think.greaterchiangmai.com is running on ramus
This commit is contained in:
292
modules/nixos/think-backend-gtcm.nix
Normal file
292
modules/nixos/think-backend-gtcm.nix
Normal file
@@ -0,0 +1,292 @@
|
||||
{
|
||||
config,
|
||||
pkgs,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.services.think-backend-greaterchiangmai;
|
||||
think-backend-gtcm = pkgs.think-backend-gtcm.override { dataDir = cfg.dataDir; };
|
||||
defaultUser = "gtcm";
|
||||
defaultGroup = "gtcm";
|
||||
|
||||
php = pkgs.php83;
|
||||
|
||||
artisan-be = pkgs.writeScriptBin "gtcm-be" ''
|
||||
#! ${pkgs.runtimeShell}
|
||||
cd ${think-backend-gtcm}
|
||||
sudo() {
|
||||
if [[ "$USER" != ${cfg.user} ]]; then
|
||||
exec /run/wrappers/bin/sudo -u ${cfg.user} "$@"
|
||||
else
|
||||
exec "$@"
|
||||
fi
|
||||
}
|
||||
sudo ${lib.getExe php} artisan "$@"
|
||||
'';
|
||||
|
||||
in
|
||||
{
|
||||
options.services.think-backend-greaterchiangmai = {
|
||||
enable = lib.mkEnableOption "To enable think.greaterchiangmai.com";
|
||||
|
||||
dataDir = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "/var/lib/think-backend.greaterchiangmai.com";
|
||||
description = ''A place where to store states'';
|
||||
};
|
||||
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = defaultUser;
|
||||
description = "User account under which this runs.";
|
||||
};
|
||||
|
||||
group = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = defaultGroup;
|
||||
defaultText = "${defaultGroup}";
|
||||
description = "Group under which the website runs.";
|
||||
};
|
||||
|
||||
package = lib.mkPackageOption pkgs "think-backend-gtcm" { };
|
||||
|
||||
domain = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "think-backend.greaterchiangmai.com";
|
||||
example = "forum.example.com";
|
||||
description = "Domain to serve on.";
|
||||
};
|
||||
|
||||
settings = lib.mkOption {
|
||||
type =
|
||||
with lib.types;
|
||||
attrsOf (
|
||||
nullOr (
|
||||
either
|
||||
(oneOf [
|
||||
bool
|
||||
int
|
||||
port
|
||||
path
|
||||
str
|
||||
])
|
||||
(submodule {
|
||||
options = {
|
||||
_secret = lib.mkOption {
|
||||
type = nullOr str;
|
||||
description = ''
|
||||
The path to a file containing the value the
|
||||
option should be set to in the final
|
||||
configuration file.
|
||||
'';
|
||||
};
|
||||
};
|
||||
})
|
||||
)
|
||||
);
|
||||
default = { };
|
||||
description = ''
|
||||
Options for settings environment variables
|
||||
'';
|
||||
example = lib.literalExpression ''
|
||||
{
|
||||
APP_NAME = "Laravel";
|
||||
APP_ENV = "local";
|
||||
APP_KEY = "key";
|
||||
APP_DEBUG = true;
|
||||
APP_URL = "http://localhost";
|
||||
|
||||
LOG_CHANNEL = "stack";
|
||||
LOG_DEPRECATIONS_CHANNEL = "null";
|
||||
LOG_LEVEL = "debug";
|
||||
|
||||
DB_CONNECTION = "mysql";
|
||||
DB_HOST = "127.0.0.1";
|
||||
DB_PORT = "3306";
|
||||
DB_DATABASE = "laravel";
|
||||
DB_USERNAME = "root";
|
||||
DB_PASSWORD = "";
|
||||
}
|
||||
'';
|
||||
};
|
||||
|
||||
};
|
||||
config = lib.mkIf cfg.enable {
|
||||
users.users.${cfg.user} = lib.mkForce {
|
||||
isSystemUser = true;
|
||||
home = cfg.dataDir;
|
||||
createHome = true;
|
||||
homeMode = "755";
|
||||
group = cfg.group;
|
||||
};
|
||||
users.groups.${cfg.group} = { };
|
||||
|
||||
services.phpfpm.pools.think-backend-gtcm = {
|
||||
inherit (cfg) user group;
|
||||
phpPackage = php;
|
||||
settings = {
|
||||
"listen.owner" = config.services.nginx.user;
|
||||
"listen.group" = config.services.nginx.group;
|
||||
"listen.mode" = "0600";
|
||||
"pm" = lib.mkDefault "dynamic";
|
||||
"pm.max_children" = lib.mkDefault 10;
|
||||
"pm.max_requests" = lib.mkDefault 500;
|
||||
"pm.start_servers" = lib.mkDefault 2;
|
||||
"pm.min_spare_servers" = lib.mkDefault 1;
|
||||
"pm.max_spare_servers" = lib.mkDefault 3;
|
||||
};
|
||||
phpOptions = ''
|
||||
error_log = syslog
|
||||
log_errors = on
|
||||
'';
|
||||
};
|
||||
|
||||
environment.systemPackages = [
|
||||
artisan-be
|
||||
];
|
||||
|
||||
services.think-backend-greaterchiangmai.settings = {
|
||||
APP_SERVICES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/services.php";
|
||||
APP_PACKAGES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/packages.php";
|
||||
APP_CONFIG_CACHE = lib.mkDefault "${cfg.dataDir}/cache/config.php";
|
||||
APP_ROUTES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/routes-v7.php";
|
||||
APP_EVENTS_CACHE = lib.mkDefault "${cfg.dataDir}/cache/events.php";
|
||||
};
|
||||
|
||||
systemd.services.think-backend-gtcm-setup = {
|
||||
