jawz/NixOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fixed servers/nginx quirks on 24.05

Browse Source
This commit is contained in:
Danilo Reyes 2024-06-09 14:15:32 -06:00
parent 5faf09f546
commit 2998c6fe40
8 changed files with 285 additions and 188 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
hosts/miniserver/configuration.nix
View File

@ -22,9 +22,9 @@ in {
ffmpreg.enable = true; ffmpreg.enable = true;
ffmpeg4discord.enable = true; ffmpeg4discord.enable = true;
manage-library.enable = true; manage-library.enable = true;
sync-subs.enable = true;
pika-list.enable = true; pika-list.enable = true;
find-dup-episodes.enable = true; find-dup-episodes.enable = true;
update-dns.enable = true;
}; };
}; };
fonts.fontconfig.enable = true; fonts.fontconfig.enable = true;
@ -112,14 +112,7 @@ in {
# }; # };
}; };
systemd = { systemd = {
packages = let packages = [ pkgs.qbittorrent-nox ];
pkgs = import (builtins.fetchTarball {
url =
"https://github.com/NixOS/nixpkgs/archive/9957cd48326fe8dbd52fdc50dd2502307f188b0d.tar.gz";
}) { };
myPkg = pkgs.qbittorrent-nox;
in [ myPkg ];
services = { services = {
"qbittorrent-nox@jawz" = { "qbittorrent-nox@jawz" = {
enable = true; enable = true;

