Compare commits
1 commit
| Author | SHA1 | Date | |
|---|---|---|---|
9624a019bd
|
14 changed files with 435 additions and 206 deletions
18
README.md
18
README.md
|
|
@ -31,28 +31,14 @@ module has options, they can be found in the `options.nix` file inside the
|
|||
module directory. More general options used by multiple modules are documented
|
||||
in `modules/options.nix`.
|
||||
|
||||
### Modules
|
||||
|
||||
Modules listed here may be unimplemented or unfinished.
|
||||
|
||||
#### Basic
|
||||
### Module Checklist
|
||||
|
||||
- [x] `basic` - Basic Internet support
|
||||
- [x] `ssh` - SSH support
|
||||
- [x] `fail2ban` - IP moderation
|
||||
|
||||
#### Public Sites
|
||||
|
||||
- [ ] `site` - Static site hosting
|
||||
- [x] `fail2ban` - IP moderation
|
||||
- [x] `forgejo` - Code forge
|
||||
|
||||
#### Social
|
||||
|
||||
- [x] `mastodon` - Mastodon server instance
|
||||
- [ ] `mail` - Mail server
|
||||
|
||||
#### Storage
|
||||
|
||||
- [ ] `cachix` - Nix build caching
|
||||
- [ ] `backup` - Automated backup system
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ pkgs, aether, forgejo-tokyo-night, ... }:
|
||||
{ config, lib, pkgs, aether, forgejo-tokyo-night, ... }:
|
||||
{
|
||||
networking.hostName = "toki-aether";
|
||||
time.timeZone = "America/New_York";
|
||||
|
|
@ -23,19 +23,13 @@
|
|||
# Aether modules
|
||||
|
||||
imports = [
|
||||
aether.all
|
||||
aether.deploy-rpi5
|
||||
|
||||
aether.basic
|
||||
aether.fail2ban
|
||||
aether.forgejo
|
||||
aether.ssh
|
||||
];
|
||||
|
||||
aether.domain = "tokinanpa.dev";
|
||||
aether.acmeEmail = "kiana.a.sheibani@gmail.com";
|
||||
|
||||
# Forgejo
|
||||
|
||||
aether.forgejo.theme = "${forgejo-tokyo-night}/public/assets";
|
||||
aether.forgejo.templates = ./forgejo-templates;
|
||||
services.forgejo.settings = {
|
||||
|
|
@ -71,16 +65,7 @@
|
|||
federation.ENABLED = true;
|
||||
};
|
||||
|
||||
# Mastodon
|
||||
|
||||
# aether.mastodon.subdomain = "social";
|
||||
# services.mastodon = {
|
||||
# package = pkgs.mastodon.override {
|
||||
# patches = [ ./mastodon/increase_limits.patch ];
|
||||
# };
|
||||
# extraConfig.SINGLE_USER_MODE = "true";
|
||||
# streamingProcesses = 3;
|
||||
# };
|
||||
aether.streams.subdomain = "social";
|
||||
|
||||
system.stateVersion = "24.05";
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,41 +0,0 @@
|
|||
diff --git a/app/javascript/mastodon/features/compose/containers/compose_form_container.js b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
|
||||
index bda2edb..1be1ce2 100644
|
||||
--- a/app/javascript/mastodon/features/compose/containers/compose_form_container.js
|
||||
+++ b/app/javascript/mastodon/features/compose/containers/compose_form_container.js
|
||||
@@ -28,7 +28,7 @@ const mapStateToProps = state => ({
|
||||
anyMedia: state.getIn(['compose', 'media_attachments']).size > 0,
|
||||
