nixos/modules/services/databases/redis.nix

   1 { config, lib, pkgs, ... }:
   2
   3 with lib;
   4
   5 let
   6   cfg = config.services.redis;
   7
   8   mkValueString = value:
   9     if value == true then "yes"
  10     else if value == false then "no"
  11     else generators.mkValueStringDefault { } value;
  12
  13   redisConfig = settings: pkgs.writeText "redis.conf" (generators.toKeyValue
  14     {
  15       listsAsDuplicateKeys = true;
  16       mkKeyValue = generators.mkKeyValueDefault { inherit mkValueString; } " ";
  17     }
  18     settings);
  19
  20   redisName = name: "redis" + optionalString (name != "") ("-" + name);
  21   enabledServers = filterAttrs (_name: conf: conf.enable) config.services.redis.servers;
  22
  23 in
  24 {
  25   imports = [
  26     (mkRemovedOptionModule [ "services" "redis" "user" ] "The redis module now is hardcoded to the redis user.")
  27     (mkRemovedOptionModule [ "services" "redis" "dbpath" ] "The redis module now uses /var/lib/redis as data directory.")
  28     (mkRemovedOptionModule [ "services" "redis" "dbFilename" ] "The redis module now uses /var/lib/redis/dump.rdb as database dump location.")
  29     (mkRemovedOptionModule [ "services" "redis" "appendOnlyFilename" ] "This option was never used.")
  30     (mkRemovedOptionModule [ "services" "redis" "pidFile" ] "This option was removed.")
  31     (mkRemovedOptionModule [ "services" "redis" "extraConfig" ] "Use services.redis.settings instead.")
  32     (mkRenamedOptionModule [ "services" "redis" "enable" ] [ "services" "redis" "servers" "" "enable" ])
  33     (mkRenamedOptionModule [ "services" "redis" "port" ] [ "services" "redis" "servers" "" "port" ])
  34     (mkRenamedOptionModule [ "services" "redis" "openFirewall" ] [ "services" "redis" "servers" "" "openFirewall" ])
  35     (mkRenamedOptionModule [ "services" "redis" "bind" ] [ "services" "redis" "servers" "" "bind" ])
  36     (mkRenamedOptionModule [ "services" "redis" "unixSocket" ] [ "services" "redis" "servers" "" "unixSocket" ])
  37     (mkRenamedOptionModule [ "services" "redis" "unixSocketPerm" ] [ "services" "redis" "servers" "" "unixSocketPerm" ])
  38     (mkRenamedOptionModule [ "services" "redis" "logLevel" ] [ "services" "redis" "servers" "" "logLevel" ])
  39     (mkRenamedOptionModule [ "services" "redis" "logfile" ] [ "services" "redis" "servers" "" "logfile" ])
  40     (mkRenamedOptionModule [ "services" "redis" "syslog" ] [ "services" "redis" "servers" "" "syslog" ])
  41     (mkRenamedOptionModule [ "services" "redis" "databases" ] [ "services" "redis" "servers" "" "databases" ])
  42     (mkRenamedOptionModule [ "services" "redis" "maxclients" ] [ "services" "redis" "servers" "" "maxclients" ])
  43     (mkRenamedOptionModule [ "services" "redis" "save" ] [ "services" "redis" "servers" "" "save" ])
  44     (mkRenamedOptionModule [ "services" "redis" "slaveOf" ] [ "services" "redis" "servers" "" "slaveOf" ])
  45     (mkRenamedOptionModule [ "services" "redis" "masterAuth" ] [ "services" "redis" "servers" "" "masterAuth" ])
  46     (mkRenamedOptionModule [ "services" "redis" "requirePass" ] [ "services" "redis" "servers" "" "requirePass" ])
  47     (mkRenamedOptionModule [ "services" "redis" "requirePassFile" ] [ "services" "redis" "servers" "" "requirePassFile" ])
  48     (mkRenamedOptionModule [ "services" "redis" "appendOnly" ] [ "services" "redis" "servers" "" "appendOnly" ])
  49     (mkRenamedOptionModule [ "services" "redis" "appendFsync" ] [ "services" "redis" "servers" "" "appendFsync" ])
  50     (mkRenamedOptionModule [ "services" "redis" "slowLogLogSlowerThan" ] [ "services" "redis" "servers" "" "slowLogLogSlowerThan" ])
  51     (mkRenamedOptionModule [ "services" "redis" "slowLogMaxLen" ] [ "services" "redis" "servers" "" "slowLogMaxLen" ])
  52     (mkRenamedOptionModule [ "services" "redis" "settings" ] [ "services" "redis" "servers" "" "settings" ])
  53   ];
  54
  55   ###### interface
  56
  57   options = {
  58
  59     services.redis = {
  60       package = mkOption {
  61         type = types.package;
  62         default = pkgs.redis;
  63         defaultText = "pkgs.redis";
  64         description = "Which Redis derivation to use.";
  65       };
  66
  67       vmOverCommit = mkEnableOption ''
  68         setting of vm.overcommit_memory to 1
  69         (Suggested for Background Saving: http://redis.io/topics/faq)
  70       '';
  71
  72       servers = mkOption {
  73         type = with types; attrsOf (submodule ({ config, name, ... }: {
  74           options = {
  75             enable = mkEnableOption ''
  76               Redis server.
  77
  78               Note that the NixOS module for Redis disables kernel support
  79               for Transparent Huge Pages (THP),
  80               because this features causes major performance problems for Redis,
  81               e.g. (https://redis.io/topics/latency).
  82             '';
  83
  84             user = mkOption {
  85               type = types.str;
  86               default = redisName name;
  87               defaultText = "\"redis\" or \"redis-\${name}\" if name != \"\"";
  88               description = "The username and groupname for redis-server.";
  89             };
  90
  91             port = mkOption {
  92               type = types.port;
  93               default = 6379;
  94               description = "The port for Redis to listen to.";
  95             };
  96
  97             openFirewall = mkOption {
  98               type = types.bool;
  99               default = false;
 100               description = ''
 101                 Whether to open ports in the firewall for the server.
 102               '';
 103             };
 104
 105             bind = mkOption {
 106               type = with types; nullOr str;
 107               default = if name == "" then "127.0.0.1" else null;
 108               defaultText = "127.0.0.1 or null if name != \"\"";
 109               description = ''
 110                 The IP interface to bind to.
 111                 <literal>null</literal> means "all interfaces".
 112               '';
 113               example = "192.0.2.1";
 114             };
 115
 116             unixSocket = mkOption {
 117               type = with types; nullOr path;
 118               default = "/run/${redisName name}/redis.sock";
 119               defaultText = "\"/run/redis/redis.sock\" or \"/run/redis-\${name}/redis.sock\" if name != \"\"";
 120               description = "The path to the socket to bind to.";
 121             };
 122
 123             unixSocketPerm = mkOption {
 124               type = types.int;
 125               default = 660;
 126               description = "Change permissions for the socket";
 127               example = 600;
 128             };
 129
 130             logLevel = mkOption {
 131               type = types.str;
 132               default = "notice"; # debug, verbose, notice, warning
 133               example = "debug";
 134               description = "Specify the server verbosity level, options: debug, verbose, notice, warning.";
 135             };
 136
 137             logfile = mkOption {
 138               type = types.str;
 139               default = "/dev/null";
 140               description = "Specify the log file name. Also 'stdout' can be used to force Redis to log on the standard output.";
 141               example = "/var/log/redis.log";
 142             };
 143
 144             syslog = mkOption {
 145               type = types.bool;
 146               default = true;
 147               description = "Enable logging to the system logger.";
 148             };
 149
 150             databases = mkOption {
 151               type = types.int;
 152               default = 16;
 153               description = "Set the number of databases.";
 154             };
 155
 156             maxclients = mkOption {
 157               type = types.int;
 158               default = 10000;
 159               description = "Set the max number of connected clients at the same time.";
 160             };
 161
 162             save = mkOption {
 163               type = with types; listOf (listOf int);
 164               default = [ [ 900 1 ] [ 300 10 ] [ 60 10000 ] ];
 165               description = "The schedule in which data is persisted to disk, represented as a list of lists where the first element represent the amount of seconds and the second the number of changes.";
 166               example = [ [ 900 1 ] [ 300 10 ] [ 60 10000 ] ];
 167             };
 168
 169             slaveOf = mkOption {
 170               type = with types; nullOr (submodule ({ ... }: {
 171                 options = {
 172                   ip = mkOption {
 173                     type = str;
 174                     description = "IP of the Redis master";
 175                     example = "192.168.1.100";
 176                   };
 177
 178                   port = mkOption {
 179                     type = port;
 180                     description = "port of the Redis master";
 181                     default = 6379;
 182                   };
 183                 };
 184               }));
 185
 186               default = null;
 187               description = "IP and port to which this redis instance acts as a slave.";
 188               example = { ip = "192.168.1.100"; port = 6379; };
 189             };
 190
 191             masterAuth = mkOption {
 192               type = with types; nullOr str;
 193               default = null;
 194               description = ''If the master is password protected (using the requirePass configuration)
 195               it is possible to tell the slave to authenticate before starting the replication synchronization
 196               process, otherwise the master will refuse the slave request.
