diff options
Diffstat (limited to 'nixops/modules/websites/tools/mediagoblin/default.nix')
-rw-r--r-- | nixops/modules/websites/tools/mediagoblin/default.nix | 171 |
1 files changed, 138 insertions, 33 deletions
diff --git a/nixops/modules/websites/tools/mediagoblin/default.nix b/nixops/modules/websites/tools/mediagoblin/default.nix index 36329d9..a02af38 100644 --- a/nixops/modules/websites/tools/mediagoblin/default.nix +++ b/nixops/modules/websites/tools/mediagoblin/default.nix | |||
@@ -1,18 +1,123 @@ | |||
1 | { lib, pkgs, config, myconfig, mylibs, ... }: | 1 | { lib, pkgs, config, myconfig, mylibs, ... }: |
2 | let | 2 | let |
3 | mediagoblin = pkgs.callPackage ./mediagoblin.nix { | 3 | env = myconfig.env.tools.mediagoblin; |
4 | inherit (mylibs) fetchedGit fetchedGithub; | 4 | socketsDir = "/run/mediagoblin"; |
5 | env = myconfig.env.tools.mediagoblin; | 5 | varDir = "/var/lib/mediagoblin"; |
6 | }; | ||
7 | |||
8 | cfg = config.services.myWebsites.tools.mediagoblin; | 6 | cfg = config.services.myWebsites.tools.mediagoblin; |
7 | mediagoblin_init = "/var/secrets/webapps/tools-mediagoblin"; | ||
8 | paste_local = pkgs.writeText "paste_local.ini" '' | ||
9 | [DEFAULT] | ||
10 | debug = false | ||
11 | |||
12 | [pipeline:main] | ||
13 | pipeline = mediagoblin | ||
14 | |||
15 | [app:mediagoblin] | ||
16 | use = egg:mediagoblin#app | ||
17 | config = ${mediagoblin_init} ${pythonRoot}/mediagoblin.ini | ||
18 | /mgoblin_static = ${pythonRoot}/mediagoblin/static | ||
19 | |||
20 | [loggers] | ||
21 | keys = root | ||
22 | |||
23 | [handlers] | ||
24 | keys = console | ||
25 | |||
26 | [formatters] | ||
27 | keys = generic | ||
28 | |||
29 | [logger_root] | ||
30 | level = INFO | ||
31 | handlers = console | ||
32 | |||
33 | [handler_console] | ||
34 | class = StreamHandler | ||
35 | args = (sys.stderr,) | ||
36 | level = NOTSET | ||
37 | formatter = generic | ||
38 | |||
39 | [formatter_generic] | ||
40 | format = %(levelname)-7.7s [%(name)s] %(message)s | ||
41 | |||
42 | [filter:errors] | ||
43 | use = egg:mediagoblin#errors | ||
44 | debug = false | ||
45 | |||
46 | [server:main] | ||
47 | use = egg:waitress#main | ||
48 | unix_socket = ${socketsDir}/mediagoblin.sock | ||
49 | unix_socket_perms = 777 | ||
50 | url_scheme = https | ||
51 | ''; | ||
52 | pythonRoot = pkgs.webapps.mediagoblin-with-plugins; | ||
9 | in { | 53 | in { |
10 | options.services.myWebsites.tools.mediagoblin = { | 54 | options.services.myWebsites.tools.mediagoblin = { |
11 | enable = lib.mkEnableOption "enable mediagoblin's website"; | 55 | enable = lib.mkEnableOption "enable mediagoblin's website"; |
12 | }; | 56 | }; |
13 | 57 | ||
14 | config = lib.mkIf cfg.enable { | 58 | config = lib.mkIf cfg.enable { |
15 | mySecrets.keys = mediagoblin.keys; | 59 | mySecrets.keys = [{ |
60 | dest = "webapps/tools-mediagoblin"; | ||
61 | user = "mediagoblin"; | ||
62 | group = "mediagoblin"; | ||
63 | permissions = "0400"; | ||
64 | text = '' | ||
65 | [DEFAULT] | ||
66 | data_basedir = "${varDir}" | ||
67 | |||
68 | [mediagoblin] | ||
