Compare commits

..

15 commits

Author SHA1 Message Date
Anish Lakhwara 130f9e70ec Merge branch 'main' of git.sealight.xyz:aynish/helm 2024-07-14 20:22:57 -07:00
Anish Lakhwara 54b3654d3b box: change website deploy to point to helix 2024-07-14 20:22:43 -07:00
Anish Lakhwara e0165b2f37 lituus: remove /storage (i'll need to add it back eventually) 2024-07-14 20:21:55 -07:00
Anish Lakhwara c5ce711784 lituus: use unstable mautrix-signal 2024-07-14 20:21:29 -07:00
Anish Lakhwara ca6a9fdafb add gopls to nvim 2024-07-14 20:21:20 -07:00
Anish Lakhwara 20a8684f60 add git machete 2024-07-14 20:21:12 -07:00
Anish Lakhwara c1af9a9ca7 fix(box): wallabag is working again!!! 2024-07-14 20:20:49 -07:00
Anish Lakhwara 07891dc81d remove sublime-music 2024-07-14 18:48:44 -07:00
Anish Lakhwara 12862e0891 dns: update lakhwara.com to point to helix 2024-07-14 18:48:24 -07:00
Anish Lakhwara ed40099439 Merge branch 'main' of git.sealight.xyz:aynish/helm 2024-07-14 16:52:26 -07:00
Anish Lakhwara 7c96b1ff5b website: move to helix 2024-07-14 16:52:11 -07:00
Anish Lakhwara 557706c7fd website: move to helix 2024-07-14 16:51:38 -07:00
Anish Lakhwara 0b5a013faf remove: ngipkgs from flake input 2024-07-14 16:45:02 -07:00
Anish Lakhwara d496c20a82 fix: taskwarrior moved from home/cli to home/gui 2024-07-14 16:44:39 -07:00
Anish Lakhwara 6522536dc8 dns: add write.sealight.xyz? 2024-07-14 16:43:57 -07:00
23 changed files with 485 additions and 315 deletions

1
.gitignore vendored Normal file
View file

@ -0,0 +1 @@
.direnv/

View file

@ -6,15 +6,15 @@ var DNS_HEDNS = NewDnsProvider('hedns');
D("lakhwara.com", REG_NONE,
DnsProvider(DNS_HEDNS),
DefaultTTL(86400),
DefaultTTL(300),
//SOA('@', 'ns1.he.net.', 'hostmaster.he.net.', 2022041702, 86400, 7200, 3600000, 86400, TTL(172800)),
A('anish', '103.16.130.98'),
A('coaching', '103.16.130.98'),
A('anish', '69.61.2.203'),
A('@', '69.61.2.203'),
//A('coaching', '103.16.130.98'),
TXT('anish', 'datkey=dat://1a240a14fab2bae9c85ebad29bddc04505aaba24e5fb809c2ccb4cdf71e3a7d5'),
CNAME('fm1._domainkey', 'fm1.lakhwara.com.dkim.fmhosted.com.'),
CNAME('fm2._domainkey', 'fm2.lakhwara.com.dkim.fmhosted.com.'),
CNAME('fm3._domainkey', 'fm3.lakhwara.com.dkim.fmhosted.com.'),
A('@', '103.16.130.98'),
MX('@', 10, 'in1-smtp.messagingengine.com.'),
MX('@', 20, 'in2-smtp.messagingengine.com.'),
//NAMESERVER('ns1.he.net.'),
@ -39,6 +39,7 @@ D('sealight.xyz', REG_NONE, DnsProvider(DNS_HEDNS),
A('git', '69.61.2.203', TTL(300)),
A('bin', '69.61.2.203', TTL(300)),
A('ci', '69.61.2.203', TTL(300)),
A('write', '69.61.2.203', TTL(300)),
// vultr -> nulled: lituus
A('@', '45.77.48.108', TTL(300)),
A('jitsi', '45.77.48.108', TTL(300)),

