dotfiles/nixos/boxes/vpsfree1/mastodon.nix

137 lines
3.5 KiB
Nix
Raw Normal View History

2022-11-26 11:10:35 +00:00
{ config, pkgs, inputs, lib, ... }:
let
domain = "peninsula.industries";
streamingPort = 55000;
webPort = 55001;
postgresPort = 5433;
path = "/var/lib/mastodon/";
mailgunSmtpSecretName = "mailgun-smtp-password";
mailgunSmtpPasswordPath = "/run/secrets/${mailgunSmtpSecretName}";
mastodonDbSecretName = "mastodon-db";
mastodonDbSecretPath = "/run/secrets/${mastodonDbSecretName}";
uid = 2049;
gid = 3049;
systemUserName = "mastodon";
systemGroupName = "mastodon";
users = {
users."${systemUserName}" = {
uid = uid;
isSystemUser = true;
isNormalUser = false;
group = systemGroupName;
};
groups."${systemGroupName}" = {
gid = gid;
members = [ "${systemUserName}" "nginx" ];
};
};
package =
inputs.nixpkgs-nixos-unstable.legacyPackages."${pkgs.system}".mastodon;
2022-11-26 11:10:35 +00:00
in {
imports = [ ../nginx.nix ];
services.nginx = {
virtualHosts = {
"${domain}" = {
forceSSL = true;
enableACME = true;
root = "${package}/public/";
2022-11-26 11:10:35 +00:00
locations."/" = { tryFiles = "$uri @proxy"; };
locations."/system/".alias = "${path}/public-system/";
2022-11-26 11:10:35 +00:00
locations."@proxy" = {
proxyPass = "http://127.0.0.1:" + toString webPort;
2022-11-26 11:10:35 +00:00
proxyWebsockets = true;
};
locations."/api/v1/streaming/" = {
proxyPass = "http://127.0.0.1:" + toString streamingPort;
2022-11-26 11:10:35 +00:00
proxyWebsockets = true;
};
};
};
};
sops.secrets."${mailgunSmtpSecretName}" = {
sopsFile = ./mailgun.sops.yaml;
path = mailgunSmtpPasswordPath;
owner = systemUserName;
group = systemGroupName;
};
sops.secrets."${mastodonDbSecretName}" = {
sopsFile = ./mastodon-db.sops.yaml;
path = mastodonDbSecretPath;
owner = systemUserName;
group = systemGroupName;
};
inherit users;
2022-11-26 11:10:35 +00:00
containers.mastodon = {
autoStart = true;
forwardPorts = [
{
containerPort = streamingPort;
hostPort = streamingPort;
}
{
containerPort = webPort;
hostPort = webPort;
}
];
bindMounts = {
"${path}" = {
hostPath = "${path}";
isReadOnly = false;
};
"${mailgunSmtpPasswordPath}" = {
hostPath = "${mailgunSmtpPasswordPath}";
isReadOnly = true;
};
"${mastodonDbSecretPath}" = {
hostPath = "${mastodonDbSecretPath}";
isReadOnly = true;
};
};
config = { config, pkgs, lib, ... }: {
system.stateVersion = "22.05";
services.postgresql.port = postgresPort;
users = users // {
mutableUsers = false;
allowNoPasswordLogin = true;
2022-11-26 11:10:35 +00:00
};
services.mastodon = {
enable = true;
inherit package;
2022-11-26 11:10:35 +00:00
localDomain = "${domain}";
user = systemUserName;
group = systemGroupName;
smtp = {
host = "smtp.eu.mailgun.org";
port = 465;
authenticate = true;
user = "postmaster@${domain}";
fromAddress = "Peninsula Industries Mastodon <mastodon@${domain}>";
createLocally = false;
passwordFile = "${mailgunSmtpPasswordPath}";
};
extraConfig = {
SMTP_TLS = "true";
SMTP_ENABLE_STARTTLS_AUTO = "true";
2022-11-26 13:26:12 +00:00
SINGLE_USER_MODE = "true";
RAILS_SERVE_STATIC_FILES = "true";
2022-11-26 11:10:35 +00:00
};
inherit streamingPort;
inherit webPort;
configureNginx = false;
enableUnixSocket = false;
database = {
port = postgresPort;
passwordFile = mastodonDbSecretPath;
};
};
};
};
}