66
hosts/miniserver/nginx.nix
View File

@ -2,30 +2,30 @@
# and may be overwritten by future invocations. Please make changes # and may be overwritten by future invocations. Please make changes
# to /etc/nixos/configuration.nix instead. # to /etc/nixos/configuration.nix instead.
{ config, lib, pkgs, modulesPath, ... }: { config, ... }:
let let
localhost = "127.0.0.1"; localhost = "127.0.0.1";
workstation = "192.168.1.64"; # workstation = "192.168.1.64";
domain = "servidos.lat"; domain = "servidos.lat";
jellyfinPort = 8096; jellyfinPort = 8096;
nextcloudPort = 80; shioriPort = 4368;
# nextcloudPort = 80;
collaboraPort = 9980; collaboraPort = 9980;
flamePort = 5005; flamePort = 5005;
secretFlamePort = 5007; secretFlamePort = 5007;
lidarrPort = 8686; # lidarrPort = 8686;
qbitPort = 9091; qbitPort = 9091;
prowlarrPort = 9696; # prowlarrPort = 9696;
radarrPort = 7878; # radarrPort = 7878;
sonarrPort = 8989; # sonarrPort = 8989;
mealiePort = 9925; mealiePort = 9925;
ryotPort = 8765; ryotPort = 8765;
scrobblePort = 9078; scrobblePort = 9078;
malojaPort = 42010; malojaPort = 42010;
darkwirePort = 3001; darkwirePort = 3001;
jiraPort = 8091;
metatubePort = 8881; metatubePort = 8881;
bazarrPort = config.services.bazarr.listenPort; # bazarrPort = config.services.bazarr.listenPort;
kavitaPort = config.services.kavita.port; # kavitaPort = config.services.kavita.port;
vaultPort = config.services.vaultwarden.config.ROCKET_PORT; vaultPort = config.services.vaultwarden.config.ROCKET_PORT;
audiobookPort = config.services.audiobookshelf.port; audiobookPort = config.services.audiobookshelf.port;
microbinPort = config.services.microbin.settings.MICROBIN_PORT; microbinPort = config.services.microbin.settings.MICROBIN_PORT;
@ -52,21 +52,21 @@ in {
http2 = true; http2 = true;
}; };
proxy = port: proxy = port:
base { "/".proxyPass = "http://${localhost}:${toString (port)}/"; }; base { "/".proxyPass = "http://${localhost}:${toString port}/"; };
proxyArr = port: # proxyArr = port:
proxy port // { # proxy port // {
extraConfig = '' # extraConfig = ''
proxy_set_header Host $host; # proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $host; # proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Proto $scheme; # proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Upgrade $http_upgrade; # proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $http_connection; # proxy_set_header Connection $http_connection;
proxy_redirect off; # proxy_redirect off;
proxy_http_version 1.1; # proxy_http_version 1.1;
''; # '';
}; # };
in { in {
# "movies.${domain}" = proxyArr radarrPort // { }; # "movies.${domain}" = proxyArr radarrPort // { };
# "indexer.${domain}" = proxyArr prowlarrPort // { }; # "indexer.${domain}" = proxyArr prowlarrPort // { };
@ -81,13 +81,13 @@ in {
"tracker.${domain}" = proxy ryotPort // { }; "tracker.${domain}" = proxy ryotPort // { };
"scrobble.${domain}" = proxy scrobblePort // { }; "scrobble.${domain}" = proxy scrobblePort // { };
"maloja.${domain}" = proxy malojaPort // { }; "maloja.${domain}" = proxy malojaPort // { };
"jira.${domain}" = proxy jiraPort // { }; "bookmarks.${domain}" = proxy shioriPort // { };
"bajameesta.${domain}" = proxy metatubePort // { }; "bajameesta.${domain}" = proxy metatubePort // { };
"qampqwn4wprhqny8h8zj.${domain}" = proxy secretFlamePort // { }; "qampqwn4wprhqny8h8zj.${domain}" = proxy secretFlamePort // { };
"xfwmrle6h6skqujbeizw.${domain}" = proxy qbitPort // { }; "xfwmrle6h6skqujbeizw.${domain}" = proxy qbitPort // { };
"audiobooks.${domain}" = base { "audiobooks.${domain}" = base {
"/" = { "/" = {
proxyPass = "http://${localhost}:${toString (audiobookPort)}"; proxyPass = "http://${localhost}:${toString audiobookPort}";
extraConfig = '' extraConfig = ''
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-Proto $scheme;
@ -103,7 +103,7 @@ in {
}; };
"dontcancelmeplz.${domain}" = base { "dontcancelmeplz.${domain}" = base {
"/" = { "/" = {
proxyPass = "http://${localhost}:${toString (darkwirePort)}"; proxyPass = "http://${localhost}:${toString darkwirePort}";
proxyWebsockets = true; proxyWebsockets = true;
extraConfig = '' extraConfig = ''
# Ensuring it can use websockets # Ensuring it can use websockets
@ -143,7 +143,7 @@ in {
location = /web/ { location = /web/ {
# Proxy main Jellyfin traffic # Proxy main Jellyfin traffic
proxy_pass http://${localhost}:${ proxy_pass http://${localhost}:${
toString (jellyfinPort) toString jellyfinPort
}/web/index.html; }/web/index.html;
proxy_set_header Host $host; proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Real-IP $remote_addr;
@ -155,11 +155,11 @@ in {
''; '';
locations = { locations = {
"/" = { "/" = {
proxyPass = "http://${localhost}:${toString (jellyfinPort)}"; proxyPass = "http://${localhost}:${toString jellyfinPort}";
proxyWebsockets = true; proxyWebsockets = true;
}; };
"/socket" = { "/socket" = {
proxyPass = "http://${localhost}:${toString (jellyfinPort)}"; proxyPass = "http://${localhost}:${toString jellyfinPort}";
extraConfig = '' extraConfig = ''
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
@ -167,7 +167,7 @@ in {
''; '';
}; };
"~ /Items/(.*)/Images" = { "~ /Items/(.*)/Images" = {
proxyPass = "http://${localhost}:${toString (jellyfinPort)}"; proxyPass = "http://${localhost}:${toString jellyfinPort}";
extraConfig = '' extraConfig = ''
proxy_cache jellyfin; proxy_cache jellyfin;
proxy_cache_revalidate on; proxy_cache_revalidate on;
@ -175,7 +175,7 @@ in {
''; '';
}; };
"~* ^/Videos/(.*)/(?!live)" = { "~* ^/Videos/(.*)/(?!live)" = {
proxyPass = "http://${localhost}:${toString (jellyfinPort)}"; proxyPass = "http://${localhost}:${toString jellyfinPort}";
extraConfig = '' extraConfig = ''
# Set size of a slice (this amount will be always requested from the backend by nginx) # Set size of a slice (this amount will be always requested from the backend by nginx)
# Higher value means more latency, lower more overhead # Higher value means more latency, lower more overhead
@ -219,7 +219,7 @@ in {
}; };
"collabora.${domain}" = let "collabora.${domain}" = let
collaboraString = "http://${localhost}:${toString (collaboraPort)}"; collaboraString = "http://${localhost}:${toString collaboraPort}";
collaboraProxy = { collaboraProxy = {
proxyPass = collaboraString; proxyPass = collaboraString;
extraConfig = '' extraConfig = ''