View file

@ -7,6 +7,9 @@
unstable.url = "github:nixos/nixpkgs/nixos-unstable";
nixos-hardware.url = "github:NixOS/nixos-hardware/master";
# ngipkgs.url = "github:Chickensoupwithrice/ngipkgs?ref=aynish/atomic-server-module";
# ngipkgs-local.url = "path:/home/anish/usr/ngipkgs";
# Home manager
home-manager.url = "github:nix-community/home-manager/release-23.11";
home-manager.inputs.nixpkgs.follows = "nixpkgs";
@ -133,6 +136,8 @@
# ];
overlays = [
agenix.overlays.default
self.overlays.additions
self.overlays.modifications
tidalcycles.overlays.default # needed for nvim which comes pre-installed lol
];
});
@ -171,6 +176,7 @@
agenix.nixosModules.age
self.nixosModules.backup
self.nixosModules.wireguard
self.nixosModules.wallabag
nixos-hardware.nixosModules.lenovo-thinkpad-x270
home-manager.nixosModules.home-manager
{
@ -192,6 +198,8 @@
agenix.nixosModules.age
self.nixosModules.backup
self.nixosModules.wireguard
# self.nixosModules.blogg
basant.nixosModule
# self.nixosModules.microbin
disko.nixosModules.disko
];

View file

@ -4,7 +4,6 @@
../profiles/cli
../profiles/direnv
../profiles/git
../profiles/task
];
home.stateVersion = "22.05";
}

View file

@ -9,5 +9,6 @@
../profiles/cal
../profiles/sync/kitaab
../profiles/ssh
../profiles/task
];
}

View file

@ -7,6 +7,7 @@
dasht
dosfstools
#git
git-machete
bottom
gptfdisk
starship

View file

@ -635,7 +635,7 @@ in
}
}
local servers = { 'clojure_lsp', 'terraform_lsp', 'zls', 'pyright', 'rust_analyzer', 'tsserver', 'lua_ls', 'nil_ls'}
local servers = { 'clojure_lsp', 'terraform_lsp', 'zls', 'pyright', 'rust_analyzer', 'tsserver', 'lua_ls', 'nil_ls', 'gopls'}
for _, lsp in ipairs(servers) do
lspconfig[lsp].setup {
on_attach = function(client, bufnr)
@ -864,6 +864,7 @@ in
rust-analyzer
clj-kondo
zls
gopls
gcc
nodePackages_latest.pyright
shellcheck

View file

@ -8,7 +8,7 @@
# taskwarrior needs write access to this file for centexts
# this way, we get a copy of the file, and we make sure it's writable
".taskrc".source = ./taskrc;
".taskrc".executable = true;
# ".taskrc".executable = true;
# ".taskrc".onChange = "cp ~/.taskrc ~/.taskrc2;rm ~/.taskrc;mv ~/.taskrc2 ~/.taskrc;chmod +w ~/.taskrc";
".task/keys/ca.cert".source = ./ca.cert;
".task/keys/public.cert".source = ./public.cert;

View file

@ -11,6 +11,8 @@
# ../profiles/mount-mossnet
../profiles/freshrss
../profiles/microbin
../profiles/site
# ../profiles/postgres_upgrade_script
];

View file

@ -20,11 +20,6 @@
fsType = "btrfs";
};
fileSystems."/storage" =
{ device = "/dev/disk/by-uuid/c2181608-cbb0-40ab-b62b-158cdc9b9300";
fsType = "btrfs";
};
swapDevices = [ ];
hardware.cpu.intel.updateMicrocode = lib.mkDefault config.hardware.enableRedistributableFirmware;

View file

@ -0,0 +1,18 @@
{pkgs, ... }:
{
services.nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
};
# Enables MySQL
services.mysql = {
enable = true;
package = pkgs.mariadb;
};
services."write.sealight.xyz".enable = true;
}

View file

@ -62,7 +62,7 @@ in
};
environment.systemPackages = with pkgs; [
unstable.sublime-music
#unstable.sublime-music
unstable.nheko
unstable.signal-desktop
unstable.tuba

View file

@ -34,7 +34,7 @@
signal = {
port = 29184;
format = "mautrix-python";
package = pkgs.mautrix-signal;
package = pkgs.unstable.mautrix-signal;
serviceConfig = {
StateDirectory = [ "matrix-as-signal" "signald" ];
SupplementaryGroups = [ "signald" ];

View file

@ -18,7 +18,7 @@
git add flake.lock
git diff-index --quiet HEAD || git commit -m 'updating website' # if nothing, don't exit 1
git push
deploy .#cube
deploy .#helix
exit 0
'';
serviceConfig = {

