2020-12-03 02:05:48 +01:00
|
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
|
|
cfg = config.services.nomad;
|
|
|
|
format = pkgs.formats.json { };
|
|
|
|
in
|
|
|
|
{
|
|
|
|
##### interface
|
|
|
|
options = {
|
|
|
|
services.nomad = {
|
|
|
|
enable = mkEnableOption "Nomad, a distributed, highly available, datacenter-aware scheduler";
|
|
|
|
|
|
|
|
package = mkOption {
|
|
|
|
type = types.package;
|
|
|
|
default = pkgs.nomad;
|
|
|
|
defaultText = "pkgs.nomad";
|
|
|
|
description = ''
|
|
|
|
The package used for the Nomad agent and CLI.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
extraPackages = mkOption {
|
|
|
|
type = types.listOf types.package;
|
|
|
|
default = [ ];
|
|
|
|
description = ''
|
|
|
|
Extra packages to add to <envar>PATH</envar> for the Nomad agent process.
|
|
|
|
'';
|
|
|
|
example = literalExample ''
|
|
|
|
with pkgs; [ cni-plugins ]
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
dropPrivileges = mkOption {
|
|
|
|
type = types.bool;
|
|
|
|
default = true;
|
|
|
|
description = ''
|
|
|
|
Whether the nomad agent should be run as a non-root nomad user.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
enableDocker = mkOption {
|
|
|
|
type = types.bool;
|
2021-01-18 03:54:06 +01:00
|
|
|
default = true;
|
2020-12-03 02:05:48 +01:00
|
|
|
description = ''
|
|
|
|
Enable Docker support. Needed for Nomad's docker driver.
|
|
|
|
|
|
|
|
Note that the docker group membership is effectively equivalent
|
|
|
|
to being root, see https://github.com/moby/moby/issues/9976.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2021-01-23 23:52:19 +01:00
|
|
|
extraSettingsPaths = mkOption {
|
|
|
|
type = types.listOf types.path;
|
|
|
|
default = [];
|
|
|
|
description = ''
|
|
|
|
Additional settings paths used to configure nomad. These can be files or directories.
|
|
|
|
'';
|
|
|
|
example = literalExample ''
|
|
|
|
[ "/etc/nomad-mutable.json" "/run/keys/nomad-with-secrets.json" "/etc/nomad/config.d" ]
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
2020-12-03 02:05:48 +01:00
|
|
|
settings = mkOption {
|
|
|
|
type = format.type;
|
2021-01-23 18:44:23 +01:00
|
|
|
default = {};
|
2020-12-03 02:05:48 +01:00
|
|
|
description = ''
|
|
|
|
Configuration for Nomad. See the <link xlink:href="https://www.nomadproject.io/docs/configuration">documentation</link>
|
|
|
|
for supported values.
|
2021-01-18 15:03:52 +01:00
|
|
|
|
2021-01-19 13:21:31 +01:00
|
|
|
Notes about <literal>data_dir</literal>:
|
2021-01-18 15:03:52 +01:00
|
|
|
|
2021-01-19 13:21:31 +01:00
|
|
|
If <literal>data_dir</literal> is set to a value other than the
|
|
|
|
default value of <literal>"/var/lib/nomad"</literal> it is the Nomad
|
|
|
|
cluster manager's responsibility to make sure that this directory
|
|
|
|
exists and has the appropriate permissions.
|
2021-01-18 15:03:52 +01:00
|
|
|
|
2021-01-19 13:21:31 +01:00
|
|
|
Additionally, if <literal>dropPrivileges</literal> is
|
|
|
|
<literal>true</literal> then <literal>data_dir</literal>
|
|
|
|
<emphasis>cannot</emphasis> be customized. Setting
|
|
|
|
<literal>dropPrivileges</literal> to <literal>true</literal> enables
|
|
|
|
the <literal>DynamicUser</literal> feature of systemd which directly
|
|
|
|
manages and operates on <literal>StateDirectory</literal>.