isInReply: state.getIn(['compose', 'in_reply_to']) !== null,
|
||||
lang: state.getIn(['compose', 'language']),
|
||||
- maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 500),
|
||||
+ maxChars: state.getIn(['server', 'server', 'configuration', 'statuses', 'max_characters'], 1000000),
|
||||
});
|
||||
|
||||
const mapDispatchToProps = (dispatch) => ({
|
||||
diff --git a/app/validators/poll_options_validator.rb b/app/validators/poll_options_validator.rb
|
||||
index 0ac84f9..9393de8 100644
|
||||
--- a/app/validators/poll_options_validator.rb
|
||||
+++ b/app/validators/poll_options_validator.rb
|
||||
@@ -1,8 +1,8 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
class PollOptionsValidator < ActiveModel::Validator
|
||||
- MAX_OPTIONS = 4
|
||||
- MAX_OPTION_CHARS = 50
|
||||
+ MAX_OPTIONS = 100
|
||||
+ MAX_OPTION_CHARS = 500
|
||||
|
||||
def validate(poll)
|
||||
poll.errors.add(:options, I18n.t('polls.errors.too_few_options')) unless poll.options.size > 1
|
||||
diff --git a/app/validators/status_length_validator.rb b/app/validators/status_length_validator.rb
|
||||
index dc841de..f0f1b25 100644
|
||||
--- a/app/validators/status_length_validator.rb
|
||||
+++ b/app/validators/status_length_validator.rb
|
||||
@@ -1,7 +1,7 @@
|
||||
# frozen_string_literal: true
|
||||
|
||||
class StatusLengthValidator < ActiveModel::Validator
|
||||
- MAX_CHARS = 500
|
||||
+ MAX_CHARS = 1000000
|
||||
URL_PLACEHOLDER_CHARS = 23
|
||||
URL_PLACEHOLDER = 'x' * 23
|
||||
|
||||
|
|
@ -9,14 +9,14 @@ let
|
|||
"EtbDcTMZ8qF0JKgVjir6X1hPxodDEiXy4XTGqqDKpyqwhMSPmTdgQFCeJEOrPhSc85vB6SJ" +
|
||||
"dVSC7YVRqIDpebiWFelen1PwsAMdL09bQKA2R3GMqJN/n6XlapKf8U= kiana@toki-earth";
|
||||
fire-key =
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDpUgBuz7ti5ZVhkfr3s3EDWnPsZTplntF" +
|
||||
"D1rEudrs1RnJV/XtG9iIiI9L0BSyyMcAMNLVhw+IJmBzTH5PS8ZWZ6vTDXMgu+6FYohyGhI" +
|
||||
"nLtqNxAnrAJj/j6RrIWqNVTk6cPW6R7WJ+DHiV0Vvin5yTBT0liBq6OcI0gnmgMD2mVMEYc" +
|
||||
"lgaWdGscJxpm5Kk6sCOMjTqxgQD2S6aUM27JhO2ESKj/iXmwoXWOnVN11ULP+4zcKPJ2rE/" +
|
||||
"c/V6l/vIIvrXhKlhWpAl7m7+mhsvUVlfBAJwf2zqFVENNt48pAdchCzU9BOdvUabEyLtHkt" +
|
||||
"GzygZi8oYYjlnjShf+CwfKBk4Zu1GVKs50V9jnpnNjUwkcddky4B72BgMs88XCgx0sVdfod" +
|
||||
"fU7ngMnv/UV4YrzJ4vItLJ5hxq+pnytG33/y3JCOe8/xSk3za83S5dVr5cML7H1Hn0V1g0e" +
|
||||
"apeWJD+iTHMQ6DnwLC8rCCt9wof0b+IB6IOlTUD6XzgaLcjLOxWMcE= kiana@toki-fire";
|
||||
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDemOeWGP40M495KAuylZfRHXKKr9av0QH" +
|
||||
"YjQwuG5EKzoy+KH0EAtBM3MbDLX5+bCd4O4oB9H/ZWxDZFfaitTPf1nrBMA89GWAxiGwVT3" +
|
||||
"U2kQL2KUIP9rXjH/KLwocqnqsljRka1McF0mijtpMhNR0jpXAOfZboHFWRE07kRacvXmhkl" +
|
||||
"tcJhXiCGMYmUfFT/HroxSgV+1BM9csYItzHlHFhoB2laEQOoTE5jLxkTkqZ55W0V9QUlM1N" +
|
||||
"830fvhv9z/I6PQcIPXttB4nm+339r2qA3qncRkF7j0+JIXbUkIxK7nQhv25EyFUS8WplnI7" +
|
||||
"mbb2T9JWVeLsAO24WrAApbPxmu+ItKq003Qi4a/0+v6D2PCXm+YoxJlM5aHh8FZdXoIhMv7" +
|
||||
"6j3lk0P0sN9Sr09gjoWkV+/rSN+3ZLCJBGS5a3LpBk3HC2ZP/mvfsd1LTDhYQBJSW0LiBZO" +
