fix[server]: get cache working

modules/nixos/server/attic.nix

@@ -0,0 +1,129 @@
+{ lib, config, globals, dns, confLib, ... }:
+let
+  inherit (confLib.gen { name = "attic"; port = 8091; }) serviceName serviceDir servicePort serviceAddress serviceDomain serviceProxy proxyAddress4 proxyAddress6;
+  inherit (config.swarselsystems) mainUser isPublic sopsFile;
+  serviceDB = "atticd";
+in
+{
+  options = {
+    swarselmodules.server.${serviceName} = lib.mkEnableOption "enable ${serviceName} on server";
+  };
+  config = lib.mkIf config.swarselmodules.server.${serviceName} {
+
+    swarselsystems.server.dns.${globals.services.${serviceName}.baseDomain}.subdomainRecords = {
+      "${globals.services.${serviceName}.subDomain}" = dns.lib.combinators.host proxyAddress4 proxyAddress6;
+    };
+
+    globals.services.${serviceName} = {
+      domain = serviceDomain;
+      inherit proxyAddress4 proxyAddress6;
+    };
+
+    sops = lib.mkIf (!isPublic) {
+      secrets = {
+        attic-server-token = { inherit sopsFile; };
+        attic-garage-access-key = { inherit sopsFile; };
+        attic-garage-secret-key = { inherit sopsFile; };
+      };
+      templates = {
+        "attic.env" = {
+          content = ''
+            ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64=${config.sops.placeholder.attic-server-token}
+            AWS_ACCESS_KEY_ID=${config.sops.placeholder.attic-garage-access-key}
+            AWS_SECRET_ACCESS_KEY=${config.sops.placeholder.attic-garage-secret-key}
+          '';
+        };
+      };
+    };
+
+    services.atticd = {
+      enable = true;
+      environmentFile = config.sops.templates."attic.env".path;
+      settings = {
+        listen = "[::]:${builtins.toString servicePort}";
+        api-endpoint = "https://${serviceDomain}/";
+        allowed-hosts = [
+          serviceDomain
+        ];
+        require-proof-of-possession = false;
+        compression = {
+          type = "zstd";
+          level = 3;
+        };
+        database.url = "postgresql:///atticd?host=/run/postgresql";
+
+        storage =
+          if config.swarselmodules.server.garage then {
+            type = "s3";
+            region = mainUser;
+            bucket = serviceName;
+            # attic must be patched to never serve pre-signed s3 urls directly
+            # otherwise it will redirect clients to this localhost endpoint
+            endpoint = "http://127.0.0.1:3900";
+          } else {
+            type = "local";
+            path = serviceDir;
+            # attic must be patched to never serve pre-signed s3 urls directly
+            # otherwise it will redirect clients to this localhost endpoint
+          };
+
+        garbage-collection = {
+          interval = "1 day";
+          default-retention-period = "3 months";
+        };
+
+        chunking = {
+          nar-size-threshold = if config.swarselmodules.server.garage then 0 else 64 * 1024; # 64 KiB
+
+          min-size = 16 * 1024; # 16 KiB
+          avg-size = 64 * 1024; # 64 KiB
+          max-size = 256 * 1024; # 256 KiBize = 262144;
+        };
+      };
+    };
+
+    services.postgresql = {
+      enable = true;
+      enableTCPIP = true;
+      ensureDatabases = [ serviceDB ];
+      ensureUsers = [
+        {
+          name = serviceDB;
+          ensureDBOwnership = true;
+        }
+      ];
+    };
+
+    systemd.services.atticd = lib.mkIf config.swarselmodules.server.garage {
+      requires = [ "garage.service" ];
+      after = [ "garage.service" ];
+    };
+
+    nodes.${serviceProxy}.services.nginx = {
+      upstreams = {
+        ${serviceName} = {
+          servers = {
+            "${serviceAddress}:${builtins.toString servicePort}" = { };
+          };
+        };
+      };
+      virtualHosts = {
+        "${serviceDomain}" = {
+          enableACME = true;
+          forceSSL = true;
+          acmeRoot = null;
+          oauth2.enable = false;
+          locations = {
+            "/" = {
+              proxyPass = "http://${serviceName}";
+              extraConfig = ''
+                client_max_body_size 0;
+              '';
+            };
+          };
+        };
+      };
+    };
+
+  };
+}