nixos/modules/services/misc/sourcehut/paste.nix

   1 { config, lib, pkgs, ... }:
   2
   3 with lib;
   4 let
   5   cfg = config.services.sourcehut;
   6   cfgIni = cfg.settings;
   7   scfg = cfg.paste;
   8   iniKey = "paste.sr.ht";
   9
  10   rcfg = config.services.redis;
  11   drv = pkgs.sourcehut.pastesrht;
  12 in
  13 {
  14   options.services.sourcehut.paste = {
  15     user = mkOption {
  16       type = types.str;
  17       default = "pastesrht";
  18       description = ''
  19         User for paste.sr.ht.
  20       '';
  21     };
  22
  23     port = mkOption {
  24       type = types.port;
  25       default = 5011;
  26       description = ''
  27         Port on which the "paste" module should listen.
  28       '';
  29     };
  30
  31     database = mkOption {
  32       type = types.str;
  33       default = "paste.sr.ht";
  34       description = ''
  35         PostgreSQL database name for paste.sr.ht.
  36       '';
  37     };
  38
  39     statePath = mkOption {
  40       type = types.path;
  41       default = "${cfg.statePath}/pastesrht";
  42       description = ''
  43         State path for pastesrht.sr.ht.
  44       '';
  45     };
  46   };
  47
  48   config = with scfg; lib.mkIf (cfg.enable && elem "paste" cfg.services) {
  49     users = {
  50       users = {
  51         "${user}" = {
  52           isSystemUser = true;
  53           group = user;
  54           description = "paste.sr.ht user";
  55         };
  56       };
  57
  58       groups = {
  59         "${user}" = { };
  60       };
  61     };
  62
  63     services.postgresql = {
  64       authentication = ''
  65         local ${database} ${user} trust
  66       '';
  67       ensureDatabases = [ database ];
  68       ensureUsers = [
  69         {
  70           name = user;
  71           ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
  72         }
  73       ];
  74     };
  75
  76     systemd = {
  77       tmpfiles.rules = [
  78         "d ${statePath} 0750 ${user} ${user} -"
  79       ];
  80
  81       services = {
  82         pastesrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
  83           after = [ "postgresql.service" "network.target" ];
  84           requires = [ "postgresql.service" ];
  85           wantedBy = [ "multi-user.target" ];
  86
  87           description = "paste.sr.ht website service";
  88
  89           serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
  90         };
  91
  92         pastesrht-webhooks = {
  93           after = [ "postgresql.service" "network.target" ];
  94           requires = [ "postgresql.service" ];
  95           wantedBy = [ "multi-user.target" ];
  96
  97           description = "paste.sr.ht webhooks service";
  98           serviceConfig = {
  99             Type = "simple";
 100             User = user;
 101             Restart = "always";
 102             ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel=info";
 103           };
 104
 105         };
 106       };
 107     };
 108
 109     services.sourcehut.settings = {
 110       # URL paste.sr.ht is being served at (protocol://domain)
 111       "paste.sr.ht".origin = mkDefault "http://paste.${cfg.originBase}";
 112       # Address and port to bind the debug server to
 113       "paste.sr.ht".debug-host = mkDefault "0.0.0.0";
 114       "paste.sr.ht".debug-port = mkDefault port;
 115       # Configures the SQLAlchemy connection string for the database.
 116       "paste.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
 117       # Set to "yes" to automatically run migrations on package upgrade.
 118       "paste.sr.ht".migrate-on-upgrade = mkDefault "yes";
 119       # paste.sr.ht's OAuth client ID and secret for meta.sr.ht
 120       # Register your client at meta.example.org/oauth
 121       "paste.sr.ht".oauth-client-id = mkDefault null;
 122       "paste.sr.ht".oauth-client-secret = mkDefault null;
 123       "paste.sr.ht".webhooks = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/5";
 124     };
 125
 126     services.nginx.virtualHosts."paste.${cfg.originBase}" = {
 127       forceSSL = true;
 128       locations."/".proxyPass = "http://${cfg.address}:${toString port}";
 129       locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
 130       locations."/static".root = "${pkgs.sourcehut.pastesrht}/${pkgs.sourcehut.python.sitePackages}/pastesrht";
 131     };
 132   };
 133 }