95 lines
2.4 KiB
Nix
95 lines
2.4 KiB
Nix
{ config, options, depot, lib, ... }:
|
|
|
|
let
|
|
inherit (depot.ops) secrets;
|
|
pkg = depot.web.quotes;
|
|
|
|
sock = "/run/quotesdb/gunicorn.sock";
|
|
in
|
|
{
|
|
options = with lib; {
|
|
my.quotesdb.listen = lib.mkOption {
|
|
type = with types; listOf str;
|
|
default = [ "127.0.0.1" "[::1]" ];
|
|
};
|
|
};
|
|
|
|
config = let
|
|
nginxListen = (map (addr: {
|
|
inherit addr;
|
|
port = 80;
|
|
ssl = false;
|
|
}) config.my.quotesdb.listen) ++ (map (addr: {
|
|
inherit addr;
|
|
port = 443;
|
|
ssl = true;
|
|
}) config.my.quotesdb.listen);
|
|
in {
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
email = lib.mkDefault "letsencrypt@lukegb.com";
|
|
certs."bfob.gg" = {
|
|
group = config.services.nginx.group;
|
|
dnsProvider = "cloudflare";
|
|
credentialsFile = secrets.cloudflareCredentials;
|
|
extraDomainNames = ["*.bfob.gg"];
|
|
};
|
|
};
|
|
services.nginx = {
|
|
enable = lib.mkDefault true;
|
|
virtualHosts."qdb.bfob.gg" = {
|
|
listen = nginxListen;
|
|
useACMEHost = "bfob.gg";
|
|
globalRedirect = "quotes.bfob.gg";
|
|
forceSSL = true;
|
|
};
|
|
virtualHosts."quotes.bfob.gg" = {
|
|
listen = nginxListen;
|
|
useACMEHost = "bfob.gg";
|
|
forceSSL = true;
|
|
locations."/static" = {
|
|
root = "${pkg}/share";
|
|
};
|
|
locations."/" = {
|
|
proxyPass = "http://unix:${sock}";
|
|
};
|
|
};
|
|
virtualHosts."dev-quotes.bfob.gg" = {
|
|
listen = nginxListen;
|
|
useACMEHost = "bfob.gg";
|
|
forceSSL = true;
|
|
locations."/" = {
|
|
proxyPass = "http://127.0.0.1:8000";
|
|
};
|
|
};
|
|
};
|
|
|
|
services.postgresql = {
|
|
enable = lib.mkDefault true;
|
|
ensureDatabases = lib.mkAfter [ "quotesdb" ];
|
|
ensureUsers = lib.mkAfter [{
|
|
name = "quotesdb";
|
|
ensurePermissions = {
|
|
"DATABASE quotesdb" = "ALL PRIVILEGES";
|
|
};
|
|
}];
|
|
};
|
|
|
|
systemd.services.quotesdb = {
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network.target" ];
|
|
environment.DJANGO_SETTINGS_MODULE = "quotes.quotesapp.prod_settings";
|
|
preStart = ''
|
|
${pkg}/bin/quotes-manage migrate --no-input
|
|
'';
|
|
serviceConfig = {
|
|
EnvironmentFile = secrets.quotesdb.environment;
|
|
RuntimeDirectory = "quotesdb";
|
|
ExecStart = "${pkg}/bin/quotes --workers 3 --bind unix:${sock}";
|
|
DynamicUser = true;
|
|
Group = "nginx";
|
|
UMask = "0007";
|
|
};
|
|
};
|
|
};
|
|
}
|