feat: streams module (WIP)

modules/streams/default.nix

@@ -0,0 +1,135 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.aether.streams;
+
+  useSubdomain = !(builtins.isNull cfg.subdomain);
+  domain = lib.optionalString useSubdomain "${cfg.subdomain}."
+           + config.aether.domain;
+in {
+  imports = [ ./options.nix ];
+
+  environment.systemPackages = [ pkgs.php ];
+
+  services.phpfpm.pools.streams = {
+    user = cfg.user;
+    settings = {
+      "listen.owner" = config.services.nginx.user;
+      "pm" = "dynamic";
+      "pm.max_children" = 32;
+      "pm.max_requests" = 500;
+      "pm.start_servers" = 2;
+      "pm.min_spare_servers" = 2;
+      "pm.max_spare_servers" = 5;
+      "php_admin_value[error_log]" = "stderr";
+      "php_admin_flag[log_errors]" = true;
+      "catch_workers_output" = true;
+    };
+    phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
+  };
+
+  services.nginx.enable = true;
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = config.aether.https;
+    enableACME = config.aether.https;
+
+    root = cfg.package;
+
+    extraConfig = ''
+      index index.php;
+      client_max_body_size 512M;
+
+      
+      # Rewrite to front controller as default rule.
+      location / {
+        if (!-e $request_filename) {
+          rewrite ^(.*)$ /index.php?req=$1;
+        }
+      }
+
+      # Make sure webfinger and other well-known services aren't blocked
+      # by denying dot files and rewrite request to the front controller.
+      location ^~ /.well-known/ {
+        allow all;
+        if (!-e $request_filename) {
+          rewrite ^(.*)$ /index.php?req=$1;
+        }
+      }
+
+      # Tell where fastcgi lives.
+      location ~ \.php$ {
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass unix:${config.services.phpfpm.pools.streams.socket};
+        include ${config.services.nginx.package}/conf/fastcgi.conf;
+      }
+
+      # Block these file types.
+      location ~* \.(tpl|tgz|log|out)$ {
+        deny all;
+      }
+
+      # Block dot files.
+      location ~ /\. {
+        deny all;
+      }
+
+      # Deny access to store.
+      location ~ /store {
+        deny all;
+      }
+
+      # Deny access to util.
+      location ~ /util {
+        deny all;
+      }
+    '';
+  };
+
+  security.acme.acceptTerms = config.aether.https;
+  security.acme.defaults.email = config.aether.acmeEmail;
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/streams - ${cfg.user} ${cfg.user} - -"
+    "d /var/lib/streams/store - ${cfg.user} ${cfg.user} - -"
+    "d /var/lib/streams/cache - ${cfg.user} ${cfg.user} - -"
+    "d /var/lib/streams/cache/smarty3 - ${cfg.user} ${cfg.user} - -"
+  ];
+
+  services.postgresql = {
+    enable = true;
+    ensureUsers = [{
+      name = cfg.user;
+      ensureDBOwnership = true;
+    }];
+    ensureDatabases = [ cfg.user ];
+  };
+
+  systemd.timers.streams-daemon = {
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    timerConfig.OnCalendar = "*:0/10";
+  };
+  systemd.services.streams-daemon = {
+    serviceConfig = {
+      Type = "oneshot";
+      User = cfg.user;
+    };
+    path = [ pkgs.php ];
+    script = ''
+      cd ${cfg.package}
+      php src/Daemon/Run.php Cron >/dev/null 2>&1
+    '';
+  };
+
+  users.users = lib.mkIf cfg.createUser {
+    ${cfg.user} = {
+      home = "/var/lib/streams";
+      group = cfg.user;
+      isSystemUser = true;
+    };
+  };
+  users.groups = lib.mkIf cfg.createUser {
+    ${cfg.user} = {};
+  };
+}

