nixos/modules/services/misc/sourcehut/meta.nix

   1 { config, lib, pkgs, ... }:
   2
   3 with lib;
   4 let
   5   cfg = config.services.sourcehut;
   6   cfgIni = cfg.settings;
   7   scfg = cfg.meta;
   8   iniKey = "meta.sr.ht";
   9   statePath = "/var/lib/sourcehut/metasrht";
  10
  11   drv = pkgs.sourcehut.metasrht;
  12 in
  13 {
  14   options.services.sourcehut.meta = {
  15     enable = mkEnableOption "meta service";
  16
  17     user = mkOption {
  18       type = types.str;
  19       default = "metasrht";
  20       description = ''
  21         User for meta.sr.ht.
  22       '';
  23     };
  24
  25     port = mkOption {
  26       type = types.port;
  27       default = 5000;
  28       description = ''
  29         Port on which the "meta" module should listen.
  30       '';
  31     };
  32
  33     database = mkOption {
  34       type = types.str;
  35       default = "meta.sr.ht";
  36       description = ''
  37         PostgreSQL database name for meta.sr.ht.
  38       '';
  39     };
  40   };
  41
  42   config = with scfg; lib.mkIf (cfg.enable && scfg.enable) {
  43     assertions =
  44       [
  45         {
  46           assertion = with cfgIni."meta.sr.ht::billing"; enabled == "yes" -> (stripe-public-key != null && stripe-secret-key != null);
  47           message = "If meta.sr.ht::billing is enabled, the keys should be defined.";
  48         }
  49       ];
  50
  51     users = {
  52       users = {
  53         ${user} = {
  54           isSystemUser = true;
  55           group = user;
  56           description = "meta.sr.ht user";
  57         };
  58       };
  59
  60       groups = {
  61         "${user}" = { };
  62       };
  63     };
  64
  65     services.postgresql = {
  66       authentication = ''
  67         local ${database} ${user} trust
  68       '';
  69       ensureDatabases = [ database ];
  70       ensureUsers = [
  71         {
  72           name = user;
  73           ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
  74         }
  75       ];
  76     };
  77
  78     systemd = {
  79       services = let
  80         commonPreStart = ''
  81           # Configure client(s) as "preauthorized"
  82           ${concatMapStringsSep "\n\n"
  83             (srv: ''
  84               if ! test -e "${statePath}/${srv}.oauth" || [ "$(cat ${statePath}/${srv}.oauth)" != "${cfgIni.${srv}.oauth-client-id}" ]; then
  85                 # Configure ${srv}'s OAuth client as "preauthorized"
  86                 psql '${database}' \
  87                   -c "UPDATE oauthclient SET preauthorized = true WHERE client_id = '${cfgIni.${srv}.oauth-client-id}'"
  88
  89                 printf "%s" "${cfgIni.${srv}.oauth-client-id}" > "${statePath}/${srv}.oauth"
  90               fi
  91             '')
  92             (builtins.attrNames (filterAttrs (k: v:
  93               let srv = builtins.match "^([a-z]*)\\.sr\\.ht$" k; in
  94               srv != null && cfg.${head srv}.enable &&
  95               ((v.oauth-client-id or null) != null)
  96               ) cfg.settings))}
  97         '';
  98         in {
  99         metasrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
 100           after = [ "postgresql.service" "network.target" ];
 101           requires = [ "postgresql.service" ];
 102           wantedBy = [ "multi-user.target" ];
 103
 104           description = "meta.sr.ht website service";
 105
 106           preStart = commonPreStart;
 107
 108           serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
 109         };
 110
 111         metasrht-api = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
 112           after = [ "postgresql.service" "network.target" ];
 113           requires = [ "postgresql.service" ];
 114           wantedBy = [ "metasrht.service" ];
 115
 116           description = "meta.sr.ht api service";
 117
 118           preStart = commonPreStart;
 119
 120           serviceConfig.ExecStart = "${pkgs.sourcehut.metasrht}/bin/metasrht-api -b :${toString (port + 100)}";
 121         };
 122
 123         metasrht-daily = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
 124           after = [ "metasrht.service" ];
 125           requires = [ "metasrht.service" ];
 126
 127           description = "meta.sr.ht daily service";
 128
 129           serviceConfig.Type = mkForce "oneshot";
 130           serviceConfig.Restart = mkForce "no";
 131           serviceConfig.ExecStart = "${cfg.python}/bin/metasrht-daily";
 132         };
 133
 134         metasrht-webhooks = {
 135           after = [ "postgresql.service" "network.target" ];
 136           requires = [ "postgresql.service" ];
 137           wantedBy = [ "multi-user.service" ];
 138
 139           description = "meta.sr.ht webhooks service";
 140           serviceConfig = {
 141             Type = "simple";
 142             User = user;
 143             Restart = "always";
 144             ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel INFO --pool eventlet";
 145           };
 146
 147         };
 148       };
 149     };
 150
 151     systemd.timers = {
 152       metasrht-daily = {
 153         description = "metasrht daily timer";
 154         wantedBy = [ "timers.target" ];
 155         timerConfig = {
 156           OnCalendar = "daily";
 157           Persistent = true;
 158           AccuracySec = "1h";
 159         };
 160       };
 161     };
 162
 163     services.nginx.virtualHosts."meta.${cfg.originBase}" = {
 164       forceSSL = true;
 165       locations."/".proxyPass = "http://${cfg.address}:${toString port}";
 166       locations."/query".proxyPass = cfgIni."meta.sr.ht".api-origin;
 167       locations."/static".root = "${pkgs.sourcehut.metasrht}/${pkgs.sourcehut.python.sitePackages}/metasrht";
 168     };
 169
 170     environment.systemPackages = [
 171       (pkgs.linkFarm "metasrht" [
 172         { name = "bin/metasrht-manageuser";
 173           path = "${cfg.python}/bin/metasrht-manageuser";
 174         }
 175       ])
 176     ];
 177   };
 178 }