Rewriting our Object Cloud

We look at the number of connected repositories:

# nix-channel --list
nixos https://nixos.org/channels/nixos-23.05

Add a channel from which the system will receive “unstable” packets:

nix-channel --add https://nixos.org/channels/nixpkgs-unstable unstable

Add Unstable channel:

{ config, pkgs, lib, modulesPath, ... }:


let
  unstableTarball =
    fetchTarball
      https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz;
in
#####
{
  imports =
    [ # Include the results of the hardware scan.
      ./hardware-configuration.nix
#      ./apps/minio-server.nix
    ];
######

Update the list of repositories:

# nix-channel --update

unpacking channels...
и 

# nix search package

# nix-env -f channel:nixpkgs-unstable -iA

services.caddy = {
  enable = true;
    extraConfig =
    ''
      localhost {
        header /* {
                -Server
                Permissions-Policy interest-cohort=()
                Strict-Transport-Security max-age=31536000;
                X-Content-Type-Options nosniff
                X-Frame-Options DENY
               Referrer-Policy no-referrer-when-downgrade
        }
        route /console/* {
                uri strip_prefix /console
                reverse_proxy http://127.0.0.1:9001
        }'';
};

We remember that last time there was a problematic version of minio-server from the package manager, so we install it from unstable-channel

nix-env -f channel:nixpkgs-unstable -iA minio

gives us the version that is currently the most recent:

# minio -v
minio version RELEASE.2023-08-16T20-17-30Z (commit-id=RELEASE.2023-08-16T20-17-30Z)
Runtime: go1.20.7 linux/amd64
License: GNU AGPLv3 <https://www.gnu.org/licenses/agpl-3.0.html>
Copyright: 2015-0000 MinIO, Inc.

and remove it:

nix-env --uninstall minio

и закомментируем строчки:
#       minio
#       minio-client
И сервис наш тоже
выполняем нашу любимую команду и чистим кэш
nixos-rebuild switch && nix-collect-garbage 

now, let’s think about how to implement this in the configuration file:

go to config

nano /etc/nixos/configuration.nix 

Next we go to a complete reinstallation of Minio

Let’s clean up our storage (since this is a test machine and the data is not really needed, we take risky steps)

#       unstable.minio
#       unstable.minio-client
И сервис наш тоже
выполняем нашу любимую команду и чистим кэш
nixos-rebuild switch && nix-collect-garbage 

uncomment and update our lines

       unstable.minio
       unstable.minio-client

update config

systemd.services.minioserver = {
      enable = true;
      description = "MinioServer" ;
      wantedBy = [ "default.target" ];
      serviceConfig = {
        EnvironmentFile= "/etc/default/minio";
        ExecStart = "${pkgs.minio}/bin/minio server --json $MINIO_OPTS $MINIO_VOLUMES ";# ExecStop = " ";
        Type = "notify";
        Restart   = "always";
        LimitNOFILE="1048576";
        TimeoutStopSec="infinity";
        SendSIGKILL="no";
        User="root";;
        Group= "root"; 
        ProtectProc="invisible";
    };
};
а этот сервис нам поможет по новой не прописывать алиас на наш сервер.
Да и в случае чего можно дополнить нужными нам командами,например- статистикой.
systemd.services.minio-config = {
    enable = true;
    path = [ pkgs.minio pkgs.minio-client];
    requiredBy = [ "multi-user.target" ];
    after = [ "minioserver.service" ];
    serviceConfig = {
      Type = "simple";
      User = "root";
      Group = "root";
    };
    script=""
      set -e
      mc alias set mys3 http://localhost:9000 barsik barsikpassword
    '';
};

It remains to update the configuration.

We clear everything as in the minio example and rewrite it.

прописываем вместо prometheus
environment.systemPackages = with pkgs; [
   ...
  unstable.prometheus #prometheus
   ...
];

since our credentials are (most likely) no longer valid and update the alias

#Здесь мы пойдем по пути меньшего сопротивления,
# потому что мы уверены на 1000%,что на него имеем доступ только мы.
#Но если это не так то делаем по аналогии,как это было в 1й части.
mc alias set mylocal http://localhost:3000 barsik barsikpassword

and generate a config for prometheus:

