463 lines
13 KiB
Nix
463 lines
13 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
cfg = config.services.rabbi-gerzi;
|
|
|
|
backendPackage = cfg.backend.package;
|
|
frontendPackage = cfg.frontend.package;
|
|
appDir = "${backendPackage}/share/php/rabbi-gerzi-backend";
|
|
phpPackage = backendPackage.passthru.php;
|
|
poolName = "rabbi-gerzi";
|
|
uploadLimits = import ./upload-limits.nix;
|
|
storagePath = "${cfg.stateDir}/storage";
|
|
cachePath = "${cfg.cacheDir}/bootstrap-cache";
|
|
backupDir = "/var/backup/rabbi-gerzi";
|
|
databaseDumpPath = "${backupDir}/rabbi-gerzi.dump";
|
|
phpFpmWasActivePath = "/root/.cache/borg/rabbi-gerzi-phpfpm-was-active";
|
|
setupService = "rabbi-gerzi-setup";
|
|
phpfpmService = "phpfpm-${poolName}";
|
|
|
|
databaseDumpCommand = lib.concatStringsSep " " [
|
|
"${config.services.postgresql.package}/bin/pg_dump"
|
|
"--format=custom"
|
|
"--dbname=${cfg.database.name}"
|
|
];
|
|
|
|
secretFileOption =
|
|
description:
|
|
lib.mkOption {
|
|
type = lib.types.path;
|
|
inherit description;
|
|
};
|
|
|
|
appEnvironment = {
|
|
APP_ENV = "production";
|
|
APP_DEBUG = "false";
|
|
APP_URL = cfg.backend.publicUrl;
|
|
APP_CONFIG_CACHE = "${cachePath}/config.php";
|
|
APP_EVENTS_CACHE = "${cachePath}/events.php";
|
|
APP_PACKAGES_CACHE = "${cachePath}/packages.php";
|
|
APP_ROUTES_CACHE = "${cachePath}/routes.php";
|
|
APP_SERVICES_CACHE = "${cachePath}/services.php";
|
|
CACHE_STORE = "file";
|
|
CORS_ALLOWED_ORIGINS = lib.concatStringsSep "," cfg.backend.corsAllowedOrigins;
|
|
DB_CONNECTION = "pgsql";
|
|
DB_DATABASE = cfg.database.name;
|
|
DB_HOST = "/run/postgresql";
|
|
DB_PASSWORD = "";
|
|
DB_PORT = "5432";
|
|
DB_USERNAME = cfg.database.user;
|
|
FILESYSTEM_DISK = "public";
|
|
LARAVEL_STORAGE_PATH = storagePath;
|
|
LOG_CHANNEL = "single";
|
|
MAIL_MAILER = "log";
|
|
QUEUE_CONNECTION = "sync";
|
|
SESSION_DRIVER = "database";
|
|
SESSION_DOMAIN = cfg.backend.cookieDomain;
|
|
SESSION_SAME_SITE = cfg.backend.cookieSameSite;
|
|
SESSION_SECURE_COOKIE = lib.boolToString cfg.backend.cookieSecure;
|
|
};
|
|
|
|
artisan = "${phpPackage}/bin/php ${appDir}/artisan";
|
|
|
|
makeDirectoryRule = path: "d ${path} 0750 ${cfg.user} ${cfg.group} - -";
|
|
in
|
|
{
|
|
options.services.rabbi-gerzi = {
|
|
enable = lib.mkEnableOption "the Rabbi Gerzi application";
|
|
|
|
secretFiles = {
|
|
borgPassphrase = secretFileOption "Borg repository passphrase file.";
|
|
borgPrivateKey = secretFileOption "Borg repository SSH private key file.";
|
|
};
|
|
|
|
user = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "rabbi-gerzi";
|
|
description = "User used to run the Rabbi Gerzi backend.";
|
|
};
|
|
|
|
group = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "rabbi-gerzi";
|
|
description = "Group used to run the Rabbi Gerzi backend.";
|
|
};
|
|
|
|
stateDir = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "/var/lib/rabbi-gerzi";
|
|
description = "Writable state directory for uploads and storage.";
|
|
};
|
|
|
|
cacheDir = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "/var/cache/rabbi-gerzi";
