65 lines
1.6 KiB
Nix
65 lines
1.6 KiB
Nix
|
{ config, depot, lib, ... }:
|
||
|
|
|
||
|
|
let
|
||
|
|
inherit (depot.ops) secrets;
|
||
|
|
pkg = depot.web.quotes;
|
||
|
|
|
||
|
|
sock = "/run/quotesdb/gunicorn.sock";
|
||
|
|
in
|
||
|
|
{
|
||
|
|
config = {
|
||
|
|
security.acme = {
|
||
|
|
acceptTerms = true;
|
||
|
|
email = lib.mkDefault "letsencrypt@lukegb.com";
|
||
|
|
certs."bfob.gg" = {
|
||
|
|
group = config.services.nginx.group;
|
||
|
|
dnsProvider = "cloudflare";
|
||
|
|
credentialsFile = secrets.cloudflareCredentials;
|
||
|
|
extraDomainNames = ["*.bfob.gg"];
|
||
|
|
};
|
||
|
|
};
|
||
|
|
services.nginx = {
|
||
|
|
enable = lib.mkDefault true;
|
||
|
|
virtualHosts."qdb.bfob.gg" = {
|
||
|
|
useACMEHost = "bfob.gg";
|
||
|
|
globalRedirect = "quotes.bfob.gg";
|
||
|
|
forceSSL = true;
|
||
|
|
};
|
||
|
|
virtualHosts."quotes.bfob.gg" = {
|
||
|
|
useACMEHost = "bfob.gg";
|
||
|
|
forceSSL = true;
|
||
|
|
locations."/static" = {
|
||
|
|
root = "${pkg}/share";
|
||
|
|
};
|
||
|
|
locations."/" = {
|
||
|
|
proxyPass = "http://unix:${sock}";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
services.postgresql = {
|
||
|
|
enable = lib.mkDefault true;
|
||
|
|
ensureDatabases = lib.mkAfter [ "quotesdb" ];
|
||
|
|
ensureUsers = lib.mkAfter [{
|
||
|
|
name = "quotesdb";
|
||
|
|
ensurePermissions = {
|
||
|
|
"DATABASE quotesdb" = "ALL PRIVILEGES";
|
||
|
|
};
|
||
|
|
}];
|
||
|
|
};
|
||
|
|
|
||
|
|
systemd.services.quotesdb = {
|
||
|
|
wantedBy = [ "multi-user.target" ];
|
||
|
|
after = [ "network.target" ];
|
||
|
|
serviceConfig = {
|
||
|
|
EnvironmentFile = secrets.quotesdb.environment;
|
||
|
|
RuntimeDirectory = "quotesdb";
|
||
|
|
ExecStart = "${pkg}/bin/quotes --workers 3 --bind unix:${sock}";
|
||
|
|
DynamicUser = true;
|
||
|
|
Group = "nginx";
|
||
|
|
UMask = "0007";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
}
|