diff --git a/README.md b/README.md index 60a3aeb..7bda54c 100644 --- a/README.md +++ b/README.md @@ -31,28 +31,14 @@ module has options, they can be found in the `options.nix` file inside the module directory. More general options used by multiple modules are documented in `modules/options.nix`. -### Modules - -Modules listed here may be unimplemented or unfinished. - -#### Basic +### Module Checklist - [x] `basic` - Basic Internet support - [x] `ssh` - SSH support -- [x] `fail2ban` - IP moderation - -#### Public Sites - - [ ] `site` - Static site hosting +- [x] `fail2ban` - IP moderation - [x] `forgejo` - Code forge - -#### Social - -- [x] `mastodon` - Mastodon server instance - [ ] `mail` - Mail server - -#### Storage - - [ ] `cachix` - Nix build caching - [ ] `backup` - Automated backup system diff --git a/aether/config.nix b/aether/config.nix index 8db7488..16617e3 100644 --- a/aether/config.nix +++ b/aether/config.nix @@ -1,4 +1,4 @@ -{ pkgs, aether, forgejo-tokyo-night, ... }: +{ config, lib, pkgs, aether, forgejo-tokyo-night, ... }: { networking.hostName = "toki-aether"; time.timeZone = "America/New_York"; @@ -23,19 +23,13 @@ # Aether modules imports = [ + aether.all aether.deploy-rpi5 - - aether.basic - aether.fail2ban - aether.forgejo - aether.ssh ]; aether.domain = "tokinanpa.dev"; aether.acmeEmail = "kiana.a.sheibani@gmail.com"; - # Forgejo - aether.forgejo.theme = "${forgejo-tokyo-night}/public/assets"; aether.forgejo.templates = ./forgejo-templates; services.forgejo.settings = { @@ -71,16 +65,7 @@ federation.ENABLED = true; }; - # Mastodon - - # aether.mastodon.subdomain = "social"; - # services.mastodon = { - # package = pkgs.mastodon.override { - # patches = [ ./mastodon/increase_limits.patch ]; - # }; - # extraConfig.SINGLE_USER_MODE = "true"; - # streamingProcesses = 3; - # }; + aether.streams.subdomain = "social"; system.stateVersion = "24.05"; } diff --git a/aether/mastodon/increase_limits.patch b/aether/mastodon/increase_limits.patch deleted file mode 100644 index bfef011..0000000 --- a/aether/mastodon/increase_limits.patch +++ /dev/null @@ -1,41 +0,0 @@ -diff --git a/app/javascript/mastodon/features/compose/containers/compose_form_container.js b/app/javascript/mastodon/features/compose/containers/compose_form_container.js -index bda2edb..1be1ce2 100644 ---- a/app/javascript/mastodon/features/compose/containers/compose_form_container.js -+++ b/app/javascript/mastodon/features/compose/containers/compose_form_container.js -@@ -28,7 +28,7 @@ const mapStateToProps = state => ({ - anyMedia: state.getIn(['compose', 'media_attachments']).size > 0, - isInReply: state.getIn(['compose', 'in_reply_to']) !== null, - lang: state.getIn(['compose', 'language']), -- maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 500), -+ maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 1000000), - }); - - const mapDispatchToProps = (dispatch) => ({ -diff --git a/app/validators/poll_options_validator.rb b/app/validators/poll_options_validator.rb -index 0ac84f9..9393de8 100644 ---- a/app/validators/poll_options_validator.rb -+++ b/app/validators/poll_options_validator.rb -@@ -1,8 +1,8 @@ - # frozen_string_literal: true - - class PollOptionsValidator < ActiveModel::Validator -- MAX_OPTIONS = 4 -- MAX_OPTION_CHARS = 50 -+ MAX_OPTIONS = 100 -+ MAX_OPTION_CHARS = 500 - - def validate(poll) - poll.errors.add(:options, I18n.t('polls.errors.too_few_options')) unless poll.options.size > 1 -diff --git a/app/validators/status_length_validator.rb b/app/validators/status_length_validator.rb -index dc841de..f0f1b25 100644 ---- a/app/validators/status_length_validator.rb -+++ b/app/validators/status_length_validator.rb -@@ -1,7 +1,7 @@ - # frozen_string_literal: true - - class StatusLengthValidator < ActiveModel::Validator -- MAX_CHARS = 500 -+ MAX_CHARS = 1000000 - URL_PLACEHOLDER_CHARS = 23 - URL_PLACEHOLDER = 'x' * 23 - diff --git a/aether/secrets/secrets.nix b/aether/secrets/secrets.nix index 42b10f4..d078f3d 100644 --- a/aether/secrets/secrets.nix +++ b/aether/secrets/secrets.nix @@ -9,14 +9,14 @@ let "EtbDcTMZ8qF0JKgVjir6X1hPxodDEiXy4XTGqqDKpyqwhMSPmTdgQFCeJEOrPhSc85vB6SJ" + "dVSC7YVRqIDpebiWFelen1PwsAMdL09bQKA2R3GMqJN/n6XlapKf8U= kiana@toki-earth"; fire-key = - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDpUgBuz7ti5ZVhkfr3s3EDWnPsZTplntF" + - "D1rEudrs1RnJV/XtG9iIiI9L0BSyyMcAMNLVhw+IJmBzTH5PS8ZWZ6vTDXMgu+6FYohyGhI" + - "nLtqNxAnrAJj/j6RrIWqNVTk6cPW6R7WJ+DHiV0Vvin5yTBT0liBq6OcI0gnmgMD2mVMEYc" + - "lgaWdGscJxpm5Kk6sCOMjTqxgQD2S6aUM27JhO2ESKj/iXmwoXWOnVN11ULP+4zcKPJ2rE/" + - "c/V6l/vIIvrXhKlhWpAl7m7+mhsvUVlfBAJwf2zqFVENNt48pAdchCzU9BOdvUabEyLtHkt" + - "GzygZi8oYYjlnjShf+CwfKBk4Zu1GVKs50V9jnpnNjUwkcddky4B72BgMs88XCgx0sVdfod" + - "fU7ngMnv/UV4YrzJ4vItLJ5hxq+pnytG33/y3JCOe8/xSk3za83S5dVr5cML7H1Hn0V1g0e" + - "apeWJD+iTHMQ6DnwLC8rCCt9wof0b+IB6IOlTUD6XzgaLcjLOxWMcE= kiana@toki-fire"; + "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDemOeWGP40M495KAuylZfRHXKKr9av0QH" + + "YjQwuG5EKzoy+KH0EAtBM3MbDLX5+bCd4O4oB9H/ZWxDZFfaitTPf1nrBMA89GWAxiGwVT3" + + "U2kQL2KUIP9rXjH/KLwocqnqsljRka1McF0mijtpMhNR0jpXAOfZboHFWRE07kRacvXmhkl" + + "tcJhXiCGMYmUfFT/HroxSgV+1BM9csYItzHlHFhoB2laEQOoTE5jLxkTkqZ55W0V9QUlM1N" + + "830fvhv9z/I6PQcIPXttB4nm+339r2qA3qncRkF7j0+JIXbUkIxK7nQhv25EyFUS8WplnI7" + + "mbb2T9JWVeLsAO24WrAApbPxmu+ItKq003Qi4a/0+v6D2PCXm+YoxJlM5aHh8FZdXoIhMv7" + + "6j3lk0P0sN9Sr09gjoWkV+/rSN+3ZLCJBGS5a3LpBk3HC2ZP/mvfsd1LTDhYQBJSW0LiBZO" + + "5aRuKZrTbyY9+i75cTWjnJuvZyBDn3giSYMiVhIAcZg5dU0ySG4M28= kiana@toki-fire"; keys = [ earth-key fire-key ]; in { inherit keys; diff --git a/deploy/rpi5/default.nix b/deploy/rpi5/default.nix index 502ae6c..8a3cfbf 100644 --- a/deploy/rpi5/default.nix +++ b/deploy/rpi5/default.nix @@ -1,6 +1,20 @@ { config, lib, ... }: { - nixpkgs.system = "aarch64-linux"; - boot.loader.systemd-boot.enable = true; - boot.loader.efi.canTouchEfiVariables = false; + options.aether.deploy.rpi5 = { + _internal.kernelPackages = lib.mkOption { + type = lib.types.raw; + description = '' + Kernel package to use for Raspberry Pi 5 support. + ''; + }; + }; + + config = + let cfg = config.aether.deploy.rpi5; + in { + nixpkgs.system = "aarch64-linux"; + boot.kernelPackages = cfg._internal.kernelPackages; + boot.loader.systemd-boot.enable = true; + boot.loader.efi.canTouchEfiVariables = false; + }; } diff --git a/flake.lock b/flake.lock index 76e19ea..82a012b 100644 --- a/flake.lock +++ b/flake.lock @@ -10,11 +10,11 @@ "systems": "systems" }, "locked": { - "lastModified": 1754433428, - "narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=", + "lastModified": 1723293904, + "narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=", "owner": "ryantm", "repo": "agenix", - "rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d", + "rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41", "type": "github" }, "original": { @@ -23,6 +23,20 @@ "type": "github" } }, + "flake-compat": { + "locked": { + "lastModified": 1696426674, + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", + "revCount": 57, + "type": "tarball", + "url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz" + } + }, "forgejo-tokyo-night": { "flake": false, "locked": { @@ -45,11 +59,11 @@ ] }, "locked": { - "lastModified": 1745494811, - "narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=", + "lastModified": 1703113217, + "narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=", "owner": "nix-community", "repo": "home-manager", - "rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be", + "rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1", "type": "github" }, "original": { @@ -58,28 +72,13 @@ "type": "github" } }, - "nixos-hardware": { - "locked": { - "lastModified": 1759582739, - "narHash": "sha256-spZegilADH0q5OngM86u6NmXxduCNv5eX9vCiUPhOYc=", - "owner": "NixOS", - "repo": "nixos-hardware", - "rev": "3441b5242af7577230a78ffb03542add264179ab", - "type": "github" - }, - "original": { - "owner": "NixOS", - "repo": "nixos-hardware", - "type": "github" - } - }, "nixpkgs": { "locked": { - "lastModified": 1759831965, - "narHash": "sha256-vgPm2xjOmKdZ0xKA6yLXPJpjOtQPHfaZDRtH+47XEBo=", + "lastModified": 1736344531, + "narHash": "sha256-8YVQ9ZbSfuUk2bUf2KRj60NRraLPKPS0Q4QFTbc+c2c=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "c9b6fb798541223bbb396d287d16f43520250518", + "rev": "bffc22eb12172e6db3c5dde9e3e5628f8e3e7912", "type": "github" }, "original": { @@ -93,8 +92,59 @@ "inputs": { "agenix": "agenix", "forgejo-tokyo-night": "forgejo-tokyo-night", - "nixos-hardware": "nixos-hardware", - "nixpkgs": "nixpkgs" + "nixpkgs": "nixpkgs", + "rpi5-kernel": "rpi5-kernel", + "streams-addons": "streams-addons", + "streams-src": "streams-src" + } + }, + "rpi5-kernel": { + "inputs": { + "flake-compat": "flake-compat", + "nixpkgs": [ + "nixpkgs" + ] + }, + "locked": { + "lastModified": 1704485878, + "narHash": "sha256-i7UH31IZyil99EUB5qnQJAiszFkea1B1yZf5pQEDIYg=", + "owner": "vriska", + "repo": "nix-rpi5", + "rev": "ac9942532e1dc2f825ad2aa3a6d31bfbd3b42eed", + "type": "gitlab" + }, + "original": { + "owner": "vriska", + "repo": "nix-rpi5", + "type": "gitlab" + } + }, + "streams-addons": { + "flake": false, + "locked": { + "lastModified": 1734638608, + "narHash": "sha256-Tgh2/AQjVX5O17a/LARjoTS72s2Yi7O3F8G0quiaCzU=", + "rev": "7f635aa21a85e865e3798c97b2745674d3deb1c0", + "type": "tarball", + "url": "https://codeberg.org/api/v1/repos/streams/streams-addons/archive/7f635aa21a85e865e3798c97b2745674d3deb1c0.