Unverified Commit 7ece4270 authored by Weijia Wang's avatar Weijia Wang Committed by GitHub
Browse files

Merge pull request #279268 from superherointj/etcd-fix-firewall-startup 

nixos/etcd: fixes etcd failing to start at boot and add openFirewall option
parents b784eff4 cbe8e0c9

nixos/modules/module-list.nix

+1 −1
Original line number Diff line number Diff line
@@ -429,6 +429,7 @@ 
  ./services/databases/couchdb.nix

  ./services/databases/dgraph.nix

  ./services/databases/dragonflydb.nix

  ./services/databases/etcd.nix

  ./services/databases/ferretdb.nix

  ./services/databases/firebird.nix

  ./services/databases/foundationdb.nix
@@ -679,7 +680,6 @@ 
  ./services/misc/dwm-status.nix

  ./services/misc/dysnomia.nix

  ./services/misc/errbot.nix

  ./services/misc/etcd.nix

  ./services/misc/etebase-server.nix

  ./services/misc/etesync-dav.nix

  ./services/misc/evdevremapkeys.nix

nixos/modules/services/misc/etcd.nix→nixos/modules/services/databases/etcd.nix

+24 −1
Original line number Diff line number Diff line
@@ -99,6 +99,17 @@ in { 
      type = types.nullOr types.path;

    };



    openFirewall = mkOption {

      type = types.bool;

      default = false;

      description = lib.mdDoc ''

        Open etcd ports in the firewall.

        Ports opened:

        - 2379/tcp for client requests

        - 2380/tcp for peer communication

      '';

    };



    peerCertFile = mkOption {

      description = lib.mdDoc "Cert file to use for peer to peer communication";

      default = cfg.certFile;
@@ -160,7 +171,10 @@ in { 
    systemd.services.etcd = {

      description = "etcd key-value store";

      wantedBy = [ "multi-user.target" ];

      after = [ "network.target" ];

      after = [ "network-online.target" ]

        ++ lib.optional config.networking.firewall.enable "firewall.service";

      wants = [ "network-online.target" ]

        ++ lib.optional config.networking.firewall.enable "firewall.service";



      environment = (filterAttrs (n: v: v != null) {

        ETCD_NAME = cfg.name;
@@ -190,6 +204,8 @@ in { 


      serviceConfig = {

        Type = "notify";

        Restart = "always";

        RestartSec = "30s";

        ExecStart = "${cfg.package}/bin/etcd";

        User = "etcd";

        LimitNOFILE = 40000;
@@ -198,6 +214,13 @@ in { 


    environment.systemPackages = [ cfg.package ];



    networking.firewall = lib.mkIf cfg.openFirewall {

      allowedTCPPorts = [

        2379 # for client requests

        2380 # for peer communication

      ];

    };



    users.users.etcd = {

      isSystemUser = true;

      group = "etcd";