296 lines
9.0 KiB
Nix
296 lines
9.0 KiB
Nix
{
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.services.think-greaterchiangmai;
|
|
think-gtcm = pkgs.think-gtcm.override { dataDir = cfg.dataDir; };
|
|
defaultUser = "gtcm";
|
|
defaultGroup = "gtcm";
|
|
|
|
php = pkgs.php83;
|
|
|
|
artisan = pkgs.writeScriptBin "gtcm" ''
|
|
#! ${pkgs.runtimeShell}
|
|
cd ${think-gtcm}
|
|
sudo() {
|
|
if [[ "$USER" != ${cfg.user} ]]; then
|
|
exec /run/wrappers/bin/sudo -u ${cfg.user} "$@"
|
|
else
|
|
exec "$@"
|
|
fi
|
|
}
|
|
sudo ${lib.getExe php} artisan "$@"
|
|
'';
|
|
|
|
in
|
|
{
|
|
options.services.think-greaterchiangmai = {
|
|
enable = lib.mkEnableOption "To enable think.greaterchiangmai.com";
|
|
|
|
dataDir = lib.mkOption {
|
|
type = lib.types.path;
|
|
default = "/var/lib/think.greaterchiangmai.com";
|
|
description = ''A place where to store states'';
|
|
};
|
|
|
|
user = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = defaultUser;
|
|
description = "User account under which this runs.";
|
|
};
|
|
|
|
group = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = defaultGroup;
|
|
defaultText = "${defaultGroup}";
|
|
description = "Group under which the website runs.";
|
|
};
|
|
|
|
package = lib.mkPackageOption pkgs "think-gtcm" { };
|
|
|
|
packageBackend = lib.mkPackageOption pkgs "think-backend-gtcm" { };
|
|
|
|
domain = lib.mkOption {
|
|
type = lib.types.str;
|
|
default = "think.greaterchiangmai.com";
|
|
example = "forum.example.com";
|
|
description = "Domain to serve on.";
|
|
};
|
|
|
|
settings = lib.mkOption {
|
|
type =
|
|
with lib.types;
|
|
attrsOf (
|
|
nullOr (
|
|
either
|
|
(oneOf [
|
|
bool
|
|
int
|
|
port
|
|
path
|
|
str
|
|
])
|
|
(submodule {
|
|
options = {
|
|
_secret = lib.mkOption {
|
|
type = nullOr str;
|
|
description = ''
|
|
The path to a file containing the value the
|
|
option should be set to in the final
|
|
configuration file.
|
|
'';
|
|
};
|
|
};
|
|
})
|
|
)
|
|
);
|
|
default = { };
|
|
description = ''
|
|
Options for settings environment variables
|
|
'';
|
|
example = lib.literalExpression ''
|
|
{
|
|
APP_NAME = "Laravel";
|
|
APP_ENV = "local";
|
|
APP_KEY = "key";
|
|
APP_DEBUG = true;
|
|
APP_URL = "http://localhost";
|
|
|
|
LOG_CHANNEL = "stack";
|
|
LOG_DEPRECATIONS_CHANNEL = "null";
|
|
LOG_LEVEL = "debug";
|
|
|
|
DB_CONNECTION = "mysql";
|
|
DB_HOST = "127.0.0.1";
|
|
DB_PORT = "3306";
|
|
DB_DATABASE = "laravel";
|
|
DB_USERNAME = "root";
|
|
DB_PASSWORD = "";
|
|
}
|
|
'';
|
|
};
|
|
|
|
};
|
|
config = lib.mkIf cfg.enable {
|
|
users.users.${cfg.user} = {
|
|
isSystemUser = true;
|
|
home = cfg.dataDir;
|
|
createHome = true;
|
|
homeMode = "755";
|
|
group = cfg.group;
|
|
};
|
|
users.groups.${cfg.group} = { };
|
|
|
|
services.phpfpm.pools.think-gtcm = {
|
|
inherit (cfg) user group;
|
|
phpPackage = php;
|
|
settings = {
|
|
"listen.owner" = config.services.nginx.user;
|
|
"listen.group" = config.services.nginx.group;
|
|
"listen.mode" = "0600";
|
|
"pm" = lib.mkDefault "dynamic";
|
|
"pm.max_children" = lib.mkDefault 10;
|
|
"pm.max_requests" = lib.mkDefault 500;
|
|
"pm.start_servers" = lib.mkDefault 2;
|
|
"pm.min_spare_servers" = lib.mkDefault 1;
|
|
"pm.max_spare_servers" = lib.mkDefault 3;
|
|
};
|
|
phpOptions = ''
|
|
error_log = syslog
|
|
log_errors = on
|
|
'';
|
|
};
|
|
|
|
environment.systemPackages = [
|
|
artisan
|
|
];
|
|
|
|
services.think-greaterchiangmai.settings = {
|
|
APP_SERVICES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/services.php";
|
|
APP_PACKAGES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/packages.php";
|
|
APP_CONFIG_CACHE = lib.mkDefault "${cfg.dataDir}/cache/config.php";
|
|
APP_ROUTES_CACHE = lib.mkDefault "${cfg.dataDir}/cache/routes-v7.php";
|
|
APP_EVENTS_CACHE = lib.mkDefault "${cfg.dataDir}/cache/events.php";
|
|
};
|
|
|
|
systemd.services.think-gtcm-setup = {
|
|
description = "think.greaterchiangmai installation";
