1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
{ lib, pkgs, config, myconfig, ... }:
let
env = myconfig.env.tools.mediagoblin;
cfg = config.services.myWebsites.tools.mediagoblin;
mcfg = config.services.mediagoblin;
in {
options.services.myWebsites.tools.mediagoblin = {
enable = lib.mkEnableOption "enable mediagoblin's website";
};
config = lib.mkIf cfg.enable {
secrets.keys = [{
dest = "webapps/tools-mediagoblin";
user = "mediagoblin";
group = "mediagoblin";
permissions = "0400";
text = ''
[DEFAULT]
data_basedir = "${mcfg.dataDir}"
[mediagoblin]
direct_remote_path = /mgoblin_static/
email_sender_address = "mediagoblin@tools.immae.eu"
#sql_engine = sqlite:///%(data_basedir)s/mediagoblin.db
sql_engine = ${env.psql_url}
email_debug_mode = false
allow_registration = false
allow_reporting = true
theme = airymodified
user_privilege_scheme = "uploader,commenter,reporter"
# We need to redefine them here since we override data_basedir
# cf /usr/share/webapps/mediagoblin/mediagoblin/config_spec.ini
workbench_path = %(data_basedir)s/media/workbench
crypto_path = %(data_basedir)s/crypto
theme_install_dir = %(data_basedir)s/themes/
theme_linked_assets_dir = %(data_basedir)s/theme_static/
plugin_linked_assets_dir = %(data_basedir)s/plugin_static/
[storage:queuestore]
base_dir = %(data_basedir)s/media/queue
[storage:publicstore]
base_dir = %(data_basedir)s/media/public
base_url = /mgoblin_media/
[celery]
CELERY_RESULT_DBURI = ${env.redis_url}
BROKER_URL = ${env.redis_url}
CELERYD_CONCURRENCY = 1
[plugins]
[[mediagoblin.plugins.geolocation]]
[[mediagoblin.plugins.ldap]]
[[[immae.eu]]]
LDAP_SERVER_URI = 'ldaps://ldap.immae.eu:636'
LDAP_SEARCH_BASE = 'dc=immae,dc=eu'
LDAP_BIND_DN = 'cn=mediagoblin,ou=services,dc=immae,dc=eu'
LDAP_BIND_PW = '${env.ldap.password}'
LDAP_SEARCH_FILTER = '(&(memberOf=cn=users,cn=mediagoblin,ou=services,dc=immae,dc=eu)(uid={username}))'
EMAIL_SEARCH_FIELD = 'mail'
[[mediagoblin.plugins.basicsearch]]
[[mediagoblin.plugins.piwigo]]
[[mediagoblin.plugins.processing_info]]
[[mediagoblin.media_types.image]]
[[mediagoblin.media_types.video]]
'';
}];
users.users.mediagoblin.extraGroups = [ "keys" ];
services.mediagoblin = {
enable = true;
plugins = builtins.attrValues pkgs.webapps.mediagoblin-plugins;
configFile = "/var/secrets/webapps/tools-mediagoblin";
};
services.websites.tools.modules = [
"proxy" "proxy_http"
];
users.users.wwwrun.extraGroups = [ "mediagoblin" ];
services.websites.tools.vhostConfs.mgoblin = {
certName = "eldiron";
addToCerts = true;
hosts = ["mgoblin.immae.eu" ];
root = null;
extraConfig = [ ''
Alias /mgoblin_media ${mcfg.dataDir}/media/public
<Directory ${mcfg.dataDir}/media/public>
Options -Indexes +FollowSymLinks +MultiViews +Includes
Require all granted
</Directory>
Alias /theme_static ${mcfg.dataDir}/theme_static
<Directory ${mcfg.dataDir}/theme_static>
Options -Indexes +FollowSymLinks +MultiViews +Includes
Require all granted
</Directory>
Alias /plugin_static ${mcfg.dataDir}/plugin_static
<Directory ${mcfg.dataDir}/plugin_static>
Options -Indexes +FollowSymLinks +MultiViews +Includes
Require all granted
</Directory>
ProxyPreserveHost on
ProxyVia On
ProxyRequests Off
ProxyPass /mgoblin_media !
ProxyPass /theme_static !
ProxyPass /plugin_static !
ProxyPassMatch ^/.well-known/acme-challenge !
ProxyPass / unix://${mcfg.sockets.paster}|http://mgoblin.immae.eu/
ProxyPassReverse / unix://${mcfg.sockets.paster}|http://mgoblin.immae.eu/
'' ];
};
};
}
|