|
|
description = "Writable cache directory for Laravel cache files.";
|
|
};
|
|
|
|
database = {
|
|
name = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = cfg.user;
|
|
description = "PostgreSQL database name.";
|
|
};
|
|
|
|
user = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = cfg.user;
|
|
description = "PostgreSQL database user.";
|
|
};
|
|
};
|
|
|
|
frontend = {
|
|
hostName = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "Frontend nginx virtual host name.";
|
|
};
|
|
|
|
redirectHostNames = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
default = [ ];
|
|
description = "Frontend host names that redirect to the canonical host.";
|
|
};
|
|
|
|
publicUrl = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "https://${cfg.frontend.hostName}";
|
|
description = "Public frontend origin.";
|
|
};
|
|
|
|
apiBaseUrl = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = cfg.backend.publicUrl;
|
|
description = "API origin baked into the frontend build.";
|
|
};
|
|
|
|
package = lib.mkOption {
|
|
type = lib.types.package;
|
|
default = pkgs.callPackage ./packages/frontend.nix {
|
|
inherit (cfg.frontend) apiBaseUrl;
|
|
};
|
|
description = "Frontend package to serve.";
|
|
};
|
|
|
|
nginx = lib.mkOption {
|
|
type = lib.types.attrs;
|
|
default = { };
|
|
description = "Extra nginx virtual host options for the frontend.";
|
|
};
|
|
};
|
|
|
|
backend = {
|
|
hostName = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "Backend nginx virtual host name.";
|
|
};
|
|
|
|
publicUrl = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "https://${cfg.backend.hostName}";
|
|
description = "Public backend origin.";
|
|
};
|
|
|
|
environmentFile = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.str;
|
|
default = null;
|
|
description = "Runtime dotenv file containing APP_KEY and admin secrets.";
|
|
};
|
|
|
|
package = lib.mkOption {
|
|
type = lib.types.package;
|
|
default = pkgs.callPackage ./packages/backend.nix { };
|
|
description = "Backend package to run.";
|
|
};
|
|
|
|
corsAllowedOrigins = lib.mkOption {
|
|
type = lib.types.listOf lib.types.str;
|
|
default = [ cfg.frontend.publicUrl ];
|
|
description = "Allowed CORS origins for the backend API.";
|
|
};
|
|
|
|
cookieSecure = lib.mkOption {
|
|
type = lib.types.bool;
|
|
default = true;
|
|
description = "Whether auth cookies require HTTPS.";
|
|
};
|
|
|
|
cookieDomain = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "";
|
|
description = "Auth cookie domain. Empty means host-only cookies.";
|
|
};
|
|
|
|
cookieSameSite = lib.mkOption {
|
|
type = lib.types.enum [
|
|
"lax"
|
|
"none"
|
|
"strict"
|
|
];
|
|
default = "none";
|
|
description = "SameSite value for auth cookies.";
|
|
};
|
|
|
|
nginx = lib.mkOption {
|
|
type = lib.types.attrs;
|
|
default = { };
|
|
description = "Extra nginx virtual host options for the backend.";
|
|
};
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
assertions = [
|
|
{
|
|
assertion = cfg.backend.environmentFile != null;
|
|
message = "services.rabbi-gerzi.backend.environmentFile is required.";
