]> git.immae.eu Git - perso/Immae/Config/Nix.git/blame - modules/private/websites/tools/mastodon/default.nix
Add ntfy notification pusher
[perso/Immae/Config/Nix.git] / modules / private / websites / tools / mastodon / default.nix
CommitLineData
ab8f306d 1{ lib, pkgs, config, ... }:
35a397cd 2let
ab8f306d 3 env = config.myEnv.tools.mastodon;
750fe5a4 4 root = "${mcfg.workdir}/public/";
4288c2f2 5 cfg = config.myServices.websites.tools.mastodon;
bc0f9fcf 6 mcfg = config.immaeServices.mastodon;
35a397cd 7in {
4288c2f2 8 options.myServices.websites.tools.mastodon = {
35a397cd
IB
9 enable = lib.mkEnableOption "enable mastodon's website";
10 };
11
12 config = lib.mkIf cfg.enable {
120bcf4d
IB
13 myServices.chatonsProperties.services.mastodon = {
14 file.datetime = "2022-08-21T19:50:00";
15 service = {
16 name = "Mastodon";
17 description = "Your self-hosted, globally interconnected microblogging community";
18 website = "https://mastodon.immae.eu/";
19 logo = "https://mastodon.immae.eu/apple-touch-icon.png";
20 status.level = "OK";
21 status.description = "OK";
22 registration."" = ["MEMBER" "CLIENT"];
23 registration.load = "OPEN";
24 install.type = "PACKAGE";
25 };
26 software = {
27 name = "Mastodon";
28 website = "https://joinmastodon.org/";
29 license.url = "https://github.com/tootsuite/mastodon/blob/master/LICENSE";
30 license.name = "GNU General Public License v3.0";
31 version = mcfg.package.version;
32 source.url = "https://github.com/tootsuite/mastodon";
33 };
34 };
4c4652aa 35 secrets.keys."webapps/tools-mastodon" = {
eb14b976
IB
36 user = "mastodon";
37 group = "mastodon";
38 permissions = "0400";
39 text = ''
40 REDIS_HOST=${env.redis.host}
41 REDIS_PORT=${env.redis.port}
42 REDIS_DB=${env.redis.db}
43 DB_HOST=${env.postgresql.socket}
44 DB_USER=${env.postgresql.user}
45 DB_NAME=${env.postgresql.database}
46 DB_PASS=${env.postgresql.password}
47 DB_PORT=${env.postgresql.port}
48
49 LOCAL_DOMAIN=mastodon.immae.eu
50 LOCAL_HTTPS=true
51 ALTERNATE_DOMAINS=immae.eu
52
53 PAPERCLIP_SECRET=${env.paperclip_secret}
54 SECRET_KEY_BASE=${env.secret_key_base}
55 OTP_SECRET=${env.otp_secret}
56
57 VAPID_PRIVATE_KEY=${env.vapid.private}
58 VAPID_PUBLIC_KEY=${env.vapid.public}
59
60 SMTP_DELIVERY_METHOD=sendmail
61 SMTP_FROM_ADDRESS=mastodon@tools.immae.eu
62 SENDMAIL_LOCATION="/run/wrappers/bin/sendmail"
613aea56 63 PAPERCLIP_ROOT_PATH=${mcfg.dataDir}
eb14b976
IB
64
65 STREAMING_CLUSTER_NUM=1
66
67 RAILS_LOG_LEVEL=warn
68
69 # LDAP authentication (optional)
70 LDAP_ENABLED=true
ab8f306d 71 LDAP_HOST=${env.ldap.host}
eb14b976
IB
72 LDAP_PORT=636
73 LDAP_METHOD=simple_tls
ab8f306d
IB
74 LDAP_BASE="${env.ldap.base}"
75 LDAP_BIND_DN="${env.ldap.dn}"
eb14b976
IB
76 LDAP_PASSWORD="${env.ldap.password}"
77 LDAP_UID="uid"
ab8f306d 78 LDAP_SEARCH_FILTER="${env.ldap.filter}"
eb14b976 79 '';
4c4652aa 80 };
bc0f9fcf 81 immaeServices.mastodon = {
613aea56 82 enable = true;
