feat: streams module (WIP)

aether/config.nix

@@ -65,5 +65,7 @@
     federation.ENABLED = true;
   };
 
+  aether.streams.subdomain = "social";
+
   system.stateVersion = "24.05";
 }

flake.lock

@@ -93,7 +93,9 @@
         "agenix": "agenix",
         "forgejo-tokyo-night": "forgejo-tokyo-night",
         "nixpkgs": "nixpkgs",
-        "rpi5-kernel": "rpi5-kernel"
+        "rpi5-kernel": "rpi5-kernel",
+        "streams-addons": "streams-addons",
+        "streams-src": "streams-src"
       }
     },
     "rpi5-kernel": {
@@ -117,6 +119,34 @@
         "type": "gitlab"
       }
     },
+    "streams-addons": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1734638608,
+        "narHash": "sha256-Tgh2/AQjVX5O17a/LARjoTS72s2Yi7O3F8G0quiaCzU=",
+        "rev": "7f635aa21a85e865e3798c97b2745674d3deb1c0",
+        "type": "tarball",
+        "url": "https://codeberg.org/api/v1/repos/streams/streams-addons/archive/7f635aa21a85e865e3798c97b2745674d3deb1c0.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://codeberg.org/streams/streams-addons/archive/release.tar.gz"
+      }
+    },
+    "streams-src": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1743540017,
+        "narHash": "sha256-JFmYawpEsvaj25A5k6C5zIy0CAKzC52/yIQEc89dy9E=",
+        "rev": "6a36b893a4695970d5d657885e105e1939950c3b",
+        "type": "tarball",
+        "url": "https://codeberg.org/api/v1/repos/streams/streams/archive/6a36b893a4695970d5d657885e105e1939950c3b.tar.gz"
+      },
+      "original": {
+        "type": "tarball",
+        "url": "https://codeberg.org/streams/streams/archive/release.tar.gz"
+      }
+    },
     "systems": {
       "locked": {
         "lastModified": 1681028828,

flake.nix

@@ -13,15 +13,28 @@ inputs = {
 
   forgejo-tokyo-night.url = "https://git.tokinanpa.dev/toki/forgejo-tokyo-night/archive/main.tar.gz";
   forgejo-tokyo-night.flake = false;
+
+  streams-src.url = "https://codeberg.org/streams/streams/archive/release.tar.gz";
+  streams-src.flake = false;
+
+  streams-addons.url = "https://codeberg.org/streams/streams-addons/archive/release.tar.gz";
+  streams-addons.flake = false;
 };
 
-outputs = inputs@{ self, nixpkgs, agenix, rpi5-kernel, ... }:
+outputs = inputs@{ self, nixpkgs, agenix, rpi5-kernel, streams-src, streams-addons, ... }:
   let
     inherit (nixpkgs) lib;
 
     # Extra config applied to each module
     # (Mostly used for injecting flake inputs)
     extraConfig = {
+      streams = {
+        aether.streams._internal.streams-src = lib.mkDefault streams-src;
+        aether.streams._internal.vendorHash =
+          lib.mkDefault "sha256-pfbQeudVDhGpEIl1BoBeHbajtU9Z2+oY62D8GRqodTI=";
+        aether.streams.addonRepos = [ streams-addons ];
+      };
+
       deploy-rpi5 = {
         aether.deploy.rpi5._internal.kernelPackages = lib.mkDefault
           rpi5-kernel.legacyPackages.aarch64-linux.linuxPackages_rpi5;

