modules/private/websites/tools/mastodon/default.nix

   1 { lib, pkgs, config,  ... }:
   2 let
   3   env = config.myEnv.tools.mastodon;
   4   root = "${mcfg.workdir}/public/";
   5   cfg = config.myServices.websites.tools.mastodon;
   6   mcfg = config.immaeServices.mastodon;
   7 in {
   8   options.myServices.websites.tools.mastodon = {
   9     enable = lib.mkEnableOption "enable mastodon's website";
  10   };
  11
  12   config = lib.mkIf cfg.enable {
  13     myServices.chatonsProperties.services.mastodon = {
  14       file.datetime = "2022-08-21T19:50:00";
  15       service = {
  16         name = "Mastodon";
  17         description = "Your self-hosted, globally interconnected microblogging community";
  18         website = "https://mastodon.immae.eu/";
  19         logo = "https://mastodon.immae.eu/apple-touch-icon.png";
  20         status.level = "OK";
  21         status.description = "OK";
  22         registration."" = ["MEMBER" "CLIENT"];
  23         registration.load = "OPEN";
  24         install.type = "PACKAGE";
  25       };
  26       software = {
  27         name = "Mastodon";
  28         website = "https://joinmastodon.org/";
  29         license.url = "https://github.com/tootsuite/mastodon/blob/master/LICENSE";
  30         license.name = "GNU General Public License v3.0";
  31         version = mcfg.package.version;
  32         source.url = "https://github.com/tootsuite/mastodon";
  33       };
  34     };
  35     secrets.keys."webapps/tools-mastodon" = {
  36       user = "mastodon";
  37       group = "mastodon";
  38       permissions = "0400";
  39       text = ''
  40         REDIS_HOST=${env.redis.host}
  41         REDIS_PORT=${env.redis.port}
  42         REDIS_DB=${env.redis.db}
  43         DB_HOST=${env.postgresql.socket}
  44         DB_USER=${env.postgresql.user}
  45         DB_NAME=${env.postgresql.database}
  46         DB_PASS=${env.postgresql.password}
  47         DB_PORT=${env.postgresql.port}
  48
  49         LOCAL_DOMAIN=mastodon.immae.eu
  50         LOCAL_HTTPS=true
  51         ALTERNATE_DOMAINS=immae.eu
  52
  53         PAPERCLIP_SECRET=${env.paperclip_secret}
  54         SECRET_KEY_BASE=${env.secret_key_base}
  55         OTP_SECRET=${env.otp_secret}
  56
  57         VAPID_PRIVATE_KEY=${env.vapid.private}
  58         VAPID_PUBLIC_KEY=${env.vapid.public}
  59
  60         SMTP_DELIVERY_METHOD=sendmail
  61         SMTP_FROM_ADDRESS=mastodon@tools.immae.eu
  62         SENDMAIL_LOCATION="/run/wrappers/bin/sendmail"
  63         PAPERCLIP_ROOT_PATH=${mcfg.dataDir}
  64
  65         STREAMING_CLUSTER_NUM=1
  66
  67         RAILS_LOG_LEVEL=warn
  68
  69         # LDAP authentication (optional)
  70         LDAP_ENABLED=true
  71         LDAP_HOST=${env.ldap.host}
  72         LDAP_PORT=636
  73         LDAP_METHOD=simple_tls
  74         LDAP_BASE="${env.ldap.base}"
  75         LDAP_BIND_DN="${env.ldap.dn}"
  76         LDAP_PASSWORD="${env.ldap.password}"
  77         LDAP_UID="uid"
  78         LDAP_SEARCH_FILTER="${env.ldap.filter}"
  79       '';
  80     };
  81     immaeServices.mastodon = {
  82       enable = true;
  83       configFile = config.secrets.fullPaths."webapps/tools-mastodon";
  84       socketsPrefix = "live_immae";
  85       dataDir = "/var/lib/mastodon_immae";
  86     };
  87     services.filesWatcher.mastodon-streaming = {
  88       restart = true;
  89       paths = [ mcfg.configFile ];
  90     };
  91     services.filesWatcher.mastodon-web = {
  92       restart = true;
  93       paths = [ mcfg.configFile ];
  94     };
  95     services.filesWatcher.mastodon-sidekiq = {
  96       restart = true;
  97       paths = [ mcfg.configFile ];
  98     };
  99
 100
 101     services.websites.env.tools.modules = [
 102       "headers" "proxy" "proxy_wstunnel" "proxy_http"
 103     ];
 104     services.websites.env.tools.vhostConfs.mastodon = {
 105       certName    = "eldiron";
 106       addToCerts  = true;
 107       hosts       = ["mastodon.immae.eu" ];
 108       root        = root;
 109       extraConfig = [ ''
 110         Header always set Referrer-Policy "strict-origin-when-cross-origin"
 111         Header always set Strict-Transport-Security "max-age=31536000"
 112
 113         <LocationMatch "^/(assets|avatars|emoji|headers|packs|sounds|system)>
 114           Header always set Cache-Control "public, max-age=31536000, immutable"
 115           Require all granted
 116         </LocationMatch>
 117
 118         ProxyPreserveHost On
 119         RequestHeader set X-Forwarded-Proto "https"
 120
 121         RewriteEngine On
 122
 123         RewriteRule ^/api/v1/streaming/(.+)$ unix://${mcfg.sockets.node}|http://mastodon.immae.eu/api/v1/streaming/$1 [P,NE,QSA,L]
 124         RewriteRule ^/api/v1/streaming/public$ unix://${mcfg.sockets.node}|http://mastodon.immae.eu/api/v1/streaming/public [P,NE,QSA,L]
 125         RewriteRule ^/api/v1/streaming/$ unix://${mcfg.sockets.node}|ws://mastodon.immae.eu/ [P,NE,QSA,L]
 126         RewriteCond %{REQUEST_URI} !/500.html
 127         RewriteCond %{REQUEST_URI} !/sw.js
 128         RewriteCond %{REQUEST_URI} !/embed.js
 129         RewriteCond %{REQUEST_URI} !/robots.txt
 130         RewriteCond %{REQUEST_URI} !/manifest.json
 131         RewriteCond %{REQUEST_URI} !/browserconfig.xml
 132         RewriteCond %{REQUEST_URI} !/mask-icon.svg
 133         RewriteCond %{REQUEST_URI} !^(/.*\.(png|ico|gif)$)
 134         RewriteCond %{REQUEST_URI} !^/(assets|avatars|emoji|headers|packs|sounds|system|.well-known/acme-challenge)
 135         RewriteRule ^/(.*)$ unix:///run/mastodon/live_immae_puma.sock|http://mastodon.immae.eu/$1 [P,NE,QSA,L]
 136         ProxyPassReverse / unix://${mcfg.sockets.rails}|http://mastodon.immae.eu/
 137
 138         Alias /system ${mcfg.dataDir}
 139
 140         <Directory ${mcfg.dataDir}>
 141           Require all granted
 142           Options -MultiViews
 143         </Directory>
 144
 145         <Directory ${root}>
 146           Require all granted
 147           Options -MultiViews +FollowSymlinks
 148         </Directory>
 149
 150         ErrorDocument 500 /500.html
 151         ErrorDocument 501 /500.html
 152         ErrorDocument 502 /500.html
 153         ErrorDocument 503 /500.html
 154         ErrorDocument 504 /500.html
 155       '' ];
 156     };
 157   };
 158 }