nixify spindle box

Signed-off-by: Anirudh Oppiliappan <[e-mail]>

flake.nix

···
           ];
           target = "nixery.tangled.sh";
         };
+
+        spindle = {
+          modules = [
+            tangled.nixosModules.spindle
+            ./hosts/spindle/services/openbao/openbao.nix
+            ./hosts/spindle/services/openbao/proxy.nix
+            ./hosts/spindle/services/spindle.nix
+            ./hosts/spindle/services/nginx.nix
+          ];
+          target = "spindle.alpha.tangled.sh";
+        };
       };
     in
     {
···
         appview = mkHost "appview" hosts.appview.modules;
         pds = mkHost "pds" hosts.pds.modules;
         nixery = mkHost "nixery" hosts.nixery.modules;
+        spindle = mkHost "spindle" hosts.spindle.modules;
       };
 
       # colmena uses this
···
         appview = mkColmenaHost "appview" hosts.appview.target hosts.appview.modules;
         pds = mkColmenaHost "pds" hosts.pds.target hosts.pds.modules;
         nixery = mkColmenaHost "nixery" hosts.nixery.target hosts.nixery.modules;
+        spindle = mkColmenaHost "spindle" hosts.spindle.target hosts.spindle.modules;
       };
     };
 }

hosts/spindle/configuration.nix

···
+{ modulesPath
+, lib
+, pkgs
+, ...
+} @ args:
+{
+  imports = [
+    (modulesPath + "/installer/scan/not-detected.nix")
+    (modulesPath + "/profiles/qemu-guest.nix")
+    ./disk-config.nix
+  ];
+  boot.loader.grub = {
+    # no need to set devices, disko will add all devices that have a EF02 partition to the list already
+    # devices = [ ];
+    efiSupport = true;
+    efiInstallAsRemovable = true;
+  };
+
+  networking.hostName = "spindle-waw";
+  services = {
+    openssh.enable = true;
+  };
+
+
+  nix = {
+    extraOptions = ''
+      experimental-features = nix-command flakes ca-derivations
+      warn-dirty = false
+      keep-outputs = false
+    '';
+  };
+
+  environment.systemPackages = map lib.lowPrio [
+    pkgs.curl
+    pkgs.gitMinimal
+  ];
+
+  users.users.tangler = {
+    extraGroups = [ "networkmanager" "wheel" "docker" ];
+    openssh.authorizedKeys.keys = args.commonArgs.sshKeys;
+    isNormalUser = true;
+  };
+
+  security.sudo.extraRules = [
+    {
+      users = [ "tangler" ];
+      commands = [
+        {
+          command = "ALL";
+          options = [ "NOPASSWD" ];
+        }
+      ];
+    }
+  ];
+
+  system.stateVersion = "25.05";
+}

hosts/spindle/disk-config.nix

···
+# Example to create a bios compatible gpt partition
+{ lib, ... }:
+{
+  disko.devices = {
+    disk.disk1 = {
+      device = lib.mkDefault "/dev/vda";
+      type = "disk";
+      content = {
+        type = "gpt";
+        partitions = {
+          boot = {
+            name = "boot";
+            size = "1M";
+            type = "EF02";
+          };
+          esp = {
+            name = "ESP";
+            size = "500M";
+            type = "EF00";
+            content = {
+              type = "filesystem";
+              format = "vfat";
+              mountpoint = "/boot";
+            };
+          };
+          root = {
+            name = "root";
+            size = "100%";
+            content = {
+              type = "lvm_pv";
+              vg = "pool";
+            };
+          };
+        };
+      };
+    };
+    lvm_vg = {
+      pool = {
+        type = "lvm_vg";
+        lvs = {
+          root = {
+            size = "100%FREE";
+            content = {
+              type = "filesystem";
+              format = "ext4";
+              mountpoint = "/";
+              mountOptions = [
+                "defaults"
+              ];
+            };
+          };
+        };
+      };
+    };
+  };
+}

hosts/spindle/services/nginx.nix

···
+{
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "spindle.alpha.tangled.sh" = {
+        forceSSL = true;
+        enableACME = true;
+        locations."/" = {
+          proxyPass = "http://127.0.0.1:6555";
+        };
+        locations."/events" = {
+          proxyPass = "http://127.0.0.1:6555";
+          extraConfig = ''
+            proxy_set_header X-Forwarded-For $remote_addr;
+            proxy_set_header Host $host;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+          '';
+        };
+        locations."/logs/" = {
+          proxyPass = "http://127.0.0.1:6555";
+          extraConfig = ''
+            proxy_set_header X-Forwarded-For $remote_addr;
+            proxy_set_header Host $host;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection "upgrade";
+          '';
+        };
+      };
+    };
+  };
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "[e-mail]";
+  };
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+}