195
hosts/miniserver/servers.nix
View File

@ -1,49 +1,44 @@
{ config, lib, pkgs, modulesPath, ... }: { config, pkgs, ... }:
let let
localhost = "127.0.0.1"; localhost = "127.0.0.1";
postgresSocket = "/run/postgresql"; postgresSocket = "/run/postgresql";
unstable = import
(builtins.fetchTarball "https://github.com/nixos/nixpkgs/tarball/master") {
config = config.nixpkgs.config;
};
in { in {
disabledModules = [ "services/web-apps/shiori.nix" ];
imports = [ ./nginx.nix ]; imports = [ ./nginx.nix ../../pkgs/shiori/shiori-service.nix ];
nixpkgs.config = { nixpkgs.config = {
permittedInsecurePackages = [ "nodejs-14.21.3" "openssl-1.1.1v" ]; permittedInsecurePackages = [ "nodejs-14.21.3" "openssl-1.1.1v" ];
}; };
environment.systemPackages = with pkgs; environment.systemPackages = [
[ # Upgrades postgres
# Upgrades postgres (let
(let # XXX specify the postgresql package you'd like to upgrade to.
# XXX specify the postgresql package you'd like to upgrade to. # Do not forget to list the extensions you need.
# Do not forget to list the extensions you need. newPostgres = pkgs.postgresql_16.withPackages (pp:
newPostgres = pkgs.postgresql_16.withPackages (pp: [
[ # pp.plv8
# pp.plv8 ]);
]); in pkgs.writeScriptBin "upgrade-pg-cluster" ''
in pkgs.writeScriptBin "upgrade-pg-cluster" '' set -eux
set -eux # XXX it's perhaps advisable to stop all services that depend on postgresql
# XXX it's perhaps advisable to stop all services that depend on postgresql systemctl stop postgresql
systemctl stop postgresql
export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}" export NEWDATA="/var/lib/postgresql/${newPostgres.psqlSchema}"
export NEWBIN="${newPostgres}/bin" export NEWBIN="${newPostgres}/bin"
export OLDDATA="${config.services.postgresql.dataDir}" export OLDDATA="${config.services.postgresql.dataDir}"
export OLDBIN="${config.services.postgresql.package}/bin" export OLDBIN="${config.services.postgresql.package}/bin"
install -d -m 0700 -o postgres -g postgres "$NEWDATA" install -d -m 0700 -o postgres -g postgres "$NEWDATA"
cd "$NEWDATA" cd "$NEWDATA"
sudo -u postgres $NEWBIN/initdb -D "$NEWDATA" sudo -u postgres $NEWBIN/initdb -D "$NEWDATA"
sudo -u postgres $NEWBIN/pg_upgrade \ sudo -u postgres $NEWBIN/pg_upgrade \
--old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \ --old-datadir "$OLDDATA" --new-datadir "$NEWDATA" \
--old-bindir $OLDBIN --new-bindir $NEWBIN \ --old-bindir $OLDBIN --new-bindir $NEWBIN \
"$@" "$@"
'') '')
]; ];
users.groups = { piracy.gid = 985; }; users.groups = { piracy.gid = 985; };
users.users = let base = { isSystemUser = true; }; users.users = let base = { isSystemUser = true; };
in { in {
@ -94,7 +89,7 @@ in {
# bazarr = base // { }; # bazarr = base // { };
jellyfin = base // { }; jellyfin = base // { };
# prowlarr.enable = true; # prowlarr.enable = true;
jira.enable = true; # jira.enable = true;
microbin = { microbin = {
enable = true; enable = true;
settings = { settings = {
@ -107,39 +102,45 @@ in {
MICROBIN_ENCRYPTION_SERVER_SIDE = true; MICROBIN_ENCRYPTION_SERVER_SIDE = true;
}; };
}; };
shiori = {
enable = true;
port = 4368;
package = pkgs.callPackage ../../pkgs/shiori/shiori.nix { };
httpSecretKey = "password";
databaseUrl = "postgres:///shiori?host=${postgresSocket}";
