path: root/nixos/modules/services/databases/influxdb2.nix

{ config, lib, pkgs, ... }:

let
  inherit
    (lib)
    any
    attrNames
    attrValues
    count
    escapeShellArg
    filterAttrs
    flatten
    flip
    getExe
    hasAttr
    hasInfix
    listToAttrs
    literalExpression
    mapAttrsToList
    mkEnableOption
    mkPackageOption
    mkIf
    mkOption
    nameValuePair
    optional
    subtractLists
    types
    unique
    ;

  format = pkgs.formats.json { };
  cfg = config.services.influxdb2;
  configFile = format.generate "config.json" cfg.settings;

  validPermissions = [
    "authorizations"
    "buckets"
    "dashboards"
    "orgs"
    "tasks"
    "telegrafs"
    "users"
    "variables"
    "secrets"
    "labels"
    "views"
    "documents"
    "notificationRules"
    "notificationEndpoints"
    "checks"
    "dbrp"
    "annotations"
    "sources"
    "scrapers"
    "notebooks"
    "remotes"
    "replications"
  ];

  # Determines whether at least one active api token is defined
  anyAuthDefined =
    flip any (attrValues cfg.provision.organizations)
    (o: o.present && flip any (attrValues o.auths)
    (a: a.present && a.tokenFile != null));

  provisionState = pkgs.writeText "provision_state.json" (builtins.toJSON {
    inherit (cfg.provision) organizations users;
  });

  influxHost = "http://${escapeShellArg (
      if ! hasAttr "http-bind-address" cfg.settings
        || hasInfix "0.0.0.0" cfg.settings.http-bind-address
      then "localhost:8086"
      else cfg.settings.http-bind-address
    )}";

  waitUntilServiceIsReady = pkgs.writeShellScript "wait-until-service-is-ready" ''
    set -euo pipefail
    export INFLUX_HOST=${influxHost}
    count=0
    while ! influx ping &>/dev/null; do
      if [ "$count" -eq 300 ]; then
        echo "Tried for 30 seconds, giving up..."
        exit 1
      fi

      if ! kill -0 "$MAINPID"; then
        echo "Main server died, giving up..."
        exit 1
      fi

      sleep 0.1
      count=$((count++))
    done
  '';

  provisioningScript = pkgs.writeShellScript "post-start-provision" ''
    set -euo pipefail
    export INFLUX_HOST=${influxHost}

    # Do the initial database setup. Pass /dev/null as configs-path to
    # avoid saving the token as the active config.
    if test -e "$STATE_DIRECTORY/.first_startup"; then
      influx setup \
        --configs-path /dev/null \
        --org ${escapeShellArg cfg.provision.initialSetup.organization} \
        --bucket ${escapeShellArg cfg.provision.initialSetup.bucket} \
        --username ${escapeShellArg cfg.provision.initialSetup.username} \
        --password "$(< "$CREDENTIALS_DIRECTORY/admin-password")" \
        --token "$(< "$CREDENTIALS_DIRECTORY/admin-token")" \
        --retention ${toString cfg.provision.initialSetup.retention}s \
        --force >/dev/null

      rm -f "$STATE_DIRECTORY/.first_startup"
    fi

    provision_result=$(${getExe pkgs.influxdb2-provision} ${provisionState} "$INFLUX_HOST" "$(< "$CREDENTIALS_DIRECTORY/admin-token")")
    if [[ "$(jq '[.auths[] | select(.action == "created")] | length' <<< "$provision_result")" -gt 0 ]]; then
      echo "Created at least one new token, queueing service restart so we can manipulate secrets"
      touch "$STATE_DIRECTORY/.needs_restart"
    fi
  '';

  restarterScript = pkgs.writeShellScript "post-start-restarter" ''
    set -euo pipefail
    if test -e "$STATE_DIRECTORY/.needs_restart"; then
      rm -f "$STATE_DIRECTORY/.needs_restart"
      /run/current-system/systemd/bin/systemctl restart influxdb2
    fi
  '';

