plugins.security.disabled" = lib.mkOption {
type = lib.types.bool;
default = true;
description = lib.mdDoc ''
Whether to enable the security plugin,
`plugins.security.ssl.transport.keystore_filepath` or
`plugins.security.ssl.transport.server.pemcert_filepath` and
`plugins.security.ssl.transport.client.pemcert_filepath`
must be set for this plugin to be enabled.
'';
};
};
default = {};
description = lib.mdDoc ''
OpenSearch configuration.
'';
};
logging = lib.mkOption {
description = lib.mdDoc "opensearch logging configuration.";
default = ''
logger.action.name = org.opensearch.action
logger.action.level = info
appender.console.type = Console
appender.console.name = console
appender.console.layout.type = PatternLayout
appender.console.layout.pattern = [%d{ISO8601}][%-5p][%-25c{1.}] %marker%m%n
rootLogger.level = info
rootLogger.appenderRef.console.ref = console
'';
type = types.str;
};
dataDir = lib.mkOption {
type = lib.types.path;
default = "/var/lib/opensearch";
apply = converge (removeSuffix "/");
description = lib.mdDoc ''
Data directory for OpenSearch. If you change this, you need to
manually create the directory. You also need to create the
`opensearch` user and group, or change
[](#opt-services.opensearch.user) and
[](#opt-services.opensearch.group) to existing ones with
access to the directory.
'';
};
user = lib.mkOption {
type = lib.types.str;
default = "opensearch";
description = lib.mdDoc ''
The user OpenSearch runs as. Should be left at default unless
you have very specific needs.
'';
};
group = lib.mkOption {
type = lib.types.str;
default = "opensearch";
description = lib.mdDoc ''
The group OpenSearch runs as. Should be left at default unless
you have very specific needs.
'';
};
extraCmdLineOptions = lib.mkOption {
description = lib.mdDoc "Extra command line options for the OpenSearch launcher.";
default = [ ];
type = lib.types.listOf lib.types.str;
};
extraJavaOptions = lib.mkOption {
description = lib.mdDoc "Extra command line options for Java.";
default = [ ];
type = lib.types.listOf lib.types.str;
example = [ "-Djava.net.preferIPv4Stack=true" ];
};
restartIfChanged = lib.mkOption {
type = lib.types.bool;
description = lib.mdDoc ''
Automatically restart the service on config change.
This can be set to false to defer restarts on a server or cluster.
Please consider the security implications of inadvertently running an older version,
and the possibility of unexpected behavior caused by inconsistent versions across a cluster when disabling this option.
'';
default = true;
};
};
config = mkIf cfg.enable {
systemd.services.opensearch = {
description = "OpenSearch Daemon";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
path = [ pkgs.inetutils ];
inherit (cfg) restartIfChanged;
environment = {
OPENSEARCH_HOME = cfg.dataDir;
OPENSEARCH_JAVA_OPTS = toString cfg.extraJavaOptions;
OPENSEARCH_PATH_CONF = configDir;
};
serviceConfig = {
ExecStartPre =
let
startPreFullPrivileges = ''
set -o errexit -o pipefail -o nounset -o errtrace
shopt -s inherit_errexit
'' + (optionalString (!config.boot.isContainer) ''
# Only set vm.max_map_count if lower than ES required minimum
# This avoids conflict if configured via boot.kernel.sysctl
if [ $(${pkgs.procps}/bin/sysctl -n vm.max_map_count) -lt 262144 ]; then
${pkgs.procps}/bin/sysctl -w vm.max_map_count=262144
fi
'');
startPreUnprivileged = ''
set -o errexit -o pipefail -o nounset -o errtrace
shopt -s inherit_errexit
# Install plugins
# remove plugins directory if it is empty.
if [[ -d ${cfg.dataDir}/plugins && -z "$(ls -A ${cfg.dataDir}/plugins)" ]]; then
rm -r "${cfg.dataDir}/plugins"
fi
ln -sfT "${cfg.package}/plugins" "${cfg.dataDir}/plugins"
ln -sfT ${cfg.package}/lib ${cfg.dataDir}/lib
ln -sfT ${cfg.package}/modules ${cfg.dataDir}/modules
# opensearch needs to create the opensearch.keystore in the config directory
# so this directory needs to be writable.
mkdir -p ${configDir}
chmod 0700 ${configDir}
# Note that we copy config files from the nix store instead of symbolically linking them
# because otherwise X-Pack Security will raise the following exception:
# java.security.AccessControlException:
# access denied ("java.io.FilePermission" "/var/lib/opensearch/config/opensearch.yml" "read")
rm -f ${configDir}/opensearch.yml
cp ${opensearchYml} ${configDir}/opensearch.yml
# Make sure the logging configuration for old OpenSearch versions is removed:
rm -f "${configDir}/logging.yml"
rm -f ${configDir}/${loggingConfigFilename}
cp ${loggingConfigFile} ${configDir}/${loggingConfigFilename}
mkdir -p ${configDir}/scripts
rm -f ${configDir}/jvm.options
cp ${cfg.package}/config/jvm.options ${configDir}/jvm.options
# redirect jvm logs to the data directory
mkdir -p ${cfg.dataDir}/logs
chmod 0700 ${cfg.dataDir}/logs
sed -e '#logs/gc.log#${cfg.dataDir}/logs/gc.log#' -i ${configDir}/jvm.options
'';
in [
"+${pkgs.writeShellScript "opensearch-start-pre-full-privileges" startPreFullPrivileges}"
"${pkgs.writeShellScript "opensearch-start-pre-unprivileged" startPreUnprivileged}"
];
ExecStartPost = pkgs.writeShellScript "opensearch-start-post" ''
set -o errexit -o pipefail -o nounset -o errtrace
shopt -s inherit_errexit
# Make sure opensearch is up and running before dependents
# are started
while ! ${pkgs.curl}/bin/curl -sS -f http://${cfg.settings."network.host"}:${toString cfg.settings."http.port"} 2>/dev/null; do
sleep 1
done
'';
ExecStart = "${cfg.package}/bin/opensearch ${toString cfg.extraCmdLineOptions}";
User = cfg.user;
Group = cfg.group;
LimitNOFILE = "1024000";
Restart = "always";
TimeoutStartSec = "infinity";
DynamicUser = usingDefaultUserAndGroup && usingDefaultDataDir;
} // (optionalAttrs (usingDefaultDataDir) {
StateDirectory = "opensearch";
StateDirectoryMode = "0700";
});
};
environment.systemPackages = [ cfg.package ];
};
}