feat: streams module (WIP)

2025-04-01 22:58:44 -04:00 · 2025-04-01 22:58:44 -04:00 · 9624a019bd
commit 9624a019bd
parent dedd95c442
6 changed files with 342 additions and 2 deletions
--- a/modules/streams/default.nix
+++ b/modules/streams/default.nix
@ -0,0 +1,135 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.aether.streams;
+
+  useSubdomain = !(builtins.isNull cfg.subdomain);
+  domain = lib.optionalString useSubdomain "${cfg.subdomain}."
+           + config.aether.domain;
+in {
+  imports = [ ./options.nix ];
+
+  environment.systemPackages = [ pkgs.php ];
+
+  services.phpfpm.pools.streams = {
+    user = cfg.user;
+    settings = {
+      "listen.owner" = config.services.nginx.user;
+      "pm" = "dynamic";
+      "pm.max_children" = 32;
+      "pm.max_requests" = 500;
+      "pm.start_servers" = 2;
+      "pm.min_spare_servers" = 2;
+      "pm.max_spare_servers" = 5;
+      "php_admin_value[error_log]" = "stderr";
+      "php_admin_flag[log_errors]" = true;
+      "catch_workers_output" = true;
+    };
+    phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
+  };
+
+  services.nginx.enable = true;
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = config.aether.https;
+    enableACME = config.aether.https;
+
+    root = cfg.package;
+
+    extraConfig = ''
+      index index.php;
+      client_max_body_size 512M;
+
+      
+      # Rewrite to front controller as default rule.
+      location / {
+        if (!-e $request_filename) {
+          rewrite ^(.*)$ /index.php?req=$1;
+        }
+      }
+
+      # Make sure webfinger and other well-known services aren't blocked
+      # by denying dot files and rewrite request to the front controller.
+      location ^~ /.well-known/ {
+        allow all;
+        if (!-e $request_filename) {
+          rewrite ^(.*)$ /index.php?req=$1;
+        }
+      }
+
+      # Tell where fastcgi lives.
+      location ~ \.php$ {
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass unix:${config.services.phpfpm.pools.streams.socket};
+        include ${config.services.nginx.package}/conf/fastcgi.conf;
+      }
+
+      # Block these file types.
+      location ~* \.(tpl|tgz|log|out)$ {
+        deny all;
+      }
+
+      # Block dot files.
+      location ~ /\. {
+        deny all;
+      }
+
+      # Deny access to store.
+      location ~ /store {
+        deny all;
+      }
+
+      # Deny access to util.
+      location ~ /util {
+        deny all;
+      }
+    '';
+  };
+
+  security.acme.acceptTerms = config.aether.https;
+  security.acme.defaults.email = config.aether.acmeEmail;
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/streams - ${cfg.user} ${cfg.user} - -"
+    "d /var/lib/streams/store - ${cfg.user} ${cfg.user} - -"
+    "d /var/lib/streams/cache - ${cfg.user} ${cfg.user} - -"
+    "d /var/lib/streams/cache/smarty3 - ${cfg.user} ${cfg.user} - -"
+  ];
+
+  services.postgresql = {
+    enable = true;
+    ensureUsers = [{
+      name = cfg.user;
+      ensureDBOwnership = true;
+    }];
+    ensureDatabases = [ cfg.user ];
+  };
+
+  systemd.timers.streams-daemon = {
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    timerConfig.OnCalendar = "*:0/10";
+  };
+  systemd.services.streams-daemon = {
+    serviceConfig = {
+      Type = "oneshot";
+      User = cfg.user;
+    };
+    path = [ pkgs.php ];
+    script = ''
+      cd ${cfg.package}
+      php src/Daemon/Run.php Cron >/dev/null 2>&1
+    '';
+  };
+
+  users.users = lib.mkIf cfg.createUser {
+    ${cfg.user} = {
+      home = "/var/lib/streams";
+      group = cfg.user;
+      isSystemUser = true;
+    };
+  };
+  users.groups = lib.mkIf cfg.createUser {
+    ${cfg.user} = {};
+  };
+}