  organizationSubmodule = types.submodule (organizationSubmod: let
    org = organizationSubmod.config._module.args.name;
  in {
    options = {
      present = mkOption {
        description = "Whether to ensure that this organization is present or absent.";
        type = types.bool;
        default = true;
      };

      description = mkOption {
        description = "Optional description for the organization.";
        default = null;
        type = types.nullOr types.str;
      };

      buckets = mkOption {
        description = "Buckets to provision in this organization.";
        default = {};
        type = types.attrsOf (types.submodule (bucketSubmod: let
          bucket = bucketSubmod.config._module.args.name;
        in {
          options = {
            present = mkOption {
              description = "Whether to ensure that this bucket is present or absent.";
              type = types.bool;
              default = true;
            };

            description = mkOption {
              description = "Optional description for the bucket.";
              default = null;
              type = types.nullOr types.str;
            };

            retention = mkOption {
              type = types.ints.unsigned;
              default = 0;
              description = "The duration in seconds for which the bucket will retain data (0 is infinite).";
            };
          };
        }));
      };

      auths = mkOption {
        description = "API tokens to provision for the user in this organization.";
        default = {};
        type = types.attrsOf (types.submodule (authSubmod: let
          auth = authSubmod.config._module.args.name;
        in {
          options = {
            id = mkOption {
              description = "A unique identifier for this authentication token. Since influx doesn't store names for tokens, this will be hashed and appended to the description to identify the token.";
              readOnly = true;
              default = builtins.substring 0 32 (builtins.hashString "sha256" "${org}:${auth}");
              defaultText = "<a hash derived from org and name>";
              type = types.str;
            };

            present = mkOption {
              description = "Whether to ensure that this user is present or absent.";
              type = types.bool;
              default = true;
            };

            description = mkOption {
              description = ''
                Optional description for the API token.
                Note that the actual token will always be created with a descriptionregardless
                of whether this is given or not. The name is always added plus a unique suffix
                to later identify the token to track whether it has already been created.
              '';
              default = null;
              type = types.nullOr types.str;
            };

            tokenFile = mkOption {
              type = types.nullOr types.path;
              default = null;
              description = "The token value. If not given, influx will automatically generate one.";
            };

            operator = mkOption {
              description = "Grants all permissions in all organizations.";
              default = false;
              type = types.bool;
            };

            allAccess = mkOption {
              description = "Grants all permissions in the associated organization.";
              default = false;
              type = types.bool;
            };

            readPermissions = mkOption {
              description = ''
                The read permissions to include for this token. Access is usually granted only
                for resources in the associated organization.

                Available permissions are `authorizations`, `buckets`, `dashboards`,
                `orgs`, `tasks`, `telegrafs`, `users`, `variables`, `secrets`, `labels`, `views`,
                `documents`, `notificationRules`, `notificationEndpoints`, `checks`, `dbrp`,
                `annotations`, `sources`, `scrapers`, `notebooks`, `remotes`, `replications`.

                Refer to `influx auth create --help` for a full list with descriptions.

                `buckets` grants read access to all associated buckets. Use `readBuckets` to define
                more granular access permissions.
              '';
              default = [];
              type = types.listOf (types.enum validPermissions);
            };

            writePermissions = mkOption {
              description = ''
                The read permissions to include for this token. Access is usually granted only
                for resources in the associated organization.

                Available permissions are `authorizations`, `buckets`, `dashboards`,
                `orgs`, `tasks`, `telegrafs`, `users`, `variables`, `secrets`, `labels`, `views`,
                `documents`, `notificationRules`, `notificationEndpoints`, `checks`, `dbrp`,
                `annotations`, `sources`, `scrapers`, `notebooks`, `remotes`, `replications`.

                Refer to `influx auth create --help` for a full list with descriptions.

