infra.data

HTTP basic auth in front of pgweb. Set false to rely solely on the network gate — tailnet reachability via tailscale serve + the headscale ACL (ADR-036). Acceptable for this read-only, --bookmarks-only UI; note the ACL is currently wide-open *:*, so “on the tailnet” today means any tailnet node, not just admins.

Type: boolean

Default:

true

Declared by: nix/modules/infra/data/pgweb

`infra.data.pgweb.authUser`

HTTP basic auth username (password from SOPS services/pgweb/auth_password). Only used when auth.enable.

Type: string

Default:

config.fleet.settings.name

Declared by: nix/modules/infra/data/pgweb

`infra.data.pgweb.enable`

Whether to enable pgweb — read-only Postgres web UI for the whole fleet.

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/data/pgweb

`infra.data.pgweb.httpPort`

Local HTTP port (proxied by the per-host Caddy).

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

Declared by: nix/modules/infra/data/pgweb

`infra.data.postgresql`

`infra.data.postgresql.allowedSubnets`

Subnets allowed to connect via TCP. Defaults to the fleet LAN CIDR when fleet.settings.network.lanCidr is set, otherwise [] (local connections only).

Type: list of string

Default:

[ config.fleet.settings.network.lanCidr ]

Example:

[
  "192.0.2.0/24"
]

Declared by: nix/modules/infra/data/postgresql

`infra.data.postgresql.authMethod`

Authentication method for network connections.

Type: one of "scram-sha-256", "md5", "trust"

Default:

"scram-sha-256"

Declared by: nix/modules/infra/data/postgresql

`infra.data.postgresql.backup.enable`

Whether to enable pgbackrest → Garage S3 backup for this PG host.

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/data/postgresql/pgbackrest.nix

`infra.data.postgresql.backup.retention.profile`

Retention profile — switchable per-host without re-bootstrapping the stanza. Bumping the profile keeps existing backups; lowering it prunes on next run.

lean — 1 full + WAL covering it (~7d window). MVP / disk-constrained default. ~10 GB stored per DB.
standard — 2 fulls + WAL covering them (~14d window). Production default. ~25 GB stored per DB.
conservative — 4 fulls + WAL covering them (~28d window). Bug-mitigation cushion. ~50 GB stored per DB.

WAL archive retention follows the kept fulls automatically via repo1-retention-archive-type=full.

Type: one of "lean", "standard", "conservative"

Default:

"lean"

Declared by: nix/modules/infra/data/postgresql/pgbackrest.nix

`infra.data.postgresql.backup.s3.accessKeyIdSecret`

SOPS path whose decrypted file contains the S3 access key id.

Type: string

Default: none (required when its feature is enabled)

Example:

"integrations/pgbackrest/analytics/access_key_id"

Declared by: nix/modules/infra/data/postgresql/pgbackrest.nix

`infra.data.postgresql.backup.s3.bucket`

Garage bucket. Provisioned by infra.data.s3 on the s3 host.

Type: string

Default:

"pg-backups"

Declared by: nix/modules/infra/data/postgresql/pgbackrest.nix

`infra.data.postgresql.backup.s3.endpoint`

S3 endpoint URL. Typically an in-fleet Garage behind Caddy TLS (an s3.<zone> vhost with a step-ca cert trusted fleet-wide via security.pki). pgbackrest’s S3 client REQUIRES https (it rejects an http:// endpoint with a FormatError and has no plaintext mode), so we must go through the TLS front — Garage’s direct :3900 is plaintext and cannot be used here.

This name resolves via the fleet’s normal DNS (CoreDNS). We do NOT pin it in /etc/hosts: a brief CoreDNS gap (e.g. a netgate redeploy) is one the postgres WAL archiver simply retries and drains, and hardcoding the s3 host IP would silently SHADOW correct DNS if that host ever moved — a worse failure than the one it guards. The durable safeguard for a sustained S3/DNS outage (the INFRA-91 scenario, where WAL piled to 123 GB unnoticed) is archive-failure alerting, tracked in INFRA-133 — not a static hosts entry.

Type: string

Default: none (required when its feature is enabled)

Example:

"https://s3.example.lan"

Declared by: nix/modules/infra/data/postgresql/pgbackrest.nix

`infra.data.postgresql.backup.s3.region`

S3 region label. Garage ignores it; SDK clients require some value.

Type: string

Default:

"us-east-1"

Declared by: nix/modules/infra/data/postgresql/pgbackrest.nix

`infra.data.postgresql.backup.s3.secretAccessKeySecret`

SOPS path whose decrypted file contains the S3 secret access key.