|
||||
"5aRuKZrTbyY9+i75cTWjnJuvZyBDn3giSYMiVhIAcZg5dU0ySG4M28= kiana@toki-fire";
|
||||
keys = [ earth-key fire-key ];
|
||||
in {
|
||||
inherit keys;
|
||||
|
|
|
|||
|
|
@ -1,6 +1,20 @@
|
|||
{ config, lib, ... }:
|
||||
{
|
||||
nixpkgs.system = "aarch64-linux";
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = false;
|
||||
options.aether.deploy.rpi5 = {
|
||||
_internal.kernelPackages = lib.mkOption {
|
||||
type = lib.types.raw;
|
||||
description = ''
|
||||
Kernel package to use for Raspberry Pi 5 support.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
config =
|
||||
let cfg = config.aether.deploy.rpi5;
|
||||
in {
|
||||
nixpkgs.system = "aarch64-linux";
|
||||
boot.kernelPackages = cfg._internal.kernelPackages;
|
||||
boot.loader.systemd-boot.enable = true;
|
||||
boot.loader.efi.canTouchEfiVariables = false;
|
||||
};
|
||||
}
|
||||
|
|
|
|||
102
flake.lock
generated
102
flake.lock
generated
|
|
@ -10,11 +10,11 @@
|
|||
"systems": "systems"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1754433428,
|
||||
"narHash": "sha256-NA/FT2hVhKDftbHSwVnoRTFhes62+7dxZbxj5Gxvghs=",
|
||||
"lastModified": 1723293904,
|
||||
"narHash": "sha256-b+uqzj+Wa6xgMS9aNbX4I+sXeb5biPDi39VgvSFqFvU=",
|
||||
"owner": "ryantm",
|
||||
"repo": "agenix",
|
||||
"rev": "9edb1787864c4f59ae5074ad498b6272b3ec308d",
|
||||
"rev": "f6291c5935fdc4e0bef208cfc0dcab7e3f7a1c41",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -23,6 +23,20 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"flake-compat": {
|
||||
"locked": {
|
||||
"lastModified": 1696426674,
|
||||
"narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=",
|
||||
"rev": "0f9255e01c2351cc7d116c072cb317785dd33b33",
|
||||
"revCount": 57,
|
||||
"type": "tarball",
|
||||
"url": "https://api.flakehub.com/f/pinned/edolstra/flake-compat/1.0.1/018afb31-abd1-7bff-a5e4-cff7e18efb7a/source.tar.gz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://flakehub.com/f/edolstra/flake-compat/1.tar.gz"
|
||||
}
|
||||
},
|
||||
"forgejo-tokyo-night": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
|
|
@ -45,11 +59,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1745494811,
|
||||
"narHash": "sha256-YZCh2o9Ua1n9uCvrvi5pRxtuVNml8X2a03qIFfRKpFs=",
|
||||
"lastModified": 1703113217,
|
||||
"narHash": "sha256-7ulcXOk63TIT2lVDSExj7XzFx09LpdSAPtvgtM7yQPE=",
|
||||
"owner": "nix-community",
|
||||
"repo": "home-manager",
|
||||
"rev": "abfad3d2958c9e6300a883bd443512c55dfeb1be",
|
||||
"rev": "3bfaacf46133c037bb356193bd2f1765d9dc82c1",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -58,28 +72,13 @@
|
|||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixos-hardware": {
|
||||
"locked": {
|
||||
"lastModified": 1759582739,
|
||||
"narHash": "sha256-spZegilADH0q5OngM86u6NmXxduCNv5eX9vCiUPhOYc=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixos-hardware",
|
||||
