nixops/modules/websites/tools/diaspora/default.nix

   1 { lib, pkgs, config, myconfig, mylibs, ... }:
   2 let
   3   diaspora = pkgs.callPackage ./diaspora.nix {
   4     inherit (mylibs) fetchedGithub;
   5     env = myconfig.env.tools.diaspora;
   6   };
   7
   8   root = "/run/current-system/webapps/tools_diaspora";
   9   cfg = config.services.myWebsites.tools.diaspora;
  10 in {
  11   options.services.myWebsites.tools.diaspora = {
  12     enable = lib.mkEnableOption "enable diaspora's website";
  13   };
  14
  15   config = lib.mkIf cfg.enable {
  16     ids.uids.diaspora = myconfig.env.tools.diaspora.user.uid;
  17     ids.gids.diaspora = myconfig.env.tools.diaspora.user.gid;
  18
  19     users.users.diaspora = {
  20       name = "diaspora";
  21       uid = config.ids.uids.diaspora;
  22       group = "diaspora";
  23       description = "Diaspora user";
  24       home = diaspora.varDir;
  25       useDefaultShell = true;
  26       packages = [ diaspora.gems pkgs.nodejs diaspora.gems.ruby ];
  27       extraGroups = [ "keys" ];
  28     };
  29
  30     users.groups.diaspora.gid = config.ids.gids.diaspora;
  31
  32     mySecrets.keys = diaspora.keys;
  33     systemd.services.diaspora = {
  34       description = "Diaspora";
  35       wantedBy = [ "multi-user.target" ];
  36       after = [
  37         "network.target" "redis.service" "postgresql.service"
  38       ];
  39       wants = [
  40         "redis.service" "postgresql.service"
  41       ];
  42
  43       environment.RAILS_ENV = "production";
  44       environment.BUNDLE_PATH = "${diaspora.gems}/${diaspora.gems.ruby.gemPath}";
  45       environment.BUNDLE_GEMFILE = "${diaspora.gems.confFiles}/Gemfile";
  46       environment.EYE_SOCK = "${diaspora.socketsDir}/eye.sock";
  47       environment.EYE_PID = "${diaspora.socketsDir}/eye.pid";
  48
  49       path = [ diaspora.gems pkgs.nodejs diaspora.gems.ruby pkgs.curl pkgs.which pkgs.gawk ];
  50
  51       preStart = ''
  52         ./bin/bundle exec rails db:migrate
  53       '';
  54
  55       script = ''
  56         exec ${diaspora.railsRoot}/script/server
  57       '';
  58
  59       serviceConfig = {
  60         User = "diaspora";
  61         PrivateTmp = true;
  62         Restart = "always";
  63         Type = "simple";
  64         WorkingDirectory = diaspora.railsRoot;
  65         StandardInput = "null";
  66         KillMode = "control-group";
  67       };
  68
  69       unitConfig.RequiresMountsFor = diaspora.varDir;
  70     };
  71
  72     system.activationScripts.diaspora = {
  73       deps = [ "users" ];
  74       text = ''
  75       install -m 0755 -o diaspora -g diaspora -d ${diaspora.socketsDir}
  76       install -m 0755 -o diaspora -g diaspora -d ${diaspora.varDir} \
  77         ${diaspora.varDir}/uploads ${diaspora.varDir}/tmp \
  78         ${diaspora.varDir}/log
  79       install -m 0700 -o diaspora -g diaspora -d ${diaspora.varDir}/tmp/pids
  80       if [ ! -f ${diaspora.varDir}/schedule.yml ]; then
  81         echo "{}" | $wrapperDir/sudo -u diaspora tee ${diaspora.varDir}/schedule.yml
  82       fi
  83       '';
  84     };
  85
  86     services.myWebsites.tools.modules = [
  87       "headers" "proxy" "proxy_http"
  88     ];
  89     security.acme.certs."eldiron".extraDomains."diaspora.immae.eu" = null;
  90     system.extraSystemBuilderCmds = ''
  91       mkdir -p $out/webapps
  92       ln -s ${diaspora.railsRoot}/public/ $out/webapps/tools_diaspora
  93       '';
  94     services.myWebsites.tools.vhostConfs.diaspora = {
  95       certName    = "eldiron";
  96       hosts       = [ "diaspora.immae.eu" ];
  97       root        = root;
  98       extraConfig = [ ''
  99         RewriteEngine On
 100         RewriteCond %{DOCUMENT_ROOT}/%{REQUEST_FILENAME} !-f
 101         RewriteRule ^/(.*)$ unix://${diaspora.railsSocket}|http://diaspora.immae.eu/%{REQUEST_URI} [P,NE,QSA,L]
 102
 103         ProxyRequests Off
 104         ProxyVia On
 105         ProxyPreserveHost On
 106         RequestHeader set X_FORWARDED_PROTO https
 107
 108         <Proxy *>
 109             Require all granted
 110         </Proxy>
 111
 112         <Directory ${root}>
 113             Require all granted
 114             Options -MultiViews
 115         </Directory>
 116       '' ];
 117     };
 118   };
 119 }