nixos/modules/services/misc/sourcehut/meta.nix

   1 { config, lib, pkgs, ... }:
   2
   3 with lib;
   4 let
   5   cfg = config.services.sourcehut;
   6   cfgIni = cfg.settings;
   7   scfg = cfg.meta;
   8   iniKey = "meta.sr.ht";
   9   statePath = "/var/lib/sourcehut/metasrht";
  10
  11   drv = pkgs.sourcehut.metasrht;
  12 in
  13 {
  14   options.services.sourcehut.meta = {
  15     user = mkOption {
  16       type = types.str;
  17       default = "metasrht";
  18       description = ''
  19         User for meta.sr.ht.
  20       '';
  21     };
  22
  23     port = mkOption {
  24       type = types.port;
  25       default = 5000;
  26       description = ''
  27         Port on which the "meta" module should listen.
  28       '';
  29     };
  30
  31     database = mkOption {
  32       type = types.str;
  33       default = "meta.sr.ht";
  34       description = ''
  35         PostgreSQL database name for meta.sr.ht.
  36       '';
  37     };
  38   };
  39
  40   config = with scfg; lib.mkIf (cfg.enable && elem "meta" cfg.services) {
  41     assertions =
  42       [
  43         {
  44           assertion = with cfgIni."meta.sr.ht::billing"; enabled == "yes" -> (stripe-public-key != null && stripe-secret-key != null);
  45           message = "If meta.sr.ht::billing is enabled, the keys should be defined.";
  46         }
  47       ];
  48
  49     users = {
  50       users = {
  51         ${user} = {
  52           isSystemUser = true;
  53           group = user;
  54           description = "meta.sr.ht user";
  55         };
  56       };
  57
  58       groups = {
  59         "${user}" = { };
  60       };
  61     };
  62
  63     services.cron.systemCronJobs = [ "0 0 * * * ${cfg.python}/bin/metasrht-daily" ];
  64     services.postgresql = {
  65       authentication = ''
  66         local ${database} ${user} trust
  67       '';
  68       ensureDatabases = [ database ];
  69       ensureUsers = [
  70         {
  71           name = user;
  72           ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
  73         }
  74       ];
  75     };
  76
  77     systemd = {
  78       services = let
  79         commonPreStart = ''
  80           # Configure client(s) as "preauthorized"
  81           ${concatMapStringsSep "\n\n"
  82             (srv: ''
  83               if ! test -e "${statePath}/${srv}.oauth" || [ "$(cat ${statePath}/${srv}.oauth)" != "${cfgIni.${srv}.oauth-client-id}" ]; then
  84                 # Configure ${srv}'s OAuth client as "preauthorized"
  85                 psql '${database}' \
  86                   -c "UPDATE oauthclient SET preauthorized = true WHERE client_id = '${cfgIni.${srv}.oauth-client-id}'"
  87
  88                 printf "%s" "${cfgIni.${srv}.oauth-client-id}" > "${statePath}/${srv}.oauth"
  89               fi
  90             '')
  91             (builtins.attrNames (filterAttrs (k: v:
  92               let srv = builtins.match "^([a-z]*)\\.sr\\.ht$" k; in
  93               srv != null && elem (head srv) cfg.services &&
  94               ((v.oauth-client-id or null) != null)
  95               ) cfg.settings))}
  96         '';
  97         in {
  98         metasrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
  99           after = [ "postgresql.service" "network.target" ];
 100           requires = [ "postgresql.service" ];
 101           wantedBy = [ "multi-user.target" ];
 102
 103           description = "meta.sr.ht website service";
 104
 105           preStart = commonPreStart;
 106
 107           serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
 108         };
 109
 110         metasrht-api = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
 111           after = [ "postgresql.service" "network.target" ];
 112           requires = [ "postgresql.service" ];
 113           wantedBy = [ "multi-user.target" ];
 114
 115           description = "meta.sr.ht api service";
 116
 117           preStart = commonPreStart;
 118
 119           serviceConfig.ExecStart = "${pkgs.sourcehut.metasrht}/bin/metasrht-api -b :${toString (port + 100)}";
 120         };
 121
 122         metasrht-webhooks = {
 123           after = [ "postgresql.service" "network.target" ];
 124           requires = [ "postgresql.service" ];
 125           wantedBy = [ "multi-user.target" ];
 126
 127           description = "meta.sr.ht webhooks service";
 128           serviceConfig = {
 129             Type = "simple";
 130             User = user;
 131             Restart = "always";
 132             ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel INFO --pool eventlet";
 133           };
 134
 135         };
 136       };
 137     };
 138
 139     services.nginx.virtualHosts."meta.${cfg.originBase}" = {
 140       forceSSL = true;
 141       locations."/".proxyPass = "http://${cfg.address}:${toString port}";
 142       locations."/query".proxyPass = cfgIni."meta.sr.ht".api-origin;
 143       locations."/static".root = "${pkgs.sourcehut.metasrht}/${pkgs.sourcehut.python.sitePackages}/metasrht";
 144     };
 145
 146     environment.systemPackages = [
 147       (pkgs.linkFarm "metasrht" [
 148         { name = "bin/metasrht-manageuser";
 149           path = "${cfg.python}/bin/metasrht-manageuser";
 150         }
 151       ])
 152     ];
 153   };
 154 }