diff --git a/flake.lock b/flake.lock index f2305795..db47dc69 100644 --- a/flake.lock +++ b/flake.lock @@ -78,11 +78,11 @@ "utils": "utils" }, "locked": { - "lastModified": 1686747123, - "narHash": "sha256-XUQK9kwHpTeilHoad7L4LjMCCyY13Oq383CoFADecRE=", + "lastModified": 1704875591, + "narHash": "sha256-eWRLbqRcrILgztU/m/k7CYLzETKNbv0OsT2GjkaNm8A=", "owner": "serokell", "repo": "deploy-rs", - "rev": "724463b5a94daa810abfc64a4f87faef4e00f984", + "rev": "1776009f1f3fb2b5d236b84d9815f2edee463a9b", "type": "github" }, "original": { @@ -170,11 +170,11 @@ "flake-compat": { "flake": false, "locked": { - "lastModified": 1668681692, - "narHash": "sha256-Ht91NGdewz8IQLtWZ9LCeNXMSXHUss+9COoqu6JLmXU=", + "lastModified": 1696426674, + "narHash": "sha256-kvjfFW7WAETZlt09AgDn1MrtKzP7t90Vf7vypd3OL1U=", "owner": "edolstra", "repo": "flake-compat", - "rev": "009399224d5e398d03b22badca40a37ac85412a1", + "rev": "0f9255e01c2351cc7d116c072cb317785dd33b33", "type": "github" }, "original": { @@ -247,7 +247,7 @@ }, "flake-utils_3": { "inputs": { - "systems": "systems" + "systems": "systems_2" }, "locked": { "lastModified": 1685518550, @@ -265,7 +265,7 @@ }, "flake-utils_4": { "inputs": { - "systems": "systems_2" + "systems": "systems_3" }, "locked": { "lastModified": 1681202837, @@ -346,16 +346,16 @@ ] }, "locked": { - "lastModified": 1687871164, - "narHash": "sha256-bBFlPthuYX322xOlpJvkjUBz0C+MOBjZdDOOJJ+G2jU=", + "lastModified": 1704099619, + "narHash": "sha256-QRVMkdxLmv+aKGjcgeEg31xtJEIsYq4i1Kbyw5EPS6g=", "owner": "nix-community", "repo": "home-manager", - "rev": "07c347bb50994691d7b0095f45ebd8838cf6bc38", + "rev": "7e398b3d76bc1503171b1364c9d4a07ac06f3851", "type": "github" }, "original": { "owner": "nix-community", - "ref": "release-23.05", + "ref": "release-23.11", "repo": "home-manager", "type": "github" } @@ -451,16 +451,16 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1691155011, - "narHash": "sha256-O15tC0ysw+fcacEbOzrDrkVNIR+SgtArSGvpgsEqpvA=", + "lastModified": 1704874635, + "narHash": "sha256-YWuCrtsty5vVZvu+7BchAxmcYzTMfolSPP5io8+WYCg=", "owner": "nixos", "repo": "nixpkgs", - "rev": "9652a97d9738d3e65cf33c0bc24429e495a7868f", + "rev": "3dc440faeee9e889fe2d1b4d25ad0f430d449356", "type": "github" }, "original": { "owner": "nixos", - "ref": "nixos-23.05", + "ref": "nixos-23.11", "repo": "nixpkgs", "type": "github" } @@ -591,6 +591,21 @@ "type": "github" } }, + "systems_3": { + "locked": { + "lastModified": 1681028828, + "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=", + "owner": "nix-systems", + "repo": "default", + "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e", + "type": "github" + }, + "original": { + "owner": "nix-systems", + "repo": "default", + "type": "github" + } + }, "tidal-src": { "flake": false, "locked": { @@ -636,11 +651,11 @@ }, "unstable": { "locked": { - "lastModified": 1698611440, - "narHash": "sha256-jPjHjrerhYDy3q9+s5EAsuhyhuknNfowY6yt6pjn9pc=", + "lastModified": 1704194953, + "narHash": "sha256-RtDKd8Mynhe5CFnVT8s0/0yqtWFMM9LmCzXv/YKxnq4=", "owner": "nixos", "repo": "nixpkgs", - "rev": "0cbe9f69c234a7700596e943bfae7ef27a31b735", + "rev": "bd645e8668ec6612439a9ee7e71f7eac4099d4f6", "type": "github" }, "original": { @@ -651,12 +666,15 @@ } }, "utils": { + "inputs": { + "systems": "systems" + }, "locked": { - "lastModified": 1667395993, - "narHash": "sha256-nuEHfE/LcWyuSWnS8t12N1wc105Qtau+/OdUAjtQ0rA=", + "lastModified": 