69 | direct_remote_path = /mgoblin_static/ | ||
70 | email_sender_address = "mediagoblin@tools.immae.eu" | ||
71 | |||
72 | #sql_engine = sqlite:///%(data_basedir)s/mediagoblin.db | ||
73 | sql_engine = ${env.psql_url} | ||
74 | |||
75 | email_debug_mode = false | ||
76 | allow_registration = false | ||
77 | allow_reporting = true | ||
78 | |||
79 | theme = airymodified | ||
80 | |||
81 | user_privilege_scheme = "uploader,commenter,reporter" | ||
82 | |||
83 | # We need to redefine them here since we override data_basedir | ||
84 | # cf /usr/share/webapps/mediagoblin/mediagoblin/config_spec.ini | ||
85 | workbench_path = %(data_basedir)s/media/workbench | ||
86 | crypto_path = %(data_basedir)s/crypto | ||
87 | theme_install_dir = %(data_basedir)s/themes/ | ||
88 | theme_linked_assets_dir = %(data_basedir)s/theme_static/ | ||
89 | plugin_linked_assets_dir = %(data_basedir)s/plugin_static/ | ||
90 | |||
91 | [storage:queuestore] | ||
92 | base_dir = %(data_basedir)s/media/queue | ||
93 | |||
94 | [storage:publicstore] | ||
95 | base_dir = %(data_basedir)s/media/public | ||
96 | base_url = /mgoblin_media/ | ||
97 | |||
98 | [celery] | ||
99 | CELERY_RESULT_DBURI = ${env.redis_url} | ||
100 | BROKER_URL = ${env.redis_url} | ||
101 | CELERYD_CONCURRENCY = 1 | ||
102 | |||
103 | [plugins] | ||
104 | [[mediagoblin.plugins.geolocation]] | ||
105 | [[mediagoblin.plugins.ldap]] | ||
106 | [[[immae.eu]]] | ||
107 | LDAP_SERVER_URI = 'ldaps://ldap.immae.eu:636' | ||
108 | LDAP_SEARCH_BASE = 'dc=immae,dc=eu' | ||
109 | LDAP_BIND_DN = 'cn=mediagoblin,ou=services,dc=immae,dc=eu' | ||
110 | LDAP_BIND_PW = '${env.ldap.password}' | ||
111 | LDAP_SEARCH_FILTER = '(&(memberOf=cn=users,cn=mediagoblin,ou=services,dc=immae,dc=eu)(uid={username}))' | ||
112 | EMAIL_SEARCH_FIELD = 'mail' | ||
113 | [[mediagoblin.plugins.basicsearch]] | ||
114 | [[mediagoblin.plugins.piwigo]] | ||
115 | [[mediagoblin.plugins.processing_info]] | ||
116 | [[mediagoblin.media_types.image]] | ||
117 | [[mediagoblin.media_types.video]] | ||
118 | ''; | ||
119 | }]; | ||
120 | |||
16 | ids.uids.mediagoblin = myconfig.env.tools.mediagoblin.user.uid; | 121 | ids.uids.mediagoblin = myconfig.env.tools.mediagoblin.user.uid; |
17 | ids.gids.mediagoblin = myconfig.env.tools.mediagoblin.user.gid; | 122 | ids.gids.mediagoblin = myconfig.env.tools.mediagoblin.user.gid; |
18 | 123 | ||
@@ -21,7 +126,7 @@ in { | |||
21 | uid = config.ids.uids.mediagoblin; | 126 | uid = config.ids.uids.mediagoblin; |
22 | group = "mediagoblin"; | 127 | group = "mediagoblin"; |
23 | description = "Mediagoblin user"; | 128 | description = "Mediagoblin user"; |
24 | home = mediagoblin.varDir; | 129 | home = varDir; |
25 | useDefaultShell = true; | 130 | useDefaultShell = true; |
26 | extraGroups = [ "keys" ]; | 131 | extraGroups = [ "keys" ]; |
27 | }; | 132 | }; |
@@ -38,17 +143,17 @@ in { | |||
38 | 143 | ||
39 | script = '' | 144 | script = '' |
40 | exec ./bin/paster serve \ | 145 | exec ./bin/paster serve \ |
41 | ${mediagoblin.pythonRoot}/paste_local.ini \ | 146 | ${paste_local} \ |
