246 lines
		
	
	
		
			7.1 KiB
		
	
	
	
		
			Nix
		
	
	
	
	
	
			
		
		
	
	
			246 lines
		
	
	
		
			7.1 KiB
		
	
	
	
		
			Nix
		
	
	
	
	
	
| { config, lib, pkgs, ... }:
 | |
| let
 | |
|   # Based on https://github.com/wallabag/wallabag/blob/2.6.6/app/config/parameters.yml.dist
 | |
|   settings = {
 | |
|     database_driver = "${cfg.database_type}";
 | |
|     database_host = null;
 | |
|     database_port = 5432;
 | |
|     database_name = "wallabag";
 | |
|     database_user = "wallabag";
 | |
|     database_password = null;
 | |
|     database_path = null;
 | |
|     database_table_prefix = "wallabag_";
 | |
|     database_socket = "/run/postgresql";
 | |
|     database_charset = "utf8";
 | |
| 
 | |
|     domain_name = "http://${cfg.domain}";
 | |
|     server_name = "Wallabag";
 | |
| 
 | |
|     # Needs an explicit command since Symfony version used by Wallabag does not yet support the `native` transport
 | |
|     # and the `sendmail` transport does not respect `sendmail_path` configured in `php.ini`.
 | |
|     mailer_dsn = "sendmail://default?command=/run/wrappers/bin/sendmail%%20-t%%20-i";
 | |
| 
 | |
|     locale = "en";
 | |
| 
 | |
|     # A secret key that's used to generate certain security-related tokens.
 | |
|     # "env(SECRET_FILE)" = "/run/secrets/wallabag";
 | |
|     # secret = "%env(file:resolve:SECRET_FILE)%";
 | |
| 
 | |
|     # two factor stuff
 | |
|     twofactor_auth = false;
 | |
|     twofactor_sender = "";
 | |
| 
 | |
|     # fosuser stuff
 | |
|     fosuser_registration = false;
 | |
|     fosuser_confirmation = false;
 | |
| 
 | |
|     # how long the access token should live in seconds for the API
 | |
|     fos_oauth_server_access_token_lifetime = 3600;
 | |
|     # how long the refresh token should life in seconds for the API
 | |
|     fos_oauth_server_refresh_token_lifetime = 1209600;
 | |
| 
 | |
|     from_email = "wallabag@read.mossnet.lan";
 | |
| 
 | |
|     # RabbitMQ processing
 | |
|     redis_scheme = "unix";
 | |
|     redis_host = ""; # Ignored for unix scheme
 | |
|     redis_port = 0; # Ignored for unix scheme
 | |
|     redis_path = config.services.redis.servers.wallabag.unixSocket;
 | |
|     redis_password = null;
 | |
| 
 | |
|     # Redis processing
 | |
|     rabbitmq_host = "";
 | |
|     rabbitmq_port = 0;
 | |
|     rabbitmq_user = "";
 | |
|     rabbitmq_password = "";
 | |
|     rabbitmq_prefetch_count = 0;
 | |
| 
 | |
|     # sentry logging
 | |
|     sentry_dsn = null;
 | |
|   } // cfg.parameters;
 | |
| 
 | |
|   php = cfg.php.package.withExtensions ({ enabled, all }: enabled ++ (with all; [
 | |
|     imagick
 | |
|     tidy
 | |
|   ]));
 | |
| 
 | |
|   commonServiceConfig = {
 | |
|     CacheDirectory = "wallabag";
 | |
|     # Stores sessions.
 | |
|     CacheDirectoryMode = "700";
 | |
|     ConfigurationDirectory = "wallabag";
 | |
|     LogsDirectory = "wallabag";
 | |
|     StateDirectory = "wallabag";
 | |
|     # Stores site-credentials-secret-key.txt.
 | |
|     StateDirectoryMode = "700";
 | |
|   };
 | |
| 
 | |
|   cfg = config.services.wallabag;
 | |
| in {
 | |
|   options.services.wallabag = with lib; {
 | |
|     enable = mkEnableOption (mdDoc "Wallabag read-it-later service");
 | |
| 
 | |
|     package = mkOption {
 | |
|       type = types.package;
 | |
|       default = pkgs.wallabag;
 | |
|     };
 | |
| 
 | |
|     php.package = mkOption {
 | |
|       type = types.package;
 | |
|       default = pkgs.php;
 | |
|     };
 | |
| 
 | |
|     parameters = mkOption {
 | |
|       type = types.attrsOf types.str;
 | |
|       default = {};
 | |
|       description = mdDoc "Parameters to override from the default. See <https://doc.wallabag.org/en/admin/parameters.html> for values.";
 | |
|     };
 | |
| 
 | |
|     database_type = mkOption {
 | |
|       type = types.enum [
 | |
|         "pdo_sqlite3"
 | |
|         "pdo_pgsql"
 | |
|       ];
 | |
|       default = if config.services.postgresql.enable
 | |
|                 then "pdo_pgsql"
 | |
|                 else "pdo_sqlite3";
 | |
|       defaultText = ''
 | |
|         if config.services.postgresql.enable
 | |
|         then "pdo_pgsql"
 | |
|         else "pdo_sqlite3"
 | |
|       '';
 | |
|       description = mdDoc ''
 | |
|         The database engine name. Can be pdo_sqlite3 or pdo_pgsql.
 | |
|       '';
 | |
|     };
 | |
| 
 | |
|     domain = mkOption {
 | |
|       type = types.str;
 | |
|       description = "Bare domain name for Wallabag";
 | |
|     };
 | |
| 
 | |
|     virtualHost.enable = mkEnableOption (mdDoc "Define nginx virtualhost for Wallabag");