                `buckets` grants write access to all associated buckets. Use `writeBuckets` to define
                more granular access permissions.
              '';
              default = [];
              type = types.listOf (types.enum validPermissions);
            };

            readBuckets = mkOption {
              description = "The organization's buckets which should be allowed to be read";
              default = [];
              type = types.listOf types.str;
            };

            writeBuckets = mkOption {
              description = "The organization's buckets which should be allowed to be written";
              default = [];
              type = types.listOf types.str;
            };
          };
        }));
      };
    };
  });
in
{
  options = {
    services.influxdb2 = {
      enable = mkEnableOption "the influxdb2 server";

      package = mkPackageOption pkgs "influxdb2" { };

      settings = mkOption {
        default = { };
        description = ''configuration options for influxdb2, see <https://docs.influxdata.com/influxdb/v2.0/reference/config-options> for details.'';
        type = format.type;
      };

      provision = {
        enable = mkEnableOption "initial database setup and provisioning";

        initialSetup = {
          organization = mkOption {
            type = types.str;
            example = "main";
            description = "Primary organization name";
          };

          bucket = mkOption {
            type = types.str;
            example = "example";
            description = "Primary bucket name";
          };

          username = mkOption {
            type = types.str;
            default = "admin";
            description = "Primary username";
          };

          retention = mkOption {
            type = types.ints.unsigned;
            default = 0;
            description = "The duration in seconds for which the bucket will retain data (0 is infinite).";
          };

          passwordFile = mkOption {
            type = types.path;
            description = "Password for primary user. Don't use a file from the nix store!";
          };

          tokenFile = mkOption {
            type = types.path;
            description = "API Token to set for the admin user. Don't use a file from the nix store!";
          };
        };

        organizations = mkOption {
          description = "Organizations to provision.";
          example = literalExpression ''
            {
              myorg = {
                description = "My organization";
                buckets.mybucket = {
                  description = "My bucket";
                  retention = 31536000; # 1 year
                };
                auths.mytoken = {
                  readBuckets = ["mybucket"];
                  tokenFile = "/run/secrets/mytoken";
                };
              };
            }
          '';
          default = {};
          type = types.attrsOf organizationSubmodule;
        };

        users = mkOption {
          description = "Users to provision.";
          default = {};
          example = literalExpression ''
            {
              # admin = {}; /* The initialSetup.username will automatically be added. */
              myuser.passwordFile = "/run/secrets/myuser_password";
            }
          '';
          type = types.attrsOf (types.submodule (userSubmod: let
            user = userSubmod.config._module.args.name;
            org = userSubmod.config.org;
          in {
            options = {
              present = mkOption {
                description = "Whether to ensure that this user is present or absent.";
                type = types.bool;
                default = true;
              };

              passwordFile = mkOption {
                description = "Password for the user. If unset, the user will not be able to log in until a password is set by an operator! Don't use a file from the nix store!";
                default = null;
                type = types.nullOr types.path;
              };
            };
          }));
        };
      };
    };
  };

  config = mkIf cfg.enable {
    assertions =
      [
        {
          assertion = !(hasAttr "bolt-path" cfg.settings) && !(hasAttr "engine-path" cfg.settings);
          message = "services.influxdb2.config: bolt-path and engine-path should not be set as they are managed by systemd";
        }
      ]
      ++ flatten (flip mapAttrsToList cfg.provision.organizations (orgName: org:
        flip mapAttrsToList org.auths (authName: auth:
          [
            {
              assertion = 1 == count (x: x) [
                auth.operator
                auth.allAccess
                (auth.readPermissions != []
                  || auth.writePermissions != []
                  || auth.readBuckets != []
                  || auth.writeBuckets != [])
              ];
              message = "influxdb2: provision.organizations.${orgName}.auths.${authName}: The `operator` and `allAccess` options are mutually exclusive with each other and the granular permission settings.";
            }
            (let unknownBuckets = subtractLists (attrNames org.buckets) auth.readBuckets; in {
              assertion = unknownBuckets == [];
              message = "influxdb2: provision.organizations.${orgName}.auths.${authName}: Refers to invalid buckets in readBuckets: ${toString unknownBuckets}";
            })
            (let unknownBuckets = subtractLists (attrNames org.buckets) auth.writeBuckets; in {
              assertion = unknownBuckets == [];
              message = "influxdb2: provision.organizations.${orgName}.auths.${authName}: Refers to invalid buckets in writeBuckets: ${toString unknownBuckets}";
            })
          ]
        )
      ));

