374 lines
12 KiB
Nix
374 lines
12 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.think-greaterchiangmai;
|
|
think-gtcm = pkgs.think-gtcm.override { dataDir = cfg.dataDir; };
|
|
think-backend-gtcm = pkgs.think-backend-gtcm.override { dataDir = cfg.dataDir; };
|
|
defaultUser = "gtcm";
|
|
defaultGroup = "gtcm";
|
|
|
|
php = pkgs.php83;
|
|
|
|
artisan = pkgs.writeShellScript "gtcm" ''
|
|
#! #{pkgs.runtimeShell}
|
|
cd ${think-gtcm}
|
|
sudo() {
|
|
if [[ "$USER" != ${cfg.user} ]]; then
|
|
exec /run/wrappers/bin/sudo -u ${cfg.user} "$@"
|
|
else
|
|
exec "$@"
|
|
fi
|
|
}
|
|
sudo ${php} artisan "$@"
|
|
'';
|
|
artisan-be = pkgs.writeShellScript "gtcm-be" ''
|
|
#! #{pkgs.runtimeShell}
|
|
cd ${think-gtcm}
|
|
sudo() {
|
|
if [[ "$USER" != ${cfg.user} ]]; then
|
|
exec /run/wrappers/bin/sudo -u ${cfg.user} "$@"
|
|
else
|
|
exec "$@"
|
|
fi
|
|
}
|
|
sudo ${php} artisan "$@"
|
|
'';
|
|
|
|
in
|
|
{
|
|
options.services.think-greaterchiangmai = {
|
|
enable = lib.mkEnableOption "To enable think.greaterchiangmai.com";
|
|
|
|
dataDir = lib.mkOption {
|
|
type = lib.types.path;
|
|
default = "/var/lib/think.greaterchiangmai.com";
|
|
description = ''A place where to store states'';
|
|
};
|
|
|
|
user = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = defaultUser;
|
|
description = "User account under which this runs.";
|
|
};
|
|
|
|
group = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = defaultGroup;
|
|
defaultText = "${defaultGroup}";
|
|
description = ''
|
|
Group under which the website runs.
|
|
'';
|
|
};
|
|
|
|
package = lib.mkPackageOption pkgs "think-gtcm" { };
|
|
|
|
packageBackend = lib.mkPackageOption pkgs "think-backend-gtcm" { };
|
|
|
|
domain = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "think.greaterchiangmai.com";
|
|
example = "forum.example.com";
|
|
description = "Domain to serve on.";
|
|
};
|
|
|
|
backendDomain = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "think-backend.greaterchiangmai.com";
|
|
example = "forum.example.com";
|
|
description = "Backend Domain to serve on.";
|
|
};
|
|
|
|
settings = lib.mkOption {
|
|
lib.type =
|
|
with lib.types;
|
|
attrsOf (
|
|
nullOr (
|
|
either
|
|
(oneOf [
|
|
bool
|
|
int
|
|
port
|
|
path
|
|
str
|
|
])
|
|
(submodule {
|
|
options = {
|
|
_secret = mkOption {
|
|
type = nullOr str;
|
|
description = ''
|
|
The path to a file containing the value the
|
|
option should be set to in the final
|
|
configuration file.
|
|
'';
|
|
};
|
|
};
|
|
})
|
|
)
|
|
);
|
|
default = { };
|
|
description = ''
|
|
Options for settings environment variables
|
|
'';
|
|
example = lib.literalExpression ''
|
|
{
|
|
APP_NAME = "Laravel";
|
|
APP_ENV = "local";
|
|
APP_KEY = "key";
|
|
APP_DEBUG = true;
|
|
APP_URL = "http://localhost";
|
|
|
|
LOG_CHANNEL = "stack";
|
|
LOG_DEPRECATIONS_CHANNEL = "null";
|
|
LOG_LEVEL = "debug";
|
|
|
|
DB_CONNECTION = "mysql";
|
|
DB_HOST = "127.0.0.1";
|
|
DB_PORT = "3306";
|
|
DB_DATABASE = "laravel";
|
|
DB_USERNAME = "root";
|
|
DB_PASSWORD = "";
|
|
}
|
|
'';
|
|
type = lib.types.submodule {
|
|
freeformType = lib.types.attrsOf (
|
|
lib.types.oneOf [
|
|
lib.types.str
|
|
lib.types.int
|
|
lib.types.bool
|
|
]
|
|
);
|
|
options = {
|
|
DB_CONNECTION = lib.mkOption {
|
|
type = lib.types.enum [
|
|
"mysql"
|
|
];
|
|
default = "mysql";
|
|
example = "mysql";
|
|
description = ''
|
|
The type of database you wish to use. only "mysql".