42 | --pid-file=${mediagoblin.socketsDir}/mediagoblin.pid | 147 | --pid-file=${socketsDir}/mediagoblin.pid |
43 | ''; | 148 | ''; |
44 | 149 | ||
45 | preStop = '' | 150 | preStop = '' |
46 | exec ./bin/paster serve \ | 151 | exec ./bin/paster serve \ |
47 | --pid-file=${mediagoblin.socketsDir}/mediagoblin.pid \ | 152 | --pid-file=${socketsDir}/mediagoblin.pid \ |
48 | ${mediagoblin.pythonRoot}/paste_local.ini stop | 153 | ${paste_local} stop |
49 | ''; | 154 | ''; |
50 | preStart = '' | 155 | preStart = '' |
51 | ./bin/gmg dbupdate | 156 | ./bin/gmg -cf ${mediagoblin_init} dbupdate |
52 | ''; | 157 | ''; |
53 | 158 | ||
54 | serviceConfig = { | 159 | serviceConfig = { |
@@ -57,11 +162,11 @@ in { | |||
57 | Restart = "always"; | 162 | Restart = "always"; |
58 | TimeoutSec = 15; | 163 | TimeoutSec = 15; |
59 | Type = "simple"; | 164 | Type = "simple"; |
60 | WorkingDirectory = mediagoblin.pythonRoot; | 165 | WorkingDirectory = pythonRoot; |
61 | PIDFile = "${mediagoblin.socketsDir}/mediagoblin.pid"; | 166 | PIDFile = "${socketsDir}/mediagoblin.pid"; |
62 | }; | 167 | }; |
63 | 168 | ||
64 | unitConfig.RequiresMountsFor = mediagoblin.varDir; | 169 | unitConfig.RequiresMountsFor = varDir; |
65 | }; | 170 | }; |
66 | 171 | ||
67 | systemd.services.mediagoblin-celeryd = { | 172 | systemd.services.mediagoblin-celeryd = { |
@@ -69,12 +174,12 @@ in { | |||
69 | wantedBy = [ "multi-user.target" ]; | 174 | wantedBy = [ "multi-user.target" ]; |
70 | after = [ "network.target" "mediagoblin-web.service" ]; | 175 | after = [ "network.target" "mediagoblin-web.service" ]; |
71 | 176 | ||
72 | environment.MEDIAGOBLIN_CONFIG = "${mediagoblin.pythonRoot}/mediagoblin_local.ini"; | 177 | environment.MEDIAGOBLIN_CONFIG = "${pythonRoot}/mediagoblin_local.ini"; |
73 | environment.CELERY_CONFIG_MODULE = "mediagoblin.init.celery.from_celery"; | 178 | environment.CELERY_CONFIG_MODULE = "mediagoblin.init.celery.from_celery"; |
74 | 179 | ||
75 | script = '' | 180 | script = '' |
76 | exec ./bin/celery worker \ | 181 | exec ./bin/celery worker \ |
77 | --logfile=${mediagoblin.varDir}/celery.log \ | 182 | --logfile=${varDir}/celery.log \ |
78 | --loglevel=INFO | 183 | --loglevel=INFO |
79 | ''; | 184 | ''; |
80 | 185 | ||
@@ -84,21 +189,21 @@ in { | |||
84 | Restart = "always"; | 189 | Restart = "always"; |
85 | TimeoutSec = 60; | 190 | TimeoutSec = 60; |
86 | Type = "simple"; | 191 | Type = "simple"; |
87 | WorkingDirectory = mediagoblin.pythonRoot; | 192 | WorkingDirectory = pythonRoot; |
88 | PIDFile = "${mediagoblin.socketsDir}/mediagoblin-celeryd.pid"; | 193 | PIDFile = "${socketsDir}/mediagoblin-celeryd.pid"; |
89 | }; | 194 | }; |
90 | 195 | ||
91 | unitConfig.RequiresMountsFor = mediagoblin.varDir; | 196 | unitConfig.RequiresMountsFor = varDir; |
92 | }; | 197 | }; |
93 | 198 | ||
94 | system.activationScripts.mediagoblin = { | 199 | system.activationScripts.mediagoblin = { |
95 | deps = [ "users" ]; | 200 | deps = [ "users" ]; |
96 | text = '' | 201 | text = '' |
