Add nix-infra-machine

2026-09-17 02:12:55 +02:00 · 2026-03-15 18:31:53 +01:00
parent 28ea6f4a47
commit 1034986fa1
79 changed files with 14465 additions and 0 deletions
@@ -0,0 +1,266 @@
+{ config, pkgs, lib, ... }: {
+  imports = [
+    # Import based on file structure on deployed machine
+    ./app_modules/_unstable/beiwe-backend/default.nix
+  ];
+
+  # ==========================================================================
+  # PostgreSQL Database for Beiwe (using infrastructure module)
+  # ==========================================================================
+  config.infrastructure.postgresql = {
+    enable = true;
+    bindToIp = "127.0.0.1";
+    bindToPort = 5432;
+    # Note: Do NOT use initialDatabases here - beiwe-db-setup.service creates
+    # the database when database.createLocally = true. Using both causes race conditions.
+    authentication = ''
+      # TYPE  DATABASE        USER            ADDRESS                 METHOD
+      local   all             all                                     trust
+      host    all             all             127.0.0.1/32            trust
+      host    all             all             ::1/128                 trust
+    '';
+  };
+
+  # ==========================================================================
+  # MinIO for S3-compatible storage (using infrastructure module)
+  # ==========================================================================
+  config.infrastructure.minio = {
+    enable = true;
+    bindToIp = "127.0.0.1";
+    apiPort = 9000;
+    consolePort = 9001;
+    rootCredentialsSecretName = "minio-credentials";
+    dataDir = [ "/var/lib/minio/data" ];
+  };
+
+  # Create MinIO credentials file
+  config.systemd.services.minio-create-credentials = {
+    description = "Create MinIO credentials file";
+    wantedBy = [ "multi-user.target" ];
+    before = [ "minio.service" ];
+    requiredBy = [ "minio.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+    };
+    script = ''
+      mkdir -p /run/secrets
+      cat > /run/secrets/minio-credentials <<EOF
+MINIO_ROOT_USER=minioadmin
+MINIO_ROOT_PASSWORD=minioadmin123
+EOF
+      chmod 400 /run/secrets/minio-credentials
+    '';
+  };
+
+  # Create the beiwe-data bucket after MinIO starts
+  config.systemd.services.minio-create-bucket = {
+    description = "Create Beiwe S3 bucket in MinIO";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "minio.service" ];
+    requires = [ "minio.service" ];
+    before = [ "beiwe-backend.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      # Set HOME so mc can store its config
+      Environment = "HOME=/tmp/minio-bucket-setup";
+    };
+    path = [ pkgs.minio-client pkgs.curl ];
+    script = ''
+      # Create temp home for mc config
+      mkdir -p /tmp/minio-bucket-setup
+      export HOME=/tmp/minio-bucket-setup
+      
+      # Wait for MinIO to be ready (both health check AND API responding)
+      echo "Waiting for MinIO to be ready..."
+      for i in {1..60}; do
+        if curl -sf http://127.0.0.1:9000/minio/health/live > /dev/null 2>&1; then
+          # Also check that the API is responding
+          if curl -sf http://127.0.0.1:9000/minio/health/ready > /dev/null 2>&1; then
+            echo "MinIO is ready"
+            break
+          fi
+        fi
+        echo "Waiting... attempt $i/60"
+        sleep 1
+      done
+      
+      # Give MinIO a moment to fully initialize
+      sleep 2
+      
+      # Configure mc client with explicit alias
+      echo "Configuring mc client..."
+      mc alias set local http://127.0.0.1:9000 minioadmin minioadmin123 --api S3v4
+      
+      # List existing buckets for debugging
+      echo "Existing buckets:"
+      mc ls local/ || echo "(no buckets yet)"
+      
+      # Create bucket if it doesn't exist
+      echo "Creating beiwe-data bucket..."
+      mc mb local/beiwe-data --ignore-existing || true
+      
+      # Verify bucket was created
+      echo "Verifying bucket creation..."
+      mc ls local/beiwe-data
+      
+      echo "Bucket setup complete"
+    '';
+  };
+
+
+  # ==========================================================================
+  # RabbitMQ for Celery task queue (using infrastructure module)
+  # ==========================================================================
+  config.infrastructure.rabbitmq = {
+    enable = true;
+    bindToIp = "127.0.0.1";
+    bindToPort = 5672;
+    managementPlugin = {
+      enable = true;
+      port = 15672;
+    };
+  };
+
+  # ==========================================================================
+  # Beiwe Backend Configuration
+  # ==========================================================================
+  config.infrastructure.beiwe-backend = {
+    enable = true;
+
+    # Network settings
+    bindToIp = "0.0.0.0";
+    bindToPort = 8080;
+    openFirewall = true;
+    domainName = "localhost:8080";
+
+    # Security (test values - DO NOT use in production!)