# mc admin prometheus generate mylocal
scrape_configs:
- job_name: minio-job
  bearer_token: eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJwcm9tZXRoZXVzIiwic3ViIjoiYmFyc2lrIiwiZXhwIjo0ODQ2OTE2OTU2fQ.TBElC01EHRxMdjmbSmgaZsbA3scZS3FnxCP2CGZacmHEbOCSPj5YWHyLnayWsgK56QwNNSd8OJvrV8sU3t9wbw
  metrics_path: /minio/v2/metrics/cluster
  scheme: http
  static_configs:
  - targets: ['localhost:9000']

write to the service:

services.prometheus = {
        enable = true;
        scrapeConfigs = [{
                job_name = "minio-job";
                bearer_token = "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJwcm9tZXRoZXVzIiwic3ViIjoiYmFyc2lrIiwiZXhwIjo0ODQ2OTE2OTU2fQ.TBElC01EHRxMdjmbSmgaZsbA3scZS3FnxCP2CGZacmHEbOCSPj5YWHyLnayWsgK56QwNNSd8OJvrV8sU3t9w>                metrics_path = "/minio/v2/metrics/cluster";
                scheme = "http";
                static_configs = [{
                                 targets = ["localhost:9000"];
                                 labels = { alias = "minio"; };
                        }];
        }];
};

Our signature:

nixos-rebuild switch
и смотрим ,что с прометеусом:
# systemctl status prometheus.service
● prometheus.service
     Loaded: loaded (/etc/systemd/system/prometheus.service; enabled; preset: enabled)
     Active: active (running) since Tue 2023-08-29 20:07:12 MSK; 3s ago
   Main PID: 60628 (prometheus)
         IP: 0B in, 0B out
         IO: 140.0K read, 0B written
      Tasks: 7 (limit: 4694)
     Memory: 15.6M
        CPU: 432ms
     CGroup: /system.slice/prometheus.service

That is, it is running and the graphs are already available in the Web-console

services.postgresql = {
  enable = true;
  ensureDatabases = [ "miniodb" ];
  enableTCPIP = true;

  authentication = pkgs.lib.mkOverride 10 ''
      #type database  DBuser  auth-method
      local all       all     trust
      host  all      all     127.0.0.1/32   trust
    # ipv6
      host all       all     ::1/128        trust
    '';
  initialScript = pkgs.writeText "backend-initScript" ''
      CREATE ROLE minio WITH LOGIN PASSWORD 'minio' CREATEDB;
      CREATE DATABASE minio;
      GRANT ALL PRIVILEGES ON DATABASE minio TO minio;
  '';
};

if we want to see what exactly is in the database and table:

# sudo -u postgres psql
psql (14.9)
Type "help" for help.

postgres=# \l
                                  List of databases
   Name    |  Owner   | Encoding |   Collate   |    Ctype    |   Access privileges
-----------+----------+----------+-------------+-------------+-----------------------
 minio     | postgres | UTF8     | en_US.UTF-8 | en_US.UTF-8 | =Tc/postgres         +
           |          |          |             |             | postgres=CTc/postgres+
           |          |          |             |             | minio=CTc/postgres
 miniodb   | postgres | UTF8     | en_US.UTF-8 | en_US.UTF-8 |
 postgres  | postgres | UTF8     | en_US.UTF-8 | en_US.UTF-8 |
 template0 | postgres | UTF8     | en_US.UTF-8 | en_US.UTF-8 | =c/postgres          +
           |          |          |             |             | postgres=CTc/postgres
 template1 | postgres | UTF8     | en_US.UTF-8 | en_US.UTF-8 | =c/postgres          +
           |          |          |             |             | postgres=CTc/postgres
(5 rows)

minio=#  \dt
       List of relations
 Schema | Name  | Type  | Owner
--------+-------+-------+-------
 public | minio | table | minio
(1 row)

minio=#  \dt+
                                    List of relations
 Schema | Name  | Type  | Owner | Persistence | Access method |    Size    | Description
--------+-------+-------+-------+-------------+---------------+------------+-------------
 public | minio | table | minio | permanent   | heap          | 8192 bytes |
(1 row)

# SELECT * FROM minio;
 key | value
-----+-------
(0 rows)

or in console:

устанавливаем jq:
 nixos-env -i jq
Ищем наш ARN
  mc admin info --json mys3/backup | jq .info.sqsARN
arn:minio:sqs::PG1:postgresql
прописываем ARN
mc event add --event "put,get,delete" mys3/backup arn:minio:sqs::PG1:postgresql

sudo -u postgres psql
psql (14.9)
Type "help" for help.

postgres=#\c minio
You are now connected to database "minio" as user "postgres".
minio=# SELECT * FROM minio1;
minio=# minio=# SELECT * FROM minio;