modules/streams/default.nix

@@ -0,0 +1,135 @@
+{ config, pkgs, lib, ... }:
+let
+  cfg = config.aether.streams;
+
+  useSubdomain = !(builtins.isNull cfg.subdomain);
+  domain = lib.optionalString useSubdomain "${cfg.subdomain}."
+           + config.aether.domain;
+in {
+  imports = [ ./options.nix ];
+
+  environment.systemPackages = [ pkgs.php ];
+
+  services.phpfpm.pools.streams = {
+    user = cfg.user;
+    settings = {
+      "listen.owner" = config.services.nginx.user;
+      "pm" = "dynamic";
+      "pm.max_children" = 32;
+      "pm.max_requests" = 500;
+      "pm.start_servers" = 2;
+      "pm.min_spare_servers" = 2;
+      "pm.max_spare_servers" = 5;
+      "php_admin_value[error_log]" = "stderr";
+      "php_admin_flag[log_errors]" = true;
+      "catch_workers_output" = true;
+    };
+    phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
+  };
+
+  services.nginx.enable = true;
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = config.aether.https;
+    enableACME = config.aether.https;
+
+    root = cfg.package;
+
+    extraConfig = ''
+      index index.php;
+      client_max_body_size 512M;
+
+      
+      # Rewrite to front controller as default rule.
+      location / {
+        if (!-e $request_filename) {
+          rewrite ^(.*)$ /index.php?req=$1;
+        }
+      }
+
+      # Make sure webfinger and other well-known services aren't blocked
+      # by denying dot files and rewrite request to the front controller.
+      location ^~ /.well-known/ {
+        allow all;
+        if (!-e $request_filename) {
+          rewrite ^(.*)$ /index.php?req=$1;
+        }
+      }
+
+      # Tell where fastcgi lives.
+      location ~ \.php$ {
+        fastcgi_split_path_info ^(.+\.php)(/.+)$;
+        fastcgi_pass unix:${config.services.phpfpm.pools.streams.socket};
+        include ${config.services.nginx.package}/conf/fastcgi.conf;
+      }
+
+      # Block these file types.
+      location ~* \.(tpl|tgz|log|out)$ {
+        deny all;
+      }
+
+      # Block dot files.
+      location ~ /\. {
+        deny all;
+      }
+
+      # Deny access to store.
+      location ~ /store {
+        deny all;
+      }
+
+      # Deny access to util.
+      location ~ /util {
+        deny all;
+      }
+    '';
+  };
+
+  security.acme.acceptTerms = config.aether.https;
+  security.acme.defaults.email = config.aether.acmeEmail;
+
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/streams - ${cfg.user} ${cfg.user} - -"
+    "d /var/lib/streams/store - ${cfg.user} ${cfg.user} - -"
+    "d /var/lib/streams/cache - ${cfg.user} ${cfg.user} - -"
+    "d /var/lib/streams/cache/smarty3 - ${cfg.user} ${cfg.user} - -"
+  ];
+
+  services.postgresql = {
+    enable = true;
+    ensureUsers = [{
+      name = cfg.user;
+      ensureDBOwnership = true;
+    }];
+    ensureDatabases = [ cfg.user ];
+  };
+
+  systemd.timers.streams-daemon = {
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    timerConfig.OnCalendar = "*:0/10";
+  };
+  systemd.services.streams-daemon = {
+    serviceConfig = {
+      Type = "oneshot";
+      User = cfg.user;
+    };
+    path = [ pkgs.php ];
+    script = ''
+      cd ${cfg.package}
+      php src/Daemon/Run.php Cron >/dev/null 2>&1
+    '';
+  };
+
+  users.users = lib.mkIf cfg.createUser {
+    ${cfg.user} = {
+      home = "/var/lib/streams";
+      group = cfg.user;
+      isSystemUser = true;
+    };
+  };
+  users.groups = lib.mkIf cfg.createUser {
+    ${cfg.user} = {};
+  };
+}

