machines/bc01n05: postgres: auth, hba, more ram
Change-Id: Id10b97efa3588a2a9147a349391da559e6cce7e5
Reviewed-on: https://gerrit.hackerspace.pl/c/hscloud/+/1482
Reviewed-by: q3k <q3k@hackerspace.pl>
diff --git a/cluster/machines/bc01n05.hswaw.net.nix b/cluster/machines/bc01n05.hswaw.net.nix
index d2b4da0..3155cc9 100644
--- a/cluster/machines/bc01n05.hswaw.net.nix
+++ b/cluster/machines/bc01n05.hswaw.net.nix
@@ -49,6 +49,8 @@
gw = "185.236.240.33";
};
+ networking.firewall.allowedTCPPorts = [ config.services.postgresql.port ];
+
environment.systemPackages = [postgresPkg];
services.postgresql = {
enable = true;
@@ -57,9 +59,9 @@
initdbArgs = ["--encoding='UTF8'" "--lc-collate='C'" "--lc-ctype='C'"];
settings = {
max_connections = 300;
- shared_buffers = "4GB";
- temp_buffers = "64MB";
- work_mem = "64MB";
+ shared_buffers = "8GB";
+ temp_buffers = "128MB";
+ work_mem = "128MB";
maintenance_work_mem = "258MB";
effective_io_concurrency = 10; # ssd, guess
maintenance_io_concurrency = 100; # ssd, guess
@@ -88,12 +90,11 @@
};
}
];
- # TODO actually allow synapse to talk to us
- # also adjust firewall
authentication = pkgs.lib.mkOverride 10 ''
- local all all trust
- host all all 127.0.0.1/32 trust
- host all all ::1/128 trust
+ local all all trust
+ host all all 127.0.0.1/32 trust
+ host all all ::1/128 trust
+ host synapse,mediarepo synapse,mediarepo 185.236.240.0/24 scram-sha-256
'';
};
}