View file

@ -1,10 +1,10 @@
{ self, pkgs, config, lib, ... }:
{
# age.secrets.wallabag-password.file = "${self}/secrets/wallabag-password.age";
# age.secrets.wallabag-secret.file = "${self}/secrets/wallabag-secret.age";
# age.secrets.wallabag-password.owner = "wallabag";
# age.secrets.wallabag-secret.owner = "wallabag";
age.secrets.wallabag-password.file = "${self}/secrets/wallabag-password.age";
age.secrets.wallabag-secret.file = "${self}/secrets/wallabag-secret.age";
age.secrets.wallabag-password.owner = "wallabag";
age.secrets.wallabag-secret.owner = "wallabag";
services.postgresql = {
enable = true;
package = pkgs.postgresql_15;
@ -18,74 +18,20 @@
}
];
authentication = ''
local wallabag all md5
local wallabag all peer
'';
};
services.wallabag = {
enable = true;
hostName = "read.mossnet.lan";
domain = "read.mossnet.lan";
virtualHost.enable = true;
package = pkgs.my-wallabag;
dataDir = "/var/lib/wallabag";
conf = ''
# This file is a "template" of what your parameters.yml file should look like
parameters:
database_driver: pdo_pgsql
database_host: localhost
database_port: ~
database_name: wallabag
database_user: wallabag
database_password: wallabag
# For SQLite, database_path should be "%kernel.project_dir%/data/db/wallabag.sqlite"
database_path: ~
database_table_prefix: wallabag_
database_socket: null
# with PostgreSQL and SQLite, you must set "utf8"
database_charset: utf8
domain_name: http://read.mossnet.lan
server_name: "mossnet wallabag instance"
mailer_dsn: null://
locale: en
# A secret key that's used to generate certain security-related tokens
secret: SAFGOECRIlfal89oe6u0(*^dsaaih961
# two factor stuff
twofactor_auth: false
twofactor_sender: no-reply@wallabag.org
# fosuser stuff
fosuser_registration: false
fosuser_confirmation: true
# how long the access token should live in seconds for the API
fos_oauth_server_access_token_lifetime: 3600
# how long the refresh token should life in seconds for the API
fos_oauth_server_refresh_token_lifetime: 1209600
from_email: ops@sealight.xyz
rss_limit: 50
# RabbitMQ processing
rabbitmq_host: localhost
rabbitmq_port: 5672
rabbitmq_user: guest
rabbitmq_password: guest
rabbitmq_prefetch_count: 10
# Redis processing
redis_scheme: tcp
redis_host: localhost
redis_port: 6379
redis_path: null
redis_password: null
# sentry logging
sentry_dsn: ~
'';
# Systemd now defaults to /var/lib?
# dataDir = "/var/lib/wallabag";
parameters = {
"env(SECRET_FILE)" = config.age.secrets.wallabag-secret.path;
secret = "%env(file:resolve:SECRET_FILE)%";
};
};
# networking.firewall.allowedTCPPorts = [ 8080 ];
}

