nixos/modules/services/misc/sourcehut/meta.nix

   1 { config, lib, pkgs, ... }:
   2
   3 with lib;
   4 let
   5   cfg = config.services.sourcehut;
   6   cfgIni = cfg.settings;
   7   scfg = cfg.meta;
   8   iniKey = "meta.sr.ht";
   9   statePath = "/var/lib/sourcehut/metasrht";
  10
  11   drv = pkgs.sourcehut.metasrht;
  12 in
  13 {
  14   options.services.sourcehut.meta = {
  15     enable = mkEnableOption "meta service";
  16
  17     user = mkOption {
  18       type = types.str;
  19       default = "metasrht";
  20       description = ''
  21         User for meta.sr.ht.
  22       '';
  23     };
  24
  25     port = mkOption {
  26       type = types.port;
  27       default = 5000;
  28       description = ''
  29         Port on which the "meta" module should listen.
  30       '';
  31     };
  32
  33     database = mkOption {
  34       type = types.str;
  35       default = "meta.sr.ht";
  36       description = ''
  37         PostgreSQL database name for meta.sr.ht.
  38       '';
  39     };
  40   };
  41
  42   config = with scfg; lib.mkIf (cfg.enable && scfg.enable) {
  43     assertions =
  44       [
  45         {
  46           assertion = with cfgIni."meta.sr.ht::billing"; enabled == "yes" -> (stripe-public-key != null && stripe-secret-key != null);
  47           message = "If meta.sr.ht::billing is enabled, the keys should be defined.";
  48         }
  49       ];
  50
  51     users = {
  52       users = {
  53         ${user} = {
  54           isSystemUser = true;
  55           group = user;
  56           description = "meta.sr.ht user";
  57         };
  58       };
  59
  60       groups = {
  61         "${user}" = { };
  62       };
  63     };
  64
  65     services.cron.systemCronJobs = [ "0 0 * * * ${cfg.python}/bin/metasrht-daily" ];
  66     services.postgresql = {
  67       authentication = ''
  68         local ${database} ${user} trust
  69       '';
  70       ensureDatabases = [ database ];
  71       ensureUsers = [
  72         {
  73           name = user;
  74           ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
  75         }
  76       ];
  77     };
  78
  79     systemd = {
  80       services = let
  81         commonPreStart = ''
  82           # Configure client(s) as "preauthorized"
  83           ${concatMapStringsSep "\n\n"
  84             (srv: ''
  85               if ! test -e "${statePath}/${srv}.oauth" || [ "$(cat ${statePath}/${srv}.oauth)" != "${cfgIni.${srv}.oauth-client-id}" ]; then
  86                 # Configure ${srv}'s OAuth client as "preauthorized"
  87                 psql '${database}' \
  88                   -c "UPDATE oauthclient SET preauthorized = true WHERE client_id = '${cfgIni.${srv}.oauth-client-id}'"
  89
  90                 printf "%s" "${cfgIni.${srv}.oauth-client-id}" > "${statePath}/${srv}.oauth"
  91               fi
  92             '')
  93             (builtins.attrNames (filterAttrs (k: v:
  94               let srv = builtins.match "^([a-z]*)\\.sr\\.ht$" k; in
  95               srv != null && cfg.${head srv}.enable &&
  96               ((v.oauth-client-id or null) != null)
  97               ) cfg.settings))}
  98         '';
  99         in {
 100         metasrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
 101           after = [ "postgresql.service" "network.target" ];
 102           requires = [ "postgresql.service" ];
 103           wantedBy = [ "multi-user.target" ];
 104
 105           description = "meta.sr.ht website service";
 106
 107           preStart = commonPreStart;
 108
 109           serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
 110         };
 111
 112         metasrht-api = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
 113           after = [ "postgresql.service" "network.target" ];
 114           requires = [ "postgresql.service" ];
 115           wantedBy = [ "multi-user.target" ];
 116
 117           description = "meta.sr.ht api service";
 118
 119           preStart = commonPreStart;
 120
 121           serviceConfig.ExecStart = "${pkgs.sourcehut.metasrht}/bin/metasrht-api -b :${toString (port + 100)}";
 122         };
 123
 124         metasrht-webhooks = {
 125           after = [ "postgresql.service" "network.target" ];
 126           requires = [ "postgresql.service" ];
 127           wantedBy = [ "multi-user.target" ];
 128
 129           description = "meta.sr.ht webhooks service";
 130           serviceConfig = {
 131             Type = "simple";
 132             User = user;
 133             Restart = "always";
 134             ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel INFO --pool eventlet";
 135           };
 136
 137         };
 138       };
 139     };
 140
 141     services.nginx.virtualHosts."meta.${cfg.originBase}" = {
 142       forceSSL = true;
 143       locations."/".proxyPass = "http://${cfg.address}:${toString port}";
 144       locations."/query".proxyPass = cfgIni."meta.sr.ht".api-origin;
 145       locations."/static".root = "${pkgs.sourcehut.metasrht}/${pkgs.sourcehut.python.sitePackages}/metasrht";
 146     };
 147
 148     environment.systemPackages = [
 149       (pkgs.linkFarm "metasrht" [
 150         { name = "bin/metasrht-manageuser";
 151           path = "${cfg.python}/bin/metasrht-manageuser";
 152         }
 153       ])
 154     ];
 155   };
 156 }