};
# audiobookshelf = { # audiobookshelf = {
# enable = true; # enable = true;
# group = "piracy"; # group = "piracy";
# port = 5687; # port = 5687;
# }; # };
# paperless = { paperless = {
# enable = true; enable = true;
# address = "0.0.0.0"; address = "0.0.0.0";
# consumptionDirIsPublic = true; consumptionDirIsPublic = true;
# consumptionDir = "/home/jawz/Backups/Scans"; consumptionDir = "/mnt/pool/scans/";
# extraConfig = { settings = {
# PAPERLESS_DBENGINE = "postgress"; PAPERLESS_DBENGINE = "postgress";
# PAPERLESS_DBNAME = "paperless"; PAPERLESS_DBNAME = "paperless";
# PAPERLESS_DBHOST = postgresSocket; PAPERLESS_DBHOST = postgresSocket;
# PAPERLESS_CONSUMER_IGNORE_PATTERN = PAPERLESS_CONSUMER_IGNORE_PATTERN =
# builtins.toJSON [ ".DS_STORE/*" "desktop.ini" ]; builtins.toJSON [ ".DS_STORE/*" "desktop.ini" ];
# PAPERLESS_TIME_ZONE = "America/Mexico_City"; PAPERLESS_TIME_ZONE = "America/Mexico_City";
# PAPERLESS_OCR_USER_ARGS = builtins.toJSON { PAPERLESS_OCR_USER_ARGS = builtins.toJSON {
# optimize = 1; optimize = 1;
# pdfa_image_compression = "lossless"; pdfa_image_compression = "lossless";
# }; };
# }; };
# }; };
vaultwarden = { vaultwarden = {
enable = true; enable = true;
dbBackend = "postgresql"; dbBackend = "postgresql";
package = pkgs.vaultwarden; package = pkgs.vaultwarden;
environmentFile = "/var/lib/vaultwarden.env";
config = { config = {
ROCKET_ADDRESS = "${localhost}"; ROCKET_ADDRESS = "${localhost}";
ROCKET_PORT = 8222; ROCKET_PORT = 8222;
WEBSOCKET_PORT = 8333; WEBSOCKET_PORT = 8333;
ADMIN_TOKEN =
"x9BLqz2QmnU5RmrMLt2kPpoPBTNPZxNFw/b8XrPgpQML2/01+MYENl87dmhDX+Jm";
DATABASE_URL = "postgresql:///vaultwarden?host=${postgresSocket}"; DATABASE_URL = "postgresql:///vaultwarden?host=${postgresSocket}";
ENABLE_DB_WAL = false; ENABLE_DB_WAL = false;
WEBSOCKET_ENABLED = true; WEBSOCKET_ENABLED = true;
@ -157,13 +158,16 @@ in {
nextcloud = { nextcloud = {
enable = true; enable = true;
https = true; https = true;
package = pkgs.nextcloud28; package = pkgs.nextcloud29;
appstoreEnable = true; appstoreEnable = true;
configureRedis = true; configureRedis = true;
extraAppsEnable = true; extraAppsEnable = true;
enableImagemagick = true; enableImagemagick = true;
maxUploadSize = "16G"; maxUploadSize = "16G";
hostName = "cloud.servidos.lat"; hostName = "cloud.servidos.lat";
extraApps = {
inherit (config.services.nextcloud.package.packages.apps) calendar;
};
config = { config = {
adminpassFile = "${pkgs.writeText "adminpass" adminpassFile = "${pkgs.writeText "adminpass"
"Overlying-Hatchback-Charting-Encounter-Deface-Gallantly7"}"; "Overlying-Hatchback-Charting-Encounter-Deface-Gallantly7"}";
@ -193,6 +197,8 @@ in {
short_open_tag = "Off"; short_open_tag = "Off";
}; };
settings = { settings = {
log_type = "file";
log_level = 3;
trusted_proxies = [ "nginx" ]; trusted_proxies = [ "nginx" ];
trusted_domains = [ "cloud.rotehaare.art" "danilo-reyes.com" ]; trusted_domains = [ "cloud.rotehaare.art" "danilo-reyes.com" ];
overwrite_protocol = "https"; overwrite_protocol = "https";
@ -214,32 +220,17 @@ in {
}; };
phpExtraExtensions = all: [ all.pdlib all.bz2 ]; phpExtraExtensions = all: [ all.pdlib all.bz2 ];
}; };
postgresql = { postgresql = let
dbNames =
[ "jawz" "paperless" "nextcloud" "ryot" "vaultwarden" "shiori" ];
