131 lines
3.8 KiB
Nix
131 lines
3.8 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
{
|
|
services.discourse = {
|
|
enable = true;
|
|
admin = {
|
|
email = "yisroel.d.baum@gmail.com";
|
|
fullName = "Yisroel Baum";
|
|
passwordFile = config.sops.secrets."discourse-admin-password".path;
|
|
username = "yisroeldbaum";
|
|
};
|
|
database.ignorePostgresqlVersion = true;
|
|
hostname = "discourse.torahimderecheretz.com";
|
|
mail = {
|
|
notificationEmailAddress = "system@torahimderecheretz.com";
|
|
contactEmailAddress = "system@torahimderecheretz.com";
|
|
|
|
outgoing = {
|
|
serverAddress = "in-v3.mailjet.com";
|
|
port = 587;
|
|
username = "1ebdd73d944240c1a9c3201e52a1e8c6";
|
|
passwordFile = config.sops.secrets."discourse-mail-key".path;
|
|
authentication = "login";
|
|
};
|
|
};
|
|
secretKeyBaseFile = config.sops.secrets."discourse-secret-key".path;
|
|
siteSettings = {
|
|
required = {
|
|
title = "Torah Im Derech Eretz";
|
|
site_description = "A forum to discuss the ideas of Rav Shamshon Refael Hirsch";
|
|
};
|
|
};
|
|
};
|
|
|
|
services.borgbackup.jobs.discourse = {
|
|
paths = [
|
|
"/var/lib/discourse"
|
|
"/var/backup/discourse/discourse.dump"
|
|
];
|
|
repo = "ssh://oas17j8p@oas17j8p.repo.borgbase.com/./repo";
|
|
user = "root";
|
|
group = "root";
|
|
encryption = {
|
|
mode = "repokey-blake2";
|
|
passCommand = "${pkgs.coreutils}/bin/cat ${config.sops.secrets."borg-passphrase".path}";
|
|
};
|
|
doInit = true;
|
|
compression = "auto,zstd";
|
|
startAt = "*-*-* 07:15:00";
|
|
persistentTimer = true;
|
|
prune.keep = {
|
|
daily = 7;
|
|
weekly = 4;
|
|
monthly = 6;
|
|
};
|
|
readWritePaths = [ "/var/backup/discourse" ];
|
|
environment.BORG_RSH = "ssh -i ${config.sops.secrets."borg-private-key".path} -o IdentitiesOnly=yes -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o UserKnownHostsFile=/root/.config/borg/known_hosts";
|
|
preHook = ''
|
|
discourseWasActive=/root/.cache/borg/discourse-was-active
|
|
dumpFile=/var/backup/discourse/discourse.dump
|
|
|
|
if ${pkgs.systemd}/bin/systemctl is-active --quiet discourse.service; then
|
|
touch "$discourseWasActive"
|
|
${pkgs.systemd}/bin/systemctl stop discourse.service
|
|
else
|
|
rm -f "$discourseWasActive"
|
|
fi
|
|
|
|
rm -f "$dumpFile"
|
|
umask 077
|
|
${lib.getExe' pkgs.su "su"} -s ${pkgs.runtimeShell} ${config.services.postgresql.superUser} -c '${config.services.postgresql.package}/bin/pg_dump --format=custom --dbname=${config.services.discourse.database.name}' > "$dumpFile"
|
|
'';
|
|
postHook = ''
|
|
discourseWasActive=/root/.cache/borg/discourse-was-active
|
|
dumpFile=/var/backup/discourse/discourse.dump
|
|
|
|
rm -f "$dumpFile"
|
|
|
|
if [ -e "$discourseWasActive" ]; then
|
|
${pkgs.systemd}/bin/systemctl start discourse.service
|
|
rm -f "$discourseWasActive"
|
|
fi
|
|
'';
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/backup/discourse 0700 root root - -"
|
|
];
|
|
|
|
systemd.services.borgbackup-job-discourse = {
|
|
after = [
|
|
"sops-install-secrets.service"
|
|
"network-online.target"
|
|
"postgresql.target"
|
|
"discourse-postgresql.service"
|
|
];
|
|
wants = [
|
|
"network-online.target"
|
|
"postgresql.target"
|
|
"discourse-postgresql.service"
|
|
];
|
|
};
|
|
|
|
sops.secrets = {
|
|
"discourse-admin-password" = {
|
|
sopsFile = ./secrets/discourseAdminPassword.yaml;
|
|
mode = "0400";
|
|
key = "password";
|
|
owner = "discourse";
|
|
group = "discourse";
|
|
};
|
|
"discourse-secret-key" = {
|
|
sopsFile = ./secrets/discourseSecretKey.yaml;
|
|
mode = "0400";
|
|
key = "key";
|
|
owner = "discourse";
|
|
group = "discourse";
|
|
};
|
|
"discourse-mail-key" = {
|
|
sopsFile = ./secrets/discourseMailKey.yaml;
|
|
mode = "0400";
|
|
key = "key";
|
|
owner = "discourse";
|
|
group = "discourse";
|
|
};
|
|
};
|
|
}
|