From 29d18e8f6f78ff5782c097d019d082a978d90160 Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Sat, 6 Jan 2024 22:06:17 -0300
Subject: [PATCH 1/2] nixos/etcd: fixes etcd failing to start at boot and add
 openFirewall option

Fixes etcd failing to start at boot for network and firewall not being ready and etcd peers being unavailable because of network/firewall

* configure etcd systemd unit to:

  - delay etcd start-up until network and firewall are ready
  - restart on failure and be always on

* add openFirewall option

  The official etcd ports are 2379 for client requests and 2380 for peer communication:
  https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt
  https://etcd.io/docs/v3.4/op-guide/configuration/
---
 nixos/modules/services/misc/etcd.nix | 25 ++++++++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/misc/etcd.nix b/nixos/modules/services/misc/etcd.nix
index ee6a56db31d3..a5b3abdbcb59 100644
--- a/nixos/modules/services/misc/etcd.nix
+++ b/nixos/modules/services/misc/etcd.nix
@@ -99,6 +99,17 @@ in {
       type = types.nullOr types.path;
     };
 
+    openFirewall = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        Open etcd ports in the firewall.
+        Ports opened:
+        - 2379/tcp for client requests
+        - 2380/tcp for peer communication
+      '';
+    };
+
     peerCertFile = mkOption {
       description = lib.mdDoc "Cert file to use for peer to peer communication";
       default = cfg.certFile;
@@ -160,7 +171,10 @@ in {
     systemd.services.etcd = {
       description = "etcd key-value store";
       wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
+      after = [ "network-online.target" ]
+        ++ lib.optional config.networking.firewall.enable "firewall.service";
+      wants = [ "network-online.target" ]
+        ++ lib.optional config.networking.firewall.enable "firewall.service";
 
       environment = (filterAttrs (n: v: v != null) {
         ETCD_NAME = cfg.name;
@@ -190,6 +204,8 @@ in {
 
       serviceConfig = {
         Type = "notify";
+        Restart = "always";
+        RestartSec = "30s";
         ExecStart = "${cfg.package}/bin/etcd";
         User = "etcd";
         LimitNOFILE = 40000;
@@ -198,6 +214,13 @@ in {
 
     environment.systemPackages = [ cfg.package ];
 
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedTCPPorts = [
+        2379 # for client requests
+        2380 # for peer communication
+      ];
+    };
+
     users.users.etcd = {
       isSystemUser = true;
       group = "etcd";

From cbe8e0c9809aa50a4a9c389cab2879b3f8935c0f Mon Sep 17 00:00:00 2001
From: superherointj <5861043+superherointj@users.noreply.github.com>
Date: Tue, 16 Jan 2024 20:31:49 -0300
Subject: [PATCH 2/2] nixos/etcd: fix etcd category from misc to databases

---
 nixos/modules/module-list.nix                       | 2 +-
 nixos/modules/services/{misc => databases}/etcd.nix | 0
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename nixos/modules/services/{misc => databases}/etcd.nix (100%)

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c2bcb2f78080..546ca5add1e5 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -427,6 +427,7 @@
   ./services/databases/couchdb.nix
   ./services/databases/dgraph.nix
   ./services/databases/dragonflydb.nix
+  ./services/databases/etcd.nix
   ./services/databases/ferretdb.nix
   ./services/databases/firebird.nix
   ./services/databases/foundationdb.nix
@@ -676,7 +677,6 @@
   ./services/misc/dwm-status.nix
   ./services/misc/dysnomia.nix
   ./services/misc/errbot.nix
-  ./services/misc/etcd.nix
   ./services/misc/etebase-server.nix
   ./services/misc/etesync-dav.nix
   ./services/misc/evdevremapkeys.nix
diff --git a/nixos/modules/services/misc/etcd.nix b/nixos/modules/services/databases/etcd.nix
similarity index 100%
rename from nixos/modules/services/misc/etcd.nix
rename to nixos/modules/services/databases/etcd.nix