"rev": "3441b5242af7577230a78ffb03542add264179ab",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
"owner": "NixOS",
|
||||
"repo": "nixos-hardware",
|
||||
"type": "github"
|
||||
}
|
||||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1759831965,
|
||||
"narHash": "sha256-vgPm2xjOmKdZ0xKA6yLXPJpjOtQPHfaZDRtH+47XEBo=",
|
||||
"lastModified": 1736344531,
|
||||
"narHash": "sha256-8YVQ9ZbSfuUk2bUf2KRj60NRraLPKPS0Q4QFTbc+c2c=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "c9b6fb798541223bbb396d287d16f43520250518",
|
||||
"rev": "bffc22eb12172e6db3c5dde9e3e5628f8e3e7912",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -93,8 +92,59 @@
|
|||
"inputs": {
|
||||
"agenix": "agenix",
|
||||
"forgejo-tokyo-night": "forgejo-tokyo-night",
|
||||
"nixos-hardware": "nixos-hardware",
|
||||
"nixpkgs": "nixpkgs"
|
||||
"nixpkgs": "nixpkgs",
|
||||
"rpi5-kernel": "rpi5-kernel",
|
||||
"streams-addons": "streams-addons",
|
||||
"streams-src": "streams-src"
|
||||
}
|
||||
},
|
||||
"rpi5-kernel": {
|
||||
"inputs": {
|
||||
"flake-compat": "flake-compat",
|
||||
"nixpkgs": [
|
||||
"nixpkgs"
|
||||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1704485878,
|
||||
"narHash": "sha256-i7UH31IZyil99EUB5qnQJAiszFkea1B1yZf5pQEDIYg=",
|
||||
"owner": "vriska",
|
||||
"repo": "nix-rpi5",
|
||||
"rev": "ac9942532e1dc2f825ad2aa3a6d31bfbd3b42eed",
|
||||
"type": "gitlab"
|
||||
},
|
||||
"original": {
|
||||
"owner": "vriska",
|
||||
"repo": "nix-rpi5",
|
||||
"type": "gitlab"
|
||||
}
|
||||
},
|
||||
"streams-addons": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1734638608,
|
||||
"narHash": "sha256-Tgh2/AQjVX5O17a/LARjoTS72s2Yi7O3F8G0quiaCzU=",
|
||||
"rev": "7f635aa21a85e865e3798c97b2745674d3deb1c0",
|
||||
"type": "tarball",
|
||||
"url": "https://codeberg.org/api/v1/repos/streams/streams-addons/archive/7f635aa21a85e865e3798c97b2745674d3deb1c0.tar.gz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://codeberg.org/streams/streams-addons/archive/release.tar.gz"
|
||||
}
|
||||
},
|
||||
"streams-src": {
|
||||
"flake": false,
|
||||
"locked": {
|
||||
"lastModified": 1743540017,
|
||||
"narHash": "sha256-JFmYawpEsvaj25A5k6C5zIy0CAKzC52/yIQEc89dy9E=",
|
||||
"rev": "6a36b893a4695970d5d657885e105e1939950c3b",
|
||||
"type": "tarball",
|
||||
"url": "https://codeberg.org/api/v1/repos/streams/streams/archive/6a36b893a4695970d5d657885e105e1939950c3b.tar.gz"
|
||||
},
|
||||
"original": {
|
||||
"type": "tarball",
|
||||
"url": "https://codeberg.org/streams/streams/archive/release.tar.gz"
|
||||
}
|
||||
},
|
||||
"systems": {
|
||||
|
|
|
|||
30
flake.nix
30
flake.nix
|
|
@ -3,7 +3,9 @@ description = "Aether - web server configuration";
|
|||
|
||||
inputs = {
|
||||
nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
|
||||
nixos-hardware.url = "github:NixOS/nixos-hardware";
|
||||
|
||||
rpi5-kernel.url = "gitlab:vriska/nix-rpi5";
|
||||