148
modules/nixos/blogging.nix Normal file
View file

@ -0,0 +1,148 @@
{ options, lib, config, pkgs, ... }:
let
# domain for the Ghost blog
serverName = "write.sealight.xyz";
# port on which the Ghost service runs
port = 1357;
# user used to run the Ghost service
userName = builtins.replaceStrings [ "." ] [ "_" ] serverName;
# MySQL database used by Ghost
dbName = userName;
# MySQL user used by Ghost
dbUser = userName;
# directory used to save the blog content
dataDir = "/var/lib/${userName}";
# Ghost package we created in the section above
ghost = import ./ghost { inherit pkgs; };
# script that sets up the Ghost content directory
setupScript = pkgs.writeScript "${serverName}-setup.sh" ''
#! ${pkgs.stdenv.shell} -e
chmod g+s "${dataDir}"
[[ ! -d "${dataDir}/content" ]] && cp -r "${ghost}/content" "${dataDir}/content"
chown -R "${userName}":"${userName}" "${dataDir}/content"
chmod -R +w "${dataDir}/content"
ln -f -s "/etc/${serverName}.json" "${dataDir}/config.production.json"
[[ -d "${dataDir}/current" ]] && rm "${dataDir}/current"
ln -f -s "${ghost}/current" "${dataDir}/current"
[[ -d "${dataDir}/content/themes/casper" ]] && rm "${dataDir}/content/themes/casper"
ln -f -s "${ghost}/current/content/themes/casper" "${dataDir}/content/themes/casper"
'';
databaseService = "mysql.service";
serviceConfig = config.services."${serverName}";
options = { enable = lib.mkEnableOption "${serverName} service"; };
in {
options.services.${serverName} = options;
config = lib.mkIf serviceConfig.enable {
# Creates the user and group
users.users.${userName} = {
isSystemUser = true;
group = userName;
createHome = true;
home = dataDir;
};
users.groups.${userName} = { };
# Creates the Ghost config
environment.etc."${serverName}.json".text = ''
{
"url": "https://${serverName}",
"server": {
"port": ${port},
"host": "0.0.0.0"
},
"database": {
"client": "mysql",
"connection": {
"host": "localhost",
"user": "${dbUser}",
"database": "${dbName}",
"password": "",
"socketPath": "/run/mysqld/mysqld.sock"
}
},
"mail": {
"transport": "sendmail"
},
"logging": {
"transports": ["stdout"]
},
"paths": {
"contentPath": "${dataDir}/content"
}
}
'';
# Sets up the Systemd service
systemd.services."${serverName}" = {
enable = true;
description = "${serverName} ghost blog";
restartIfChanged = true;
restartTriggers =
[ ghost config.environment.etc."${serverName}.json".source ];
requires = [ databaseService ];
after = [ databaseService ];
path = [ pkgs.nodejs pkgs.vips ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
User = userName;
Group = userName;
WorkingDirectory = dataDir;
# Executes the setup script before start
ExecStartPre = setupScript;
# Runs Ghost with node
ExecStart = "${pkgs.nodejs}/bin/node current/index.js";
# Sandboxes the Systemd service
AmbientCapabilities = [ ];
CapabilityBoundingSet = [ ];
KeyringMode = "private";
LockPersonality = true;
NoNewPrivileges = true;
PrivateDevices = true;
PrivateMounts = true;
PrivateTmp = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
ProtectSystem = "full";
RemoveIPC = true;
RestrictAddressFamilies = [ ];
RestrictNamespaces = true;
RestrictRealtime = true;
};
environment = { NODE_ENV = "production"; };
};
# Sets up the blog virtual host on NGINX
services.nginx.virtualHosts.${serverName} = {
# Sets up Lets Encrypt SSL certificates for the blog
forceSSL = true;
enableACME = true;
locations."/" = { proxyPass = "http://127.0.0.1:${toString port}"; };
extraConfig = ''
charset UTF-8;
add_header Strict-Transport-Security "max-age=2592000; includeSubDomains" always;
add_header Referrer-Policy "strict-origin-when-cross-origin";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Content-Type-Options nosniff;
'';
};
# Sets up MySQL database and user for Ghost
services.mysql = {
ensureDatabases = [ dbName ];
ensureUsers = [{
name = dbUser;
ensurePermissions = { "${dbName}.*" = "ALL PRIVILEGES"; };
}];
};
};
}

View file

@ -9,5 +9,6 @@
wireguard = import ./wireguard.nix;
backup = import ./backup.nix;
ulogger-server = import ./ulogger.nix;
blogg = import ./blogging.nix;
# microbin = import ./microbin.nix; # includide in 23.11
}