97 | install -m 0755 -o mediagoblin -g mediagoblin -d ${mediagoblin.socketsDir} | 202 | install -m 0755 -o mediagoblin -g mediagoblin -d ${socketsDir} |
98 | install -m 0755 -o mediagoblin -g mediagoblin -d ${mediagoblin.varDir} | 203 | install -m 0755 -o mediagoblin -g mediagoblin -d ${varDir} |
99 | if [ -d ${mediagoblin.varDir}/plugin_static/ ]; then | 204 | if [ -d ${varDir}/plugin_static/ ]; then |
100 | rm ${mediagoblin.varDir}/plugin_static/coreplugin_basic_auth | 205 | rm ${varDir}/plugin_static/coreplugin_basic_auth |
101 | ln -sf ${mediagoblin.pythonRoot}/mediagoblin/plugins/basic_auth/static ${mediagoblin.varDir}/plugin_static/coreplugin_basic_auth | 206 | ln -sf ${pythonRoot}/mediagoblin/plugins/basic_auth/static ${varDir}/plugin_static/coreplugin_basic_auth |
102 | fi | 207 | fi |
103 | ''; | 208 | ''; |
104 | }; | 209 | }; |
@@ -113,20 +218,20 @@ in { | |||
113 | hosts = ["mgoblin.immae.eu" ]; | 218 | hosts = ["mgoblin.immae.eu" ]; |
114 | root = null; | 219 | root = null; |
115 | extraConfig = [ '' | 220 | extraConfig = [ '' |
116 | Alias /mgoblin_media ${mediagoblin.varDir}/media/public | 221 | Alias /mgoblin_media ${varDir}/media/public |
117 | <Directory ${mediagoblin.varDir}/media/public> | 222 | <Directory ${varDir}/media/public> |
118 | Options -Indexes +FollowSymLinks +MultiViews +Includes | 223 | Options -Indexes +FollowSymLinks +MultiViews +Includes |
119 | Require all granted | 224 | Require all granted |
120 | </Directory> | 225 | </Directory> |
121 | 226 | ||
122 | Alias /theme_static ${mediagoblin.varDir}/theme_static | 227 | Alias /theme_static ${varDir}/theme_static |
123 | <Directory ${mediagoblin.varDir}/theme_static> | 228 | <Directory ${varDir}/theme_static> |
124 | Options -Indexes +FollowSymLinks +MultiViews +Includes | 229 | Options -Indexes +FollowSymLinks +MultiViews +Includes |
125 | Require all granted | 230 | Require all granted |
126 | </Directory> | 231 | </Directory> |
127 | 232 | ||
128 | Alias /plugin_static ${mediagoblin.varDir}/plugin_static | 233 | Alias /plugin_static ${varDir}/plugin_static |
129 | <Directory ${mediagoblin.varDir}/plugin_static> | 234 | <Directory ${varDir}/plugin_static> |
130 | Options -Indexes +FollowSymLinks +MultiViews +Includes | 235 | Options -Indexes +FollowSymLinks +MultiViews +Includes |
131 | Require all granted | 236 | Require all granted |
132 | </Directory> | 237 | </Directory> |
@@ -138,8 +243,8 @@ in { | |||
138 | ProxyPass /theme_static ! | 243 | ProxyPass /theme_static ! |
139 | ProxyPass /plugin_static ! | 244 | ProxyPass /plugin_static ! |
140 | ProxyPassMatch ^/.well-known/acme-challenge ! | 245 | ProxyPassMatch ^/.well-known/acme-challenge ! |
141 | ProxyPass / unix://${mediagoblin.socketsDir}/mediagoblin.sock|http://mgoblin.immae.eu/ | 246 | ProxyPass / unix://${socketsDir}/mediagoblin.sock|http://mgoblin.immae.eu/ |
142 | ProxyPassReverse / unix://${mediagoblin.socketsDir}/mediagoblin.sock|http://mgoblin.immae.eu/ | 247 | ProxyPassReverse / unix://${socketsDir}/mediagoblin.sock|http://mgoblin.immae.eu/ |
143 | '' ]; | 248 | '' ]; |
144 | }; | 249 | }; |
145 | }; | 250 | }; |