|
|
'';
|
|
};
|
|
DB_HOST = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = if cfg.settings.DB_CONNECTION == "pgsql" then "/run/postgresql" else "localhost";
|
|
defaultText = ''
|
|
"localhost" if DB_CONNECTION is "sqlite" or "mysql", "/run/postgresql" if "pgsql".
|
|
'';
|
|
description = ''
|
|
The machine which hosts your database. This is left at the
|
|
default value for "mysql" because we use the "DB_SOCKET" option
|
|
to connect to a unix socket instead. "pgsql" requires that the
|
|
unix socket location be specified here instead of at "DB_SOCKET".
|
|
This option does not affect "sqlite".
|
|
'';
|
|
};
|
|
DB_PORT = lib.mkOption {
|
|
type = lib.types.nullOr lib.types.int;
|
|
default =
|
|
if cfg.settings.DB_CONNECTION == "pgsql" then
|
|
5432
|
|
else if cfg.settings.DB_CONNECTION == "mysql" then
|
|
3306
|
|
else
|
|
null;
|
|
defaultText = ''
|
|
`null` if DB_CONNECTION is "sqlite", `3306` if "mysql", `5432` if "pgsql"
|
|
'';
|
|
description = ''
|
|
The port your database is listening at. sqlite does not require
|
|
this value to be filled.
|
|
'';
|
|
};
|
|
DB_DATABASE = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "thinkgreatercm";
|
|
};
|
|
DB_USERNAME = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "thinkgreatercm";
|
|
};
|
|
DB_PASSWORD = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "thinkgreatercm";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
};
|
|
config = lib.mkIf cfg.enable {
|
|
users.users.${cfg.user} = {
|
|
isSystemUser = true;
|
|
home = cfg.dataDir;
|
|
createHome = true;
|
|
homeMode = "755";
|
|
group = cfg.group;
|
|
};
|
|
users.groups.${cfg.group} = { };
|
|
|
|
services.phpfpm.pools.think-gtcm = {
|
|
inherit (cfg) user group;
|
|
phpPackage = php;
|
|
settings = {
|
|
"listen.owner" = cfg.user;
|
|
"listen.group" = cfg.group;
|
|
"listen.mode" = "0600";
|
|
"pm" = lib.mkDefault "dynamic";
|
|
"pm.max_children" = lib.mkDefault 10;
|
|
"pm.max_requests" = lib.mkDefault 500;
|
|
"pm.start_servers" = lib.mkDefault 2;
|
|
"pm.min_spare_servers" = lib.mkDefault 1;
|
|
"pm.max_spare_servers" = lib.mkDefault 3;
|
|
};
|
|
phpOptions = ''
|
|
error_log = syslog
|
|
log_errors = on
|
|
'';
|
|
};
|
|
|
|
systemd.services.think-gtcm-setup = {
|
|
description = "think.greaterchiangmai installation";
|
|
requiredBy = [ "phpfpm-think-gtcm.service" ];
|
|
before = [ "phpfpm-think-gtcm.service" ];
|
|
requires = [ "mysql.service" ];
|
|
after = [ "mysql.service" ];
|
|
serviceConfig = {
|
|
type = "oneshot";
|
|
RemainAfterExit = true;
|
|
User = cfg.user;
|
|
UMask = 77;
|
|
WorkingDirectory = "${think-gtcm}";
|
|
RuntimeDirectory = "think-gtcm/cache";
|
|
RuntimeDirectoryMode = 700;
|
|
};
|
|
path = [ pkgs.replace-secret ];
|
|
script =
|
|
let
|
|
isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
|
|
gtcmEnvVars = lib.generators.toKeyValue {
|
|
mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
|
|
mkValueString =
|
|
v:
|
|
with builtins;
|
|
if isInt v then
|
|
toString v
|
|
else if isString v then
|
|
v
|
|
else if true == v then
|
|
"true"
|
|
else if false == v then
|
|
"false"
|
|
else if isSecret v then
|
|
hashString "sha256" v._secret