    services.influxdb2.provision = mkIf cfg.provision.enable {
      organizations.${cfg.provision.initialSetup.organization} = {
        buckets.${cfg.provision.initialSetup.bucket} = {
          inherit (cfg.provision.initialSetup) retention;
        };
      };
      users.${cfg.provision.initialSetup.username} = {
        inherit (cfg.provision.initialSetup) passwordFile;
      };
    };

    systemd.services.influxdb2 = {
      description = "InfluxDB is an open-source, distributed, time series database";
      documentation = [ "https://docs.influxdata.com/influxdb/" ];
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      environment = {
        INFLUXD_CONFIG_PATH = configFile;
        ZONEINFO = "${pkgs.tzdata}/share/zoneinfo";
      };
      serviceConfig = {
        Type = "exec"; # When credentials are used with systemd before v257 this is necessary to make the service start reliably (see systemd/systemd#33953)
        ExecStart = "${cfg.package}/bin/influxd --bolt-path \${STATE_DIRECTORY}/influxd.bolt --engine-path \${STATE_DIRECTORY}/engine";
        StateDirectory = "influxdb2";
        User = "influxdb2";
        Group = "influxdb2";
        CapabilityBoundingSet = "";
        SystemCallFilter = "@system-service";
        LimitNOFILE = 65536;
        KillMode = "control-group";
        Restart = "on-failure";
        LoadCredential = mkIf cfg.provision.enable [
          "admin-password:${cfg.provision.initialSetup.passwordFile}"
          "admin-token:${cfg.provision.initialSetup.tokenFile}"
        ];

        ExecStartPost = [
          waitUntilServiceIsReady
        ] ++ (lib.optionals cfg.provision.enable (
          [provisioningScript] ++
          # Only the restarter runs with elevated privileges
          optional anyAuthDefined "+${restarterScript}"
        ));
      };

      path = [
        pkgs.influxdb2-cli
        pkgs.jq
      ];

      # Mark if this is the first startup so postStart can do the initial setup.
      # Also extract any token secret mappings and apply them if this isn't the first start.
      preStart = let
        tokenPaths = listToAttrs (flatten
          # For all organizations
          (flip mapAttrsToList cfg.provision.organizations
            # For each contained token that has a token file
            (_: org: flip mapAttrsToList (filterAttrs (_: x: x.tokenFile != null) org.auths)
              # Collect id -> tokenFile for the mapping
              (_: auth: nameValuePair auth.id auth.tokenFile))));
        tokenMappings = pkgs.writeText "token_mappings.json" (builtins.toJSON tokenPaths);
      in mkIf cfg.provision.enable ''
        if ! test -e "$STATE_DIRECTORY/influxd.bolt"; then
          touch "$STATE_DIRECTORY/.first_startup"
        else
          # Manipulate provisioned api tokens if necessary
          ${getExe pkgs.influxdb2-token-manipulator} "$STATE_DIRECTORY/influxd.bolt" ${tokenMappings}
        fi
      '';
    };

    users.extraUsers.influxdb2 = {
      isSystemUser = true;
      group = "influxdb2";
    };

    users.extraGroups.influxdb2 = {};
  };

  meta.maintainers = with lib.maintainers; [ nickcao oddlama ];
}