Upgrade syden peertube to flake
[perso/Immae/Config/Nix.git] / modules / private / websites / syden / peertube.nix
CommitLineData
8a05c7fb
IB
1{ lib, pkgs, config, ... }:
2let
3 scfg = config.myServices.websites.syden.peertube;
4 name = "peertube";
5 dataDir = "/var/lib/syden_peertube";
ce950269 6 package = (pkgs.mylibs.flakeCompat ../../../../flakes/private/peertube).default;
8a05c7fb
IB
7 env = config.myEnv.tools.syden_peertube;
8in
9{
10 options.myServices.websites.syden.peertube.enable = lib.mkEnableOption "enable Syden's website";
11
12 config = lib.mkIf scfg.enable {
13 services.duplyBackup.profiles.syden_peertube = {
14 rootDir = dataDir;
5a61f6ad 15 remotes = ["eriomem" "ovh"];
8a05c7fb
IB
16 };
17 users.users.peertube = {
18 uid = config.ids.uids.peertube;
19 group = "peertube";
20 description = "Peertube user";
21 useDefaultShell = true;
22 extraGroups = [ "keys" ];
23 };
24 users.groups.peertube.gid = config.ids.gids.peertube;
25
26 secrets.keys = [{
d3452fc5 27 dest = "websites/syden/peertube";
8a05c7fb
IB
28 user = "peertube";
29 group = "peertube";
30 permissions = "0640";
31 text = ''
32 listen:
33 hostname: 'localhost'
34 port: ${toString env.listenPort}
35 webserver:
36 https: true
a8c07ade 37 hostname: 'record-links.immae.eu'
8a05c7fb
IB
38 port: 443
39 database:
40 hostname: '${env.postgresql.socket}'
41 port: 5432
42 suffix: '_syden'
43 username: '${env.postgresql.user}'
44 password: '${env.postgresql.password}'
45 pool:
46 max: 5
47 redis:
48 socket: '${env.redis.socket}'
49 auth: null
50 db: ${env.redis.db}
51 smtp:
52 transport: sendmail
53 sendmail: '/run/wrappers/bin/sendmail'
54 from_address: 'peertube@tools.immae.eu'
55 storage:
56 tmp: '${dataDir}/storage/tmp/'
57 avatars: '${dataDir}/storage/avatars/'
58 videos: '${dataDir}/storage/videos/'
59 streaming_playlists: '${dataDir}/storage/streaming-playlists/'
60 redundancy: '${dataDir}/storage/videos/'
61 logs: '${dataDir}/storage/logs/'
62 previews: '${dataDir}/storage/previews/'
63 thumbnails: '${dataDir}/storage/thumbnails/'
64 torrents: '${dataDir}/storage/torrents/'
65 captions: '${dataDir}/storage/captions/'
66 cache: '${dataDir}/storage/cache/'
67 plugins: '${dataDir}/storage/plugins/'
ce950269 68 client_overrides: '${dataDir}/storage/client-overrides/'
8a05c7fb
IB
69 '';
70 }];
71
72 services.filesWatcher.syden_peertube = {
73 restart = true;
d3452fc5 74 paths = [ config.secrets.fullPaths."websites/syden/peertube" ];
8a05c7fb
IB
75 };
76
77 systemd.services.syden_peertube = {
78 description = "Peertube";
79 wantedBy = [ "multi-user.target" ];
80 after = [ "network.target" "postgresql.service" ];
81 wants = [ "postgresql.service" ];
82
83 environment.NODE_CONFIG_DIR = "${dataDir}/config";
84 environment.NODE_ENV = "production";
85 environment.HOME = package;
86
87 path = [ pkgs.nodejs pkgs.bashInteractive pkgs.ffmpeg pkgs.openssl ];
88
89 script = ''
90 install -m 0750 -d ${dataDir}/config
d3452fc5 91 ln -sf ${config.secrets.fullPaths."websites/syden/peertube"} ${dataDir}/config/production.yaml
8a05c7fb
IB
92 ln -sf ${package}/config/default.yaml ${dataDir}/config/default.yaml
93 exec npm run start
94 '';
95
96 serviceConfig = {
97 User = "peertube";
98 Group = "peertube";
99 WorkingDirectory = package;
100 StateDirectory = "syden_peertube";
101 StateDirectoryMode = 0750;
102 PrivateTmp = true;
103 ProtectHome = true;
104 ProtectControlGroups = true;
105 Restart = "always";
106 Type = "simple";
107 TimeoutSec = 60;
108 };
109
110 unitConfig.RequiresMountsFor = dataDir;
111 };
112
113 services.websites.env.production.vhostConfs.syden_peertube = {
d3452fc5
IB
114 certName = "syden";
115 addToCerts = true;
a8c07ade
IB
116 certMainHost = "record-links.immae.eu";
117 hosts = [ "record-links.immae.eu" ];
d3452fc5
IB
118 root = null;
119 extraConfig = [ ''
8a05c7fb
IB
120 RewriteEngine On
121
122 RewriteCond %{REQUEST_URI} ^/socket.io [NC]
123 RewriteCond %{QUERY_STRING} transport=websocket [NC]
124 RewriteRule /(.*) ws://localhost:${toString env.listenPort}/$1 [P,NE,QSA,L]
125
126 RewriteCond %{REQUEST_URI} ^/tracker/socket [NC]
127 RewriteRule /(.*) ws://localhost:${toString env.listenPort}/$1 [P,NE,QSA,L]
128
129 ProxyPass / http://localhost:${toString env.listenPort}/
130 ProxyPassReverse / http://localhost:${toString env.listenPort}/
131
132 ProxyPreserveHost On
133 RequestHeader set X-Real-IP %{REMOTE_ADDR}s
134 '' ];
135 };
136 };
137}