Type: string

Default: none (required when its feature is enabled)

Example:

"integrations/pgbackrest/analytics/secret_access_key"

Declared by: nix/modules/infra/data/postgresql/pgbackrest.nix

`infra.data.postgresql.backup.schedule.diff`

systemd OnCalendar expression for differential backups. Each diff captures changes since the most recent full, so on Sunday it inherits from Saturday’s full.

Type: string

Default:

"Mon..Sat 02:00"

Declared by: nix/modules/infra/data/postgresql/pgbackrest.nix

`infra.data.postgresql.backup.schedule.full`

systemd OnCalendar expression for weekly full backups.

Type: string

Default:

"Sun 02:00"

Declared by: nix/modules/infra/data/postgresql/pgbackrest.nix

`infra.data.postgresql.backup.stanza`

pgbackrest stanza name. Conventionally the short DB role (e.g. “analytics”, “app”, “timescale”). Used as the S3 prefix inside the shared pg-backups bucket so multiple DB hosts can coexist without colliding on object names.

Type: string

Default: none (required when its feature is enabled)

Example:

"analytics"

Declared by: nix/modules/infra/data/postgresql/pgbackrest.nix

`infra.data.postgresql.dataDir`

Directory for PostgreSQL data.

Type: string

Default:

"/var/lib/postgresql/16"

Declared by: nix/modules/infra/data/postgresql

`infra.data.postgresql.databases`

Databases to provision declaratively. Each key is the database name. Roles are created with login privileges and passwords set from sops secrets. The role is granted ownership of its database.

Type: attribute set of (submodule)

Default:

{ }

Example:

{
  komodo = {
    passwordSecret = "komodo/db_password";
    user = "komodo";
  };
}

Declared by: nix/modules/infra/data/postgresql

`infra.data.postgresql.databases.<name>.passwordSecret`

Sops key path whose decrypted file contains the role password.

Type: string

Default: none (required when its feature is enabled)

Example:

"dbs/app/password"

Declared by: nix/modules/infra/data/postgresql

`infra.data.postgresql.databases.<name>.user`

Role name (created with LOGIN and DB ownership).

Type: string

Default: none (required when its feature is enabled)

Example:

"appuser"

Declared by: nix/modules/infra/data/postgresql

`infra.data.postgresql.effectiveCacheSize`

Planner estimate of OS file cache size.

Type: string

Default:

"3GB"

Declared by: nix/modules/infra/data/postgresql

`infra.data.postgresql.enable`

Whether to enable PostgreSQL server for platform services.

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/data/postgresql

`infra.data.postgresql.maintenanceWorkMem`

Memory for maintenance operations (VACUUM, CREATE INDEX).

Type: string

Default:

"256MB"

Declared by: nix/modules/infra/data/postgresql

`infra.data.postgresql.maxConnections`

Maximum number of concurrent connections.

Type: signed integer

Default:

Declared by: nix/modules/infra/data/postgresql

`infra.data.postgresql.package`

PostgreSQL package to use.

Type: package

Default:

pkgs.postgresql_16

Declared by: nix/modules/infra/data/postgresql

`infra.data.postgresql.pgwebAccess.databases`

Database names to expose in pgweb. The core module exports attrNames of infra.data.postgresql.databases automatically; hosts whose databases exist only at runtime (pgbackrest restores) list them explicitly in their host file. List definitions merge by concatenation.

Type: list of string

Default:

[ ]

Example:

[
  "appdb"
  "analytics"
]

Declared by: nix/modules/infra/data/postgresql/pgweb-access.nix

`infra.data.postgresql.pgwebAccess.enable`

Advertise this host’s databases to the fleet pgweb instance and provision the read-only pgweb role. Inert while databases is empty. Set false to keep a Postgres host out of pgweb.

Type: boolean

Default:

true

Declared by: nix/modules/infra/data/postgresql/pgweb-access.nix

`infra.data.postgresql.pgwebAccess.pgwebHostIp`

Internal IP of the pgweb LXC — pg_hba scope for the pgweb role.

Type: string

Default: none (required when its feature is enabled)

Example:

"192.0.2.10"

Declared by: nix/modules/infra/data/postgresql/pgweb-access.nix

`infra.data.postgresql.pgwebAccess.port`

Port the pgweb LXC should connect to.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

Declared by: nix/modules/infra/data/postgresql/pgweb-access.nix

`infra.data.postgresql.sharedBuffers`

Shared buffer pool size.

Type: string

Default:

"1GB"

Declared by: nix/modules/infra/data/postgresql

`infra.data.postgresql.tcpPort`

TCP port PostgreSQL listens on.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

Declared by: nix/modules/infra/data/postgresql

`infra.data.postgresql.walBuffers`

WAL buffer size.