View file

@ -1,253 +1,245 @@
{ config, options, lib, pkgs, ... }:
with lib;
{ config, lib, pkgs, ... }:
let
# Based on https://github.com/wallabag/wallabag/blob/2.6.6/app/config/parameters.yml.dist
settings = {
database_driver = "${cfg.database_type}";
database_host = null;
database_port = 5432;
database_name = "wallabag";
database_user = "wallabag";
database_password = null;
database_path = null;
database_table_prefix = "wallabag_";
database_socket = "/run/postgresql";
database_charset = "utf8";
domain_name = "http://${cfg.domain}";
server_name = "Wallabag";
# Needs an explicit command since Symfony version used by Wallabag does not yet support the `native` transport
# and the `sendmail` transport does not respect `sendmail_path` configured in `php.ini`.
mailer_dsn = "sendmail://default?command=/run/wrappers/bin/sendmail%%20-t%%20-i";
locale = "en";
# A secret key that's used to generate certain security-related tokens.
# "env(SECRET_FILE)" = "/run/secrets/wallabag";
# secret = "%env(file:resolve:SECRET_FILE)%";
# two factor stuff
twofactor_auth = false;
twofactor_sender = "";
# fosuser stuff
fosuser_registration = false;
fosuser_confirmation = false;
# how long the access token should live in seconds for the API
fos_oauth_server_access_token_lifetime = 3600;
# how long the refresh token should life in seconds for the API
fos_oauth_server_refresh_token_lifetime = 1209600;
from_email = "wallabag@read.mossnet.lan";
# RabbitMQ processing
redis_scheme = "unix";
redis_host = ""; # Ignored for unix scheme
redis_port = 0; # Ignored for unix scheme
redis_path = config.services.redis.servers.wallabag.unixSocket;
redis_password = null;
# Redis processing
rabbitmq_host = "";
rabbitmq_port = 0;
rabbitmq_user = "";
rabbitmq_password = "";
rabbitmq_prefetch_count = 0;
# sentry logging
sentry_dsn = null;
} // cfg.parameters;
php = cfg.php.package.withExtensions ({ enabled, all }: enabled ++ (with all; [
imagick
tidy
]));
commonServiceConfig = {
CacheDirectory = "wallabag";
# Stores sessions.
CacheDirectoryMode = "700";
ConfigurationDirectory = "wallabag";
LogsDirectory = "wallabag";
StateDirectory = "wallabag";
# Stores site-credentials-secret-key.txt.
StateDirectoryMode = "700";
};
cfg = config.services.wallabag;
in {
options.services.wallabag = with lib; {
enable = mkEnableOption (mdDoc "Wallabag read-it-later service");
poolName = "wallabag";
package = mkOption {
type = types.package;
default = pkgs.wallabag;
};
configFile = pkgs.writeTextFile {
name = "wallabag-config";
text = cfg.conf;
destination = "/app/config/parameters.yml";
php.package = mkOption {
type = types.package;
default = pkgs.php;
};
parameters = mkOption {
type = types.attrsOf types.str;
default = {};
description = mdDoc "Parameters to override from the default. See <https://doc.wallabag.org/en/admin/parameters.html> for values.";
};
database_type = mkOption {
type = types.enum [
"pdo_sqlite3"
"pdo_pgsql"
];
default = if config.services.postgresql.enable
then "pdo_pgsql"
else "pdo_sqlite3";
defaultText = ''
if config.services.postgresql.enable
then "pdo_pgsql"
else "pdo_sqlite3"
'';
description = mdDoc ''
The database engine name. Can be pdo_sqlite3 or pdo_pgsql.
'';
};
domain = mkOption {
type = types.str;
description = "Bare domain name for Wallabag";
};
virtualHost.enable = mkEnableOption (mdDoc "Define nginx virtualhost for Wallabag");
};
appDir = pkgs.buildEnv {
name = "wallabag-app-dir";
ignoreCollisions = true;
checkCollisionContents = false;
paths = [ configFile "${cfg.package}" ];
pathsToLink = [ "/app" "/src" "/translations" ];
};
# See there for available commands:
# https://doc.wallabag.org/en/admin/console_commands.html
# A user can be made admin with the fos:user:promote --super <user> command
console = pkgs.writeShellScriptBin "wallabag-console" ''
export WALLABAG_DATA="${cfg.dataDir}"
cd "${cfg.dataDir}"
${pkgs.php}/bin/php ${cfg.package}/bin/console --env=prod $@
'';
in
{
options = {
services.wallabag = {
enable = mkEnableOption "wallabag";
user = mkOption {
type = types.str;
default = "nginx";
description = ''
User account under which both the update daemon and the web-application run.
'';
};
dataDir = mkOption {
type = types.path;
default = "/var/lib/wallabag";
description = ''
Data directory.
'';
};
package = mkOption {
type = types.package;
default = pkgs.wallabag;
description = ''
Wallabag package to use.
'';
};
hostName = mkOption {
type = types.str;
description = ''
Name of the nginx virtualhost to use and setup.
'';
};
poolConfig = mkOption {
type = types.lines;
default = ''
pm = dynamic
pm.max_children = 75
pm.start_servers = 1
pm.min_spare_servers = 1
pm.max_spare_servers = 20
pm.max_requests = 500
catch_workers_output = 1
'';
description = ''
Options for wallabag's PHP pool. See the documentation on <literal>php-fpm.conf</literal> for details on configuration directives.
'';
};
conf = mkOption {
type = types.str;
description = ''
Contents of the wallabag configuration file (parameters.yml)
'';
config = lib.mkIf cfg.enable {
environment.etc."wallabag/parameters.yml" = {
source = pkgs.writeTextFile {
name = "wallabag-config";
text = builtins.toJSON {
parameters = settings;
};
};
};
};
services.nginx = lib.mkIf cfg.virtualHost.enable {
enable = true;
config = mkIf cfg.enable {
virtualHosts = {
"${cfg.domain}" = {
root = "${pkgs.wallabag}/web";
services.phpfpm.pools."${poolName}" = {
user = "${cfg.user}";
group = "nginx";
phpPackage = pkgs.php;
phpEnv = {
WALLABAG_DATA = cfg.dataDir;
PATH = lib.makeBinPath [pkgs.php];
extraConfig = ''
add_header X-Frame-Options SAMEORIGIN;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
'';
locations."/" = {
extraConfig = ''
try_files $uri /app.php$is_args$args;