rpi5-kernel.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
||||
agenix.url = "github:ryantm/agenix";
|
||||
agenix.inputs.nixpkgs.follows = "nixpkgs";
|
||||
|
|
@ -11,17 +13,31 @@ inputs = {
|
|||
|
||||
forgejo-tokyo-night.url = "https://git.tokinanpa.dev/toki/forgejo-tokyo-night/archive/main.tar.gz";
|
||||
forgejo-tokyo-night.flake = false;
|
||||
|
||||
streams-src.url = "https://codeberg.org/streams/streams/archive/release.tar.gz";
|
||||
streams-src.flake = false;
|
||||
|
||||
streams-addons.url = "https://codeberg.org/streams/streams-addons/archive/release.tar.gz";
|
||||
streams-addons.flake = false;
|
||||
};
|
||||
|
||||
outputs = inputs@{ self, nixpkgs, nixos-hardware, agenix, ... }:
|
||||
outputs = inputs@{ self, nixpkgs, agenix, rpi5-kernel, streams-src, streams-addons, ... }:
|
||||
let
|
||||
inherit (nixpkgs) lib;
|
||||
|
||||
# Extra config applied to each module
|
||||
# (Mostly used for injecting flake inputs)
|
||||
extraConfig = {
|
||||
streams = {
|
||||
aether.streams._internal.streams-src = lib.mkDefault streams-src;
|
||||
aether.streams._internal.vendorHash =
|
||||
lib.mkDefault "sha256-pfbQeudVDhGpEIl1BoBeHbajtU9Z2+oY62D8GRqodTI=";
|
||||
aether.streams.addonRepos = [ streams-addons ];
|
||||
};
|
||||
|
||||
deploy-rpi5 = {
|
||||
imports = [ nixos-hardware.nixosModules.raspberry-pi-5 ];
|
||||
aether.deploy.rpi5._internal.kernelPackages = lib.mkDefault
|
||||
rpi5-kernel.legacyPackages.aarch64-linux.linuxPackages_rpi5;
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -44,11 +60,11 @@ outputs = inputs@{ self, nixpkgs, nixos-hardware, agenix, ... }:
|
|||
(name: ./deploy/${lib.removePrefix "deploy-" name});
|
||||
|
||||
modulesWithCfg = builtins.mapAttrs (k: v: {
|
||||
imports = [ v (extraConfig.${k} or {}) ];
|
||||
}) modules;
|
||||
imports = [ v ];
|
||||
} // extraConfig.${k} or {}) modules;
|
||||
deploymentsWithCfg = builtins.mapAttrs (k: v: {
|
||||
imports = [ v (extraConfig.${k} or {}) ];
|
||||
}) deployments;
|
||||
imports = [ v ];
|
||||
} // extraConfig.${k} or {}) deployments;
|
||||
in {
|
||||
nixosModules =
|
||||
modulesWithCfg // deploymentsWithCfg // {
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
{ config, lib, ... }:
|
||||
args@{ config, lib, ... }:
|
||||
{
|
||||
imports = [ ../options.nix ];
|
||||
|
||||
|
|
@ -49,4 +49,11 @@
|
|||
};
|
||||
};
|
||||
};
|
||||
|
||||
config.assertions = lib.mkIf config.aether.https [
|
||||
{
|
||||
assertion = !(builtins.isNull config.aether.acmeEmail);
|
||||
message = "HTTPS support requires providing a contact email";
|
||||
}
|
||||
];
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,37 +0,0 @@
|
|||
{ config, lib, ... }:
|
||||
let
|
||||
cfg = config.aether.mastodon;
|
||||
mastodon = config.services.mastodon;
|
||||
|
||||
useSubdomain = !(builtins.isNull cfg.subdomain);
|
||||
domain = lib.optionalString useSubdomain "${cfg.subdomain}."
