modules/private/websites/tools/mastodon/default.nix

   1 { lib, pkgs, config, myconfig,  ... }:
   2 let
   3   env = myconfig.env.tools.mastodon;
   4   root = "/run/current-system/webapps/tools_mastodon";
   5   cfg = config.myServices.websites.tools.mastodon;
   6   mcfg = config.services.mastodon;
   7 in {
   8   options.myServices.websites.tools.mastodon = {
   9     enable = lib.mkEnableOption "enable mastodon's website";
  10   };
  11
  12   config = lib.mkIf cfg.enable {
  13     secrets.keys = [{
  14       dest = "webapps/tools-mastodon";
  15       user = "mastodon";
  16       group = "mastodon";
  17       permissions = "0400";
  18       text = ''
  19         REDIS_HOST=${env.redis.host}
  20         REDIS_PORT=${env.redis.port}
  21         REDIS_DB=${env.redis.db}
  22         DB_HOST=${env.postgresql.socket}
  23         DB_USER=${env.postgresql.user}
  24         DB_NAME=${env.postgresql.database}
  25         DB_PASS=${env.postgresql.password}
  26         DB_PORT=${env.postgresql.port}
  27
  28         LOCAL_DOMAIN=mastodon.immae.eu
  29         LOCAL_HTTPS=true
  30         ALTERNATE_DOMAINS=immae.eu
  31
  32         PAPERCLIP_SECRET=${env.paperclip_secret}
  33         SECRET_KEY_BASE=${env.secret_key_base}
  34         OTP_SECRET=${env.otp_secret}
  35
  36         VAPID_PRIVATE_KEY=${env.vapid.private}
  37         VAPID_PUBLIC_KEY=${env.vapid.public}
  38
  39         SMTP_DELIVERY_METHOD=sendmail
  40         SMTP_FROM_ADDRESS=mastodon@tools.immae.eu
  41         SENDMAIL_LOCATION="/run/wrappers/bin/sendmail"
  42         PAPERCLIP_ROOT_PATH=${mcfg.dataDir}
  43
  44         STREAMING_CLUSTER_NUM=1
  45
  46         RAILS_LOG_LEVEL=warn
  47
  48         # LDAP authentication (optional)
  49         LDAP_ENABLED=true
  50         LDAP_HOST=ldap.immae.eu
  51         LDAP_PORT=636
  52         LDAP_METHOD=simple_tls
  53         LDAP_BASE="dc=immae,dc=eu"
  54         LDAP_BIND_DN="cn=mastodon,ou=services,dc=immae,dc=eu"
  55         LDAP_PASSWORD="${env.ldap.password}"
  56         LDAP_UID="uid"
  57         LDAP_SEARCH_FILTER="(&(%{uid}=%{email})(memberOf=cn=users,cn=mastodon,ou=services,dc=immae,dc=eu))"
  58       '';
  59     }];
  60     services.mastodon = {
  61       enable = true;
  62       configFile = "/var/secrets/webapps/tools-mastodon";
  63       socketsPrefix = "live_immae";
  64       dataDir = "/var/lib/mastodon_immae";
  65     };
  66     services.filesWatcher.mastodon-streaming = {
  67       restart = true;
  68       paths = [ mcfg.configFile ];
  69     };
  70     services.filesWatcher.mastodon-web = {
  71       restart = true;
  72       paths = [ mcfg.configFile ];
  73     };
  74     services.filesWatcher.mastodon-sidekiq = {
  75       restart = true;
  76       paths = [ mcfg.configFile ];
  77     };
  78
  79
  80     services.websites.tools.modules = [
  81       "headers" "proxy" "proxy_wstunnel" "proxy_http"
  82     ];
  83     system.extraSystemBuilderCmds = ''
  84       mkdir -p $out/webapps
  85       ln -s ${mcfg.workdir}/public/ $out/webapps/tools_mastodon
  86       '';
  87     services.websites.tools.vhostConfs.mastodon = {
  88       certName    = "eldiron";
  89       addToCerts  = true;
  90       hosts       = ["mastodon.immae.eu" ];
  91       root        = root;
  92       extraConfig = [ ''
  93         Header always set Referrer-Policy "strict-origin-when-cross-origin"
  94         Header always set Strict-Transport-Security "max-age=31536000"
  95
  96         <LocationMatch "^/(assets|avatars|emoji|headers|packs|sounds|system)>
  97           Header always set Cache-Control "public, max-age=31536000, immutable"
  98           Require all granted
  99         </LocationMatch>
 100
 101         ProxyPreserveHost On
 102         RequestHeader set X-Forwarded-Proto "https"
 103
 104         RewriteEngine On
 105
 106         ProxyPass /500.html !
 107         ProxyPass /sw.js !
 108         ProxyPass /embed.js !
 109         ProxyPass /robots.txt !
 110         ProxyPass /manifest.json !
 111         ProxyPass /browserconfig.xml !
 112         ProxyPass /mask-icon.svg !
 113         ProxyPassMatch ^(/.*\.(png|ico|gif)$) !
 114         ProxyPassMatch ^/(assets|avatars|emoji|headers|packs|sounds|system|.well-known/acme-challenge) !
 115
 116         RewriteRule ^/api/v1/streaming/(.+)$ unix://${mcfg.sockets.node}|http://mastodon.immae.eu/api/v1/streaming/$1 [P,NE,QSA,L]
 117         RewriteRule ^/api/v1/streaming/$ unix://${mcfg.sockets.node}|ws://mastodon.immae.eu/ [P,NE,QSA,L]
 118         ProxyPass / unix://${mcfg.sockets.rails}|http://mastodon.immae.eu/
 119         ProxyPassReverse / unix://${mcfg.sockets.rails}|http://mastodon.immae.eu/
 120
 121         Alias /system ${mcfg.dataDir}
 122
 123         <Directory ${mcfg.dataDir}>
 124           Require all granted
 125           Options -MultiViews
 126         </Directory>
 127
 128         <Directory ${root}>
 129           Require all granted
 130           Options -MultiViews +FollowSymlinks
 131         </Directory>
 132
 133         ErrorDocument 500 /500.html
 134         ErrorDocument 501 /500.html
 135         ErrorDocument 502 /500.html
 136         ErrorDocument 503 /500.html
 137         ErrorDocument 504 /500.html
 138       '' ];
 139     };
 140   };
 141 }