'';
};
locations."/assets".root = "${pkgs.wallabag}/app/web";
locations."~ ^/app\\.php(/|$)" = {
extraConfig = ''
fastcgi_pass unix:${config.services.phpfpm.pools.wallabag.socket};
include ${config.services.nginx.package}/conf/fastcgi.conf;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
fastcgi_param SCRIPT_FILENAME ${pkgs.wallabag}/web/$fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT ${pkgs.wallabag}/web;
fastcgi_read_timeout 120;
internal;
'';
};
locations."~ /(?!app)\\.php$" = {
extraConfig = ''
return 404;
'';
};
};
};
};
services.phpfpm.pools.wallabag = {
user = config.users.users.wallabag.name;
phpPackage = php;
settings = {
"listen.owner" = "nginx";
"listen.group" = "nginx";
"listen.mode" = "0600";
"user" = "${cfg.user}";
"group" = "nginx";
"catch_workers_output" = true;
"listen.owner" = config.services.nginx.user;
"listen.group" = "root";
"pm" = "dynamic";
"pm.max_children" = "75";
"pm.min_spare_servers" = "5";
"pm.max_spare_servers" = "20";
"pm.max_requests" = "10";
"catch_workers_output" = "1";
"php_admin_value[error_log]" = "stderr";
"pm.max_children" = 5;
"pm.start_servers" = 2;
"pm.min_spare_servers" = 1;
"pm.max_spare_servers" = 3;
"php_admin_value[error_log]" = "/var/log/wallabag/error.log";
"php_admin_value[access_log]" = "/var/log/wallabag/access.log";
"php_admin_flag[log_errors]" = true;
};
};
services.phpfpm.phpOptions = ''
max_execution_time = 120
phpOptions = ''
; Set up $_ENV superglobal.
; http://php.net/request-order
variables_order = "EGPCS"
# Wallabag will crash on start-up.
# https://github.com/wallabag/wallabag/issues/6042
# error_reporting = E_ALL & ~E_USER_DEPRECATED & ~E_DEPRECATED
'';
services.nginx.enable = mkDefault true;
environment.systemPackages = [ console ];
# services.nginx.virtualHosts."${cfg.hostName}" = {
# forceSSL = false;
# enableACME = false;
# extraConfig = ''
# error_log /var/log/nginx/wallabag_error.log;
# access_log /var/log/nginx/wallabag_access.log;
# '';
# root = "${cfg.package}/web";
# locations."/" = {
# priority = 10;
# tryFiles = "$uri /app.php$is_args$args";
# };
# locations."/assets".root = "${cfg.dataDir}/web";
# locations."~ ^/app\\.php(/|$)" = {
# priority = 100;
# fastcgiParams = {
# SCRIPT_FILENAME = "$realpath_root$fastcgi_script_name";
# DOCUMENT_ROOT = "$realpath_root";
# };
# extraConfig = ''
# fastcgi_pass unix:${config.services.phpfpm.pools."${poolName}".socket};
# include ${config.services.nginx.package}/conf/fastcgi_params;
# include ${config.services.nginx.package}/conf/fastcgi.conf;
# internal;
# '';
# };
# locations."~ \\.php$" = {
# priority = 1000;
# return = "404";
# };
# };
services.nginx.virtualHosts."${cfg.hostName}" = {
enableACME = false;
forceSSL = false;
root = "${cfg.package}/web";
# extraConfig = ''
# add_header X-Frame-Options SAMEORIGIN;
# add_header X-Content-Type-Options nosniff;
# add_header X-XSS-Protection "1; mode=block";
# '';
locations."/" = {
tryFiles = "$uri /app.php$is_args$args";
};
locations."/assets".root = "${cfg.dataDir}/web";
locations."~ ^/app\\.php(/|$)" = {
# fastcgiParams = {
# SCRIPT_FILENAME = "$realpath_root$fastcgi_script_name";
# DOCUMENT_ROOT = "$realpath_root";
# };
extraConfig = ''
fastcgi_pass unix:${config.services.phpfpm.pools."${poolName}".socket};
fastcgi_split_path_info ^(.+\.php)(/.*)$;
include ${pkgs.nginx}/conf/fastcgi_params;
fastcgi_param SCRIPT_FILENAME ${cfg.package}/web/$fastcgi_script_name;
fastcgi_param DOCUMENT_ROOT ${cfg.package}/web;
fastcgi_read_timeout 120;
internal;
'';
};
locations."~ /(?!app)\\.php$" = {
extraConfig = ''
return 404;
'';
settings = {
# Accept settings from the systemd service.
clear_env = false;
};
};
users.users.wallabag = {
isSystemUser = true;
group = "wallabag";
};
users.groups.wallabag = {};
services.redis.servers.wallabag = {
enable = true;
user = "wallabag";
};
services.rabbitmq.enable = false;
systemd.services.phpfpm-wallabag.serviceConfig = commonServiceConfig;
systemd.services.wallabag-install = {
description = "Wallabag install service";
wantedBy = [ "multi-user.target" ];
before = [ "phpfpm-wallabag.service" ];
after = [ "mysql.service" "postgresql.service" ];
after = [ "postgresql.service" ];
path = with pkgs; [ coreutils php phpPackages.composer ];
serviceConfig = {
User = cfg.user;
User = "wallabag";
Type = "oneshot";
RemainAfterExit = "yes";
PermissionsStartOnly = true;
};
preStart = ''
mkdir -p "${cfg.dataDir}"
chown ${cfg.user}:nginx "${cfg.dataDir}"
'';
} // commonServiceConfig;
script = ''
echo "Setting up wallabag files in ${cfg.dataDir} ..."
cd "${cfg.dataDir}"
rm -rf var/cache/*
rm -f app src translations
ln -sf ${appDir}/app app
ln -sf ${appDir}/src src
ln -sf ${appDir}/translations translations
ln -sf ${cfg.package}/composer.{json,lock} .
export WALLABAG_DATA="${cfg.dataDir}"
if [ ! -f installed ]; then
echo "Install file not found, installing ..."
php ${cfg.package}/bin/console --env=prod doctrine:database:create --if-not-exists --no-interaction
php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction
# Until https://github.com/wallabag/wallabag/issues/3662 is fixed
# yes no | php ${cfg.package}/bin/console --env=prod wallabag:install
touch installed
else
php ${cfg.package}/bin/console --env=prod doctrine:migrations:migrate --no-interaction
fi
php ${cfg.package}/bin/console --env=prod cache:clear
'';
if [ ! -f "$STATE_DIRECTORY/installed" ]; then
php ${pkgs.wallabag}/bin/console --env=prod wallabag:install
touch "$STATE_DIRECTORY/installed"
else
php ${pkgs.wallabag}/bin/console --env=prod doctrine:migrations:migrate --no-interaction
fi
php ${pkgs.wallabag}/bin/console --env=prod cache:clear
'';
};
};
meta = with stdenv.lib; {
maintainers = with maintainers; [ nadrieril ];
};
}