1701680307, + "narHash": "sha256-kAuep2h5ajznlPMD9rnQyffWG8EM/C73lejGofXvdM8=", "owner": "numtide", "repo": "flake-utils", - "rev": "5aed5285a952e0b949eb3ba02c12fa4fcfef535f", + "rev": "4022d587cbbfd70fe950c1e2083a02621806a725", "type": "github" }, "original": { diff --git a/flake.nix b/flake.nix index 78f6142e..caac031d 100644 --- a/flake.nix +++ b/flake.nix @@ -8,7 +8,7 @@ nixos-hardware.url = "github:NixOS/nixos-hardware/master"; # Home manager - home-manager.url = "github:nix-community/home-manager/release-23.05"; + home-manager.url = "github:nix-community/home-manager/release-23.11"; home-manager.inputs.nixpkgs.follows = "nixpkgs"; hardware.url = "github:nixos/nixos-hardware"; @@ -127,8 +127,12 @@ # for when space matters litePkgsFor = forAllSystems (system: import nixpkgs { inherit system; + # config.permittedInsecurePackages = [ + # "forgejo-1.19.4-0" # Needed for archivebox deployments on curve + # # Check when archive box updates it's dependeny + # ]; overlays = [ - ag serviceenix.overlays.default + agenix.overlays.default tidalcycles.overlays.default # needed for nvim which comes pre-installed lol ]; }); @@ -283,6 +287,7 @@ helix = { hostname = "git.sealight.xyz"; autoRollback = false; + magicRollback = false; profiles.system = { user = "root"; path = deploy-rs.lib.x86_64-linux.activate.nixos self.nixosConfigurations.helix; diff --git a/hosts/profiles/wallabag/default.nix b/hosts/profiles/wallabag/default.nix index 0020eb55..4d582e98 100644 --- a/hosts/profiles/wallabag/default.nix +++ b/hosts/profiles/wallabag/default.nix @@ -7,16 +7,19 @@ # age.secrets.wallabag-secret.owner = "wallabag"; services.postgresql = { enable = true; - package = pkgs.postgresql_11; + package = pkgs.postgresql_15; # Ensure the database, user, and permissions always exist ensureDatabases = [ "wallabag" ]; ensureUsers = [ { name = "wallabag"; - ensureDBOwnership = true; + # ensureDBOwnership = true; } ]; + authentication = '' + local wallabag all md5 + ''; }; services.wallabag = { @@ -39,28 +42,21 @@ # with PostgreSQL and SQLite, you must set "utf8" database_charset: utf8 - domain_name: http://read.mossnet.lan + domain_name: http://read.mossnet.lan/ server_name: "mossnet wallabag instance" - mailer_transport: smtp - mailer_user: ~ - mailer_password: ~ - mailer_host: 127.0.0.1 - mailer_port: false - mailer_encryption: ~ - mailer_auth_mode: ~ - + mailer_dsn: null:// locale: en # A secret key that's used to generate certain security-related tokens secret: SAFGOECRIlfal89oe6u0(*^dsaaih961 # two factor stuff - twofactor_auth: true + twofactor_auth: false twofactor_sender: no-reply@wallabag.org # fosuser stuff - fosuser_registration: true + fosuser_registration: false fosuser_confirmation: true # how long the access token should live in seconds for the API diff --git a/modules/nixos/wallabag.nix b/modules/nixos/wallabag.nix index 55f93ec1..bb02e4f5 100644 --- a/modules/nixos/wallabag.nix +++ b/modules/nixos/wallabag.nix @@ -9,16 +9,26 @@ let configFile = pkgs.writeTextFile { name = "wallabag-config"; text = cfg.conf; - destination = "/config/parameters.yml"; + destination = "/app/config/parameters.yml"; }; appDir = pkgs.buildEnv { name = "wallabag-app-dir"; ignoreCollisions = true; checkCollisionContents = false; - paths = [ configFile "${cfg.package}/app" ]; + paths = [ configFile "${cfg.package}" ]; + pathsToLink = [ "/app" "/src" "/translations" ]; }; + # See there for available commands: + # https://doc.wallabag.org/en/admin/console_commands.html + # A user can be made admin with the fos:user:promote --super command + console = pkgs.writeShellScriptBin "wallabag-console" '' + export