feat: add garage to best

hosts/best/garage/default.nix

@@ -0,0 +1,44 @@
+{ self, config, lib, pkgs, ... }: let
+  inherit (config.networking) domain;
+  inherit (lib) enabled merge;
+
+  fqdn    = "s3.${domain}";
+  portS3  = 8004;
+  portRpc = 8005;
+in {
+  imports = [(self + /modules/nginx.nix)];
+
+  secrets.garageEnvironment.file  = ./environment.age;
+
+  services.garage = enabled {
+    package = pkgs.garage_1_0_1;
+
+    environmentFile = config.secrets.garageEnvironment.path;
+
+    settings = {
+      data_dir = [{
+        capacity = "2T";
+        path     = "/var/lib/garage/data";
+      }];
+
+      replication_factor = 1; # TODO: Expand.
+      consistency_mode   = "consistent";
+
+      metadata_fsync = true;
+      data_fsync     = true;
+
+      rpc_bind_addr   = "[::]:${toString portRpc}";
+
+      s3_api = {
+        s3_region = "garage";
+
+        api_bind_addr = "[::1]:${toString portS3}";
+        root_domain   = fqdn;
+      };
+    };
+  };
+
+  services.nginx.virtualHosts.${fqdn} = merge config.services.nginx.sslTemplate {
+    locations."/".proxyPass = "http://[::1]:${toString portS3}";
+  };
+}

hosts/best/garage/environment.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 8y3T6w izWjzENLwfqk9n6gvSvSQVPl/BZJZCa8hhLOVu5IvjY
+wvfsfYEoYRWf93ArRNP/6rmXikqr0pZa2WyoYmoOYuw
+-> ssh-ed25519 CzqbPQ h4ciazCxdHa0kEhImX9PPxLRs9Qw4eP9GFm4GgzQzzo
+0wgm2Bf1/OfsxESnaoYQlXjN1IFHtBihU7yTDm3nGK0
+--- kzbMa60jx3l2aqxA3Ll86mwCOzBLxcy2X2HjQS/iFtE
+!@xAmzôU Ð"{G)ÏŠÎbYihJ}öÖºõ›@&g†çæ ·Ô
+Ù5•Cñ¾¾{b/\=Ùxð (´Ï}z–[ ŸA \ÔÏÔè7 EBœ3¢­„™2Ùk~A%§äLðù«k0l1M¸­Õ³Tà<>iÏ