in {
enable = true; enable = true;
ensureDatabases = [ "jawz" "paperless" "nextcloud" "ryot" "vaultwarden" ]; ensureDatabases = dbNames;
package = pkgs.postgresql_16; package = pkgs.postgresql_16;
ensureUsers = [ ensureUsers = map (name: {
{ name = name;
name = "jawz"; ensureDBOwnership = true;
ensureDBOwnership = true; }) dbNames;
}
{
name = "nextcloud";
ensureDBOwnership = true;
}
{
name = "paperless";
ensureDBOwnership = true;
}
{
name = "ryot";
ensureDBOwnership = true;
}
{
name = "vaultwarden";
ensureDBOwnership = true;
}
];
authentication = pkgs.lib.mkOverride 10 '' authentication = pkgs.lib.mkOverride 10 ''
local all all trust local all all trust
host all all ${localhost}/32 trust host all all ${localhost}/32 trust
@ -249,15 +240,12 @@ in {
}; };
systemd = { systemd = {
services = { services = {
nextcloud-cron = { path = [ pkgs.perl ]; };
# sub-sync = { # sub-sync = {
# restartIfChanged = true; # restartIfChanged = true;
# description = "syncronizes subtitles downloaded & modified today"; # description = "syncronizes subtitles downloaded & modified today";
# wantedBy = [ "default.target" ]; # wantedBy = [ "default.target" ];
# path = [ # path = [ pkgs.bash pkgs.nix jawzSubs ];
# pkgs.bash
# pkgs.nix
# jawzSubs
# ];
# serviceConfig = { # serviceConfig = {
# Restart = "on-failure"; # Restart = "on-failure";
# RestartSec = 30; # RestartSec = 30;
@ -267,16 +255,16 @@ in {
# }; # };
# }; # };
nextcloud-cronjob = let nextcloud-cronjob = let
jawzNextcloudCronjob = pkgs.writeScriptBin "nextcloud-cronjob" nextcloud-cronjob = pkgs.writeScriptBin "nextcloud-cronjob"
(builtins.readFile ../../scripts/nextcloud-cronjob.sh); (builtins.readFile ../../scripts/nextcloud-cronjob.sh);
in { in {
description = "Runs various nextcloud-related cronjobs"; description = "Runs various nextcloud-related cronjobs";
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];
path = [ pkgs.bash jawzNextcloudCronjob ]; path = [ pkgs.bash nextcloud-cronjob ];
serviceConfig = { serviceConfig = {
Restart = "on-failure"; Restart = "on-failure";
RestartSec = 30; RestartSec = 30;
ExecStart = "${jawzNextcloudCronjob}/bin/nextcloud-cronjob"; ExecStart = "${nextcloud-cronjob}/bin/nextcloud-cronjob";
}; };
}; };
}; };
@ -291,38 +279,9 @@ in {
# enable = true; # enable = true;
# description = "syncronizes subtitles downloaded & modified today"; # description = "syncronizes subtitles downloaded & modified today";
# wantedBy = [ "timers.target" ]; # wantedBy = [ "timers.target" ];
# timerConfig = { # timerConfig = { OnCalendar = "22:00"; };
# OnCalendar = "22:00";
# };
# }; # };
}; };
user.services = {
update-dns = let
jawzUpdateDns = pkgs.writeScriptBin "update-dns"
(builtins.readFile ../../scripts/update-dns.sh);
in {
restartIfChanged = true;
description = "update DNS of my websites";
wantedBy = [ "default.target" ];
path = [ pkgs.bash pkgs.nix jawzUpdateDns ];
serviceConfig = {
Restart = "on-failure";
RestartSec = 30;
ExecStart = "${jawzUpdateDns}/bin/update-dns";
};
};
};
user.timers = {
update-dns = {
enable = true;
description = "update DNS of my websites";
wantedBy = [ "timers.target" ];
timerConfig = {
OnBootSec = "1min";
OnUnitActiveSec = "30m";
};
};
};
}; };
networking = { networking = {