Type: string

Default:

"16MB"

Declared by: nix/modules/infra/data/postgresql

`infra.data.postgresql.workMem`

Memory per sort/hash operation.

Type: string

Default:

"10MB"

Declared by: nix/modules/infra/data/postgresql

`infra.data.rabbitmq`

`infra.data.rabbitmq.appPassword`

Password for the application user. WARNING: lands world-readable in the nix store via the provisioning script — acceptable only because the broker is reachable solely from the fleet-internal network. Rotate to a SOPS-sourced mechanism if that changes.

Type: string

Default: none (required when its feature is enabled)

Example:

"change-me"

Declared by: nix/modules/infra/data/rabbitmq

`infra.data.rabbitmq.appUser`

Application user provisioned with full permissions on the / vhost and the management tag.

Type: string

Default:

config.fleet.settings.name

Declared by: nix/modules/infra/data/rabbitmq

`infra.data.rabbitmq.enable`

Whether to enable RabbitMQ message broker.

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/data/rabbitmq

`infra.data.rabbitmq.managementPort`

Management-plugin HTTP port. Opened in the firewall and reverse-proxied by the rabbitmq.<domain.internal> Caddy vhost.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

Declared by: nix/modules/infra/data/rabbitmq

`infra.data.rabbitmq.port`

AMQP listener port. Opened in the firewall; RabbitMQ binds it on all interfaces.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

Declared by: nix/modules/infra/data/rabbitmq

`infra.data.s3`

`infra.data.s3.buckets`

Bucket names to ensure exist. Idempotent — bucket info is used to skip already-existing buckets so a re-run on every boot is harmless.

Type: list of string

Default:

[ ]

Example:

[
  "pg-backups"
  "pbs-chunkstore"
]

Declared by: nix/modules/infra/data/s3

`infra.data.s3.enable`

Whether to enable Garage layout + bucket bootstrap oneshots.

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/data/s3

`infra.data.s3.environmentFile`

Path to the env file carrying GARAGE_RPC_SECRET. Almost always the same value the host module passes to services.garage.environmentFile — set them from the same sops.templates.“”.path so a rotation re-renders both.

Type: absolute path

Default: none (required when its feature is enabled)

Example:

config.sops.templates."garage-env".path

Declared by: nix/modules/infra/data/s3

`infra.data.s3.layout`

Single-node layout to assign on first boot. Set to null on multi-node clusters where the operator owns layout out-of-band.

Type: null or (submodule)

Default:

null

Declared by: nix/modules/infra/data/s3

`infra.data.s3.layout.capacity`

Capacity advertised for this node (Garage units, e.g. “500G”, “2T”). Match the disk size of the /data mount.

Type: string

Default: none (required when its feature is enabled)

Example:

"500G"

Declared by: nix/modules/infra/data/s3

`infra.data.s3.layout.zone`

Garage zone label (logical placement region).

Type: string

Default:

"dc1"

Declared by: nix/modules/infra/data/s3

`infra.data.valkey`

`infra.data.valkey.allowedSubnets`

CIDRs allowed to reach the valkey port at the firewall level. Empty (default) keeps the port closed everywhere — appropriate for bindAddress = 127.0.0.1. Open to the fleet LAN CIDR (fleet.settings.network.lanCidr) for a dedicated cache host.

Type: list of string

Default:

[ ]

Example:

[
  "192.0.2.0/24"
]

Declared by: nix/modules/infra/data/valkey

`infra.data.valkey.bindAddress`

Address valkey binds to. Default is loopback (sidecar form). Set to the host’s internal IP for a dedicated cache LXC reachable from sibling LXCs on the internal subnet.

Type: string

Default:

"127.0.0.1"

Example:

"192.0.2.16"

Declared by: nix/modules/infra/data/valkey

`infra.data.valkey.enable`

Whether to enable Valkey cache (Redis-compatible).

Type: boolean

Default:

false

Example:

true

Declared by: nix/modules/infra/data/valkey

`infra.data.valkey.maxMemory`

Maximum memory for cache. Evicts LRU when full.

Type: string

Default:

"256mb"

Declared by: nix/modules/infra/data/valkey

`infra.data.valkey.port`

TCP port valkey listens on. Only opened in the firewall (scoped to allowedSubnets) in the dedicated-host form; the loopback sidecar form needs no firewall opening.

Type: 16 bit unsigned integer; between 0 and 65535 (both inclusive)

Default:

Declared by: nix/modules/infra/data/valkey

Keyboard shortcuts

fleetkit