View file

@ -14,6 +14,15 @@
buildInputs = prevAttrs.propagatedBuildInputs ++ [ final.python3.pkgs.aiosqlite ]; # We're using sqlite and upstream doesn't package this dependency
});
wallabag = prev.wallabag.overrideAttrs (attrs: {
patches = builtins.filter (patch: builtins.baseNameOf patch != "wallabag-data.patch") attrs.patches ++ [
# Out of the box, Wallabag wants to write to various subdirectories of the project directory.
# Lets replace references to such paths with designated systemd locations
# so that the project source can remain immutable.
../pkgs/wallabag-data.patch
];
});
# Need to do server and agent too, maybe
# woodpecker-cli-next =
# let

View file

@ -8,6 +8,10 @@
kobopatch = pkgs.callPackage ./kobopatch.nix { };
my-mautrix-discord = pkgs.callPackage ./mautrix-discord.nix { }; # Handled by matrix-appservices input
ulogger-server = pkgs.callPackage ./ulogger.nix { };
# Wallabag is now an overlay
# TODO: we still use the patch from this folder though
my-wallabag = pkgs.callPackage ./wallabag.nix { };
mautrix-slack = pkgs.callPackage ./mautrix-slack.nix { };
gpodder2go = pkgs.callPackage ./gpodder2go.nix { };
ghost = pkgs.callPackage ./ghost { };
}