hosts/spindle/services/openbao/openbao.nix

···
+{ config, pkgs, lib, ... }:
+{
+  # Create openbao user and group
+  users.groups.openbao = {};
+
+  users.users.openbao = {
+    isSystemUser = true;
+    group = "openbao";
+    home = "/var/lib/openbao";
+    createHome = true;
+    description = "OpenBao service user";
+  };
+
+  systemd.services.openbao = {
+    serviceConfig = {
+      DynamicUser = lib.mkForce false;
+      User = "openbao";
+      Group = "openbao";
+    };
+  };
+
+  services.openbao = {
+    enable = true;
+    settings = {
+      ui = true;
+
+      listener.default = {
+        type = "tcp";
+        address = "127.0.0.1:8201";
+        tls_disable = true;
+      };
+
+      cluster_addr = "http://127.0.0.1:8202";
+      api_addr = "http://127.0.0.1:8201";
+
+      storage.raft.path = "/var/lib/openbao";
+    };
+  };
+}

hosts/spindle/services/openbao/proxy.nix

···
+{ pkgs, ... }:
+
+{
+  systemd.services.openbao-proxy = {
+    description = "OpenBao Proxy with Auto-Auth";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      User = "root";
+      ExecStart = "${pkgs.openbao}/bin/bao proxy -config=/etc/openbao/proxy.hcl";
+      Restart = "always";
+      RestartSec = "5";
+      LimitNOFILE = "65536";
+    };
+  };
+
+
+
+  environment.etc."openbao/proxy.hcl".text = ''
+    vault {
+      address = "http://localhost:8201"
+
+      # Retry configuration
+      retry {
+        num_retries = 5
+      }
+    }
+
+    # Auto-Auth using AppRole
+    auto_auth {
+      method "approle" {
+        mount_path = "auth/approle"
+        config = {
+          role_id_file_path   = "/etc/openbao/role-id"
+          secret_id_file_path = "/etc/openbao/secret-id"
+          remove_secret_id_file_after_reading = false
+        }
+      }
+
+      # Write authenticated token to file
+      sink "file" {
+        config = {
+          path = "/var/lib/openbao/token"
+          mode = 0640
+        }
+      }
+    }
+
+    # API Proxy listener for Spindle
+    listener "tcp" {
+      address     = "127.0.0.1:8200"
+      tls_disable = true
+
+      # Security headers
+      require_request_header = false
+
+      # Enable proxy API for management
+      proxy_api {
+        enable_quit = true
+      }
+    }
+
+    # Enable API proxy with auto-auth token
+    api_proxy {
+      use_auto_auth_token = true
+    }
+
+    cache {
+    }
+
+    # Logging configuration
+    log_level = "info"
+    log_format = "standard"
+    log_file = "/var/log/openbao/proxy.log"
+    log_rotate_duration = "24h"
+    log_rotate_max_files = 30
+
+    # Process management
+    pid_file = "/var/lib/openbao/proxy.pid"
+
+    # Disable idle connections for reliability
+    disable_idle_connections = ["auto-auth", "proxying"]
+  '';
+
+  # Create necessary directories and files
+  systemd.tmpfiles.rules = [
+    # Directories
+    "d /var/lib/openbao 0755 root root -"
+    "d /var/lib/openbao/cache 0755 root root -"
+    "d /var/log/openbao 0755 root root -"
+    "d /etc/openbao 0755 root root -"
+
+    # Credential files (content must be populated externally)
+    "f /etc/openbao/role-id 0600 root root -"
+    "f /etc/openbao/secret-id 0600 root root -"
+
+    # Configuration file
+    "f /etc/openbao/proxy.hcl 0644 root root -"
+  ];
+}

hosts/spindle/services/spindle.nix

···
+{ config, pkgs, ... }:
+{
+  services.tangled.spindle = {
+    enable = true;
+    server = {
+      owner = "did:plc:wshs7t2adsemcrrd4snkeqli"; # @tangled.sh
+      hostname = "spindle.alpha.tangled.sh";
+      listenAddr = "127.0.0.1:6555";
+      queueSize = 100;
+      maxJobCount = 2;
+      secrets = {
+        provider = "openbao";
+      };
+    };
+    pipelines = {
+      workflowTimeout = "15m";
+    };
+  };
+}