135 lines
3.3 KiB
Nix
135 lines
3.3 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
let
|
|
cfg = config.aether.streams;
|
|
|
|
useSubdomain = !(builtins.isNull cfg.subdomain);
|
|
domain = lib.optionalString useSubdomain "${cfg.subdomain}."
|
|
+ config.aether.domain;
|
|
in {
|
|
imports = [ ./options.nix ];
|
|
|
|
environment.systemPackages = [ pkgs.php ];
|
|
|
|
services.phpfpm.pools.streams = {
|
|
user = cfg.user;
|
|
settings = {
|
|
"listen.owner" = config.services.nginx.user;
|
|
"pm" = "dynamic";
|
|
"pm.max_children" = 32;
|
|
"pm.max_requests" = 500;
|
|
"pm.start_servers" = 2;
|
|
"pm.min_spare_servers" = 2;
|
|
"pm.max_spare_servers" = 5;
|
|
"php_admin_value[error_log]" = "stderr";
|
|
"php_admin_flag[log_errors]" = true;
|
|
"catch_workers_output" = true;
|
|
};
|
|
phpEnv."PATH" = lib.makeBinPath [ pkgs.php ];
|
|
};
|
|
|
|
services.nginx.enable = true;
|
|
services.nginx.virtualHosts.${domain} = {
|
|
forceSSL = config.aether.https;
|
|
enableACME = config.aether.https;
|
|
|
|
root = cfg.package;
|
|
|
|
extraConfig = ''
|
|
index index.php;
|
|
client_max_body_size 512M;
|
|
|
|
|
|
# Rewrite to front controller as default rule.
|
|
location / {
|
|
if (!-e $request_filename) {
|
|
rewrite ^(.*)$ /index.php?req=$1;
|
|
}
|
|
}
|
|
|
|
# Make sure webfinger and other well-known services aren't blocked
|
|
# by denying dot files and rewrite request to the front controller.
|
|
location ^~ /.well-known/ {
|
|
allow all;
|
|
if (!-e $request_filename) {
|
|
rewrite ^(.*)$ /index.php?req=$1;
|
|
}
|
|
}
|
|
|
|
# Tell where fastcgi lives.
|
|
location ~ \.php$ {
|
|
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
|
fastcgi_pass unix:${config.services.phpfpm.pools.streams.socket};
|
|
include ${config.services.nginx.package}/conf/fastcgi.conf;
|
|
}
|
|
|
|
# Block these file types.
|
|
location ~* \.(tpl|tgz|log|out)$ {
|
|
deny all;
|
|
}
|
|
|
|
# Block dot files.
|
|
location ~ /\. {
|
|
deny all;
|
|
}
|
|
|
|
# Deny access to store.
|
|
location ~ /store {
|
|
deny all;
|
|
}
|
|
|
|
# Deny access to util.
|
|
location ~ /util {
|
|
deny all;
|
|
}
|
|
'';
|
|
};
|
|
|
|
security.acme.acceptTerms = config.aether.https;
|
|
security.acme.defaults.email = config.aether.acmeEmail;
|
|
|
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/lib/streams - ${cfg.user} ${cfg.user} - -"
|
|
"d /var/lib/streams/store - ${cfg.user} ${cfg.user} - -"
|
|
"d /var/lib/streams/cache - ${cfg.user} ${cfg.user} - -"
|
|
"d /var/lib/streams/cache/smarty3 - ${cfg.user} ${cfg.user} - -"
|
|
];
|
|
|
|
services.postgresql = {
|
|
enable = true;
|
|
ensureUsers = [{
|
|
name = cfg.user;
|
|
ensureDBOwnership = true;
|
|
}];
|
|
ensureDatabases = [ cfg.user ];
|
|
};
|
|
|
|
systemd.timers.streams-daemon = {
|
|
after = [ "network.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
timerConfig.OnCalendar = "*:0/10";
|
|
};
|
|
systemd.services.streams-daemon = {
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
User = cfg.user;
|
|
};
|
|
path = [ pkgs.php ];
|
|
script = ''
|
|
cd ${cfg.package}
|
|
php src/Daemon/Run.php Cron >/dev/null 2>&1
|
|
'';
|
|
};
|
|
|
|
users.users = lib.mkIf cfg.createUser {
|
|
${cfg.user} = {
|
|
home = "/var/lib/streams";
|
|
group = cfg.user;
|
|
isSystemUser = true;
|
|
};
|
|
};
|
|
users.groups = lib.mkIf cfg.createUser {
|
|
${cfg.user} = {};
|
|
};
|
|
}
|