WALLABAG_DATA="${cfg.dataDir}" + cd "${cfg.dataDir}" + ${pkgs.php}/bin/php ${pkgs.wallabag}/bin/console --env=prod $@ + ''; + in { @@ -90,20 +100,24 @@ in user = "${cfg.user}"; group = "nginx"; phpPackage = pkgs.php; + phpEnv = { + WALLABAG_DATA = cfg.dataDir; + PATH = lib.makeBinPath [pkgs.php]; + }; settings = { "listen.owner" = "nginx"; "listen.group" = "nginx"; "listen.mode" = "0600"; "user" = "${cfg.user}"; "group" = "nginx"; - "env[WALLABAG_DATA]" = "${cfg.dataDir}"; "pm" = "dynamic"; "pm.max_children" = "75"; "pm.min_spare_servers" = "5"; "pm.max_spare_servers" = "20"; "pm.max_requests" = "10"; "catch_workers_output" = "1"; - "php_admin_value[error_log]" = "/var/log/nginx/${poolName}-phpfpm-error.log"; + "php_admin_value[error_log]" = "stderr"; + "php_admin_flag[log_errors]" = true; }; }; services.phpfpm.phpOptions = '' @@ -111,6 +125,41 @@ in ''; services.nginx.enable = mkDefault true; + environment.systemPackages = [ console ]; + + # services.nginx.virtualHosts."${cfg.hostName}" = { + # forceSSL = false; + # enableACME = false; + # extraConfig = '' + # error_log /var/log/nginx/wallabag_error.log; + # access_log /var/log/nginx/wallabag_access.log; + # ''; + + # root = "${cfg.package}/web"; + # locations."/" = { + # priority = 10; + # tryFiles = "$uri /app.php$is_args$args"; + # }; + # locations."/assets".root = "${cfg.dataDir}/web"; + # locations."~ ^/app\\.php(/|$)" = { + # priority = 100; + # fastcgiParams = { + # SCRIPT_FILENAME = "$realpath_root$fastcgi_script_name"; + # DOCUMENT_ROOT = "$realpath_root"; + # }; + # extraConfig = '' + # fastcgi_pass unix:${config.services.phpfpm.pools."${poolName}".socket}; + # include ${config.services.nginx.package}/conf/fastcgi_params; + # include ${config.services.nginx.package}/conf/fastcgi.conf; + # internal; + # ''; + # }; + # locations."~ \\.php$" = { + # priority = 1000; + # return = "404"; + # }; + # }; + services.nginx.virtualHosts."${cfg.hostName}" = { enableACME = false; @@ -124,23 +173,31 @@ in ''; locations."/" = { - extraConfig = '' - try_files $uri /app.php$is_args$args; - ''; + tryFiles = "$uri /app.php$is_args$args"; }; locations."/assets".root = "${cfg.dataDir}/web"; locations."~ ^/app\\.php(/|$)" = { + fastcgiParams = { + SCRIPT_FILENAME = "$realpath_root$fastcgi_script_name"; + DOCUMENT_ROOT = "$realpath_root"; + }; extraConfig = '' fastcgi_pass unix:${config.services.phpfpm.pools."${poolName}".socket}; - fastcgi_split_path_info ^(.+\.php)(/.*)$; - include ${pkgs.nginx}/conf/fastcgi_params; - fastcgi_param SCRIPT_FILENAME ${cfg.package}/web/$fastcgi_script_name; - fastcgi_param DOCUMENT_ROOT ${cfg.package}/web; - fastcgi_read_timeout 120; + include ${config.services.nginx.package}/conf/fastcgi_params; + include ${config.services.nginx.package}/conf/fastcgi.conf; internal; ''; + # extraConfig = '' + # fastcgi_pass unix:${config.services.phpfpm.pools."${poolName}".socket}; + # fastcgi_split_path_info ^(.+\.php)(/.*)$; + # include ${pkgs.nginx}/conf/fastcgi_params; + # fastcgi_param SCRIPT_FILENAME ${cfg.package}/web/$fastcgi_script_name; + # fastcgi_param DOCUMENT_ROOT ${cfg.package}/web; + # fastcgi_read_timeout 120; + # internal; + # ''; }; locations."~ /(?!app)\\.php$" = { @@ -174,8 +231,10 @@ in cd "${cfg.dataDir}" rm -rf var/cache/* - rm -f app - ln -sf ${appDir} app + rm -f app src translations + ln -sf ${appDir}/app app + ln -sf ${appDir}/src src + ln -sf ${appDir}/translations translations ln -sf ${cfg.package}/composer.{json,lock} . export WALLABAG_DATA="${cfg.dataDir}"