tower: set up postgres

1 files changed, 50 insertions, 0 deletions

diff --git a/hosts/tower/postgres.nix b/hosts/tower/postgres.nix
new file mode 100644
index 0000000..67c9fdd
--- /dev/null
+++ b/hosts/tower/postgres.nix
@@ -0,0 +1,50 @@
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
+let
+  newPostgres = pkgs.postgresql_18_jit;
+  cfg = config.services.postgresql;
+  upgrade-pg-cluster = pkgs.writeScriptBin "upgrade-pg-cluster" ''
+    set -eux
+    systemctl stop postgresql
+
+    export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
+    export NEWBIN="${newPostgres}/bin"
+
+    export OLDDATA="${cfg.dataDir}"
+    export OLDBIN="${cfg.finalPackage}/bin"
+
+    install -d -m 0700 -o postgres -g postgres "$NEWDATA"
+    cd "$NEWDATA"
+    sudo -u postgres "$NEWBIN/initdb" -D "$NEWDATA" ${lib.escapeShellArgs cfg.initdbArgs}
+
+    sudo -u postgres "$NEWBIN/pg_upgrade" \
+      --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
+      --old-bindir "$OLDBIN" --new-bindir "$NEWBIN" \
+      "$@"
+  '';
+in
+{
+  services.postgresql = {
+    enable = true;
+    package = pkgs.postgresql_18_jit;
+    enableTCPIP = true;
+    enableJIT = true;
+
+    settings = {
+      password_encryption = "scram-sha-256";
+    };
+
+    authentication = ''
+      # TYPE  DATABASE  USER        ADDRESS  METHOD
+      local   all       all                  peer
+      host    all       postgres    all      reject
+      host    all       all         all      scram-sha-256
+    '';
+  }; # end of services.postgreslq
+
+  environment.systemPackages = [ upgrade-pg-cluster ];
+}