17
modules/scripts.nix
View File

@ -5,12 +5,25 @@
./scripts/ffmpreg.nix ./scripts/ffmpreg.nix
./scripts/find-dup-episode.nix ./scripts/find-dup-episode.nix
./scripts/manage-library.nix ./scripts/manage-library.nix
./scripts/nextcloud-cronjob.nix
./scripts/pika-list.nix ./scripts/pika-list.nix
./scripts/run.nix ./scripts/run.nix
./scripts/split-dir.nix ./scripts/split-dir.nix
./scripts/sub-sync.nix
./scripts/tasks.nix ./scripts/tasks.nix
./scripts/update-dns.nix ./scripts/update-dns.nix
]; ];
<<<<<<< HEAD
=======
my.scripts = {
download.enable = lib.mkDefault false;
ffmpeg4discord.enable = lib.mkDefault false;
ffmpreg.enable = lib.mkDefault false;
find-dup-episodes.enable = lib.mkDefault false;
manage-library.enable = lib.mkDefault false;
pika-list.enable = lib.mkDefault false;
run.enable = lib.mkDefault false;
split-dir.enable = lib.mkDefault false;
tasks.enable = lib.mkDefault false;
update-dns.enable = lib.mkDefault false;
};
>>>>>>> f7500a4 (fixed servers/nginx quirks on 24.05)
} }

13
modules/scripts/nextcloud-cronjob.nix
View File

@ -1,13 +0,0 @@
{ pkgs, ... }: {
imports = [ ./base.nix ];
config.my.scripts.nextcloud-cronjob = {
enable = true;
install = false;
service = true;
timer = "*:0/10";
name = "nextcloud-cronjob";
description = "runs tasks for nextcloud";
package = pkgs.writeScriptBin "nextcloud-cronjob"
(builtins.readFile ../../scripts/nextcloud-cronjob.sh);
};
}

13
modules/scripts/sub-sync.nix
View File

@ -1,13 +0,0 @@
{ pkgs, ... }: {
imports = [ ./base.nix ];
config.my.scripts.sub-sync = {
enable = true;
install = true;
service = true;
name = "sub-sync";
timer = "22:00";
description = "Syncronixes subtitles downloaded and modified the last day";
package = pkgs.writeScriptBin "sub-sync"
(builtins.readFile ../../scripts/sub-sync.sh);
};
}