|
|
requiredBy = [ "phpfpm-think-gtcm.service" ];
|
|
before = [ "phpfpm-think-gtcm.service" ];
|
|
requires = [ "mysql.service" ];
|
|
after = [ "mysql.service" ];
|
|
serviceConfig = {
|
|
type = "oneshot";
|
|
RemainAfterExit = true;
|
|
User = cfg.user;
|
|
UMask = 77;
|
|
WorkingDirectory = "${think-gtcm}";
|
|
RuntimeDirectory = "think-gtcm/cache";
|
|
RuntimeDirectoryMode = 700;
|
|
};
|
|
path = [ pkgs.replace-secret ];
|
|
script =
|
|
let
|
|
isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
|
|
gtcmEnvVars = lib.generators.toKeyValue {
|
|
mkKeyValue = lib.flip lib.generators.mkKeyValueDefault "=" {
|
|
mkValueString =
|
|
v:
|
|
with builtins;
|
|
if isInt v then
|
|
toString v
|
|
else if isString v then
|
|
v
|
|
else if true == v then
|
|
"true"
|
|
else if false == v then
|
|
"false"
|
|
else if isSecret v then
|
|
hashString "sha256" v._secret
|
|
else
|
|
throw "unsupported type ${typeOf v}: ${(lib.generators.toPretty { }) v}";
|
|
};
|
|
};
|
|
secretPaths = lib.mapAttrsToList (_: v: v._secret) (lib.filterAttrs (_: isSecret) cfg.settings);
|
|
mkSecretReplacement = file: ''
|
|
replace-secret ${
|
|
lib.escapeShellArgs [
|
|
(builtins.hashString "sha256" file)
|
|
file
|
|
"${cfg.dataDir}/.env"
|
|
]
|
|
}
|
|
'';
|
|
secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
|
|
filteredConfig = lib.converge (lib.filterAttrsRecursive (
|
|
_: v:
|
|
!lib.elem v [
|
|
{ }
|
|
null
|
|
]
|
|
)) cfg.settings;
|
|
gtcmEnv = pkgs.writeText "gtcm.env" (gtcmEnvVars filteredConfig);
|
|
in
|
|
''
|
|
# error handling
|
|
set -euo pipefail
|
|
|
|
# create .env file
|
|
install -T -m 0600 -o ${cfg.user} ${gtcmEnv} "${cfg.dataDir}/.env"
|
|
${secretReplacements}
|
|
if ! grep 'APP_KEY=base64:' "${cfg.dataDir}/.env" >/dev/null; then
|
|
sed -i 's/APP_KEY=/APP_KEY=base64:/' "${cfg.dataDir}/.env"
|
|
fi
|
|
|
|
# migrate & seed db
|
|
${lib.getExe php} artisan key:generate --force
|
|
${lib.getExe php} artisan migrate --force
|
|
${lib.getExe php} artisan config:cache
|
|
'';
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d ${cfg.dataDir} 0710 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/cache 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/public 0750 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/public/uploads 0750 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/app 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/fonts 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/framework 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/framework/cache 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/framework/sessions 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/framework/views 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/logs 0700 ${cfg.user} ${cfg.group} - -"
|
|
"d ${cfg.dataDir}/storage/uploads 0700 ${cfg.user} ${cfg.group} - -"
|
|
];
|
|
|
|
networking.firewall.allowedTCPPorts = [
|
|
80
|
|
443
|
|
];
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
recommendedTlsSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedGzipSettings = true;
|
|
recommendedBrotliSettings = true;
|
|
recommendedProxySettings = true;
|
|
virtualHosts."${cfg.domain}" = {
|
|
root = "${think-gtcm}/public";
|
|
locations = {
|
|
"/" = {
|
|
index = "index.php";
|
|
tryFiles = "$uri $uri/ /index.php?$query_string";
|
|
};
|
|
|
|
"~ \\.php$".extraConfig = ''
|
|
fastcgi_pass unix:${config.services.phpfpm.pools."think-gtcm".socket};
|
|
'';
|
|
"~ \\.(js|css|gif|png|ico|jpg|jpeg)$" = {
|
|
extraConfig = "expires 365d;";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
services.mysql = {
|
|
enable = true;
|
|
package = pkgs.mariadb;
|
|
ensureDatabases = [ cfg.settings.DB_DATABASE ];
|
|
ensureUsers = [
|
|
{
|
|
name = cfg.settings.DB_USERNAME;
|
|
ensurePermissions = {
|
|
"${cfg.settings.DB_DATABASE}.*" = "ALL PRIVILEGES";
|
|
};
|
|
}
|
|
];
|
|
};
|
|
};
|
|
}
|