Merge pull request #712 from input-output-hk/restore-http-snapshot

docker/nixos: allow restore of snapshot from env variable
IntersectMBO · Jul 29, 2021 · b9d0d36 · b9d0d36
2 parents b100f71 + fdeff8b
commit b9d0d36
Show file tree

Hide file tree

Showing 4 changed files with 62 additions and 10 deletions.
diff --git a/nix/docker.nix b/nix/docker.nix
@@ -145,8 +145,12 @@ let
         else
           DBSYNC=${cardano-db-sync}/bin/cardano-db-sync
         fi
-         exec $DBSYNC \
-           --schema-dir ${../schema} $@
+
+        set -euo pipefail
+        ${scripts.mainnet.db-sync.passthru.service.restoreSnapshotScript}
+
+        exec $DBSYNC \
+          --schema-dir ${../schema} $@
       ${clusterStatements}
       else
         echo "Managed configuration for network "$NETWORK" does not exist"

diff --git a/nix/nixos/cardano-db-sync-service.nix b/nix/nixos/cardano-db-sync-service.nix
@@ -34,6 +34,57 @@ in {
           Snapshot file is deleted after restore.
           '';
       };
+      restoreSnapshotSha = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = null;
+        description = ''
+          SHA256 checksum of the snapshot to restore
+        '';
+      };
+      restoreSnapshotSigKey = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = if (cfg.cluster == "mainnet" || cfg.cluster == "testnet")
+          then "D32587D4090FE461CAEE0FF4966E5CB9CBFAA9BA"
+          else null;
+        description = ''
+          Key ID for verifying the snaspshot signature.
+        '';
+      };
+      restoreSnapshotScript = lib.mkOption {
+        type = lib.types.str;
+        internal = true;
+        default = lib.optionalString (cfg.restoreSnapshot != null) ''
+        ${lib.optionalString (lib.hasPrefix "$" cfg.restoreSnapshot) ''if [ ! -z "''${${lib.removePrefix "$" cfg.restoreSnapshot}:-}" ]; then''}
+        SNAPSHOT_BASENAME="$(basename "${cfg.restoreSnapshot}")"
+        RESTORED_MARKER="$SNAPSHOT_BASENAME.restored"
+        if [ ! -f "$RESTORED_MARKER" ]; then
+          if [[ "${cfg.restoreSnapshot}" =~ ^https://.* ]]; then
+            ${pkgs.curl}/bin/curl -LOC - "${cfg.restoreSnapshot}"
+
+            ${if (cfg.restoreSnapshotSha != null)
+            then  ''echo "${cfg.restoreSnapshotSha} $SNAPSHOT_BASENAME" > "$SNAPSHOT_BASENAME.sha256sum"''
+            else  ''${pkgs.curl}/bin/curl -LO "${cfg.restoreSnapshot}.sha256sum"''
+            }
+            ${pkgs.coreutils}/bin/sha256sum -c "$SNAPSHOT_BASENAME.sha256sum"
+
+            ${lib.optionalString (cfg.restoreSnapshotSigKey != null) ''
+              ${pkgs.curl}/bin/curl -LO "${cfg.restoreSnapshot}.asc"
+              ${pkgs.gnupg}/bin/gpg --keyserver keys.openpgp.org --recv-keys ${cfg.restoreSnapshotSigKey}
+              ${pkgs.gnupg}/bin/gpg --verify "$SNAPSHOT_BASENAME.asc" "$SNAPSHOT_BASENAME"
+            ''}
+
+            SNAPSHOT="$SNAPSHOT_BASENAME"
+          else
+            SNAPSHOT="${cfg.restoreSnapshot}"
+          fi
+          rm -f *.lstate
+          ${../../scripts/postgresql-setup.sh} --restore-snapshot "$SNAPSHOT" ./
+          touch $RESTORED_MARKER
+          rm -f $SNAPSHOT{,.sha256sum,.asc}
+        fi
+        ${lib.optionalString (lib.hasPrefix "$" cfg.restoreSnapshot) "fi"}
+        '';
+      };
       # FIXME: is my assumption that this is required correct?
       pgpass = lib.mkOption {
         internal = true;
@@ -145,13 +196,7 @@ in {
         fi
         ''}
 
-        ${lib.optionalString (cfg.restoreSnapshot != null) ''
-        if [ -f ${cfg.restoreSnapshot} ]; then
-          rm -f *.lstate
-          ${../../scripts/postgresql-setup.sh} --restore-snapshot ${cfg.restoreSnapshot} ./
-          rm ${cfg.restoreSnapshot}
-        fi
-        ''}
+        ${cfg.restoreSnapshotScript}
 
         mkdir -p log-dir
         exec ${exec} \

diff --git a/nix/pkgs.nix b/nix/pkgs.nix
@@ -55,6 +55,7 @@ in {
   dockerImage = let
     defaultConfig = rec {
       services.cardano-db-sync = {
+        restoreSnapshot = lib.mkDefault "$RESTORE_SNAPSHOT";
         socketPath = lib.mkDefault ("/node-ipc/node.socket");
         postgres.generatePGPASS = false;
       };

diff --git a/nix/scripts.nix b/nix/scripts.nix
@@ -26,6 +26,8 @@ let
       #!${pkgs.runtimeShell}
       set -euo pipefail
       ${service.script} $@
-    '';
+    '' // {
+      passthru = { inherit service; };
+    };
   };
 in cardanoLib.forEnvironmentsCustom mkScript environments