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://codeberg.org/streams/streams-addons/archive/release.tar.gz" + } + }, + "streams-src": { + "flake": false, + "locked": { + "lastModified": 1743540017, + "narHash": "sha256-JFmYawpEsvaj25A5k6C5zIy0CAKzC52/yIQEc89dy9E=", + "rev": "6a36b893a4695970d5d657885e105e1939950c3b", + "type": "tarball", + "url": "https://codeberg.org/api/v1/repos/streams/streams/archive/6a36b893a4695970d5d657885e105e1939950c3b.tar.gz" + }, + "original": { + "type": "tarball", + "url": "https://codeberg.org/streams/streams/archive/release.tar.gz" } }, "systems": { diff --git a/flake.nix b/flake.nix index 24356df..4b2756e 100644 --- a/flake.nix +++ b/flake.nix @@ -3,7 +3,9 @@ description = "Aether - web server configuration"; inputs = { nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable"; - nixos-hardware.url = "github:NixOS/nixos-hardware"; + + rpi5-kernel.url = "gitlab:vriska/nix-rpi5"; + rpi5-kernel.inputs.nixpkgs.follows = "nixpkgs"; agenix.url = "github:ryantm/agenix"; agenix.inputs.nixpkgs.follows = "nixpkgs"; @@ -11,17 +13,31 @@ inputs = { forgejo-tokyo-night.url = "https://git.tokinanpa.dev/toki/forgejo-tokyo-night/archive/main.tar.gz"; forgejo-tokyo-night.flake = false; + + streams-src.url = "https://codeberg.org/streams/streams/archive/release.tar.gz"; + streams-src.flake = false; + + streams-addons.url = "https://codeberg.org/streams/streams-addons/archive/release.tar.gz"; + streams-addons.flake = false; }; -outputs = inputs@{ self, nixpkgs, nixos-hardware, agenix, ... }: +outputs = inputs@{ self, nixpkgs, agenix, rpi5-kernel, streams-src, streams-addons, ... }: let inherit (nixpkgs) lib; # Extra config applied to each module # (Mostly used for injecting flake inputs) extraConfig = { + streams = { + aether.streams._internal.streams-src = lib.mkDefault streams-src; + aether.streams._internal.vendorHash = + lib.mkDefault "sha256-pfbQeudVDhGpEIl1BoBeHbajtU9Z2+oY62D8GRqodTI="; + aether.streams.addonRepos = [ streams-addons ]; + }; + deploy-rpi5 = { - imports = [ nixos-hardware.nixosModules.raspberry-pi-5 ]; + aether.deploy.rpi5._internal.kernelPackages = lib.mkDefault + rpi5-kernel.legacyPackages.aarch64-linux.linuxPackages_rpi5; }; }; @@ -44,11 +60,11 @@ outputs = inputs@{ self, nixpkgs, nixos-hardware, agenix, ... }: (name: ./deploy/${lib.removePrefix "deploy-" name}); modulesWithCfg = builtins.mapAttrs (k: v: { - imports = [ v (extraConfig.${k} or {}) ]; - }) modules; + imports = [ v ]; + } // extraConfig.${k} or {}) modules; deploymentsWithCfg = builtins.mapAttrs (k: v: { - imports = [ v (extraConfig.${k} or {}) ]; - }) deployments; + imports = [ v ]; + } // extraConfig.${k} or {}) deployments; in { nixosModules = modulesWithCfg // deploymentsWithCfg // { diff --git a/modules/forgejo/options.nix b/modules/forgejo/options.nix index 6a4d101..102255d 100644 --- a/modules/forgejo/options.nix +++ b/modules/forgejo/options.nix @@ -1,4 +1,4 @@ -{ config, lib, ... }: +args@{ config, lib, ... }: { imports = [ ../options.nix ]; @@ -49,4 +49,11 @@ }; }; }; + + config.assertions = lib.mkIf config.aether.https [ + { + assertion = !(builtins.isNull config.aether.acmeEmail); + message = "HTTPS support requires providing a contact email"; + } + ]; } diff --git a/modules/mastodon/default.nix b/modules/mastodon/default.nix deleted file mode 100644 index 5b4495f..0000000 --- a/modules/mastodon/default.nix +++ /dev/null @@ -1,37 +0,0 @@ -{ config, lib, ... }: -let - cfg = config.aether.mastodon; - mastodon = config.services.mastodon; - - useSubdomain = !