da30ae4f 83 configFile = config.secrets.fullPaths."webapps/tools-mastodon";
613aea56
IB
84 socketsPrefix = "live_immae";
85 dataDir = "/var/lib/mastodon_immae";
35a397cd 86 };
17f6eae9
IB
87 services.filesWatcher.mastodon-streaming = {
88 restart = true;
89 paths = [ mcfg.configFile ];
90 };
91 services.filesWatcher.mastodon-web = {
92 restart = true;
93 paths = [ mcfg.configFile ];
94 };
95 services.filesWatcher.mastodon-sidekiq = {
96 restart = true;
97 paths = [ mcfg.configFile ];
98 };
99
35a397cd 100
29f8cb85 101 services.websites.env.tools.modules = [
a952acc4 102 "headers" "proxy" "proxy_wstunnel" "proxy_http"
35a397cd 103 ];
29f8cb85 104 services.websites.env.tools.vhostConfs.mastodon = {
35a397cd 105 certName = "eldiron";
7df420c2 106 addToCerts = true;
35a397cd 107 hosts = ["mastodon.immae.eu" ];
a95ab089 108 root = root;
35a397cd
IB
109 extraConfig = [ ''
110 Header always set Referrer-Policy "strict-origin-when-cross-origin"
111 Header always set Strict-Transport-Security "max-age=31536000"
112
113 <LocationMatch "^/(assets|avatars|emoji|headers|packs|sounds|system)>
114 Header always set Cache-Control "public, max-age=31536000, immutable"
115 Require all granted
116 </LocationMatch>
117
118 ProxyPreserveHost On
119 RequestHeader set X-Forwarded-Proto "https"
120
121 RewriteEngine On
122
613aea56 123 RewriteRule ^/api/v1/streaming/(.+)$ unix://${mcfg.sockets.node}|http://mastodon.immae.eu/api/v1/streaming/$1 [P,NE,QSA,L]
e34b3079 124 RewriteRule ^/api/v1/streaming/public$ unix://${mcfg.sockets.node}|http://mastodon.immae.eu/api/v1/streaming/public [P,NE,QSA,L]
613aea56 125 RewriteRule ^/api/v1/streaming/$ unix://${mcfg.sockets.node}|ws://mastodon.immae.eu/ [P,NE,QSA,L]
e34b3079
IB
126 RewriteCond %{REQUEST_URI} !/500.html
127 RewriteCond %{REQUEST_URI} !/sw.js
128 RewriteCond %{REQUEST_URI} !/embed.js
129 RewriteCond %{REQUEST_URI} !/robots.txt
130 RewriteCond %{REQUEST_URI} !/manifest.json
131 RewriteCond %{REQUEST_URI} !/browserconfig.xml
132 RewriteCond %{REQUEST_URI} !/mask-icon.svg
133 RewriteCond %{REQUEST_URI} !^(/.*\.(png|ico|gif)$)
134 RewriteCond %{REQUEST_URI} !^/(assets|avatars|emoji|headers|packs|sounds|system|.well-known/acme-challenge)
135 RewriteRule ^/(.*)$ unix:///run/mastodon/live_immae_puma.sock|http://mastodon.immae.eu/$1 [P,NE,QSA,L]
613aea56 136 ProxyPassReverse / unix://${mcfg.sockets.rails}|http://mastodon.immae.eu/
35a397cd 137
613aea56 138 Alias /system ${mcfg.dataDir}
35a397cd 139
613aea56 140 <Directory ${mcfg.dataDir}>
35a397cd
IB
141 Require all granted
142 Options -MultiViews
143 </Directory>
144
a95ab089 145 <Directory ${root}>
35a397cd
IB
146 Require all granted
147 Options -MultiViews +FollowSymlinks
148 </Directory>
149
150 ErrorDocument 500 /500.html
151 ErrorDocument 501 /500.html
152 ErrorDocument 502 /500.html
153 ErrorDocument 503 /500.html
154 ErrorDocument 504 /500.html
155 '' ];
156 };
157 };
158}