130
pkgs/shiori/shiori-service.nix Normal file
View File

@ -0,0 +1,130 @@
{ config, lib, pkgs, ... }:
with lib;
let cfg = config.services.shiori;
in {
options = {
services.shiori = {
enable = mkEnableOption "Shiori simple bookmarks manager";
package = mkPackageOption pkgs "shiori" { };
address = mkOption {
type = types.str;
default = "";
description = ''
The IP address on which Shiori will listen.
If empty, listens on all interfaces.
'';
};
port = mkOption {
type = types.port;
default = 8080;
description = "The port of the Shiori web application";
};
webRoot = mkOption {
type = types.str;
default = "/";
example = "/shiori";
description = "The root of the Shiori web application";
};
httpSecretKey = mkOption {
type = types.str;
example = "SuperSecretPassword";
description =
"When empty all sessions will be invalidated on server restart";
};
databaseUrl = mkOption {
type = types.str;
default = "";
example = "postgresql:///shiori?host=/run/postgresql";
description = "The connection URL to connect to MySQL or PostgreSQL";
};
};
};
config = mkIf cfg.enable {
systemd.services.shiori = with cfg; {
description = "Shiori simple bookmarks manager";
wantedBy = [ "multi-user.target" ];
environment = {
SHIORI_DIR = "/var/lib/shiori";
} // lib.optionalAttrs (cfg.databaseUrl != "") {
SHIORI_DATABASE_URL = cfg.databaseUrl;
} // lib.optionalAttrs (cfg.httpSecretKey != "") {
SHIORI_HTTP_SECRET_KEY = cfg.httpSecretKey;
};
serviceConfig = {
ExecStart =
"${package}/bin/shiori server --address '${address}' --port '${
toString port
}' --webroot '${webRoot}'";
DynamicUser = true;
StateDirectory = "shiori";
# As the RootDirectory
RuntimeDirectory = "shiori";
# Security options
BindReadOnlyPaths = [
"/nix/store"
# For SSL certificates, and the resolv.conf
"/etc"
] ++ lib.optional (lib.strings.hasInfix "postgres" cfg.databaseUrl)
"/run/postgresql"
++ lib.optional (lib.strings.hasInfix "mysql" cfg.databaseUrl)
"/var/run/mysqld";
CapabilityBoundingSet = "";
AmbientCapabilities = "CAP_NET_BIND_SERVICE";
DeviceAllow = "";
LockPersonality = true;
MemoryDenyWriteExecute = true;
PrivateDevices = true;
PrivateUsers = true;
ProtectClock = true;
ProtectControlGroups = true;
ProtectHome = true;
ProtectHostname = true;
ProtectKernelLogs = true;
ProtectKernelModules = true;
ProtectKernelTunables = true;
RestrictNamespaces = true;
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" "AF_UNIX" ];
RestrictRealtime = true;
RestrictSUIDSGID = true;
RootDirectory = "/run/shiori";
SystemCallArchitectures = "native";
SystemCallErrorNumber = "EPERM";
SystemCallFilter = [
"@system-service"
"~@cpu-emulation"
"~@debug"
"~@keyring"
"~@memlock"
"~@obsolete"
"~@privileged"
"~@setuid"
];
};
};
};
meta.maintainers = with maintainers; [ minijackson CaptainJawZ ];
}

28
pkgs/shiori/shiori.nix Normal file
View File

@ -0,0 +1,28 @@
{ lib, buildGoModule, fetchFromGitHub, nixosTests }:
buildGoModule rec {
pname = "shiori";
version = "1.6.2";
vendorHash = "sha256-LLiBRsh9HsadeHQh4Yvops1r2GfjtvQKt5ZelQnPGdI=";
doCheck = false;
src = fetchFromGitHub {
owner = "go-shiori";
repo = pname;
rev = "v${version}";
sha256 = "sha256-1ZZpQXlAHs5MTowCv3sWS3L7X5FTnU/b4trvHPiz+uE=";
};
passthru.tests = {
smoke-test = nixosTests.shiori;
};
meta = with lib; {
description = "Simple bookmark manager built with Go";
homepage = "https://github.com/go-shiori/shiori";
license = licenses.mit;
maintainers = with maintainers; [ minijackson ];
};
}