{ config, lib, this, ... }: with lib; let cfg = config.nixfiles.modules.ipfs; gatewayDefaultPort = 6001; apiDefaultPort = 5001; swarmDefaultPort = 4001; in { options.nixfiles.modules.ipfs = { enable = mkEnableOption "IPFS daemon"; domain = mkOption { description = "Domain name sans protocol scheme."; type = with types; str; default = "ipfs.${config.networking.fqdn}"; }; gatewayPort = mkOption { description = "Gateway port."; type = with types; port; default = if this.isHeadless then gatewayDefaultPort + 990 else gatewayDefaultPort; }; apiPort = mkOption { description = "API port."; type = with types; port; default = if this.isHeadless then apiDefaultPort + 990 else apiDefaultPort; }; swarmPort = mkOption { description = "Swarm port."; type = with types; port; default = swarmDefaultPort; }; }; config = mkIf cfg.enable (mkMerge [ { services.kubo = { enable = true; user = my.username; inherit (config.my) group; dataDir = "${config.dirs.data}/ipfs"; autoMigrate = true; autoMount = true; emptyRepo = true; enableGC = true; # https://github.com/ipfs/kubo/blob/master/docs/config.md settings = mkMerge [ ( let filterAddresses = [ "/ip4/100.64.0.0/ipcidr/10" "/ip4/169.254.0.0/ipcidr/16" "/ip4/172.16.0.0/ipcidr/12" "/ip4/192.0.0.0/ipcidr/24" "/ip4/192.0.2.0/ipcidr/24" "/ip4/192.168.0.0/ipcidr/16" "/ip4/198.18.0.0/ipcidr/15" "/ip4/198.51.100.0/ipcidr/24" "/ip4/203.0.113.0/ipcidr/24" "/ip4/240.0.0.0/ipcidr/4" "/ip6/100::/ipcidr/64" "/ip6/2001:2::/ipcidr/48" "/ip6/2001:db8::/ipcidr/32" "/ip6/fe80::/ipcidr/10" ] ++ optionals (!hasAttr "wireguard" this) [ "/ip4/10.0.0.0/ipcidr/8" "/ip6/fc00::/ipcidr/7" ]; in { Addresses = { API = "/ip4/127.0.0.1/tcp/${toString cfg.apiPort}"; Gateway = "/ip4/127.0.0.1/tcp/${toString cfg.gatewayPort}"; Swarm = let port = toString cfg.swarmPort; in [ "/ip4/0.0.0.0/tcp/${port}" "/ip6/::/tcp/${port}" "/ip4/0.0.0.0/udp/${port}/quic" "/ip4/0.0.0.0/udp/${port}/quic-v1" "/ip4/0.0.0.0/udp/${port}/quic-v1/webtransport" "/ip6/::/udp/${port}/quic" "/ip6/::/udp/${port}/quic-v1" "/ip6/::/udp/${port}/quic-v1/webtransport" ]; NoAnnounce = filterAddresses; }; Swarm.AddrFilters = filterAddresses; } ) ]; localDiscovery = true; startWhenNeeded = true; }; networking.firewall = rec { allowedTCPPorts = [swarmDefaultPort]; allowedUDPPorts = allowedTCPPorts; }; } (mkIf this.isHeadless { nixfiles.modules.nginx = { enable = true; upstreams = with cfg; { kubo_gateway.servers."127.0.0.1:${toString gatewayPort}" = {}; kubo_api.servers."127.0.0.1:${toString apiPort}" = {}; }; virtualHosts = { ${cfg.domain} = { locations."/".proxyPass = "http://kubo_gateway"; extraConfig = nginxInternalOnly; }; "api.${cfg.domain}" = { locations = { "/".proxyPass = "http://kubo_api"; "~ ^/$".return = "301 http${ optionalString config.nixfiles.modules.acme.enable "s" }://api.${cfg.domain}/webui"; }; extraConfig = nginxInternalOnly; }; }; }; }) ]); }