]> git.immae.eu Git - perso/Immae/Config/Nix.git/blob - nixops/modules/websites/tools/mediagoblin/default.nix
Move ssh ftp and mpd to new secrets
[perso/Immae/Config/Nix.git] / nixops / modules / websites / tools / mediagoblin / default.nix
1 { lib, pkgs, config, myconfig, mylibs, ... }:
2 let
3 mediagoblin = pkgs.callPackage ./mediagoblin.nix {
4 inherit (mylibs) fetchedGit fetchedGithub;
5 env = myconfig.env.tools.mediagoblin;
6 };
7
8 cfg = config.services.myWebsites.tools.mediagoblin;
9 in {
10 options.services.myWebsites.tools.mediagoblin = {
11 enable = lib.mkEnableOption "enable mediagoblin's website";
12 };
13
14 config = lib.mkIf cfg.enable {
15 deployment.keys = mediagoblin.keys;
16 ids.uids.mediagoblin = myconfig.env.tools.mediagoblin.user.uid;
17 ids.gids.mediagoblin = myconfig.env.tools.mediagoblin.user.gid;
18
19 users.users.mediagoblin = {
20 name = "mediagoblin";
21 uid = config.ids.uids.mediagoblin;
22 group = "mediagoblin";
23 description = "Mediagoblin user";
24 home = mediagoblin.varDir;
25 useDefaultShell = true;
26 extraGroups = [ "keys" ];
27 };
28
29 users.groups.mediagoblin.gid = config.ids.gids.mediagoblin;
30
31 systemd.services.mediagoblin-web = {
32 description = "Mediagoblin service";
33 wantedBy = [ "multi-user.target" ];
34 after = [ "network.target" "tools-mediagoblin-key.service" ];
35 wants = [ "postgresql.service" "redis.service" "tools-mediagoblin-key.service" ];
36
37 environment.SCRIPT_NAME = "/mediagoblin/";
38
39 script = ''
40 exec ./bin/paster serve \
41 ${mediagoblin.pythonRoot}/paste_local.ini \
42 --pid-file=${mediagoblin.socketsDir}/mediagoblin.pid
43 '';
44
45 preStop = ''
46 exec ./bin/paster serve \
47 --pid-file=${mediagoblin.socketsDir}/mediagoblin.pid \
48 ${mediagoblin.pythonRoot}/paste_local.ini stop
49 '';
50 preStart = ''
51 ./bin/gmg dbupdate
52 '';
53
54 serviceConfig = {
55 User = "mediagoblin";
56 PrivateTmp = true;
57 Restart = "always";
58 TimeoutSec = 15;
59 Type = "simple";
60 WorkingDirectory = mediagoblin.pythonRoot;
61 PIDFile = "${mediagoblin.socketsDir}/mediagoblin.pid";
62 };
63
64 unitConfig.RequiresMountsFor = mediagoblin.varDir;
65 };
66
67 systemd.services.mediagoblin-celeryd = {
68 description = "Mediagoblin service";
69 wantedBy = [ "multi-user.target" ];
70 after = [ "network.target" "mediagoblin-web.service" ];
71
72 environment.MEDIAGOBLIN_CONFIG = "${mediagoblin.pythonRoot}/mediagoblin_local.ini";
73 environment.CELERY_CONFIG_MODULE = "mediagoblin.init.celery.from_celery";
74
75 script = ''
76 exec ./bin/celery worker \
77 --logfile=${mediagoblin.varDir}/celery.log \
78 --loglevel=INFO
79 '';
80
81 serviceConfig = {
82 User = "mediagoblin";
83 PrivateTmp = true;
84 Restart = "always";
85 TimeoutSec = 60;
86 Type = "simple";
87 WorkingDirectory = mediagoblin.pythonRoot;
88 PIDFile = "${mediagoblin.socketsDir}/mediagoblin-celeryd.pid";
89 };
90
91 unitConfig.RequiresMountsFor = mediagoblin.varDir;
92 };
93
94 system.activationScripts.mediagoblin = {
95 deps = [ "users" ];
96 text = ''
97 install -m 0755 -o mediagoblin -g mediagoblin -d ${mediagoblin.socketsDir}
98 install -m 0755 -o mediagoblin -g mediagoblin -d ${mediagoblin.varDir}
99 if [ -d ${mediagoblin.varDir}/plugin_static/ ]; then
100 rm ${mediagoblin.varDir}/plugin_static/coreplugin_basic_auth
101 ln -sf ${mediagoblin.pythonRoot}/mediagoblin/plugins/basic_auth/static ${mediagoblin.varDir}/plugin_static/coreplugin_basic_auth
102 fi
103 '';
104 };
105
106 services.myWebsites.tools.modules = [
107 "proxy" "proxy_http"
108 ];
109 users.users.wwwrun.extraGroups = [ "mediagoblin" ];
110 security.acme.certs."eldiron".extraDomains."mgoblin.immae.eu" = null;
111 services.myWebsites.tools.vhostConfs.mgoblin = {
112 certName = "eldiron";
113 hosts = ["mgoblin.immae.eu" ];
114 root = null;
115 extraConfig = [ ''
116 Alias /mgoblin_media ${mediagoblin.varDir}/media/public
117 <Directory ${mediagoblin.varDir}/media/public>
118 Options -Indexes +FollowSymLinks +MultiViews +Includes
119 Require all granted
120 </Directory>
121
122 Alias /theme_static ${mediagoblin.varDir}/theme_static
123 <Directory ${mediagoblin.varDir}/theme_static>
124 Options -Indexes +FollowSymLinks +MultiViews +Includes
125 Require all granted
126 </Directory>
127
128 Alias /plugin_static ${mediagoblin.varDir}/plugin_static
129 <Directory ${mediagoblin.varDir}/plugin_static>
130 Options -Indexes +FollowSymLinks +MultiViews +Includes
131 Require all granted
132 </Directory>
133
134 ProxyPreserveHost on
135 ProxyVia On
136 ProxyRequests Off
137 ProxyPass /mgoblin_media !
138 ProxyPass /theme_static !
139 ProxyPass /plugin_static !
140 ProxyPassMatch ^/.well-known/acme-challenge !
141 ProxyPass / unix://${mediagoblin.socketsDir}/mediagoblin.sock|http://mgoblin.immae.eu/
142 ProxyPassReverse / unix://${mediagoblin.socketsDir}/mediagoblin.sock|http://mgoblin.immae.eu/
143 '' ];
144 };
145 };
146 }