|
||||
+ config.aether.domain;
|
||||
in {
|
||||
imports = [ ./options.nix ];
|
||||
|
||||
services.mastodon = {
|
||||
enable = true;
|
||||
user = cfg.user;
|
||||
group = mastodon.user;
|
||||
localDomain = domain;
|
||||
configureNginx = true;
|
||||
smtp.fromAddress = cfg.email;
|
||||
};
|
||||
|
||||
security.acme.acceptTerms = true;
|
||||
security.acme.defaults.email = config.aether.acmeEmail;
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
users.users = lib.mkIf (cfg.createUser && mastodon.user != "mastodon") {
|
||||
${mastodon.user} = {
|
||||
home = mastodon.package;
|
||||
useDefaultShell = true;
|
||||
group = mastodon.group;
|
||||
isSystemUser = true;
|
||||
};
|
||||
};
|
||||
users.groups = lib.mkIf (cfg.createUser && mastodon.group != "mastodon") {
|
||||
${mastodon.group} = {};
|
||||
};
|
||||
}
|
||||
|
|
@ -1,42 +0,0 @@
|
|||
{ config, lib, ... }:
|
||||
{
|
||||
imports = [ ../options.nix ];
|
||||
|
||||
options.aether = {
|
||||
mastodon = {
|
||||
subdomain = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = "mastodon";
|
||||
description = ''
|
||||
The subdomain to host Mastodon under.
|
||||
|
||||
If null, then Mastodon is hosted at the domain itself.
|
||||
'';
|
||||
};
|
||||
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "mastodon";
|
||||
description = ''
|
||||
The user to run Mastodon with.
|
||||
'';
|
||||
};
|
||||
|
||||
createUser = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether to create the Mastodon user automatically.
|
||||
'';
|
||||
};
|
||||
|
||||
email = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = config.aether.acmeEmail;
|
||||
description = ''
|
||||
The email address used by Mastodon to send emails from.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
@ -9,17 +9,13 @@
|
|||
https = lib.mkOption {
|
||||
type = lib.types.boolByOr;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether to force HTTPS connections for websites.
|
||||
|
||||
This option is ignored if the service strictly requires HTTPS.
|
||||
'';
|
||||
description = "Whether to force HTTPS connections for websites.";
|
||||
};
|
||||
|
||||
acmeEmail = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = null;
|
||||
description = "Email address to provide to the ACME service.";
|
||||
description = "Email address for ACME.";
|
||||
};
|
||||
};
|
||||
}
|
||||
|
|
|
|||
135
modules/streams/default.nix
Normal file
135
modules/streams/default.nix
Normal file
|
|
@ -0,0 +1,135 @@
|
|||
{ config, pkgs, lib, ... }:
|
||||
let
|
||||
cfg = config.aether.streams;
|
||||
|
||||
useSubdomain = !(builtins.isNull cfg.subdomain);
|
||||
domain = lib.optionalString useSubdomain "${cfg.subdomain}."
|
||||
+ config.aether.domain;
|
||||
in {
|
||||
imports = [ ./options.nix ];
|
||||
|
||||
environment.systemPackages = [ pkgs.php ];
|
||||
|
||||
services.phpfpm.pools.streams = {
|
||||
user = cfg.user;
|
||||
settings = {
|
||||
"listen.owner" = config.services.nginx.user;
|
||||
"pm" = "dynamic";
|
||||
"pm.max_children" = 32;
|
||||
"pm.max_requests" = 500;
|
||||
"pm.start_servers" = 2;
|
||||
"pm.min_spare_servers" = 2;
|
||||
"pm.max_spare_servers" = 5;
|
||||
"php_admin_value[error_log]" = "stderr";
|
||||
"php_admin_flag[log_errors]" = true;
|
||||
"catch_workers_output" = true;
|
||||
};
|
||||
phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
|
||||
};
|
||||
|
||||
services.nginx.enable = true;
|
||||
services.nginx.virtualHosts.${domain} = {
|
||||
forceSSL = config.aether.https;
|
||||
enableACME = config.aether.https;
|
||||
|
||||
root = cfg.package;
|
||||
|
||||
extraConfig = ''
|
||||
index index.php;
|
||||
client_max_body_size 512M;
|
||||
|
||||
|
||||
# Rewrite to front controller as default rule.
|
||||
location / {
|
||||
if (!-e $request_filename) {
|
||||
rewrite ^(.*)$ /index.php?req=$1;
