modules/private/websites/tools/peertube/default.nix

   1 { lib, pkgs, config,  ... }:
   2 let
   3   env = config.myEnv.tools.peertube;
   4   cfg = config.myServices.websites.tools.peertube;
   5   pcfg = config.services.peertube;
   6 in {
   7   options.myServices.websites.tools.peertube = {
   8     enable = lib.mkEnableOption "enable Peertube's website";
   9   };
  10
  11   config = lib.mkIf cfg.enable {
  12     services.duplyBackup.profiles.peertube = {
  13       rootDir = pcfg.dataDir;
  14     };
  15     services.peertube = {
  16       enable = true;
  17       configFile = "/var/secrets/webapps/tools-peertube";
  18     };
  19     users.users.peertube.extraGroups = [ "keys" ];
  20
  21     secrets.keys = [{
  22       dest = "webapps/tools-peertube";
  23       user = "peertube";
  24       group = "peertube";
  25       permissions = "0640";
  26       text = ''
  27         listen:
  28           hostname: 'localhost'
  29           port: ${toString config.myEnv.ports.peertube}
  30         webserver:
  31           https: true
  32           hostname: 'peertube.immae.eu'
  33           port: 443
  34         database:
  35           hostname: '${env.postgresql.socket}'
  36           port: 5432
  37           suffix: '_prod'
  38           username: '${env.postgresql.user}'
  39           password: '${env.postgresql.password}'
  40           pool:
  41             max: 5
  42         redis:
  43           socket: '${env.redis.socket}'
  44           auth: null
  45           db: ${env.redis.db}
  46         auth:
  47           local:
  48             enabled: true
  49           ldap:
  50             enabled: true
  51             ldap_only: false
  52             url: ldaps://${env.ldap.host}/${env.ldap.base}
  53             bind_dn: ${env.ldap.dn}
  54             bind_password: ${env.ldap.password}
  55             base: ${env.ldap.base}
  56             mail_entry: "mail"
  57             user_filter: "${env.ldap.filter}"
  58         smtp:
  59           transport: sendmail
  60           sendmail: '/run/wrappers/bin/sendmail'
  61           from_address: 'peertube@tools.immae.eu'
  62         storage:
  63           tmp: '${pcfg.dataDir}/storage/tmp/'
  64           avatars: '${pcfg.dataDir}/storage/avatars/'
  65           videos: '${pcfg.dataDir}/storage/videos/'
  66           streaming_playlists: '${pcfg.dataDir}/storage/streaming-playlists/'
  67           redundancy: '${pcfg.dataDir}/storage/videos/'
  68           logs: '${pcfg.dataDir}/storage/logs/'
  69           previews: '${pcfg.dataDir}/storage/previews/'
  70           thumbnails: '${pcfg.dataDir}/storage/thumbnails/'
  71           torrents: '${pcfg.dataDir}/storage/torrents/'
  72           captions: '${pcfg.dataDir}/storage/captions/'
  73           cache: '${pcfg.dataDir}/storage/cache/'
  74           plugins: '${pcfg.dataDir}/storage/plugins/'
  75           client_overrides: '${pcfg.dataDir}/storage/client-overrides/'
  76         '';
  77     }];
  78
  79     services.websites.env.tools.modules = [
  80       "headers" "proxy" "proxy_http" "proxy_wstunnel"
  81     ];
  82     services.filesWatcher.peertube = {
  83       restart = true;
  84       paths = [ pcfg.configFile ];
  85     };
  86
  87     services.websites.env.tools.vhostConfs.peertube = {
  88       certName    = "eldiron";
  89       addToCerts  = true;
  90       hosts       = [ "peertube.immae.eu" ];
  91       root        = null;
  92       extraConfig = [ ''
  93           RewriteEngine On
  94
  95           RewriteCond %{REQUEST_URI}  ^/socket.io            [NC]
  96           RewriteCond %{QUERY_STRING} transport=websocket    [NC]
  97           RewriteRule /(.*)           ws://localhost:${toString env.listenPort}/$1 [P,NE,QSA,L]
  98
  99           RewriteCond %{REQUEST_URI}  ^/tracker/socket       [NC]
 100           RewriteRule /(.*)           ws://localhost:${toString env.listenPort}/$1 [P,NE,QSA,L]
 101
 102           ProxyPass /        http://localhost:${toString env.listenPort}/
 103           ProxyPassReverse / http://localhost:${toString env.listenPort}/
 104
 105           ProxyPreserveHost On
 106           RequestHeader set X-Real-IP %{REMOTE_ADDR}s
 107       '' ];
 108     };
 109   };
 110 }