+    flaskSecretKey = "test-secret-key-not-for-production-use";
+    sysadminEmails = "test@localhost";
+
+    # Database configuration (local PostgreSQL)
+    database = {
+      host = "localhost";  # Use TCP connection instead of socket
+      port = 5432;
+      name = "beiwe";
+      user = "beiwe";
+      password = "unused_with_trust_auth";  # Required by Beiwe even with trust auth
+      sslmode = "disable";  # Disable SSL for local development without certificates
+      createLocally = true;
+    };
+
+    # S3 configuration (local MinIO)
+    s3 = {
+      bucket = "beiwe-data";
+      accessKeyId = "minioadmin";
+      secretAccessKey = "minioadmin123";
+      endpoint = "http://127.0.0.1:9000";
+    };
+
+    # Celery configuration (local RabbitMQ)
+    celery = {
+      enable = true;
+      rabbitmq = {
+        host = "127.0.0.1";
+        port = 5672;
+        user = "guest";
+        password = "guest";
+        vhost = "";
+      };
+      concurrency = 2;
+      logLevel = "INFO";
+    };
+
+    # Gunicorn settings
+    gunicorn = {
+      workers = 2;
+      threads = 2;
+      timeout = 120;
+    };
+  };
+
+  # ==========================================================================
+  # Service Dependencies
+  # ==========================================================================
+  
+  # Ensure beiwe-backend starts after all dependencies
+  config.systemd.services.beiwe-backend = {
+    after = [ 
+      "postgresql.service" 
+      "minio.service"
+      "minio-create-bucket.service"
+      "beiwe-db-setup.service"
+      "rabbitmq.service"
+    ];
+    wants = [
+      "minio-create-bucket.service"
+    ];
+  };
+
+  # Ensure celery worker starts after RabbitMQ is ready
+  config.systemd.services.beiwe-celery-worker = {
+    after = [
+      "rabbitmq.service"
+      "postgresql.service"
+      "minio.service"
+    ];
+  };
+
+  # ==========================================================================
+  # Test utilities
+  # ==========================================================================
+  config.environment.systemPackages = with pkgs; [
+    curl
+    jq
+    minio-client
+    postgresql
+  ];
+}
+
+# ==========================================================================
+# NOTES ON SERVICES
+# ==========================================================================
+#
+# REQUIRED SERVICES (all configured):
+#
+# 1. PostgreSQL (Database)
+#    - Status: CONFIGURED via infrastructure.postgresql
+#    - Purpose: Stores all application data, user accounts, study configurations
+#
+# 2. MinIO/S3 (Object Storage)
+#    - Status: CONFIGURED via infrastructure.minio
+#    - Purpose: Stores uploaded data files from mobile apps
+#
+# OPTIONAL SERVICES:
+#
+# 3. RabbitMQ + Celery (Message Queue)
+#    - Status: CONFIGURED via infrastructure.rabbitmq + celery options
+#    - Purpose: Background task processing
+#    - Enables:
+#      * Push notifications to mobile apps
+#      * Data processing pipelines
+#      * Forest analysis integration
+#
+# 4. Firebase Credentials
+#    - Status: N/A (credentials, not a service)
+#    - Impact: Push notifications to iOS devices won't work
+#    - To add: Contact Onnela Lab for credentials, configure via environment vars
+#
+# 5. Sentry Error Tracking
+#    - Status: N/A (external service)
+#    - Impact: No centralized error tracking
+#    - To add: Create Sentry.io account, add DSN to config.infrastructure.beiwe-backend.sentry.dsn
+#
+# WHAT WORKS WITH THIS CONFIGURATION:
+# - Web-based study management portal
+# - User authentication and management
+# - Study configuration
+# - Survey creation and management
+# - Participant registration
+# - Data uploads from mobile apps (stored in S3/MinIO)
+# - Basic API endpoints
+# - Background task processing (with Celery enabled)
+# - Push notifications (requires Firebase credentials)
+# - Data processing pipelines
+#