modules/streams/options.nix

@@ -0,0 +1,91 @@
+args@{ config, lib, pkgs, ... }:
+{
+  imports = [ ../options.nix ];
+
+  options.aether = {
+    streams = {
+      # INTERNAL
+      _internal.streams-src = lib.mkOption {
+        type = lib.types.pathInStore;
+        description = ''
+          The source repository of (streams).
+        '';
+      };
+
+      _internal.vendorHash = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          The vendor hash to use when finding PHP dependencies.
+        '';
+      };
+
+      # OPTIONS
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.callPackage ./package.nix {
+          src = config.aether.streams._internal.streams-src;
+          vendorHash = config.aether.streams._internal.vendorHash;
+          inherit (config.aether.streams) addonRepos themeRepos;
+        };
+        description = ''
+          The (streams) package to use.
+
+          The derivation must be built in a precise way to be compatible with
+          this module; see the package.nix file for details.
+        '';
+      };
+
+      subdomain = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = "streams";
+        description = ''
+          The subdomain to host the (streams) instance under.
+
+          If null, then (streams) is hosted at the domain itself.
+        '';
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "streams";
+        description = ''
+          The user to run (streams) with.
+        '';
+      };
+
+      createUser = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to create the (streams) user automatically.
+        '';
+      };
+
+      addonRepos = lib.mkOption {
+        type = lib.types.listOf lib.types.pathInStore;
+        default = [];
+        defaultText = "[ <streams-addons> ]";
+        description = ''
+          A list of repositories containing addons.
+
+          The official addon repository is provided by default.
+        '';
+      };
+
+      themeRepos = lib.mkOption {
+        type = lib.types.listOf lib.types.pathInStore;
+        default = [];
+        description = ''
+          A list of repositories containing themes.
+        '';
+      };
+    };
+  };
+
+  config.assertions = lib.mkIf config.aether.https [
+    {
+      assertion = !(builtins.isNull config.aether.acmeEmail);
+      message = "HTTPS support requires providing a contact email";
+    }
+  ];
+}

modules/streams/package.nix

@@ -0,0 +1,69 @@
+{
+  lib,
+  php,
+
+  src,
+  vendorHash,
+  addonRepos ? [],
+  themeRepos ? []
+}:
+
+php.buildComposerProject {
+  pname = "streams";
+  version = "25.4.2";
+  inherit src vendorHash;
+
+  postInstall = ''
+    # Override composerInstallHook's output location
+    rm -rf $out
+    cp -r . $out
+
+    # Ugly hack: These locations need to be writable,
+    # so link them to outside of the Nix store
+    ln -s /var/lib/streams/store $out/store
+    ln -s /var/lib/streams/cache $out/cache
+    ln -s /var/lib/streams/config.php $out/.htconfig.php
+
+    # Install addons and themes
+
+    mkdir $out/addon
+    for repo in ${lib.concatStringsSep " " addonRepos}; do
+        filelist=(`ls $repo`)
+        for a in "''${filelist[@]}" ; do
+            if [ $a = 'version.php' ]; then
+                if [ ! -x $out/addon/version.php ]; then
+                    ln -s $repo/version.php $out/addon/version.php
+                fi
+            fi
+            base=`basename $a`
+            if [ $base = '.git' ]; then
+                continue;
+            fi
+            if [ ! -d $repo/$base ]; then
+                continue;
+            fi
+            if [ -x $out/addon/$base ]; then
+                continue;
+            fi
+            ln -s $repo/$base $out/addon/$base
+        done
+    done
+
+    for repo in ${lib.concatStringsSep " " themeRepos}; do
+        filelist=(`ls $repo`)
+        for a in "''${filelist[@]}" ; do
+            base=`basename $a`
+            if [ $base = '.git' ]; then
+                continue;
+            fi
+            if [ ! -d $repo/$base ]; then
+                continue;
+            fi
+            if [ -x $out/view/theme/$base ]; then
+                continue;
+            fi
+            ln -s $repo/$base $out/view/theme/$base
+        done
+    done
+  '';
+}