depot/ops/nixos/lib/quotes.bfob.gg.nix

{ config, options, depot, lib, ... }:

let
  inherit (depot.ops) secrets;
  pkg = depot.web.quotes;

  sock = "/run/quotesdb/gunicorn.sock";
in
{
  options = with lib; {
    my.quotesdb.listen = lib.mkOption {
      type = with types; listOf str;
      default = [ "127.0.0.1" "[::1]" ];
    };
  };

  config = let
    nginxListen = (map (addr: {
      inherit addr;
      port = 80;
      ssl = false;
    }) config.my.quotesdb.listen) ++ (map (addr: {
      inherit addr;
      port = 443;
      ssl = true;
    }) config.my.quotesdb.listen);
  in {
    my.vault.acmeCertificates.bfob = {
      hostnames = [ "bfob.gg" "*.bfob.gg" ];
      nginxVirtualHosts = [ "qdb.bfob.gg" "quotes.bfob.gg" "dev-quotes.bfob.gg" ];
    };
    services.nginx = {
      enable = lib.mkDefault true;
      virtualHosts."qdb.bfob.gg" = {
        listen = nginxListen;
        globalRedirect = "quotes.bfob.gg";
        forceSSL = true;
      };
      virtualHosts."quotes.bfob.gg" = {
        listen = nginxListen;
        forceSSL = true;
        locations."/static" = {
          root = "${pkg}/share";
        };
        locations."/" = {
          proxyPass = "http://unix:${sock}";
        };
      };
      virtualHosts."dev-quotes.bfob.gg" = {
        listen = nginxListen;
        forceSSL = true;
        locations."/" = {
          proxyPass = "http://127.0.0.1:8000";
        };
      };
    };

    services.postgresql = {
      enable = lib.mkDefault true;
      ensureDatabases = lib.mkAfter [ "quotesdb" ];
      ensureUsers = lib.mkAfter [{
        name = "quotesdb";
        ensurePermissions = {
          "DATABASE quotesdb" = "ALL PRIVILEGES";
        };
      }];
    };

    users.users.quotesdb = {
      isSystemUser = true;
      group = "nginx";
    };
    users.groups.quotesdb = {};

    systemd.services.quotesdb = {
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      environment.DJANGO_SETTINGS_MODULE = "quotes.quotesapp.prod_settings";
      preStart = ''
        ${pkg}/bin/quotes-manage migrate --no-input
      '';
      serviceConfig = {
        EnvironmentFile = config.my.vault.secrets.quotesdb-environment.path;
        RuntimeDirectory = "quotesdb";
        ExecStart = "${pkg}/bin/quotes --workers 3 --bind unix:${sock}";
        User = "quotesdb";
        Group = "nginx";
        UMask = "0007";
      };
    };

    my.vault.secrets.quotesdb-environment = {
      reloadOrRestartUnits = ["quotesdb.service"];
      group = "root";
      template = ''
        {{ with secret "kv/apps/quotesdb" }}
        {{ .Data.data.environment }}
        {{ end }}
      '';
    };
  };
}