stockholm/krebs/3modules/bepasty-server.nix

181 lines
5.4 KiB
Nix
Raw Normal View History

2015-10-20 16:11:30 +00:00
{ config, lib, pkgs, ... }:
2016-10-20 18:54:38 +00:00
with import <stockholm/lib>;
2015-10-20 16:11:30 +00:00
let
2019-12-01 15:16:17 +00:00
gunicorn = pkgs.python3Packages.gunicorn;
bepasty = pkgs.bepasty;
gevent = pkgs.python3Packages.gevent;
python = pkgs.python3Packages.python;
2015-10-21 16:48:13 +00:00
cfg = config.krebs.bepasty;
2015-10-20 16:11:30 +00:00
out = {
2015-10-21 16:48:13 +00:00
options.krebs.bepasty = api;
2016-02-14 15:43:44 +00:00
config = lib.mkIf cfg.enable (lib.mkMerge [
(lib.mkIf cfg.serveNginx nginx-imp)
2015-10-22 14:14:37 +00:00
imp
]);
2015-10-20 16:11:30 +00:00
};
api = {
enable = mkEnableOption "Bepasty Servers";
serveNginx = mkEnableOption "Serve Bepasty Servers with Nginx";
servers = mkOption {
type = with types; attrsOf optionSet;
example = ''
{
"paste.r" = {
defaultPermissions = "read,delete,create";
};
"paste.krebsco.de" = {
defaultPermissions = "read";
};
}
'';
2015-10-20 16:11:30 +00:00
options = singleton {
2015-10-21 16:48:13 +00:00
nginx = mkOption {
2015-10-20 16:11:30 +00:00
# TODO use the correct type
type = with types; attrsOf unspecified;
description = ''
2017-04-17 14:22:09 +00:00
Additional nginx configuration.
2015-10-22 14:14:37 +00:00
'';
2015-10-20 16:11:30 +00:00
};
secretKey = mkOption {
type = types.str;
description = ''
server secret for safe session cookies, must be set.
'';
2015-10-21 16:48:13 +00:00
default = "";
2015-10-20 16:11:30 +00:00
};
2015-10-20 16:11:30 +00:00
# we create a wsgi socket in $workDir/gunicorn-${name}.wsgi
workDir = mkOption {
type = types.str;
description = ''
Path to the working directory (used for sockets and pidfile).
Defaults to the users home directory. Must be accessible to nginx,
permissions will be set to 755
'';
default = config.users.extraUsers.bepasty.home;
2021-11-08 00:21:27 +00:00
defaultText = "<literal>\${config.users.extraUsers.bepasty.home}</literal>";
2015-10-20 16:11:30 +00:00
};
dataDir = mkOption {
type = types.str;
description = ''
Defaults to the new users home dir which defaults to
/var/lib/bepasty-server/data
2015-10-22 14:14:37 +00:00
'';
2015-10-20 16:11:30 +00:00
default = "${config.users.extraUsers.bepasty.home}/data";
2021-11-08 00:21:27 +00:00
defaultText = "<literal>\${config.users.extraUsers.bepasty.home}/data</literal>";
2015-10-20 16:11:30 +00:00
};
extraConfig = mkOption {
type = types.str;
default = "";
2015-10-21 16:48:13 +00:00
# TODO configure permissions in separate
2015-10-20 16:11:30 +00:00
example = ''
PERMISSIONS = {
'myadminsecret': 'admin,list,create,read,delete',
}
MAX_ALLOWED_FILE_SIZE = 5 * 1000 * 1000
2015-10-22 14:14:37 +00:00
'';
2015-10-20 16:11:30 +00:00
};
defaultPermissions = mkOption {
2015-10-21 16:48:13 +00:00
# TODO: listOf str
2015-10-20 16:11:30 +00:00
type = types.str;
2015-10-21 16:48:13 +00:00
description = ''
2015-10-22 14:14:37 +00:00
default permissions for all unauthenticated users.
2015-10-21 16:48:13 +00:00
'';
example = "read,create,delete";
default = "read";
2015-10-20 16:11:30 +00:00
};
};
default = {};
};
};
imp = {
# Configures systemd services for each configured server
# environment.systemPackages = [ bepasty gunicorn gevent ];
systemd.services = mapAttrs' (name: server:
2015-10-22 14:14:37 +00:00
nameValuePair "bepasty-server-${name}" {
description = "Bepasty Server ${name}";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
restartIfChanged = true;
environment = let
penv = python.buildEnv.override {
extraLibs = [ bepasty gevent ];
};
in {
2015-10-22 14:14:37 +00:00
BEPASTY_CONFIG = "${server.workDir}/bepasty-${name}.conf";
PYTHONPATH= "${penv}/${python.sitePackages}/";
2015-10-22 14:14:37 +00:00
};
serviceConfig = {
Type = "simple";
PrivateTmp = true;
2016-06-13 00:04:22 +00:00
ExecStartPre = assert server.secretKey != ""; pkgs.writeDash "bepasty-server.${name}-init" ''
2015-10-22 14:14:37 +00:00
mkdir -p "${server.dataDir}" "${server.workDir}"
chown bepasty:bepasty "${server.workDir}" "${server.dataDir}"
cat > "${server.workDir}/bepasty-${name}.conf" <<EOF
SITENAME="${name}"
STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}"
SECRET_KEY="${server.secretKey}"
DEFAULT_PERMISSIONS="${server.defaultPermissions}"
${server.extraConfig}
EOF
'';
ExecStart = ''${gunicorn}/bin/gunicorn bepasty.wsgi --name ${name} \
-u bepasty \
-g bepasty \
--workers 3 --log-level=info \
--bind=unix:${server.workDir}/gunicorn-${name}.sock \
--pid ${server.workDir}/gunicorn-${name}.pid \
-k gevent
'';
};
}
2015-10-20 16:11:30 +00:00
) cfg.servers;
users.extraUsers.bepasty = {
2018-12-03 08:45:56 +00:00
uid = genid_uint31 "bepasty";
2015-10-21 16:48:13 +00:00
group = "bepasty";
2015-10-20 16:11:30 +00:00
home = "/var/lib/bepasty-server";
2021-06-05 12:52:48 +00:00
isSystemUser = true;
2015-10-21 16:48:13 +00:00
};
users.extraGroups.bepasty = {
2018-12-03 08:45:56 +00:00
gid = genid_uint31 "bepasty";
2015-10-20 16:11:30 +00:00
};
};
2015-10-21 16:48:13 +00:00
2015-10-20 16:11:30 +00:00
nginx-imp = {
assertions = [{ assertion = config.services.nginx.enable;
message = "services.nginx.enable must be true"; }];
2015-10-20 16:11:30 +00:00
services.nginx.virtualHosts = mapAttrs ( name: server:
(mkMerge [
server.nginx
{
extraConfig = ''
client_max_body_size 32M;
'';
locations = {
"/".extraConfig = "proxy_set_header Host $host;";
"/".proxyPass = "http://unix:${server.workDir}/gunicorn-${name}.sock";
"/static/".extraConfig = ''
alias ${bepasty}/lib/${python.libPrefix}/site-packages/bepasty/static/;
'';
};
}])
) cfg.servers ;
2015-10-20 16:11:30 +00:00
};
in
out