 | |
|   };
 | |
| 
 | |
|   config = lib.mkIf cfg.enable {
 | |
|     environment.etc."wallabag/parameters.yml" = {
 | |
|       source = pkgs.writeTextFile {
 | |
|         name = "wallabag-config";
 | |
|         text = builtins.toJSON {
 | |
|           parameters = settings;
 | |
|         };
 | |
|       };
 | |
|     };
 | |
| 
 | |
|     services.nginx = lib.mkIf cfg.virtualHost.enable {
 | |
|       enable = true;
 | |
| 
 | |
|       virtualHosts = {
 | |
|         "${cfg.domain}" = {
 | |
|           root = "${pkgs.wallabag}/web";
 | |
| 
 | |
|           extraConfig = ''
 | |
|           add_header X-Frame-Options SAMEORIGIN;
 | |
|           add_header X-Content-Type-Options nosniff;
 | |
|           add_header X-XSS-Protection "1; mode=block";
 | |
|         '';
 | |
| 
 | |
|           locations."/" = {
 | |
|             extraConfig = ''
 | |
|             try_files $uri /app.php$is_args$args;
 | |
|           '';
 | |
|           };
 | |
| 
 | |
|           locations."/assets".root = "${pkgs.wallabag}/app/web";
 | |
| 
 | |
|           locations."~ ^/app\\.php(/|$)" = {
 | |
|             extraConfig = ''
 | |
|             fastcgi_pass unix:${config.services.phpfpm.pools.wallabag.socket};
 | |
|             include ${config.services.nginx.package}/conf/fastcgi.conf;
 | |
|             fastcgi_param PATH_INFO $fastcgi_path_info;
 | |
|             fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
 | |
|             fastcgi_param SCRIPT_FILENAME ${pkgs.wallabag}/web/$fastcgi_script_name;
 | |
|             fastcgi_param DOCUMENT_ROOT ${pkgs.wallabag}/web;
 | |
|             fastcgi_read_timeout 120;
 | |
|             internal;
 | |
|           '';
 | |
|           };
 | |
| 
 | |
|           locations."~ /(?!app)\\.php$" = {
 | |
|             extraConfig = ''
 | |
|             return 404;
 | |
|           '';
 | |
|           };
 | |
|         };
 | |
|       };
 | |
|     };
 | |
| 
 | |
|     services.phpfpm.pools.wallabag = {
 | |
|       user = config.users.users.wallabag.name;
 | |
|       phpPackage = php;
 | |
|       settings = {
 | |
|         "catch_workers_output" = true;
 | |
| 
 | |
|         "listen.owner" = config.services.nginx.user;
 | |
|         "listen.group" = "root";
 | |
|         "pm" = "dynamic";
 | |
|         "pm.max_children" = 5;
 | |
|         "pm.start_servers" = 2;
 | |
|         "pm.min_spare_servers" = 1;
 | |
|         "pm.max_spare_servers" = 3;
 | |
|         "php_admin_value[error_log]" = "/var/log/wallabag/error.log";
 | |
|         "php_admin_value[access_log]" = "/var/log/wallabag/access.log";
 | |
|         "php_admin_flag[log_errors]" = true;
 | |
|       };
 | |
|       phpOptions = ''
 | |
|       ; Set up $_ENV superglobal.
 | |
|       ; http://php.net/request-order
 | |
|       variables_order = "EGPCS"
 | |
|       # Wallabag will crash on start-up.
 | |
|       # https://github.com/wallabag/wallabag/issues/6042
 | |
|       # error_reporting = E_ALL & ~E_USER_DEPRECATED & ~E_DEPRECATED
 | |
|     '';
 | |
|       settings = {
 | |
|         # Accept settings from the systemd service.
 | |
|         clear_env = false;
 | |
|       };
 | |
|     };
 | |
| 
 | |
|     users.users.wallabag = {
 | |
|       isSystemUser = true;
 | |
|       group = "wallabag";
 | |
|     };
 | |
|     users.groups.wallabag = {};
 | |
|     services.redis.servers.wallabag = {
 | |
|       enable = true;
 | |
|       user = "wallabag";
 | |
|     };
 | |
|     services.rabbitmq.enable = false;
 | |
| 
 | |
|     systemd.services.phpfpm-wallabag.serviceConfig = commonServiceConfig;
 | |
| 
 | |
|     systemd.services.wallabag-install = {
 | |
|       description = "Wallabag install service";
 | |
|       wantedBy = [ "multi-user.target" ];
 | |
|       before = [ "phpfpm-wallabag.service" ];
 | |
|       after = [ "postgresql.service" ];
 | |
|       path = with pkgs; [ coreutils php phpPackages.composer ];
 | |
| 
 | |
|       serviceConfig = {
 | |
|         User = "wallabag";
 | |
|         Type = "oneshot";
 | |
|       } // commonServiceConfig;
 | |
| 
 | |
|       script = ''
 | |
|       if [ ! -f "$STATE_DIRECTORY/installed" ]; then
 | |
|         php ${pkgs.wallabag}/bin/console --env=prod wallabag:install
 | |
|         touch "$STATE_DIRECTORY/installed"
 | |
|       else
 | |
|         php ${pkgs.wallabag}/bin/console --env=prod doctrine:migrations:migrate --no-interaction
 | |
|       fi
 | |
|       php ${pkgs.wallabag}/bin/console --env=prod cache:clear
 | |
|     '';
 | |
|     };
 | |
|   };
 | |
| }
 |