🎉 Initial Rev.

[mhkarimi1383]

This pull request introduces a new Nix flake for RustFS, providing a prebuilt binary package and a NixOS module for easy integration and configuration. It adds support for multiple platforms, detailed documentation, and a robust NixOS service definition for managing RustFS as a systemd service.

The most important changes are:

Nix Flake and Packaging:

• Added flake.nix to define the RustFS flake, providing prebuilt binaries for Linux and macOS on both x86_64 and aarch64 architectures, and exposing both a package and a NixOS module.
• Included sources.json to track RustFS release versions and platform-specific download URLs and hashes for the prebuilt binaries.

NixOS Module:

• Introduced nixos/rustfs.nix as a NixOS module to manage RustFS as a service, with configurable options such as access keys, volumes, logging, and TLS directories, and a secure systemd service definition.

Documentation:

• Expanded and improved README.md with usage instructions, configuration options, and examples for integrating RustFS into NixOS systems using the new flake and module.

[mhkarimi1383]

For managing sources.json file we should determine if we do it manually or automatically

[Copilot]

Pull request overview

This pull request introduces the initial release of a Nix flake for RustFS, providing infrastructure for deploying RustFS as a prebuilt binary package with NixOS integration. The implementation includes cross-platform binary distribution, a systemd service module, and comprehensive documentation.

Key changes:

• Added Nix flake infrastructure with prebuilt binary packages for Linux and macOS on x86_64 and aarch64 architectures
• Introduced a NixOS module with systemd service definition and configurable options for RustFS deployment
• Provided documentation with usage examples and configuration reference

Reviewed changes

Copilot reviewed 4 out of 6 changed files in this pull request and generated 12 comments.

Show a summary per file

File	Description
sources.json	Defines version and platform-specific download URLs/hashes for RustFS prebuilt binaries
nixos/rustfs.nix	Implements NixOS module with service configuration, options, and systemd unit definition
flake.nix	Defines Nix flake structure with package derivations and module exports
flake.lock	Lock file for nixpkgs dependency
README.md	User documentation with installation instructions and configuration options reference
.gitignore	Ignores Nix build artifacts and direnv cache

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Running the service as root (User = "root", Group = "root") violates the principle of least privilege and creates unnecessary security risk. If the service is compromised, an attacker would have full system access. Consider creating a dedicated rustfs user and group with minimal permissions needed to access only the volumes and log directories.

[Copilot]

The startScript sources the environment file from /etc/default/rustfs but doesn't verify it exists or handle potential errors. If the file is missing or malformed, the script will fail silently or with unclear errors. Consider adding error handling or verification that the environment file is properly created.

Suggested change

	. /etc/default/rustfs
	exec ${cfg.package}/bin/rustfs $RUSTFS_VOLUMES
	set -euo pipefail
	if [ ! -r /etc/default/rustfs ]; then
	echo "rustfs: environment file /etc/default/rustfs is missing or not readable" >&2
	exit 1
	fi
	. /etc/default/rustfs
	if [ -z "${RUSTFS_VOLUMES:-}" ]; then
	echo "rustfs: RUSTFS_VOLUMES is not set in /etc/default/rustfs" >&2
	exit 1
	fi
	exec ${cfg.package}/bin/rustfs "$RUSTFS_VOLUMES"

[mhkarimi1383]

This problem is not possible since we are already getting them from parameters

[Copilot]

The tmpfiles.rules create directories with root:root ownership, but these directories should be owned by the service user. If the service ever runs as a non-root user (as it should for security), it won't have permission to write to these directories. The ownership should match the service's User and Group settings.

[Copilot]

The envFile definition writes RUSTFS_ACCESS_KEY and RUSTFS_SECRET_KEY into a Nix store file via pkgs.writeText, which is typically world-readable and then symlinked into /etc/default/rustfs. This exposes RustFS admin credentials in cleartext to any local user on the system, allowing them to exfiltrate or abuse object storage data without needing root. Treat these values as secrets and load them from a restricted-permissions secret source (e.g., systemd credentials or a NixOS secret management module) rather than embedding them in the store and /etc.

[mhkarimi1383]

Same as what we have for normal installations

[mhkarimi1383]

Same as what we have for normal installations

[mhkarimi1383]

I have also added support for extra env vars

[loverustfs]

Hello @mhkarimi1383 ,

Thank you very much.

Merged.