|
||||
}
|
||||
}
|
||||
|
||||
# Make sure webfinger and other well-known services aren't blocked
|
||||
# by denying dot files and rewrite request to the front controller.
|
||||
location ^~ /.well-known/ {
|
||||
allow all;
|
||||
if (!-e $request_filename) {
|
||||
rewrite ^(.*)$ /index.php?req=$1;
|
||||
}
|
||||
}
|
||||
|
||||
# Tell where fastcgi lives.
|
||||
location ~ \.php$ {
|
||||
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
||||
fastcgi_pass unix:${config.services.phpfpm.pools.streams.socket};
|
||||
include ${config.services.nginx.package}/conf/fastcgi.conf;
|
||||
}
|
||||
|
||||
# Block these file types.
|
||||
location ~* \.(tpl|tgz|log|out)$ {
|
||||
deny all;
|
||||
}
|
||||
|
||||
# Block dot files.
|
||||
location ~ /\. {
|
||||
deny all;
|
||||
}
|
||||
|
||||
# Deny access to store.
|
||||
location ~ /store {
|
||||
deny all;
|
||||
}
|
||||
|
||||
# Deny access to util.
|
||||
location ~ /util {
|
||||
deny all;
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
security.acme.acceptTerms = config.aether.https;
|
||||
security.acme.defaults.email = config.aether.acmeEmail;
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d /var/lib/streams - ${cfg.user} ${cfg.user} - -"
|
||||
"d /var/lib/streams/store - ${cfg.user} ${cfg.user} - -"
|
||||
"d /var/lib/streams/cache - ${cfg.user} ${cfg.user} - -"
|
||||
"d /var/lib/streams/cache/smarty3 - ${cfg.user} ${cfg.user} - -"
|
||||
];
|
||||
|
||||
services.postgresql = {
|
||||
enable = true;
|
||||
ensureUsers = [{
|
||||
name = cfg.user;
|
||||
ensureDBOwnership = true;
|
||||
}];
|
||||
ensureDatabases = [ cfg.user ];
|
||||
};
|
||||
|
||||
systemd.timers.streams-daemon = {
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
timerConfig.OnCalendar = "*:0/10";
|
||||
};
|
||||
systemd.services.streams-daemon = {
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
User = cfg.user;
|
||||
};
|
||||
path = [ pkgs.php ];
|
||||
script = ''
|
||||
cd ${cfg.package}
|
||||
php src/Daemon/Run.php Cron >/dev/null 2>&1
|
||||
'';
|
||||
};
|
||||
|
||||
users.users = lib.mkIf cfg.createUser {
|
||||
${cfg.user} = {
|
||||
home = "/var/lib/streams";
|
||||
group = cfg.user;
|
||||
isSystemUser = true;
|
||||
};
|
||||
};
|
||||
users.groups = lib.mkIf cfg.createUser {
|
||||
${cfg.user} = {};
|
||||
};
|
||||
}
|
||||
91
modules/streams/options.nix
Normal file
91
modules/streams/options.nix
Normal file
|
|
@ -0,0 +1,91 @@
|
|||
args@{ config, lib, pkgs, ... }:
|
||||
{
|
||||
imports = [ ../options.nix ];
|
||||
|
||||
options.aether = {
|
||||
streams = {
|
||||
# INTERNAL
|
||||
_internal.streams-src = lib.mkOption {
|
||||
type = lib.types.pathInStore;
|
||||
description = ''
|
||||
The source repository of (streams).
|
||||
'';
|
||||
};
|
||||
|
||||
_internal.vendorHash = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = ''
|
||||
The vendor hash to use when finding PHP dependencies.
|
||||
'';
|
||||
};
|
||||
|
||||
# OPTIONS
|
||||
package = lib.mkOption {
|
||||
type = lib.types.package;
|
||||
default = pkgs.callPackage ./package.nix {
|
||||
src = config.aether.streams._internal.streams-src;
|
||||
vendorHash = config.aether.streams._internal.vendorHash;
|
||||
inherit (config.aether.streams) addonRepos themeRepos;
|
||||
};
|
||||
description = ''
|
||||
The (streams) package to use.
