From c68118ce651adde39bbb6352151deedb72cecf86 Mon Sep 17 00:00:00 2001 From: Pascal Bach Date: Sun, 10 Sep 2017 09:39:26 +0200 Subject: [PATCH 1/2] glusterfs service: add support for TLS communication TLS settings are implemented as submodule. --- .../network-filesystems/glusterfs.nix | 61 +++++++++++++++++++ 1 file changed, 61 insertions(+) diff --git a/nixos/modules/services/network-filesystems/glusterfs.nix b/nixos/modules/services/network-filesystems/glusterfs.nix index 7454eeef803..ae4f4521cf2 100644 --- a/nixos/modules/services/network-filesystems/glusterfs.nix +++ b/nixos/modules/services/network-filesystems/glusterfs.nix @@ -5,6 +5,22 @@ with lib; let inherit (pkgs) glusterfs rsync; + tlsCmd = if (cfg.tlsSettings != null) then + '' + mkdir -p /var/lib/glusterd + touch /var/lib/glusterd/secure-access + '' + else + '' + rm -f /var/lib/glusterd/secure-access + ''; + + restartTriggers = if (cfg.tlsSettings != null) then [ + config.environment.etc."ssl/glusterfs.pem".source + config.environment.etc."ssl/glusterfs.key".source + config.environment.etc."ssl/glusterfs.ca".source + ] else []; + cfg = config.services.glusterfs; in @@ -30,6 +46,41 @@ in description = "Extra flags passed to the GlusterFS daemon"; default = []; }; + + tlsSettings = mkOption { + description = '' + Make the server communicate via TLS. + This means it will only connect to other gluster + servers having certificates signed by the same CA. + + Enabling this will create a file /var/lib/glusterd/secure-access. + Disabling will delete this file again. + + See also: https://gluster.readthedocs.io/en/latest/Administrator%20Guide/SSL/ + ''; + default = null; + type = types.nullOr (types.submodule { + options = { + tlsKey = mkOption { + default = null; + type = types.path; + description = "Path to the private key used for TLS."; + }; + + tlsPem = mkOption { + default = null; + type = types.path; + description = "Path to the certificate used for TLS."; + }; + + caCert = mkOption { + default = null; + type = types.path; + description = "Path certificate authority used to sign the cluster certificates."; + }; + }; + }); + }; }; }; @@ -40,7 +91,14 @@ in services.rpcbind.enable = true; + environment.etc = mkIf (cfg.tlsSettings != null) { + "ssl/glusterfs.pem".source = cfg.tlsSettings.tlsPem; + "ssl/glusterfs.key".source = cfg.tlsSettings.tlsKey; + "ssl/glusterfs.ca".source = cfg.tlsSettings.caCert; + }; + systemd.services.glusterd = { + inherit restartTriggers; description = "GlusterFS, a clustered file-system server"; @@ -57,6 +115,8 @@ in + '' mkdir -p /var/lib/glusterd/hooks/ ${rsync}/bin/rsync -a ${glusterfs}/var/lib/glusterd/hooks/ /var/lib/glusterd/hooks/ + + ${tlsCmd} '' # `glusterfind` needs dirs that upstream installs at `make install` phase # https://github.com/gluster/glusterfs/blob/v3.10.2/tools/glusterfind/Makefile.am#L16-L17 @@ -75,6 +135,7 @@ in }; systemd.services.glustereventsd = { + inherit restartTriggers; description = "Gluster Events Notifier"; From 8ed758696c321a84b3d3d5d08b6bfa004779f211 Mon Sep 17 00:00:00 2001 From: Pascal Bach Date: Sun, 17 Sep 2017 18:49:02 +0200 Subject: [PATCH 2/2] gluster service: use str instead of path for private key This pervents the user from accidently commiting the key to the nix store. If providing a path instead of a string. --- nixos/modules/services/network-filesystems/glusterfs.nix | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/nixos/modules/services/network-filesystems/glusterfs.nix b/nixos/modules/services/network-filesystems/glusterfs.nix index ae4f4521cf2..e7f52bc4a7d 100644 --- a/nixos/modules/services/network-filesystems/glusterfs.nix +++ b/nixos/modules/services/network-filesystems/glusterfs.nix @@ -61,9 +61,9 @@ in default = null; type = types.nullOr (types.submodule { options = { - tlsKey = mkOption { + tlsKeyPath = mkOption { default = null; - type = types.path; + type = types.str; description = "Path to the private key used for TLS."; }; @@ -93,7 +93,7 @@ in environment.etc = mkIf (cfg.tlsSettings != null) { "ssl/glusterfs.pem".source = cfg.tlsSettings.tlsPem; - "ssl/glusterfs.key".source = cfg.tlsSettings.tlsKey; + "ssl/glusterfs.key".source = cfg.tlsSettings.tlsKeyPath; "ssl/glusterfs.ca".source = cfg.tlsSettings.caCert; };