modules/streams/options.nix

@@ -0,0 +1,91 @@
+args@{ config, lib, pkgs, ... }:
+{
+  imports = [ ../options.nix ];
+
+  options.aether = {
+    streams = {
+      # INTERNAL
+      _internal.streams-src = lib.mkOption {
+        type = lib.types.pathInStore;
+        description = ''
+          The source repository of (streams).
+        '';
+      };
+
+      _internal.vendorHash = lib.mkOption {
+        type = lib.types.str;
+        description = ''
+          The vendor hash to use when finding PHP dependencies.
+        '';
+      };
+
+      # OPTIONS
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.callPackage ./package.nix {
+          src = config.aether.streams._internal.streams-src;
+          vendorHash = config.aether.streams._internal.vendorHash;
+          inherit (config.aether.streams) addonRepos themeRepos;
+        };
+        description = ''
+          The (streams) package to use.
+
+          The derivation must be built in a precise way to be compatible with
+          this module; see the package.nix file for details.
+        '';
+      };
+
+      subdomain = lib.mkOption {
+        type = lib.types.nullOr lib.types.str;
+        default = "streams";
+        description = ''
+          The subdomain to host the (streams) instance under.
+
+          If null, then (streams) is hosted at the domain itself.
+        '';
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "streams";
+        description = ''
+          The user to run (streams) with.
+        '';
+      };
+
+      createUser = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Whether to create the (streams) user automatically.
+        '';
+      };
+
+      addonRepos = lib.mkOption {
+        type = lib.types.listOf lib.types.pathInStore;
+        default = [];
+        defaultText = "[ <streams-addons> ]";
+        description = ''
+          A list of repositories containing addons.
+
+          The official addon repository is provided by default.
+        '';
+      };
+
+      themeRepos = lib.mkOption {
+        type = lib.types.listOf lib.types.pathInStore;
+        default = [];
+        description = ''
+          A list of repositories containing themes.
+        '';
+      };
+    };
+  };
+
+  config.assertions = lib.mkIf config.aether.https [
+    {
+      assertion = !(builtins.isNull config.aether.acmeEmail);
+      message = "HTTPS support requires providing a contact email";
+    }
+  ];
+}

modules/streams/package.nix

@@ -0,0 +1,69 @@
+{
+  lib,
+  php,
+
+  src,
+  vendorHash,
+  addonRepos ? [],
+  themeRepos ? []
+}:
+
+php.buildComposerProject {
+  pname = "streams";
+  version = "25.4.2";
+  inherit src vendorHash;
+
+  postInstall = ''
+    # Override composerInstallHook's output location
+    rm -rf $out
+    cp -r . $out
+
+    # Ugly hack: These locations need to be writable,
+    # so link them to outside of the Nix store
+    ln -s /var/lib/streams/store $out/store
+    ln -s /var/lib/streams/cache $out/cache
+    ln -s /var/lib/streams/config.php $out/.htconfig.php
+
+    # Install addons and themes
+
+    mkdir $out/addon
+    for repo in ${lib.concatStringsSep " " addonRepos}; do
+        filelist=(`ls $repo`)
+        for a in "''${filelist[@]}" ; do
+            if [ $a = 'version.php' ]; then
+                if [ ! -x $out/addon/version.php ]; then
+                    ln -s $repo/version.php $out/addon/version.php
+                fi
+            fi
+            base=`basename $a`
+            if [ $base = '.git' ]; then
+                continue;
+            fi
+            if [ ! -d $repo/$base ]; then
+                continue;
+            fi
+            if [ -x $out/addon/$base ]; then
+                continue;
+            fi
+            ln -s $repo/$base $out/addon/$base
+        done
+    done
+
+    for repo in ${lib.concatStringsSep " " themeRepos}; do
+        filelist=(`ls $repo`)
+        for a in "''${filelist[@]}" ; do
+            base=`basename $a`
+            if [ $base = '.git' ]; then
+                continue;
+            fi
+            if [ ! -d $repo/$base ]; then
+                continue;
+            fi
+            if [ -x $out/view/theme/$base ]; then
+                continue;
+            fi
+            ln -s $repo/$base $out/view/theme/$base
+        done
+    done
+  '';
+}