|
|
else
|
|
throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
|
|
};
|
|
};
|
|
secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.config);
|
|
mkSecretReplacement = file: ''
|
|
replace-secret ${
|
|
lib.escapeShellArgs [
|
|
(builtins.hashString "sha256" file)
|
|
file
|
|
"${cfg.dataDir}/.env"
|
|
]
|
|
}
|
|
'';
|
|
secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
|
|
filteredConfig = lib.converge (lib.filterAttrsRecursive (
|
|
_: v:
|
|
!lib.elem v [
|
|
{ }
|
|
null
|
|
]
|
|
)) cfg.settings;
|
|
gtcmEnv = pkgs.writeText "gtcm.env" (gtcmEnvVars filteredConfig);
|
|
in
|
|
''
|
|
# error handling
|
|
set -euo pipefail
|
|
|
|
# create .env file
|
|
install -T -m 0600 -o ${cfg.user} ${gtcmEnv} "${cfg.dataDir}/.env"
|
|
${secretReplacements}
|
|
if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
|
|
sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
|
|
fi
|
|
|
|
# migrate & seed db
|
|
${php} artisan key:generate --force
|
|
${php} artisan migrate --force
|
|
${php} artisan config:cache
|
|
'';
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d ${cfg.dataDir} 0710 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/public 0750 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/public/uploads 0750 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/app 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/fonts 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/framework 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/framework/cache 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/framework/sessions 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/framework/views 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/logs 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/uploads 0700 ${cfg.user} ${cfg.group} - -"
|
|
];
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
recommendedTlsSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedGzipSettings = true;
|
|
recommendedBrotliSettings = true;
|
|
recommendedProxySettings = true;
|
|
virtualHosts."${cfg.domain}" = {
|
|
root = "${cfg.package}/share/php/think-gtcm/public";
|
|
locations = {
|
|
"/" = {
|
|
index = "index.php";
|
|
tryFiles = "$uri $uri/ /index.php?$query_string";
|
|
};
|
|
|
|
"~ \\.php$".extraConfig = ''
|
|
fastcgi_pass unix:${config.services.phpfpm.pools."think-gtcm".socket};
|
|
'';
|
|
"~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
|
|
extraConfig = "expires 365d;";
|
|
};
|
|
};
|
|
};
|
|
# virtualHosts."${cfg.backendDomain}" = {
|
|
# root = "${cfg.packageBackend}/share/php/think-backend-gtcm/public";
|
|
# locations."~ \\.php$".extraConfig = ''
|
|
# fastcgi_pass unix:${config.services.phpfpm.pools.think-greaterchiangmai.socket};
|
|
# fastcgi_index index.php;
|
|
# '';
|
|
# extraConfig = ''
|
|
# index index.php;
|
|
# '';
|
|
# };
|
|
};
|
|
|
|
services.mysql = {
|
|
enable = true;
|
|
package = pkgs.mariadb;
|
|
ensureDatabases = [ cfg.settings.DB_DATABASE ];
|
|
ensureUsers = [
|
|
{
|
|
name = cfg.settings.DB_USERNAME;
|
|
ensurePermissions = {
|
|
"${cfg.settings.DB_DATABASE}.*" = "ALL PRIVILEGES";
|
|
};
|
|
}
|
|
];
|
|
};
|
|
};
|
|
}
|