|
2020-12-03 02:05:48 +01:00
|
|
|
'';
|
|
|
|
example = literalExample ''
|
|
|
|
{
|
|
|
|
# A minimal config example:
|
|
|
|
server = {
|
|
|
|
enabled = true;
|
|
|
|
bootstrap_expect = 1; # for demo; no fault tolerance
|
|
|
|
};
|
|
|
|
client = {
|
|
|
|
enabled = true;
|
|
|
|
};
|
|
|
|
}
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
##### implementation
|
|
|
|
config = mkIf cfg.enable {
|
2021-01-23 18:44:23 +01:00
|
|
|
services.nomad.settings = {
|
|
|
|
# Agrees with `StateDirectory = "nomad"` set below.
|
|
|
|
data_dir = mkDefault "/var/lib/nomad";
|
|
|
|
};
|
|
|
|
|
2020-12-03 02:05:48 +01:00
|
|
|
environment = {
|
|
|
|
etc."nomad.json".source = format.generate "nomad.json" cfg.settings;
|
|
|
|
systemPackages = [ cfg.package ];
|
|
|
|
};
|
|
|
|
|
|
|
|
systemd.services.nomad = {
|
|
|
|
description = "Nomad";
|
|
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
wants = [ "network-online.target" ];
|
|
|
|
after = [ "network-online.target" ];
|
|
|
|
restartTriggers = [ config.environment.etc."nomad.json".source ];
|
|
|
|
|
|
|
|
path = cfg.extraPackages ++ (with pkgs; [
|
|
|
|
# Client mode requires at least the following:
|
|
|
|
coreutils
|
2021-04-08 13:33:09 +02:00
|
|
|
iproute2
|
2020-12-03 02:05:48 +01:00
|
|
|
iptables
|
|
|
|
]);
|
|
|
|
|
2021-01-18 15:05:59 +01:00
|
|
|
serviceConfig = mkMerge [
|
|
|
|
{
|
|
|
|
DynamicUser = cfg.dropPrivileges;
|
|
|
|
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
|
|
|
|
ExecStart = "${cfg.package}/bin/nomad agent -config=/etc/nomad.json" +
|
|
|
|
concatMapStrings (path: " -config=${path}") cfg.extraSettingsPaths;
|
|
|
|
KillMode = "process";
|
|
|
|
KillSignal = "SIGINT";
|
|
|
|
LimitNOFILE = 65536;
|
|
|
|
LimitNPROC = "infinity";
|
|
|
|
OOMScoreAdjust = -1000;
|
|
|
|
Restart = "on-failure";
|
|
|
|
RestartSec = 2;
|
|
|
|
TasksMax = "infinity";
|
|
|
|
}
|
2021-01-18 15:07:56 +01:00
|
|
|
(mkIf cfg.enableDocker {
|
|
|
|
SupplementaryGroups = "docker"; # space-separated string
|
|
|
|
})
|
2021-01-24 00:04:26 +01:00
|
|
|
(mkIf (cfg.settings.data_dir == "/var/lib/nomad") {
|
|
|
|
StateDirectory = "nomad";
|
|
|
|
})
|
2021-01-18 15:05:59 +01:00
|
|
|
];
|
2021-01-23 18:43:43 +01:00
|
|
|
|
2020-12-03 02:05:48 +01:00
|
|
|
unitConfig = {
|
|
|
|
StartLimitIntervalSec = 10;
|
|
|
|
StartLimitBurst = 3;
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2021-01-18 15:02:05 +01:00
|
|
|
assertions = [
|
|
|
|
{
|
|
|
|
assertion = cfg.dropPrivileges -> cfg.settings.data_dir == "/var/lib/nomad";
|
|
|
|
message = "settings.data_dir must be equal to \"/var/lib/nomad\" if dropPrivileges is true";
|
|
|
|
}
|
|
|
|
];
|
|
|
|
|
2020-12-03 02:05:48 +01:00
|
|
|
# Docker support requires the Docker daemon to be running.
|
|
|
|
virtualisation.docker.enable = mkIf cfg.enableDocker true;
|
|
|
|
};
|
|
|
|
}
|