77 lines
2.4 KiB
Nix
77 lines
2.4 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
}:
|
|
|
|
let
|
|
frontendConfig = config.services.rabbi-gerzi.frontend;
|
|
backendConfig = config.services.rabbi-gerzi.backend;
|
|
frontendVirtualHost = config.services.nginx.virtualHosts.${frontendConfig.hostName};
|
|
backendVirtualHost = config.services.nginx.virtualHosts.${backendConfig.hostName};
|
|
redirectVirtualHost = lib.attrByPath [
|
|
"www.rabbigerzi.com"
|
|
] { } config.services.nginx.virtualHosts;
|
|
|
|
assertions = [
|
|
{
|
|
assertion = frontendConfig.hostName == "rabbigerzi.com";
|
|
message = "Rabbi Gerzi frontend does not use the production domain";
|
|
}
|
|
{
|
|
assertion = frontendConfig.apiBaseUrl == "https://api.rabbigerzi.com";
|
|
message = "Rabbi Gerzi frontend does not use the production API";
|
|
}
|
|
{
|
|
assertion = frontendConfig.redirectHostNames == [ "www.rabbigerzi.com" ];
|
|
message = "Rabbi Gerzi frontend redirect hosts are not configured";
|
|
}
|
|
{
|
|
assertion = backendConfig.hostName == "api.rabbigerzi.com";
|
|
message = "Rabbi Gerzi backend does not use the production API domain";
|
|
}
|
|
{
|
|
assertion =
|
|
backendConfig.corsAllowedOrigins == [
|
|
"https://rabbigerzi.com"
|
|
"https://rabbigerzi.yisroelbaum.com"
|
|
];
|
|
message = "Rabbi Gerzi CORS origins do not cover production and staging";
|
|
}
|
|
{
|
|
assertion = builtins.elem "rabbigerzi.yisroelbaum.com" frontendVirtualHost.serverAliases;
|
|
message = "Rabbi Gerzi frontend staging alias is missing";
|
|
}
|
|
{
|
|
assertion = builtins.elem "rabbigerziapi.yisroelbaum.com" backendVirtualHost.serverAliases;
|
|
message = "Rabbi Gerzi backend staging alias is missing";
|
|
}
|
|
{
|
|
assertion = redirectVirtualHost.globalRedirect or null == "rabbigerzi.com";
|
|
message = "Rabbi Gerzi www host does not redirect to the apex";
|
|
}
|
|
{
|
|
assertion = redirectVirtualHost.forceSSL or false;
|
|
message = "Rabbi Gerzi www redirect does not force HTTPS";
|
|
}
|
|
{
|
|
assertion = redirectVirtualHost.enableACME or false;
|
|
message = "Rabbi Gerzi www redirect does not enable ACME";
|
|
}
|
|
];
|
|
|
|
failedAssertions = lib.filter (assertion: !assertion.assertion) assertions;
|
|
in
|
|
pkgs.runCommand "rabbi-gerzi-production-domains"
|
|
{
|
|
failures = lib.concatMapStringsSep "\n" (assertion: assertion.message) failedAssertions;
|
|
preferLocalBuild = true;
|
|
}
|
|
''
|
|
if [ -n "$failures" ]; then
|
|
printf '%s\n' "$failures" >&2
|
|
exit 1
|
|
fi
|
|
|
|
touch $out
|
|
''
|