(builtins.isNull cfg.subdomain); - domain = lib.optionalString useSubdomain "${cfg.subdomain}." - + config.aether.domain; -in { - imports = [ ./options.nix ]; - - services.mastodon = { - enable = true; - user = cfg.user; - group = mastodon.user; - localDomain = domain; - configureNginx = true; - smtp.fromAddress = cfg.email; - }; - - security.acme.acceptTerms = true; - security.acme.defaults.email = config.aether.acmeEmail; - - networking.firewall.allowedTCPPorts = [ 80 443 ]; - - users.users = lib.mkIf (cfg.createUser && mastodon.user != "mastodon") { - ${mastodon.user} = { - home = mastodon.package; - useDefaultShell = true; - group = mastodon.group; - isSystemUser = true; - }; - }; - users.groups = lib.mkIf (cfg.createUser && mastodon.group != "mastodon") { - ${mastodon.group} = {}; - }; -} diff --git a/modules/mastodon/options.nix b/modules/mastodon/options.nix deleted file mode 100644 index 259df26..0000000 --- a/modules/mastodon/options.nix +++ /dev/null @@ -1,42 +0,0 @@ -{ config, lib, ... }: -{ - imports = [ ../options.nix ]; - - options.aether = { - mastodon = { - subdomain = lib.mkOption { - type = lib.types.nullOr lib.types.str; - default = "mastodon"; - description = '' - The subdomain to host Mastodon under. - - If null, then Mastodon is hosted at the domain itself. - ''; - }; - - user = lib.mkOption { - type = lib.types.str; - default = "mastodon"; - description = '' - The user to run Mastodon with. - ''; - }; - - createUser = lib.mkOption { - type = lib.types.bool; - default = true; - description = '' - Whether to create the Mastodon user automatically. - ''; - }; - - email = lib.mkOption { - type = lib.types.str; - default = config.aether.acmeEmail; - description = '' - The email address used by Mastodon to send emails from. - ''; - }; - }; - }; -} diff --git a/modules/options.nix b/modules/options.nix index 09ca8bd..a482a52 100644 --- a/modules/options.nix +++ b/modules/options.nix @@ -9,17 +9,13 @@ https = lib.mkOption { type = lib.types.boolByOr; default = true; - description = '' - Whether to force HTTPS connections for websites. - - This option is ignored if the service strictly requires HTTPS. - ''; + description = "Whether to force HTTPS connections for websites."; }; acmeEmail = lib.mkOption { - type = lib.types.str; + type = lib.types.nullOr lib.types.str; default = null; - description = "Email address to provide to the ACME service."; + description = "Email address for ACME."; }; }; } diff --git a/modules/streams/default.nix b/modules/streams/default.nix new file mode 100644 index 0000000..5d03de8 --- /dev/null +++ b/modules/streams/default.nix @@ -0,0 +1,135 @@ +{ config, pkgs, lib, ... }: +let + cfg = config.aether.streams; + + useSubdomain = !