From 79d2de8b83d765721b2cb720b2bc59673df54a4a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Tue, 7 May 2019 15:07:00 +0200 Subject: Move directories with only default.nix to standalone file --- nixops/modules/websites/tools/mastodon.nix | 249 +++++++++++++++++++++++++++++ 1 file changed, 249 insertions(+) create mode 100644 nixops/modules/websites/tools/mastodon.nix (limited to 'nixops/modules/websites/tools/mastodon.nix') diff --git a/nixops/modules/websites/tools/mastodon.nix b/nixops/modules/websites/tools/mastodon.nix new file mode 100644 index 0000000..3279cf8 --- /dev/null +++ b/nixops/modules/websites/tools/mastodon.nix @@ -0,0 +1,249 @@ +{ lib, pkgs, config, myconfig, mylibs, ... }: +let + varDir = "/var/lib/mastodon_immae"; + socketsDir = "/run/mastodon"; + nodeSocket = "${socketsDir}/live_immae_node.sock"; + railsSocket = "${socketsDir}/live_immae_puma.sock"; + + mastodon = pkgs.webapps.mastodon.override { inherit varDir; }; + + env = myconfig.env.tools.mastodon; + root = "/run/current-system/webapps/tools_mastodon"; + cfg = config.services.myWebsites.tools.mastodon; +in { + options.services.myWebsites.tools.mastodon = { + enable = lib.mkEnableOption "enable mastodon's website"; + }; + + config = lib.mkIf cfg.enable { + mySecrets.keys = [{ + dest = "webapps/tools-mastodon"; + user = "mastodon"; + group = "mastodon"; + permissions = "0400"; + text = '' + REDIS_HOST=${env.redis.host} + REDIS_PORT=${env.redis.port} + REDIS_DB=${env.redis.db} + DB_HOST=${env.postgresql.socket} + DB_USER=${env.postgresql.user} + DB_NAME=${env.postgresql.database} + DB_PASS=${env.postgresql.password} + DB_PORT=${env.postgresql.port} + + LOCAL_DOMAIN=mastodon.immae.eu + LOCAL_HTTPS=true + ALTERNATE_DOMAINS=immae.eu + + PAPERCLIP_SECRET=${env.paperclip_secret} + SECRET_KEY_BASE=${env.secret_key_base} + OTP_SECRET=${env.otp_secret} + + VAPID_PRIVATE_KEY=${env.vapid.private} + VAPID_PUBLIC_KEY=${env.vapid.public} + + SMTP_DELIVERY_METHOD=sendmail + SMTP_FROM_ADDRESS=mastodon@tools.immae.eu + SENDMAIL_LOCATION="/run/wrappers/bin/sendmail" + PAPERCLIP_ROOT_PATH=${varDir} + + STREAMING_CLUSTER_NUM=1 + + RAILS_LOG_LEVEL=warn + + # LDAP authentication (optional) + LDAP_ENABLED=true + LDAP_HOST=ldap.immae.eu + LDAP_PORT=636 + LDAP_METHOD=simple_tls + LDAP_BASE="dc=immae,dc=eu" + LDAP_BIND_DN="cn=mastodon,ou=services,dc=immae,dc=eu" + LDAP_PASSWORD="${env.ldap.password}" + LDAP_UID="uid" + LDAP_SEARCH_FILTER="(&(%{uid}=%{email})(memberOf=cn=users,cn=mastodon,ou=services,dc=immae,dc=eu))" + ''; + }]; + ids.uids.mastodon = env.user.uid; + ids.gids.mastodon = env.user.gid; + + users.users.mastodon = { + name = "mastodon"; + uid = config.ids.uids.mastodon; + group = "mastodon"; + description = "Mastodon user"; + home = varDir; + useDefaultShell = true; + }; + + users.groups.mastodon.gid = config.ids.gids.mastodon; + + systemd.services.mastodon-streaming = { + description = "Mastodon Streaming"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" "mastodon-web.service" ]; + + environment.NODE_ENV = "production"; + environment.SOCKET = nodeSocket; + + path = [ pkgs.nodejs pkgs.bashInteractive ]; + + script = '' + exec npm run start + ''; + + postStart = '' + while [ ! -S $SOCKET ]; do + sleep 0.5 + done + chmod a+w $SOCKET + ''; + + postStop = '' + rm $SOCKET + ''; + + serviceConfig = { + User = "mastodon"; + EnvironmentFile = "/var/secrets/webapps/tools-mastodon"; + PrivateTmp = true; + Restart = "always"; + TimeoutSec = 15; + Type = "simple"; + WorkingDirectory = mastodon; + }; + + unitConfig.RequiresMountsFor = varDir; + }; + + systemd.services.mastodon-web = { + description = "Mastodon Web app"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + + environment.RAILS_ENV = "production"; + environment.BUNDLE_PATH = "${mastodon.gems}/${mastodon.gems.ruby.gemPath}"; + environment.BUNDLE_GEMFILE = "${mastodon.gems.confFiles}/Gemfile"; + environment.SOCKET = railsSocket; + + path = [ mastodon.gems mastodon.gems.ruby pkgs.file ]; + + preStart = '' + ./bin/bundle exec rails db:migrate + ''; + + script = '' + exec ./bin/bundle exec puma -C config/puma.rb + ''; + + serviceConfig = { + User = "mastodon"; + EnvironmentFile = "/var/secrets/webapps/tools-mastodon"; + PrivateTmp = true; + Restart = "always"; + TimeoutSec = 60; + Type = "simple"; + WorkingDirectory = mastodon; + }; + + unitConfig.RequiresMountsFor = varDir; + }; + + systemd.services.mastodon-sidekiq = { + description = "Mastodon Sidekiq"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" "mastodon-web.service" ]; + + environment.RAILS_ENV="production"; + environment.BUNDLE_PATH = "${mastodon.gems}/${mastodon.gems.ruby.gemPath}"; + environment.BUNDLE_GEMFILE = "${mastodon.gems.confFiles}/Gemfile"; + environment.DB_POOL="5"; + + path = [ mastodon.gems mastodon.gems.ruby pkgs.imagemagick pkgs.ffmpeg pkgs.file ]; + + script = '' + exec ./bin/bundle exec sidekiq -c 5 -q default -q mailers -q pull -q push + ''; + + serviceConfig = { + User = "mastodon"; + EnvironmentFile = "/var/secrets/webapps/tools-mastodon"; + PrivateTmp = true; + Restart = "always"; + TimeoutSec = 15; + Type = "simple"; + WorkingDirectory = mastodon; + }; + + unitConfig.RequiresMountsFor = varDir; + }; + + system.activationScripts.mastodon = { + deps = [ "users" ]; + text = '' + install -m 0755 -o mastodon -g mastodon -d ${socketsDir} + install -m 0755 -o mastodon -g mastodon -d ${varDir} ${varDir}/tmp/cache + ''; + }; + + services.myWebsites.tools.modules = [ + "headers" "proxy" "proxy_wstunnel" "proxy_http" + ]; + security.acme.certs."eldiron".extraDomains."mastodon.immae.eu" = null; + system.extraSystemBuilderCmds = '' + mkdir -p $out/webapps + ln -s ${mastodon}/public/ $out/webapps/tools_mastodon + ''; + services.myWebsites.tools.vhostConfs.mastodon = { + certName = "eldiron"; + hosts = ["mastodon.immae.eu" ]; + root = root; + extraConfig = [ '' + Header always set Referrer-Policy "strict-origin-when-cross-origin" + Header always set Strict-Transport-Security "max-age=31536000" + + + Header always set Cache-Control "public, max-age=31536000, immutable" + Require all granted + + + ProxyPreserveHost On + RequestHeader set X-Forwarded-Proto "https" + + RewriteEngine On + + ProxyPass /500.html ! + ProxyPass /sw.js ! + ProxyPass /embed.js ! + ProxyPass /robots.txt ! + ProxyPass /manifest.json ! + ProxyPass /browserconfig.xml ! + ProxyPass /mask-icon.svg ! + ProxyPassMatch ^(/.*\.(png|ico|gif)$) ! + ProxyPassMatch ^/(assets|avatars|emoji|headers|packs|sounds|system|.well-known/acme-challenge) ! + + RewriteRule ^/api/v1/streaming/(.+)$ unix://${nodeSocket}|http://mastodon.immae.eu/api/v1/streaming/$1 [P,NE,QSA,L] + RewriteRule ^/api/v1/streaming/$ unix://${nodeSocket}|ws://mastodon.immae.eu/ [P,NE,QSA,L] + ProxyPass / unix://${railsSocket}|http://mastodon.immae.eu/ + ProxyPassReverse / unix://${railsSocket}|http://mastodon.immae.eu/ + + Alias /system ${varDir} + + + Require all granted + Options -MultiViews + + + + Require all granted + Options -MultiViews +FollowSymlinks + + + ErrorDocument 500 /500.html + ErrorDocument 501 /500.html + ErrorDocument 502 /500.html + ErrorDocument 503 /500.html + ErrorDocument 504 /500.html + '' ]; + }; + }; +} -- cgit v1.2.3