71 lines
2.2 KiB
Nix
71 lines
2.2 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
with lib;
|
|
let
|
|
cfg = config.services.piped;
|
|
|
|
backend_config = {
|
|
PORT = cfg.backend_port;
|
|
HTTP_WORKERS = 2;
|
|
PROXY_PART = "https://${cfg.proxy_domain}"; # TODO: fix
|
|
API_URL = "https://${cfg.backend_domain}";
|
|
FRONTEND_URL = "https://${cfg.frontend_domain}";
|
|
DISABLE_REGISTRATION = false;
|
|
COMPROMISED_PASSWORD_CHECK = false;
|
|
FEED_RETENTION = 30;
|
|
"hibernate.connection.url" = "jdbc:postgresql://localhost:5432/piped";
|
|
"hibernate.connection.driver_class" = "org.postgresql.Driver";
|
|
"hibernate.dialect" = "org.hibernate.dialect.PostgreSQLDialect";
|
|
"hibernate.connection.username" = "piped";
|
|
"hibernate.connection.password" = "password";
|
|
};
|
|
|
|
cfgToString = v: if builtins.isBool v then boolToString v else toString v;
|
|
backend_config_file = pkgs.writeText "config.properties"
|
|
(concatStringsSep "\n"
|
|
(mapAttrsToList (n: v: "${n}:${cfgToString v}") backend_config));
|
|
|
|
in {
|
|
config = (lib.mkIf cfg.enable) {
|
|
systemd.tmpfiles.rules = [ "d /run/piped-backend - root root" ];
|
|
|
|
systemd.services.piped-backend = {
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
WorkingDirectory = "/run/piped-backend";
|
|
ExecStartPre = "${pkgs.writeShellScript "piped-backend-init" ''
|
|
cp ${backend_config_file} /run/piped-backend/config.properties
|
|
''}";
|
|
ExecStart = "${pkgs.piped-backend}/bin/piped-backend";
|
|
};
|
|
};
|
|
|
|
systemd.services.piped-password = {
|
|
serviceConfig.Type = "oneshot";
|
|
wantedBy = [ "piped-backend.service" ];
|
|
wants = [ "postgresql.service" ];
|
|
after = [ "postgresql.service" ];
|
|
script = ''
|
|
${pkgs.postgresql}/bin/psql -c "ALTER USER piped WITH PASSWORD 'password';"
|
|
'';
|
|
serviceConfig.User = "postgres";
|
|
};
|
|
|
|
services.postgresql = {
|
|
enable = true;
|
|
ensureUsers = [{
|
|
name = "piped";
|
|
ensurePermissions."DATABASE piped" = "ALL PRIVILEGES";
|
|
}];
|
|
ensureDatabases = [ "piped" ];
|
|
};
|
|
|
|
services.nginx.virtualHosts."${cfg.backend_domain}" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
locations."/" = {
|
|
proxyPass = "http://127.0.0.1:${toString cfg.backend_port}";
|
|
};
|
|
};
|
|
};
|
|
}
|