{ config, pkgs, inputs, lib, ... }: let domain = "peninsula.industries"; streamingPort = 55000; webPort = 55001; postgresPort = 5433; path = "/var/lib/mastodon/"; mailgunSmtpSecretName = "mailgun-smtp-password"; mailgunSmtpPasswordPath = "/run/secrets/${mailgunSmtpSecretName}"; mastodonDbSecretName = "mastodon-db"; mastodonDbSecretPath = "/run/secrets/${mastodonDbSecretName}"; uid = 2049; gid = 3049; systemUserName = "mastodon"; systemGroupName = "mastodon"; users = { users."${systemUserName}" = { uid = uid; isSystemUser = true; isNormalUser = false; group = systemGroupName; }; groups."${systemGroupName}" = { gid = gid; members = [ "${systemUserName}" "nginx" ]; }; }; secretSettings = { owner = systemUserName; group = systemGroupName; }; publicPath = "${path}/public-system/"; package = inputs.nixpkgs-nixos-unstable.legacyPackages."${pkgs.system}".mastodon; in { imports = [ ../nginx.nix ]; services.nginx = { virtualHosts = { "${domain}" = { forceSSL = true; enableACME = true; root = "${package}/public/"; locations."/" = { tryFiles = "$uri @proxy"; }; locations."/system/".alias = "${publicPath}"; locations."@proxy" = { proxyPass = "http://127.0.0.1:" + toString webPort; proxyWebsockets = true; }; locations."/api/v1/streaming/" = { proxyPass = "http://127.0.0.1:" + toString streamingPort; proxyWebsockets = true; }; }; }; }; sops.secrets."${mailgunSmtpSecretName}" = { sopsFile = ./mailgun.sops.yaml; path = mailgunSmtpPasswordPath; } // secretSettings; sops.secrets."${mastodonDbSecretName}" = { sopsFile = ./mastodon-db.sops.yaml; path = mastodonDbSecretPath; } // secretSettings; inherit users; systemd.services.mastodon-make-path = { script = '' mkdir -p ${path} chown -R ${systemUserName}:${systemGroupName} ${path} mkdir -p ${publicPath} chmod -R o-rwx ${publicPath} chmod -R g-rwx ${publicPath} chmod -R g+X ${publicPath} chmod -R g+r ${publicPath} ''; serviceConfig = { Type = "oneshot"; ProtectSystem = "strict"; ReadWritePaths = path; }; before = [ "container@mastodon.service" ]; }; containers.mastodon = { autoStart = true; forwardPorts = [ { containerPort = streamingPort; hostPort = streamingPort; } { containerPort = webPort; hostPort = webPort; } ]; bindMounts = { "${path}" = { hostPath = "${path}"; isReadOnly = false; }; "${mailgunSmtpPasswordPath}" = { hostPath = "${mailgunSmtpPasswordPath}"; isReadOnly = true; }; "${mastodonDbSecretPath}" = { hostPath = "${mastodonDbSecretPath}"; isReadOnly = true; }; }; config = { config, pkgs, lib, ... }: { system.stateVersion = "22.05"; services.postgresql.port = postgresPort; users = users // { mutableUsers = false; allowNoPasswordLogin = true; }; services.mastodon = { enable = true; inherit package; localDomain = "${domain}"; user = systemUserName; group = systemGroupName; smtp = { host = "smtp.eu.mailgun.org"; port = 465; authenticate = true; user = "postmaster@${domain}"; fromAddress = "Peninsula Industries Mastodon "; createLocally = false; passwordFile = "${mailgunSmtpPasswordPath}"; }; extraConfig = { SMTP_TLS = "true"; SMTP_ENABLE_STARTTLS_AUTO = "true"; SINGLE_USER_MODE = "true"; RAILS_SERVE_STATIC_FILES = "true"; }; inherit streamingPort; inherit webPort; configureNginx = false; enableUnixSocket = false; database = { port = postgresPort; passwordFile = mastodonDbSecretPath; }; }; }; }; }