14
pkgs/gpodder2go.nix Normal file
View file

@ -0,0 +1,14 @@
{ pkgs, ... }:
pkgs.buildGoModule rec {
name = "gpodder2go";
src = pkgs.fetchFromGitHub {
owner = "oxtyped";
repo = "gpodder2go";
rev = "v0.1.2";
hash = "sha256-RAt0rd4DZwI7b7IEFd1o4s4ivADzgzBzBaeGVL8OmYo";
};
vendorHash = "sha256-mbSgY5WjIAesT27uRgaiRF3N06yuUntjTp6kjUMh6Bw";
doCheck = false;
}

View file

@ -1,26 +1,55 @@
diff --git a/app/AppKernel.php b/app/AppKernel.php
index 61b734e06..d25d1aaa3 100644
index 61b734e06..0902c20fc 100644
--- a/app/AppKernel.php
+++ b/app/AppKernel.php
@@ -62,14 +62,19 @@ class AppKernel extends Kernel
return $bundles;
}
@@ -64,12 +64,12 @@ class AppKernel extends Kernel
+ public function getProjectDir()
+ {
+ return getenv('WALLABAG_DATA') ?: dirname(__DIR__);
+ }
+
public function getCacheDir()
{
- return dirname(__DIR__) . '/var/cache/' . $this->getEnvironment();
+ return $this->getProjectDir() . '/var/cache/' . $this->getEnvironment();
+ return getenv('CACHE_DIRECTORY') . '/' . $this->getEnvironment();
}
public function getLogDir()
{
- return dirname(__DIR__) . '/var/logs';
+ return $this->getProjectDir() . '/var/logs';
+ return getenv('LOGS_DIRECTORY');
}
public function registerContainerConfiguration(LoaderInterface $loader)
diff --git a/app/config/config.yml b/app/config/config.yml
index 7f0a4ca6c..77b5175c8 100644
--- a/app/config/config.yml
+++ b/app/config/config.yml
@@ -1,5 +1,7 @@
imports:
- - { resource: parameters.yml }
+ # Unfortunately, we cannot use %env(string:CONFIGURATION_DIRECTORY)%. Hardcoding the path for simplicity.
+ # https://symfony.com/doc/current/service_container/import.html#importing-configuration-with-imports
+ - { resource: '/etc/wallabag/parameters.yml' }
- { resource: security.yml }
- { resource: services.yml }
- { resource: wallabag.yml }
@@ -28,7 +30,7 @@ framework:
session:
# handler_id set to null will use default session handler from php.ini
handler_id: session.handler.native_file
- save_path: "%kernel.project_dir%/var/sessions/%kernel.environment%"
+ save_path: "%env(string:CACHE_DIRECTORY)%/sessions/%kernel.environment%"
cookie_secure: auto
fragments: ~
http_method_override: true
diff --git a/app/config/wallabag.yml b/app/config/wallabag.yml
index bd57d6377..8e1cd0970 100644
--- a/app/config/wallabag.yml
+++ b/app/config/wallabag.yml
@@ -35,7 +35,7 @@ wallabag_core:
fetching_error_message: |
wallabag can't retrieve contents for this article. Please <a href="https://doc.wallabag.org/en/user/errors_during_fetching.html#how-can-i-help-to-fix-that">troubleshoot this issue</a>.
api_limit_mass_actions: 10
- encryption_key_path: "%kernel.project_dir%/data/site-credentials-secret-key.txt"
+ encryption_key_path: "%env(string:STATE_DIRECTORY)%/site-credentials-secret-key.txt"
default_internal_settings:
-
name: share_public

View file

@ -15,7 +15,7 @@
let
pname = "wallabag";
version = "2.6.8";
version = "2.6.9";
in
stdenv.mkDerivation {
inherit pname version;
@ -23,7 +23,7 @@ stdenv.mkDerivation {
# Release tarball includes vendored files
src = fetchurl {
url = "https://github.com/wallabag/wallabag/releases/download/${version}/wallabag-${version}.tar.gz";
hash = "sha256-pmQXafqpd5rTwBIYG9NnwIIPta6Ek7iYaPaHvz1s550=";
hash = "sha256-V4s5/y9fFAmZ+WnUxU03UyRivEihD1ZUKQOOq4TLEKw=";
};
patches = [