blob: 43333af5e2fea7ef49299b1dfa1f7a2e06608bfb (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
|
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.nomad;
format = pkgs.formats.json { };
in
{
##### interface
options = {
services.nomad = {
enable = mkEnableOption "Nomad, a distributed, highly available, datacenter-aware scheduler";
package = mkOption {
type = types.package;
default = pkgs.nomad;
defaultText = literalExpression "pkgs.nomad";
description = ''
The package used for the Nomad agent and CLI.
'';
};
extraPackages = mkOption {
type = types.listOf types.package;
default = [ ];
description = ''
Extra packages to add to <envar>PATH</envar> for the Nomad agent process.
'';
example = literalExpression ''
with pkgs; [ cni-plugins ]
'';
};
dropPrivileges = mkOption {
type = types.bool;
default = true;
description = ''
Whether the nomad agent should be run as a non-root nomad user.
'';
};
enableDocker = mkOption {
type = types.bool;
default = true;
description = ''
Enable Docker support. Needed for Nomad's docker driver.
Note that the docker group membership is effectively equivalent
to being root, see https://github.com/moby/moby/issues/9976.
'';
};
extraSettingsPaths = mkOption {
type = types.listOf types.path;
default = [ ];
description = ''
Additional settings paths used to configure nomad. These can be files or directories.
'';
example = literalExpression ''
[ "/etc/nomad-mutable.json" "/run/keys/nomad-with-secrets.json" "/etc/nomad/config.d" ]
'';
};
extraSettingsPlugins = mkOption {
type = types.listOf (types.either types.package types.path);
default = [ ];
description = ''
Additional plugins dir used to configure nomad.
'';
example = literalExpression ''
[ "<pluginDir>" "pkgs.<plugins-name>"]
'';
};
settings = mkOption {
type = format.type;
default = { };
description = ''
Configuration for Nomad. See the <link xlink:href="https://www.nomadproject.io/docs/configuration">documentation</link>
for supported values.
Notes about <literal>data_dir</literal>:
If <literal>data_dir</literal> is set to a value other than the
default value of <literal>"/var/lib/nomad"</literal> it is the Nomad
cluster manager's responsibility to make sure that this directory
exists and has the appropriate permissions.
Additionally, if <literal>dropPrivileges</literal> is
<literal>true</literal> then <literal>data_dir</literal>
<emphasis>cannot</emphasis> be customized. Setting
<literal>dropPrivileges</literal> to <literal>true</literal> enables
the <literal>DynamicUser</literal> feature of systemd which directly
manages and operates on <literal>StateDirectory</literal>.
'';
example = literalExpression ''
{
# A minimal config example:
server = {
enabled = true;
bootstrap_expect = 1; # for demo; no fault tolerance
};
client = {
enabled = true;
};
}
'';
};
};
};
##### implementation
config = mkIf cfg.enable {
services.nomad.settings = {
# Agrees with `StateDirectory = "nomad"` set below.
data_dir = mkDefault "/var/lib/nomad";
};
environment = {
etc."nomad.json".source = format.generate "nomad.json" cfg.settings;
systemPackages = [ cfg.package ];
};
systemd.services.nomad = {
description = "Nomad";
wantedBy = [ "multi-user.target" ];
wants = [ "network-online.target" ];
after = [ "network-online.target" ];
restartTriggers = [ config.environment.etc."nomad.json".source ];
path = cfg.extraPackages ++ (with pkgs; [
# Client mode requires at least the following:
coreutils
iproute2
iptables
]);
serviceConfig = mkMerge [
{
DynamicUser = cfg.dropPrivileges;
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
ExecStart = "${cfg.package}/bin/nomad agent -config=/etc/nomad.json" +
concatMapStrings (path: " -config=${path}") cfg.extraSettingsPaths +
concatMapStrings (path: " -plugin-dir=${path}/bin") cfg.extraSettingsPlugins;
KillMode = "process";
KillSignal = "SIGINT";
LimitNOFILE = 65536;
LimitNPROC = "infinity";
OOMScoreAdjust = -1000;
Restart = "on-failure";
RestartSec = 2;
TasksMax = "infinity";
}
(mkIf cfg.enableDocker {
SupplementaryGroups = "docker"; # space-separated string
})
(mkIf (cfg.settings.data_dir == "/var/lib/nomad") {
StateDirectory = "nomad";
})
];
unitConfig = {
StartLimitIntervalSec = 10;
StartLimitBurst = 3;
};
};
assertions = [
{
assertion = cfg.dropPrivileges -> cfg.settings.data_dir == "/var/lib/nomad";
message = "settings.data_dir must be equal to \"/var/lib/nomad\" if dropPrivileges is true";
}
];
# Docker support requires the Docker daemon to be running.
virtualisation.docker.enable = mkIf cfg.enableDocker true;
};
}
|