|
|
}
|
|
{
|
|
assertion = cfg.backend.cookieSameSite != "none" || cfg.backend.cookieSecure;
|
|
message = "SameSite=None auth cookies require cookieSecure = true.";
|
|
}
|
|
{
|
|
assertion = cfg.database.name == cfg.database.user;
|
|
message = "Managed PostgreSQL database and user names must match.";
|
|
}
|
|
];
|
|
|
|
users.groups.${cfg.group} = { };
|
|
users.users.${cfg.user} = {
|
|
isSystemUser = true;
|
|
group = cfg.group;
|
|
home = cfg.stateDir;
|
|
};
|
|
users.users.${config.services.nginx.user}.extraGroups = [ cfg.group ];
|
|
|
|
services.postgresql = {
|
|
enable = true;
|
|
ensureDatabases = [ cfg.database.name ];
|
|
ensureUsers = [
|
|
{
|
|
name = cfg.database.user;
|
|
ensureDBOwnership = true;
|
|
}
|
|
];
|
|
};
|
|
|
|
services.borgbackup.jobs.rabbi-gerzi = {
|
|
paths = [
|
|
cfg.stateDir
|
|
databaseDumpPath
|
|
];
|
|
repo = "ssh://mgjjruz9@mgjjruz9.repo.borgbase.com/./repo";
|
|
user = "root";
|
|
group = "root";
|
|
encryption = {
|
|
mode = "repokey-blake2";
|
|
passCommand = "${pkgs.coreutils}/bin/cat ${cfg.secretFiles.borgPassphrase}";
|
|
};
|
|
doInit = true;
|
|
compression = "auto,zstd";
|
|
startAt = "*-*-* 05:15:00";
|
|
persistentTimer = true;
|
|
prune.keep = {
|
|
daily = 7;
|
|
weekly = 4;
|
|
monthly = 6;
|
|
};
|
|
readWritePaths = [ backupDir ];
|
|
environment.BORG_RSH = lib.concatStringsSep " " [
|
|
"ssh"
|
|
"-i ${cfg.secretFiles.borgPrivateKey}"
|
|
"-o IdentitiesOnly=yes"
|
|
"-o BatchMode=yes"
|
|
"-o StrictHostKeyChecking=accept-new"
|
|
"-o UserKnownHostsFile=/root/.config/borg/known_hosts"
|
|
];
|
|
preHook = ''
|
|
phpFpmWasActive=${phpFpmWasActivePath}
|
|
dumpFile=${databaseDumpPath}
|
|
|
|
if ${pkgs.systemd}/bin/systemctl is-active --quiet ${phpfpmService}.service; then
|
|
touch "$phpFpmWasActive"
|
|
${pkgs.systemd}/bin/systemctl stop ${phpfpmService}.service
|
|
else
|
|
rm -f "$phpFpmWasActive"
|
|
fi
|
|
|
|
rm -f "$dumpFile"
|
|
umask 077
|
|
${lib.getExe' pkgs.su "su"} \
|
|
-s ${pkgs.runtimeShell} \
|
|
${config.services.postgresql.superUser} \
|
|
-c '${databaseDumpCommand}' \
|
|
> "$dumpFile"
|
|
'';
|
|
postHook = ''
|
|
phpFpmWasActive=${phpFpmWasActivePath}
|
|
dumpFile=${databaseDumpPath}
|
|
|
|
rm -f "$dumpFile"
|
|
|
|
if [ -e "$phpFpmWasActive" ]; then
|
|
${pkgs.systemd}/bin/systemctl start ${phpfpmService}.service
|
|
rm -f "$phpFpmWasActive"
|
|
fi
|
|
'';
|
|
};
|
|
|
|
systemd.tmpfiles.rules =
|
|
(map makeDirectoryRule [
|
|
cfg.stateDir
|
|
cfg.cacheDir
|
|
storagePath
|
|
"${storagePath}/app"
|
|
"${storagePath}/app/private"
|
|
"${storagePath}/app/public"
|
|
"${storagePath}/framework"
|
|
"${storagePath}/framework/cache"
|
|
"${storagePath}/framework/cache/data"
|
|
"${storagePath}/framework/sessions"
|
|
"${storagePath}/framework/views"
|
|
"${storagePath}/logs"
|
|
cachePath
|
|
])
|
|
++ [ "d ${backupDir} 0700 root root - -" ];
|
|
|
|
services.phpfpm.pools.${poolName} = {
|
|
inherit (cfg) user group;
|
|
inherit phpPackage;
|
|
phpOptions = uploadLimits.phpOptions;
|
|
settings = {
|
|
"catch_workers_output" = true;