(builtins.isNull cfg.subdomain); + domain = lib.optionalString useSubdomain "${cfg.subdomain}." + + config.aether.domain; +in { + imports = [ ./options.nix ]; + + environment.systemPackages = [ pkgs.php ]; + + services.phpfpm.pools.streams = { + user = cfg.user; + settings = { + "listen.owner" = config.services.nginx.user; + "pm" = "dynamic"; + "pm.max_children" = 32; + "pm.max_requests" = 500; + "pm.start_servers" = 2; + "pm.min_spare_servers" = 2; + "pm.max_spare_servers" = 5; + "php_admin_value[error_log]" = "stderr"; + "php_admin_flag[log_errors]" = true; + "catch_workers_output" = true; + }; + phpEnv."PATH" = lib.makeBinPath [ pkgs.php ]; + }; + + services.nginx.enable = true; + services.nginx.virtualHosts.${domain} = { + forceSSL = config.aether.https; + enableACME = config.aether.https; + + root = cfg.package; + + extraConfig = '' + index index.php; + client_max_body_size 512M; + + + # Rewrite to front controller as default rule. + location / { + if (!-e $request_filename) { + rewrite ^(.*)$ /index.php?req=$1; + } + } + + # Make sure webfinger and other well-known services aren't blocked + # by denying dot files and rewrite request to the front controller. + location ^~ /.well-known/ { + allow all; + if (!-e $request_filename) { + rewrite ^(.*)$ /index.php?req=$1; + } + } + + # Tell where fastcgi lives. + location ~ \.php$ { + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_pass unix:${config.services.phpfpm.pools.streams.socket}; + include ${config.services.nginx.package}/conf/fastcgi.conf; + } + + # Block these file types. + location ~* \.(tpl|tgz|log|out)$ { + deny all; + } + + # Block dot files. + location ~ /\. { + deny all; + } + + # Deny access to store. + location ~ /store { + deny all; + } + + # Deny access to util. + location ~ /util { + deny all; + } + ''; + }; + + security.acme.acceptTerms = config.aether.https; + security.acme.defaults.email = config.aether.acmeEmail; + + networking.firewall.allowedTCPPorts = [ 80 443 ]; + + systemd.tmpfiles.rules = [ + "d /var/lib/streams - ${cfg.user} ${cfg.user} - -" + "d /var/lib/streams/store - ${cfg.user} ${cfg.user} - -" + "d /var/lib/streams/cache - ${cfg.user} ${cfg.user} - -" + "d /var/lib/streams/cache/smarty3 - ${cfg.user} ${cfg.user} - -" + ]; + + services.postgresql = { + enable = true; + ensureUsers = [{ + name = cfg.user; + ensureDBOwnership = true; + }]; + ensureDatabases = [ cfg.user ]; + }; + + systemd.timers.streams-daemon = { + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + timerConfig.OnCalendar = "*:0/10"; + }; + systemd.services.streams-daemon = { + serviceConfig = { + Type = "oneshot"; + User = cfg.user; + }; + path = [ pkgs.php ]; + script = '' + cd ${cfg.package} + php src/Daemon/Run.php Cron >/dev/null 2>&1 + ''; + }; + + users.users = lib.mkIf cfg.createUser { + ${cfg.user} = { + home = "/var/lib/streams"; + group = cfg.user; + isSystemUser = true; + }; + }; + users.groups = lib.mkIf cfg.createUser { + ${cfg.user} = {}; + }; +} diff --git a/modules/streams/options.nix b/modules/streams/options.nix new file mode 100644 index 0000000..c96ed81 --- /dev/null +++ b/modules/streams/options.nix @@ -0,0 +1,91 @@ +args@{ config, lib, pkgs, ... }: +{ + imports = [ ../options.nix ]; + + options.aether = { + streams = { + # INTERNAL + _internal.streams-src = lib.mkOption { + type = lib.types.pathInStore; + description = '' + The source repository of (streams). + ''; + }; + + _internal.vendorHash = lib.mkOption { + type = lib.types.str; + description = '' + The vendor hash to use when finding PHP dependencies. + ''; + }; + + # OPTIONS + package = lib.mkOption { + type = lib.types.package; + default = pkgs.callPackage ./package.nix { + src = config.aether.streams._internal.streams-src; + vendorHash = config.aether.streams._internal.vendorHash; + inherit (config.aether.streams) addonRepos themeRepos; + }; + description = '' + The (streams) package to use. + + The derivation must be built in a precise way to be compatible with + this module; see the package.nix file for details. + ''; + }; + + subdomain = lib.mkOption { + type = lib.types.nullOr lib.types.str; + default = "streams"; + description = '' + The subdomain to host the (streams) instance under. + + If null, then (streams) is hosted at the domain itself. + ''; + }; + + user = lib.mkOption { + type = lib.types.str; + default = "streams"; + description = '' + The user to run (streams) with. + ''; + }; + + createUser = lib.mkOption { + type = lib.types.bool; + default = true; + description = '' + Whether to create the (streams) user automatically. + ''; + }; + + addonRepos = lib.mkOption { + type = lib.types.listOf lib.types.pathInStore; + default = []; + defaultText = "[ ]"; + description = '' + A list of repositories containing addons. + + The official addon repository is provided by default. + ''; + }; + + themeRepos = lib.mkOption { + type = lib.types.listOf lib.types.pathInStore; + default = []; + description = '' + A list of repositories containing themes. + ''; + }; + }; + }; + + config.assertions = lib.mkIf config.aether.https [ + { + assertion = !(builtins.isNull config.aether.acmeEmail); + message = "HTTPS support requires providing a contact email"; + } + ]; +} diff --git a/modules/streams/package.nix b/modules/streams/package.nix new file mode 100644 index 0000000..94fb786 --- /dev/null +++ b/modules/streams/package.nix @@ -0,0 +1,69 @@ +{ + lib, + php, + + src, + vendorHash, + addonRepos ? [], + themeRepos ? [] +}: + +php.buildComposerProject { + pname = "streams"; + version = "25.4.2"; + inherit src vendorHash; + + postInstall = '' + # Override composerInstallHook's output location + rm -rf $out + cp -r . $out + + # Ugly hack: These locations need to be writable, + # so link them to outside of the Nix store + ln -s /var/lib/streams/store $out/store + ln -s /var/lib/streams/cache $out/cache + ln -s /var/lib/streams/config.php $out/.htconfig.php + + # Install addons and themes + + mkdir $out/addon + for repo in ${lib.concatStringsSep " " addonRepos}; do + filelist=(`ls $repo`) + for a in "''${filelist[@]}" ; do + if [ $a = 'version.php' ]; then + if [ ! -x $out/addon/version.php ]; then + ln -s $repo/version.php $out/addon/version.php + fi + fi + base=`basename $a` + if [ $base = '.git' ]; then + continue; + fi + if [ ! -d $repo/$base ]; then + continue; + fi + if [ -x $out/addon/$base ]; then + continue; + fi + ln -s $repo/$base $out/addon/$base + done + done + + for repo in ${lib.concatStringsSep " " themeRepos}; do + filelist=(`ls $repo`) + for a in "''${filelist[@]}" ; do + base=`basename $a` + if [ $base = '.git' ]; then + continue; + fi + if [ ! -d $repo/$base ]; then + continue; + fi + if [ -x $out/view/theme/$base ]; then + continue; + fi + ln -s $repo/$base $out/view/theme/$base + done + done + ''; +}