1 { lib, pkgs, config, myconfig, mylibs, ... }:
3 env = myconfig.env.tools.mediagoblin;
4 socketsDir = "/run/mediagoblin";
5 varDir = "/var/lib/mediagoblin";
6 cfg = config.services.myWebsites.tools.mediagoblin;
7 mediagoblin_init = "/var/secrets/webapps/tools-mediagoblin";
8 paste_local = pkgs.writeText "paste_local.ini" ''
13 pipeline = mediagoblin
16 use = egg:mediagoblin#app
17 config = ${mediagoblin_init} ${pythonRoot}/mediagoblin.ini
18 /mgoblin_static = ${pythonRoot}/mediagoblin/static
40 format = %(levelname)-7.7s [%(name)s] %(message)s
43 use = egg:mediagoblin#errors
47 use = egg:waitress#main
48 unix_socket = ${socketsDir}/mediagoblin.sock
49 unix_socket_perms = 777
52 pythonRoot = pkgs.webapps.mediagoblin-with-plugins;
54 options.services.myWebsites.tools.mediagoblin = {
55 enable = lib.mkEnableOption "enable mediagoblin's website";
58 config = lib.mkIf cfg.enable {
60 dest = "webapps/tools-mediagoblin";
62 group = "mediagoblin";
66 data_basedir = "${varDir}"
69 direct_remote_path = /mgoblin_static/
70 email_sender_address = "mediagoblin@tools.immae.eu"
72 #sql_engine = sqlite:///%(data_basedir)s/mediagoblin.db
73 sql_engine = ${env.psql_url}
75 email_debug_mode = false
76 allow_registration = false
77 allow_reporting = true
81 user_privilege_scheme = "uploader,commenter,reporter"
83 # We need to redefine them here since we override data_basedir
84 # cf /usr/share/webapps/mediagoblin/mediagoblin/config_spec.ini
85 workbench_path = %(data_basedir)s/media/workbench
86 crypto_path = %(data_basedir)s/crypto
87 theme_install_dir = %(data_basedir)s/themes/
88 theme_linked_assets_dir = %(data_basedir)s/theme_static/
89 plugin_linked_assets_dir = %(data_basedir)s/plugin_static/
92 base_dir = %(data_basedir)s/media/queue
95 base_dir = %(data_basedir)s/media/public
96 base_url = /mgoblin_media/
99 CELERY_RESULT_DBURI = ${env.redis_url}
100 BROKER_URL = ${env.redis_url}
101 CELERYD_CONCURRENCY = 1
104 [[mediagoblin.plugins.geolocation]]
105 [[mediagoblin.plugins.ldap]]
107 LDAP_SERVER_URI = 'ldaps://ldap.immae.eu:636'
108 LDAP_SEARCH_BASE = 'dc=immae,dc=eu'
109 LDAP_BIND_DN = 'cn=mediagoblin,ou=services,dc=immae,dc=eu'
110 LDAP_BIND_PW = '${env.ldap.password}'
111 LDAP_SEARCH_FILTER = '(&(memberOf=cn=users,cn=mediagoblin,ou=services,dc=immae,dc=eu)(uid={username}))'
112 EMAIL_SEARCH_FIELD = 'mail'
113 [[mediagoblin.plugins.basicsearch]]
114 [[mediagoblin.plugins.piwigo]]
115 [[mediagoblin.plugins.processing_info]]
116 [[mediagoblin.media_types.image]]
117 [[mediagoblin.media_types.video]]
121 ids.uids.mediagoblin = myconfig.env.tools.mediagoblin.user.uid;
122 ids.gids.mediagoblin = myconfig.env.tools.mediagoblin.user.gid;
124 users.users.mediagoblin = {
125 name = "mediagoblin";
126 uid = config.ids.uids.mediagoblin;
127 group = "mediagoblin";
128 description = "Mediagoblin user";
130 useDefaultShell = true;
131 extraGroups = [ "keys" ];
134 users.groups.mediagoblin.gid = config.ids.gids.mediagoblin;
136 systemd.services.mediagoblin-web = {
137 description = "Mediagoblin service";
138 wantedBy = [ "multi-user.target" ];
139 after = [ "network.target" ];
140 wants = [ "postgresql.service" "redis.service" ];
142 environment.SCRIPT_NAME = "/mediagoblin/";
145 exec ./bin/paster serve \
147 --pid-file=${socketsDir}/mediagoblin.pid
151 exec ./bin/paster serve \
152 --pid-file=${socketsDir}/mediagoblin.pid \
156 ./bin/gmg -cf ${mediagoblin_init} dbupdate
160 User = "mediagoblin";
165 WorkingDirectory = pythonRoot;
166 PIDFile = "${socketsDir}/mediagoblin.pid";
169 unitConfig.RequiresMountsFor = varDir;
172 systemd.services.mediagoblin-celeryd = {
173 description = "Mediagoblin service";
174 wantedBy = [ "multi-user.target" ];
175 after = [ "network.target" "mediagoblin-web.service" ];
177 environment.MEDIAGOBLIN_CONFIG = "${pythonRoot}/mediagoblin_local.ini";
178 environment.CELERY_CONFIG_MODULE = "mediagoblin.init.celery.from_celery";
181 exec ./bin/celery worker \
182 --logfile=${varDir}/celery.log \
187 User = "mediagoblin";
192 WorkingDirectory = pythonRoot;
193 PIDFile = "${socketsDir}/mediagoblin-celeryd.pid";
196 unitConfig.RequiresMountsFor = varDir;
199 system.activationScripts.mediagoblin = {
202 install -m 0755 -o mediagoblin -g mediagoblin -d ${socketsDir}
203 install -m 0755 -o mediagoblin -g mediagoblin -d ${varDir}
204 if [ -d ${varDir}/plugin_static/ ]; then
205 rm ${varDir}/plugin_static/coreplugin_basic_auth
206 ln -sf ${pythonRoot}/mediagoblin/plugins/basic_auth/static ${varDir}/plugin_static/coreplugin_basic_auth
211 services.myWebsites.tools.modules = [
214 users.users.wwwrun.extraGroups = [ "mediagoblin" ];
215 security.acme.certs."eldiron".extraDomains."mgoblin.immae.eu" = null;
216 services.myWebsites.tools.vhostConfs.mgoblin = {
217 certName = "eldiron";
218 hosts = ["mgoblin.immae.eu" ];
221 Alias /mgoblin_media ${varDir}/media/public
222 <Directory ${varDir}/media/public>
223 Options -Indexes +FollowSymLinks +MultiViews +Includes
227 Alias /theme_static ${varDir}/theme_static
228 <Directory ${varDir}/theme_static>
229 Options -Indexes +FollowSymLinks +MultiViews +Includes
233 Alias /plugin_static ${varDir}/plugin_static
234 <Directory ${varDir}/plugin_static>
235 Options -Indexes +FollowSymLinks +MultiViews +Includes
242 ProxyPass /mgoblin_media !
243 ProxyPass /theme_static !
244 ProxyPass /plugin_static !
245 ProxyPassMatch ^/.well-known/acme-challenge !
246 ProxyPass / unix://${socketsDir}/mediagoblin.sock|http://mgoblin.immae.eu/
247 ProxyPassReverse / unix://${socketsDir}/mediagoblin.sock|http://mgoblin.immae.eu/