|
|
"clear_env" = "no";
|
|
"listen.group" = config.services.nginx.group;
|
|
"listen.mode" = "0660";
|
|
"listen.owner" = cfg.user;
|
|
"pm" = "dynamic";
|
|
"pm.max_children" = 16;
|
|
"pm.max_requests" = 500;
|
|
"pm.max_spare_servers" = 4;
|
|
"pm.min_spare_servers" = 1;
|
|
"pm.start_servers" = 2;
|
|
};
|
|
};
|
|
|
|
systemd.services.${setupService} = {
|
|
description = "Prepare Rabbi Gerzi backend";
|
|
wantedBy = [ "multi-user.target" ];
|
|
before = [ "${phpfpmService}.service" ];
|
|
after = [ "postgresql.service" ];
|
|
requires = [ "postgresql.service" ];
|
|
path = [ phpPackage ];
|
|
environment = appEnvironment;
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
RemainAfterExit = true;
|
|
User = cfg.user;
|
|
Group = cfg.group;
|
|
UMask = "0077";
|
|
WorkingDirectory = appDir;
|
|
EnvironmentFile = cfg.backend.environmentFile;
|
|
ReadWritePaths = [
|
|
cfg.stateDir
|
|
cfg.cacheDir
|
|
];
|
|
};
|
|
script = ''
|
|
${artisan} migrate --force
|
|
${artisan} rabbi-gerzi:ensure-initial-admin
|
|
'';
|
|
};
|
|
|
|
systemd.services.${phpfpmService} = {
|
|
after = [ "${setupService}.service" ];
|
|
requires = [ "${setupService}.service" ];
|
|
environment = appEnvironment;
|
|
serviceConfig = {
|
|
EnvironmentFile = cfg.backend.environmentFile;
|
|
KillSignal = "SIGQUIT";
|
|
ReadWritePaths = [
|
|
cfg.stateDir
|
|
cfg.cacheDir
|
|
];
|
|
};
|
|
};
|
|
|
|
systemd.services.borgbackup-job-rabbi-gerzi = {
|
|
after = [
|
|
"sops-install-secrets.service"
|
|
"network-online.target"
|
|
"postgresql.service"
|
|
"${setupService}.service"
|
|
];
|
|
wants = [
|
|
"network-online.target"
|
|
"postgresql.service"
|
|
"${setupService}.service"
|
|
];
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = lib.mkDefault true;
|
|
recommendedGzipSettings = lib.mkDefault true;
|
|
recommendedOptimisation = lib.mkDefault true;
|
|
recommendedProxySettings = lib.mkDefault true;
|
|
recommendedTlsSettings = lib.mkDefault true;
|
|
|
|
virtualHosts =
|
|
lib.genAttrs cfg.frontend.redirectHostNames (redirectHostName: {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
globalRedirect = cfg.frontend.hostName;
|
|
})
|
|
// {
|
|
${cfg.frontend.hostName} = lib.mkMerge [
|
|
cfg.frontend.nginx
|
|
{
|
|
root = "${frontendPackage}";
|
|
locations."/" = {
|
|
tryFiles = "$uri $uri/ /index.html";
|
|
};
|
|
}
|
|
];
|
|
|
|
${cfg.backend.hostName} = lib.mkMerge [
|
|
cfg.backend.nginx
|
|
{
|
|
root = "${appDir}/public";
|
|
extraConfig = ''
|
|
client_max_body_size ${uploadLimits.nginxClientMaxBodySize};
|
|
'';
|
|
locations = {
|
|
"/" = {
|
|
index = "index.php";
|
|
tryFiles = "$uri $uri/ /index.php?$query_string";
|
|
};
|
|
|
|
"/storage/" = {
|
|
alias = "${storagePath}/app/public/";
|
|
extraConfig = ''
|
|
expires 30d;
|
|
access_log off;
|
|
'';
|
|
};
|
|
|
|
"~ \\.php$" = {
|
|
extraConfig = ''
|
|
include ${pkgs.nginx}/conf/fastcgi_params;
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
fastcgi_pass unix:${config.services.phpfpm.pools.${poolName}.socket};
|
|
'';
|
|
};
|
|
};
|
|
}
|
|
];
|
|
};
|
|
};
|
|
};
|
|
}
|