modules/private/websites/tools/mastodon/default.nix

   1 { lib, pkgs, config,  ... }:
   2 let
   3   env = config.myEnv.tools.mastodon;
   4   root = "/run/current-system/webapps/tools_mastodon";
   5   cfg = config.myServices.websites.tools.mastodon;
   6   mcfg = config.services.mastodon;
   7 in {
   8   options.myServices.websites.tools.mastodon = {
   9     enable = lib.mkEnableOption "enable mastodon's website";
  10   };
  11
  12   config = lib.mkIf cfg.enable {
  13     services.duplyBackup.profiles.mastodon = {
  14       rootDir = mcfg.dataDir;
  15     };
  16     secrets.keys = [{
  17       dest = "webapps/tools-mastodon";
  18       user = "mastodon";
  19       group = "mastodon";
  20       permissions = "0400";
  21       text = ''
  22         REDIS_HOST=${env.redis.host}
  23         REDIS_PORT=${env.redis.port}
  24         REDIS_DB=${env.redis.db}
  25         DB_HOST=${env.postgresql.socket}
  26         DB_USER=${env.postgresql.user}
  27         DB_NAME=${env.postgresql.database}
  28         DB_PASS=${env.postgresql.password}
  29         DB_PORT=${env.postgresql.port}
  30
  31         LOCAL_DOMAIN=mastodon.immae.eu
  32         LOCAL_HTTPS=true
  33         ALTERNATE_DOMAINS=immae.eu
  34
  35         PAPERCLIP_SECRET=${env.paperclip_secret}
  36         SECRET_KEY_BASE=${env.secret_key_base}
  37         OTP_SECRET=${env.otp_secret}
  38
  39         VAPID_PRIVATE_KEY=${env.vapid.private}
  40         VAPID_PUBLIC_KEY=${env.vapid.public}
  41
  42         SMTP_DELIVERY_METHOD=sendmail
  43         SMTP_FROM_ADDRESS=mastodon@tools.immae.eu
  44         SENDMAIL_LOCATION="/run/wrappers/bin/sendmail"
  45         PAPERCLIP_ROOT_PATH=${mcfg.dataDir}
  46
  47         STREAMING_CLUSTER_NUM=1
  48
  49         RAILS_LOG_LEVEL=warn
  50
  51         # LDAP authentication (optional)
  52         LDAP_ENABLED=true
  53         LDAP_HOST=${env.ldap.host}
  54         LDAP_PORT=636
  55         LDAP_METHOD=simple_tls
  56         LDAP_BASE="${env.ldap.base}"
  57         LDAP_BIND_DN="${env.ldap.dn}"
  58         LDAP_PASSWORD="${env.ldap.password}"
  59         LDAP_UID="uid"
  60         LDAP_SEARCH_FILTER="${env.ldap.filter}"
  61       '';
  62     }];
  63     services.mastodon = {
  64       enable = true;
  65       configFile = "/var/secrets/webapps/tools-mastodon";
  66       socketsPrefix = "live_immae";
  67       dataDir = "/var/lib/mastodon_immae";
  68     };
  69     services.filesWatcher.mastodon-streaming = {
  70       restart = true;
  71       paths = [ mcfg.configFile ];
  72     };
  73     services.filesWatcher.mastodon-web = {
  74       restart = true;
  75       paths = [ mcfg.configFile ];
  76     };
  77     services.filesWatcher.mastodon-sidekiq = {
  78       restart = true;
  79       paths = [ mcfg.configFile ];
  80     };
  81
  82
  83     services.websites.env.tools.modules = [
  84       "headers" "proxy" "proxy_wstunnel" "proxy_http"
  85     ];
  86     system.extraSystemBuilderCmds = ''
  87       mkdir -p $out/webapps
  88       ln -s ${mcfg.workdir}/public/ $out/webapps/tools_mastodon
  89       '';
  90     services.websites.env.tools.vhostConfs.mastodon = {
  91       certName    = "eldiron";
  92       addToCerts  = true;
  93       hosts       = ["mastodon.immae.eu" ];
  94       root        = root;
  95       extraConfig = [ ''
  96         Header always set Referrer-Policy "strict-origin-when-cross-origin"
  97         Header always set Strict-Transport-Security "max-age=31536000"
  98
  99         <LocationMatch "^/(assets|avatars|emoji|headers|packs|sounds|system)>
 100           Header always set Cache-Control "public, max-age=31536000, immutable"
 101           Require all granted
 102         </LocationMatch>
 103
 104         ProxyPreserveHost On
 105         RequestHeader set X-Forwarded-Proto "https"
 106
 107         RewriteEngine On
 108
 109         ProxyPass /500.html !
 110         ProxyPass /sw.js !
 111         ProxyPass /embed.js !
 112         ProxyPass /robots.txt !
 113         ProxyPass /manifest.json !
 114         ProxyPass /browserconfig.xml !
 115         ProxyPass /mask-icon.svg !
 116         ProxyPassMatch ^(/.*\.(png|ico|gif)$) !
 117         ProxyPassMatch ^/(assets|avatars|emoji|headers|packs|sounds|system|.well-known/acme-challenge) !
 118
 119         RewriteRule ^/api/v1/streaming/(.+)$ unix://${mcfg.sockets.node}|http://mastodon.immae.eu/api/v1/streaming/$1 [P,NE,QSA,L]
 120         RewriteRule ^/api/v1/streaming/$ unix://${mcfg.sockets.node}|ws://mastodon.immae.eu/ [P,NE,QSA,L]
 121         ProxyPass / unix://${mcfg.sockets.rails}|http://mastodon.immae.eu/
 122         ProxyPassReverse / unix://${mcfg.sockets.rails}|http://mastodon.immae.eu/
 123
 124         Alias /system ${mcfg.dataDir}
 125
 126         <Directory ${mcfg.dataDir}>
 127           Require all granted
 128           Options -MultiViews
 129         </Directory>
 130
 131         <Directory ${root}>
 132           Require all granted
 133           Options -MultiViews +FollowSymlinks
 134         </Directory>
 135
 136         ErrorDocument 500 /500.html
 137         ErrorDocument 501 /500.html
 138         ErrorDocument 502 /500.html
 139         ErrorDocument 503 /500.html
 140         ErrorDocument 504 /500.html
 141       '' ];
 142     };
 143   };
 144 }