 197               (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';
 198             };
 199
 200             requirePass = mkOption {
 201               type = with types; nullOr str;
 202               default = null;
 203               description = ''
 204                 Password for database (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE).
 205                 Use requirePassFile to store it outside of the nix store in a dedicated file.
 206               '';
 207               example = "letmein!";
 208             };
 209
 210             requirePassFile = mkOption {
 211               type = with types; nullOr path;
 212               default = null;
 213               description = "File with password for the database.";
 214               example = "/run/keys/redis-password";
 215             };
 216
 217             appendOnly = mkOption {
 218               type = types.bool;
 219               default = false;
 220               description = "By default data is only periodically persisted to disk, enable this option to use an append-only file for improved persistence.";
 221             };
 222
 223             appendFsync = mkOption {
 224               type = types.str;
 225               default = "everysec"; # no, always, everysec
 226               description = "How often to fsync the append-only log, options: no, always, everysec.";
 227             };
 228
 229             slowLogLogSlowerThan = mkOption {
 230               type = types.int;
 231               default = 10000;
 232               description = "Log queries whose execution take longer than X in milliseconds.";
 233               example = 1000;
 234             };
 235
 236             slowLogMaxLen = mkOption {
 237               type = types.int;
 238               default = 128;
 239               description = "Maximum number of items to keep in slow log.";
 240             };
 241
 242             settings = mkOption {
 243               # TODO: this should be converted to freeformType
 244               type = with types; attrsOf (oneOf [ bool int str (listOf str) ]);
 245               default = { };
 246               description = ''
 247                 Redis configuration. Refer to
 248                 <link xlink:href="https://redis.io/topics/config"/>
 249                 for details on supported values.
 250               '';
 251               example = literalExample ''
 252                 {
 253                   loadmodule = [ "/path/to/my_module.so" "/path/to/other_module.so" ];
 254                 }
 255               '';
 256             };
 257           };
 258           config.settings = mkMerge [
 259             {
 260               port = if config.bind == null then 0 else config.port;
 261               daemonize = false;
 262               supervised = "systemd";
 263               loglevel = config.logLevel;
 264               logfile = config.logfile;
 265               syslog-enabled = config.syslog;
 266               databases = config.databases;
 267               maxclients = config.maxclients;
 268               save = map (d: "${toString (builtins.elemAt d 0)} ${toString (builtins.elemAt d 1)}") config.save;
 269               dbfilename = "dump.rdb";
 270               dir = "/var/lib/${redisName name}";
 271               appendOnly = config.appendOnly;
 272               appendfsync = config.appendFsync;
 273               slowlog-log-slower-than = config.slowLogLogSlowerThan;
 274               slowlog-max-len = config.slowLogMaxLen;
 275             }
 276             (mkIf (config.bind != null) { bind = config.bind; })
 277             (mkIf (config.unixSocket != null) {
 278               unixsocket = config.unixSocket;
 279               unixsocketperm = toString config.unixSocketPerm;
 280             })
 281             (mkIf (config.slaveOf != null) { slaveof = "${config.slaveOf.ip} ${toString config.slaveOf.port}"; })
 282             (mkIf (config.masterAuth != null) { masterauth = config.masterAuth; })
 283             (mkIf (config.requirePass != null) { requirepass = config.requirePass; })
 284           ];
 285         }));
 286         description = "Configuration of multiple <literal>redis-server</literal> instances.";
 287         default = { };
 288       };
 289     };
 290
 291   };
 292
 293
 294   ###### implementation
 295
 296   config = mkIf (enabledServers != { }) {
 297
 298     assertions = attrValues (mapAttrs
 299       (name: conf: {
 300         assertion = conf.requirePass != null -> conf.requirePassFile == null;
 301         message = ''
 302           You can only set one services.redis.servers.${name}.requirePass
 303           or services.redis.servers.${name}.requirePassFile
 304         '';
 305       })
 306       enabledServers);
 307
 308     boot.kernel.sysctl = mkMerge [
 309       { "vm.nr_hugepages" = "0"; }
 310       (mkIf cfg.vmOverCommit { "vm.overcommit_memory" = "1"; })
 311     ];
 312
 313     networking.firewall.allowedTCPPorts = concatMap
 314       (conf:
 315         optional conf.openFirewall conf.port
 316       )
 317       (attrValues enabledServers);
 318
 319     environment.systemPackages = [ cfg.package ];
 320
 321     users.users = mapAttrs'
 322       (name: _conf: nameValuePair (redisName name) {
 323         description = "System user for the redis-server instance ${name}";
 324         isSystemUser = true;
 325         group = redisName name;
 326       })
 327       enabledServers;
 328     users.groups = mapAttrs'
 329       (name: _conf: nameValuePair (redisName name) { })
 330       enabledServers;
 331
 332     systemd.services = mapAttrs'
 333       (name: conf: nameValuePair (redisName name) {
 334         description = "Redis Server - ${redisName name}";
 335
 336         wantedBy = [ "multi-user.target" ];
 337         after = [ "network.target" ];
 338
 339         serviceConfig = {
 340           ExecStart = "${cfg.package}/bin/redis-server /run/${redisName name}/redis.conf";
 341           ExecStartPre = [
 342             ("+" + pkgs.writeShellScript "${redisName name}-credentials" (''
 343               install -o '${conf.user}' -m 600 ${redisConfig conf.settings} /run/${redisName name}/redis.conf
 344             '' + optionalString (conf.requirePassFile != null) ''
 345               {
 346                 printf requirePass' '
 347                 cat ${escapeShellArg conf.requirePassFile}
 348               } >>/run/${redisName name}/redis.conf
 349             '')
 350             )
 351           ];
 352           Type = "notify";
 353           # User and group
 354           User = conf.user;
 355           Group = conf.user;
 356           # Runtime directory and mode
 357           RuntimeDirectory = redisName name;
 358           RuntimeDirectoryMode = "0750";
 359           # State directory and mode
 360           StateDirectory = redisName name;
 361           StateDirectoryMode = "0700";
 362           # Access write directories
 363           UMask = "0077";
 364           # Capabilities
 365           CapabilityBoundingSet = "";
 366           # Security
 367           NoNewPrivileges = true;
 368           # Process Properties
 369           LimitNOFILE = mkDefault "${toString (conf.maxclients + 32)}";
 370           # Sandboxing
 371           ProtectSystem = "strict";
 372           ProtectHome = true;
 373           PrivateTmp = true;
 374           PrivateDevices = true;
 375           PrivateUsers = true;
 376           ProtectClock = true;
 377           ProtectHostname = true;
 378           ProtectKernelLogs = true;
 379           ProtectKernelModules = true;
 380           ProtectKernelTunables = true;
 381           ProtectControlGroups = true;
 382           RestrictAddressFamilies =
 383             optionals (conf.bind != null) [ "AF_INET" "AF_INET6" ] ++
 384             optional (conf.unixSocket != null) "AF_UNIX";
 385           RestrictNamespaces = true;
 386           LockPersonality = true;
 387           MemoryDenyWriteExecute = true;
 388           RestrictRealtime = true;
 389           RestrictSUIDSGID = true;
 390           PrivateMounts = true;
 391           # System Call Filtering
 392           SystemCallArchitectures = "native";
 393           SystemCallFilter = "~@cpu-emulation @debug @keyring @memlock @mount @obsolete @privileged @resources @setuid";
 394         };
 395       })
 396       enabledServers;
 397
 398   };
 399 }