description = "think-backend.greaterchiangmai installation";
|
||||
requiredBy = [ "phpfpm-think-backend-gtcm.service" ];
|
||||
before = [ "phpfpm-think-backend-gtcm.service" ];
|
||||
requires = [ "mysql.service" ];
|
||||
after = [ "mysql.service" ];
|
||||
serviceConfig = {
|
||||
type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
User = cfg.user;
|
||||
UMask = 77;
|
||||
WorkingDirectory = "${think-backend-gtcm}";
|
||||
RuntimeDirectory = "think-backend-gtcm/cache";
|
||||
RuntimeDirectoryMode = 700;
|
||||
};
|
||||
path = [ pkgs.replace-secret ];
|
||||
script =
|
||||
let
|
||||
isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
|
||||
gtcmEnvVars = lib.generators.toKeyValue {
|
||||
mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
|
||||
mkValueString =
|
||||
v:
|
||||
with builtins;
|
||||
if isInt v then
|
||||
toString v
|
||||
else if isString v then
|
||||
v
|
||||
else if true == v then
|
||||
"true"
|
||||
else if false == v then
|
||||
"false"
|
||||
else if isSecret v then
|
||||
hashString "sha256" v._secret
|
||||
else
|
||||
throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
|
||||
};
|
||||
};
|
||||
secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.settings);
|
||||
mkSecretReplacement = file: ''
|
||||
replace-secret ${
|
||||
lib.escapeShellArgs [
|
||||
(builtins.hashString "sha256" file)
|
||||
file
|
||||
"${cfg.dataDir}/.env"
|
||||
]
|
||||
}
|
||||
'';
|
||||
secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
|
||||
filteredConfig = lib.converge (lib.filterAttrsRecursive (
|
||||
_: v:
|
||||
!lib.elem v [
|
||||
{ }
|
||||
null
|
||||
]
|
||||
)) cfg.settings;
|
||||
gtcmEnv = pkgs.writeText "gtcm-be.env" (gtcmEnvVars filteredConfig);
|
||||
in
|
||||
''
|
||||
# error handling
|
||||
set -euo pipefail
|
||||
|
||||
# create .env file
|
||||
install -T -m 0600 -o ${cfg.user} ${gtcmEnv} "${cfg.dataDir}/.env"
|
||||
${secretReplacements}
|
||||
if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
|
||||
sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
|
||||
fi
|
||||
|
||||
# migrate & seed db
|
||||
${lib.getExe php} artisan key:generate --force
|
||||
${lib.getExe php} artisan migrate --force
|
||||
${lib.getExe php} artisan config:cache
|
||||
'';
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"d ${cfg.dataDir} 0710 ${cfg.user} ${cfg.group} - -"
|
||||
"d ${cfg.dataDir}/cache 0700 ${cfg.user} ${cfg.group} - -"
|
||||
"d ${cfg.dataDir}/public 0750 ${cfg.user} ${cfg.group} - -"
|
||||
"d ${cfg.dataDir}/public/uploads 0750 ${cfg.user} ${cfg.group} - -"
|
||||
"d ${cfg.dataDir}/storage 0700 ${cfg.user} ${cfg.group} - -"
|
||||
"d ${cfg.dataDir}/storage/app 0700 ${cfg.user} ${cfg.group} - -"
|
||||
"d ${cfg.dataDir}/storage/fonts 0700 ${cfg.user} ${cfg.group} - -"
|
||||
"d ${cfg.dataDir}/storage/framework 0700 ${cfg.user} ${cfg.group} - -"
|
||||
"d ${cfg.dataDir}/storage/framework/cache 0700 ${cfg.user} ${cfg.group} - -"
|
||||
"d ${cfg.dataDir}/storage/framework/sessions 0700 ${cfg.user} ${cfg.group} - -"
|
||||
"d ${cfg.dataDir}/storage/framework/views 0700 ${cfg.user} ${cfg.group} - -"
|
||||
"d ${cfg.dataDir}/storage/logs 0700 ${cfg.user} ${cfg.group} - -"
|
||||
"d ${cfg.dataDir}/storage/uploads 0700 ${cfg.user} ${cfg.group} - -"
|
||||
];
|
||||
|
||||
networking.firewall.allowedTCPPorts = [
|
||||
80
|
||||
443
|
||||
];
|
||||
|
||||
services.nginx = {
|
||||
enable = true;
|
||||
recommendedTlsSettings = true;
|
||||
recommendedOptimisation = true;
|
||||
recommendedGzipSettings = true;
|
||||
recommendedBrotliSettings = true;
|
||||
recommendedProxySettings = true;
|
||||
virtualHosts."${cfg.domain}" = {
|
||||
root = "${think-backend-gtcm}/public";
|
||||
locations = {
|
||||
"/" = {
|
||||
index = "index.php";
|
||||
tryFiles = "$uri $uri/ /index.php?$query_string";
|
||||
};
|
||||
"~ \\.php$".extraConfig = ''
|
||||
fastcgi_pass unix:${config.services.phpfpm.pools."think-backend-gtcm".socket};
|
||||
'';
|
||||
"~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
|
||||
extraConfig = "expires 365d;";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
services.mysql = {
|
||||
enable = true;
|
||||
package = lib.mkForce pkgs.mariadb;
|
||||
ensureDatabases = [ cfg.settings.DB_DATABASE ];
|
||||
ensureUsers = [
|
||||
{
|
||||
name = cfg.settings.DB_USERNAME;
|
||||
ensurePermissions = {
|
||||
"${cfg.settings.DB_DATABASE}.*" = "ALL PRIVILEGES";
|
||||
};
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in New Issue
Block a user