feat: deploy logrotate using system manager

.editorconfig

@@ -0,0 +1,12 @@
+# EditorConfig is awesome: https://EditorConfig.org
+
+# top-most EditorConfig file
+root = true
+
+[*.nix]
+indent_style = space
+indent_size = 2
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true

ansible/tasks/finalize-ami.yml

@@ -41,18 +41,6 @@
     policy: deny
     direction: incoming
 
-- name: Move logrotate files to /etc/logrotate.d/
-  copy:
-    src: "files/logrotate_config/{{ item.file }}"
-    dest: "/etc/logrotate.d/{{ item.file }}"
-    mode: "0700"
-    owner: root
-  loop:
-    - { file: "logrotate-postgres-csv.conf" }
-    - { file: "logrotate-postgres.conf" }
-    - { file: "logrotate-walg.conf" }
-    - { file: "logrotate-postgres-auth.conf" }
-
 - name: Ensure default Postgres logrotate config is removed
   file:
     path: /etc/logrotate.d/postgresql-common
@@ -63,14 +51,6 @@
     src: files/cron.deny
     dest: /etc/cron.deny
 
-- name: Configure logrotation to run every hour
-  shell:
-    cmd: |
-        cp  /usr/lib/systemd/system/logrotate.timer /etc/systemd/system/logrotate.timer
-        sed -i -e 's;daily;*:0/5;' /etc/systemd/system/logrotate.timer
-        systemctl reenable logrotate.timer
-  become: yes
-
 - name: import pgsodium_getkey script
   template:
     src: files/pgsodium_getkey_readonly.sh.j2

nix/packages/docker-ubuntu.nix

@@ -14,6 +14,10 @@ let
     in
     runCommand "ubuntu-cloudimg" { nativeBuildInputs = [ xz ]; } ''
       mkdir -p $out
+      # FIXME: remove (among other things) builtin logrotate to avoid conflicts with the one set-up by system-manager
+      #   --exclude='etc/systemd/system/timers.target.wants/logrotate.timer' \
+      #   --exclude='usr/lib/systemd/system/logrotate.service' \
+      #   --exclude='usr/lib/systemd/system/logrotate.timer' \
       tar --exclude='dev/*' \
           --exclude='etc/systemd/system/network-online.target.wants/systemd-networkd-wait-online.service' \
           --exclude='etc/systemd/system/multi-user.target.wants/systemd-resolved.service' \

nix/systemConfigs.nix

@@ -1,9 +1,11 @@
 { self, inputs, ... }:
 let
   mkModules = system: [
+    self.systemModules.logrotate
     ({
       services.nginx.enable = true;
       nixpkgs.hostPlatform = system;
+      supabase.services.logrotate.enable = true;
     })
   ];
 

nix/systemModules/default.nix

@@ -4,6 +4,8 @@
 {
   imports = [ ./tests ];
   flake = {
-    systemModules = { };
+    systemModules = {
+      logrotate = ./logrotate.nix;
+    };
   };
 }

nix/systemModules/logrotate.nix

@@ -0,0 +1,90 @@
+{
+  lib,
+  nixosModulesPath,
+  config,
+  ...
+}:
+let
+  cfg = config.supabase.services.logrotate;
+in
+{
+  imports = map (path: nixosModulesPath + path) [
+    # FIXME: we can't use the logrotate module from nixpkgs becauce it's defined as a no-op option in system-manager:
+    # https://github.com/numtide/system-manager/blob/main/nix/modules/default.nix#L102-L108
+    #
+    # error: The option `services.logrotate' in module `/nix/store/...-source/nix/modules'
+    # would be a parent of the following options,but its type `attribute set' does not support nested options.
+    #
+    # "/services/logging/logrotate.nix"
+  ];
+
+  options = {
+    supabase.services.logrotate = {
+      enable = lib.mkEnableOption "Whether to enable the logrotate systemd service.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.etc = {
+      "logrotate.d/logrotate-postgres-auth.conf".text = ''
+        /var/log/postgresql/auth-failures.csv {
+          size 10M
+          rotate 5
+          compress
+          delaycompress
+          notifempty
+          missingok
+        }
+      '';
+      "logrotate.d/logrotate-postgres-csv.conf".text = ''
+        /var/log/postgresql/postgresql.csv {
+          size 50M
+          rotate 9
+          compress
+          delaycompress
+          notifempty
+          missingok
+          postrotate
+            sudo -u postgres /usr/lib/postgresql/bin/pg_ctl -D /var/lib/postgresql/data logrotate
+          endscript
+        }
+      '';
+      "logrotate.d/logrotate-postgres.conf".text = ''
+        /var/log/postgresql/postgresql.log {
+          size 50M
+          rotate 3
+          copytruncate
+          delaycompress
+          compress
+          notifempty
+          missingok
+        }
+      '';
+      "logrotate.d/logrotate-walg.conf".text = ''
+        /var/log/wal-g/*.log {
+          size 50M
+          rotate 3
+          copytruncate
+          delaycompress
+          compress
+          notifempty
+          missingok
+        }
+      '';
+    };
+
+    # FIXME: logrotate.service isn't a valid unit file (missing ExecStart), because it's already provided by Ubuntu:
+    # systemd.services.logrotate = {
+    #   wantedBy = lib.mkForce [
+    #     "system-manager.target"
+    #   ];
+    # };
+
+    # Overide systemd logrotate.timer to run every 5 minutes:
+    systemd.timers.logrotate = {
+      wantedBy = [ "timers.target" ];
+      timerConfig.OnCalendar = "*:0/5";
+      timerConfig.Persistent = true;
+    };
+  };
+}

nix/systemModules/tests/test_logrotate.py

@@ -0,0 +1,30 @@
+# from time import sleep
+
+
+# def test_debug(host):
+#     sleep(5000) # Handy for interactive debugging (with docker exec -it $CONTAINER_ID /bin/bash)
+
+
+def test_logrotate_timer(host):
+    timer = host.service("logrotate.timer")
+    assert timer.is_enabled
+    assert timer.is_running
+
+
+def test_logrotate_service_unit(host):
+    svc = host.service("logrotate.service")
+    assert svc.is_valid
+    result = host.run("systemctl start logrotate.service")
+    assert result.rc == 0
+
+
+def test_logrotate_configs(host):
+    for fname in [
+        "/etc/logrotate.d/logrotate-postgres-auth.conf",
+        "/etc/logrotate.d/logrotate-postgres-csv.conf",
+        "/etc/logrotate.d/logrotate-postgres.conf",
+        "/etc/logrotate.d/logrotate-walg.conf",
+    ]:
+        f = host.file(fname)
+        assert f.exists
+        assert f.user == "root"