nixos/modules/services/misc/sourcehut/meta.nix

   1 { config, lib, pkgs, ... }:
   2
   3 with lib;
   4 let
   5   cfg = config.services.sourcehut;
   6   cfgIni = cfg.settings;
   7   scfg = cfg.meta;
   8   iniKey = "meta.sr.ht";
   9   statePath = "/var/lib/sourcehut/metasrht";
  10
  11   drv = pkgs.sourcehut.metasrht;
  12 in
  13 {
  14   options.services.sourcehut.meta = {
  15     user = mkOption {
  16       type = types.str;
  17       default = "metasrht";
  18       description = ''
  19         User for meta.sr.ht.
  20       '';
  21     };
  22
  23     port = mkOption {
  24       type = types.port;
  25       default = 5000;
  26       description = ''
  27         Port on which the "meta" module should listen.
  28       '';
  29     };
  30
  31     database = mkOption {
  32       type = types.str;
  33       default = "meta.sr.ht";
  34       description = ''
  35         PostgreSQL database name for meta.sr.ht.
  36       '';
  37     };
  38   };
  39
  40   config = with scfg; lib.mkIf (cfg.enable && elem "meta" cfg.services) {
  41     assertions =
  42       [
  43         {
  44           assertion = with cfgIni."meta.sr.ht::billing"; enabled == "yes" -> (stripe-public-key != null && stripe-secret-key != null);
  45           message = "If meta.sr.ht::billing is enabled, the keys should be defined.";
  46         }
  47       ];
  48
  49     users = {
  50       users = {
  51         ${user} = {
  52           isSystemUser = true;
  53           group = user;
  54           description = "meta.sr.ht user";
  55         };
  56       };
  57
  58       groups = {
  59         "${user}" = { };
  60       };
  61     };
  62
  63     services.cron.systemCronJobs = [ "0 0 * * * ${cfg.python}/bin/metasrht-daily" ];
  64     services.postgresql = {
  65       authentication = ''
  66         local ${database} ${user} trust
  67       '';
  68       ensureDatabases = [ database ];
  69       ensureUsers = [
  70         {
  71           name = user;
  72           ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
  73         }
  74       ];
  75     };
  76
  77     systemd = {
  78       services = let
  79         commonPreStart = ''
  80           # Configure client(s) as "preauthorized"
  81           ${concatMapStringsSep "\n\n"
  82             (attr: ''
  83               if ! test -e "${statePath}/${attr}.oauth" || [ "$(cat ${statePath}/${attr}.oauth)" != "${cfgIni."${attr}".oauth-client-id}" ]; then
  84                 # Configure ${attr}'s OAuth client as "preauthorized"
  85                 psql ${database} \
  86                   -c "UPDATE oauthclient SET preauthorized = true WHERE client_id = '${cfgIni."${attr}".oauth-client-id}'"
  87
  88                 printf "%s" "${cfgIni."${attr}".oauth-client-id}" > "${statePath}/${attr}.oauth"
  89               fi
  90             '')
  91             (builtins.attrNames (filterAttrs
  92               (k: v: !(hasInfix "::" k) && (v.oauth-client-id or null) != null)
  93               cfg.settings))}
  94         '';
  95         in {
  96         metasrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
  97           after = [ "postgresql.service" "network.target" ];
  98           requires = [ "postgresql.service" ];
  99           wantedBy = [ "multi-user.target" ];
 100
 101           description = "meta.sr.ht website service";
 102
 103           preStart = commonPreStart;
 104
 105           serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
 106         };
 107
 108         metasrht-api = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
 109           after = [ "postgresql.service" "network.target" ];
 110           requires = [ "postgresql.service" ];
 111           wantedBy = [ "multi-user.target" ];
 112
 113           description = "meta.sr.ht api service";
 114
 115           preStart = commonPreStart;
 116
 117           serviceConfig.ExecStart = "${pkgs.sourcehut.metasrht}/bin/metasrht-api -b :${toString (port + 100)}";
 118         };
 119
 120         metasrht-webhooks = {
 121           after = [ "postgresql.service" "network.target" ];
 122           requires = [ "postgresql.service" ];
 123           wantedBy = [ "multi-user.target" ];
 124
 125           description = "meta.sr.ht webhooks service";
 126           serviceConfig = {
 127             Type = "simple";
 128             User = user;
 129             Restart = "always";
 130             ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel INFO --pool eventlet";
 131           };
 132
 133         };
 134       };
 135     };
 136
 137     services.nginx.virtualHosts."meta.${cfg.originBase}" = {
 138       forceSSL = true;
 139       locations."/".proxyPass = "http://${cfg.address}:${toString port}";
 140       locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
 141       locations."/static".root = "${pkgs.sourcehut.metasrht}/${pkgs.sourcehut.python.sitePackages}/metasrht";
 142     };
 143   };
 144 }