94 lines
2.3 KiB
Nix
94 lines
2.3 KiB
Nix
# NixOps configuration for the hosts running a Cardano node
|
|
{
|
|
config,
|
|
inputs,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}: let
|
|
cardanoNodeProject = import (inputs.cardano-node + "/nix") {
|
|
gitrev = inputs.cardano-node.rev;
|
|
};
|
|
in {
|
|
age.secrets = {
|
|
cardano-kes = {
|
|
file = ../secrets/cardano/cardano-kes.age;
|
|
path = "/run/keys/cardano-kes";
|
|
owner = "cardano-node";
|
|
group = "cardano-node";
|
|
mode = "0600";
|
|
};
|
|
cardano-opcert = {
|
|
file = ../secrets/cardano/cardano-opcert.age;
|
|
path = "/run/keys/cardano-opcert";
|
|
owner = "cardano-node";
|
|
group = "cardano-node";
|
|
mode = "0600";
|
|
};
|
|
cardano-vrf = {
|
|
file = ../secrets/cardano/cardano-vrf.age;
|
|
path = "/run/keys/cardano-vrf";
|
|
owner = "cardano-node";
|
|
group = "cardano-node";
|
|
mode = "0600";
|
|
};
|
|
};
|
|
|
|
#imports = [../secrets/cardano/producers.nix];
|
|
|
|
environment.systemPackages = [inputs.cardano-node.packages.${pkgs.system}.cardano-cli];
|
|
|
|
services = {
|
|
cardano-node = {
|
|
enable = true;
|
|
environment = "mainnet";
|
|
hostAddr = "0.0.0.0";
|
|
nodeConfig =
|
|
inputs.cardano-node.environments.x86_64-linux.mainnet
|
|
// {
|
|
Protocol = "Cardano";
|
|
hasPrometheus = ["127.0.0.1" 12798];
|
|
setupScribes = [
|
|
{
|
|
scKind = "JournalSK";
|
|
scName = "cardano";
|
|
scFormat = "ScText";
|
|
}
|
|
];
|
|
defaultScribes = [["JournalSK" "cardano"]];
|
|
};
|
|
kesKey = "${config.age.secrets.cardano-kes.path}";
|
|
vrfKey = "${config.age.secrets.cardano-vrf.path}";
|
|
operationalCertificate = "${config.age.secrets.cardano-opcert.path}";
|
|
};
|
|
};
|
|
|
|
systemd = {
|
|
services = {
|
|
cardano-node = {
|
|
# Ensure cardano-node starts after nixops keys are loaded
|
|
after = [
|
|
"cardano-kes-key.service"
|
|
"cardano-opcert-key.service"
|
|
"cardano-vrf-key.service"
|
|
];
|
|
wants = [
|
|
"cardano-kes-key.service"
|
|
"cardano-opcert-key.service"
|
|
"cardano-vrf-key.service"
|
|
];
|
|
};
|
|
};
|
|
};
|
|
|
|
networking = {
|
|
firewall = {
|
|
allowedTCPPorts = [
|
|
3001 # cardano-node
|
|
];
|
|
};
|
|
};
|
|
|
|
users.groups.keys.members = ["cardano-node"]; # Required due to NixOps issue #1204
|
|
}
|