|
||||
|
||||
The derivation must be built in a precise way to be compatible with
|
||||
this module; see the package.nix file for details.
|
||||
'';
|
||||
};
|
||||
|
||||
subdomain = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.str;
|
||||
default = "streams";
|
||||
description = ''
|
||||
The subdomain to host the (streams) instance under.
|
||||
|
||||
If null, then (streams) is hosted at the domain itself.
|
||||
'';
|
||||
};
|
||||
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "streams";
|
||||
description = ''
|
||||
The user to run (streams) with.
|
||||
'';
|
||||
};
|
||||
|
||||
createUser = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = true;
|
||||
description = ''
|
||||
Whether to create the (streams) user automatically.
|
||||
'';
|
||||
};
|
||||
|
||||
addonRepos = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.pathInStore;
|
||||
default = [];
|
||||
defaultText = "[ <streams-addons> ]";
|
||||
description = ''
|
||||
A list of repositories containing addons.
|
||||
|
||||
The official addon repository is provided by default.
|
||||
'';
|
||||
};
|
||||
|
||||
themeRepos = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.pathInStore;
|
||||
default = [];
|
||||
description = ''
|
||||
A list of repositories containing themes.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config.assertions = lib.mkIf config.aether.https [
|
||||
{
|
||||
assertion = !(builtins.isNull config.aether.acmeEmail);
|
||||
message = "HTTPS support requires providing a contact email";
|
||||
}
|
||||
];
|
||||
}
|
||||
69
modules/streams/package.nix
Normal file
69
modules/streams/package.nix
Normal file
|
|
@ -0,0 +1,69 @@
|
|||
{
|
||||
lib,
|
||||
php,
|
||||
|
||||
src,
|
||||
vendorHash,
|
||||
addonRepos ? [],
|
||||
themeRepos ? []
|
||||
}:
|
||||
|
||||
php.buildComposerProject {
|
||||
pname = "streams";
|
||||
version = "25.4.2";
|
||||
inherit src vendorHash;
|
||||
|
||||
postInstall = ''
|
||||
# Override composerInstallHook's output location
|
||||
rm -rf $out
|
||||
cp -r . $out
|
||||
|
||||
# Ugly hack: These locations need to be writable,
|
||||
# so link them to outside of the Nix store
|
||||
ln -s /var/lib/streams/store $out/store
|
||||
ln -s /var/lib/streams/cache $out/cache
|
||||
ln -s /var/lib/streams/config.php $out/.htconfig.php
|
||||
|
||||
# Install addons and themes
|
||||
|
||||
mkdir $out/addon
|
||||
for repo in ${lib.concatStringsSep " " addonRepos}; do
|
||||
filelist=(`ls $repo`)
|
||||
for a in "''${filelist[@]}" ; do
|
||||
if [ $a = 'version.php' ]; then
|
||||
if [ ! -x $out/addon/version.php ]; then
|
||||
ln -s $repo/version.php $out/addon/version.php
|
||||
fi
|
||||
fi
|
||||
base=`basename $a`
|
||||
if [ $base = '.git' ]; then
|
||||
continue;
|
||||
fi
|
||||
if [ ! -d $repo/$base ]; then
|
||||
continue;
|
||||
fi
|
||||
if [ -x $out/addon/$base ]; then
|
||||
continue;
|
||||
fi
|
||||
ln -s $repo/$base $out/addon/$base
|
||||
done
|
||||
done
|
||||
|
||||
for repo in ${lib.concatStringsSep " " themeRepos}; do
|
||||
filelist=(`ls $repo`)
|
||||
for a in "''${filelist[@]}" ; do
|
||||
base=`basename $a`
|
||||
if [ $base = '.git' ]; then
|
||||
continue;
|
||||
fi
|
||||
if [ ! -d $repo/$base ]; then
|
||||
continue;
|
||||
fi
|
||||
if [ -x $out/view/theme/$base ]; then
|
||||
continue;
|
||||
fi
|
||||
ln -s $repo/$base $out/view/theme/$base
|
||||
done
|
||||
done
|
||||
'';
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue