pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6
7 cfg = config.services.confluence;
8
9 pkg = pkgs.atlassian-confluence.override (optionalAttrs cfg.sso.enable {
10 enableSSO = cfg.sso.enable;
11 crowdProperties = ''
12 application.name ${cfg.sso.applicationName}
13 application.password ${cfg.sso.applicationPassword}
14 application.login.url ${cfg.sso.crowd}/console/
15
16 crowd.server.url ${cfg.sso.crowd}/services/
17 crowd.base.url ${cfg.sso.crowd}/
18
19 session.isauthenticated session.isauthenticated
20 session.tokenkey session.tokenkey
21 session.validationinterval ${toString cfg.sso.validationInterval}
22 session.lastvalidation session.lastvalidation
23 '';
24 });
25
26in
27
28{
29 options = {
30 services.confluence = {
31 enable = mkEnableOption "Atlassian Confluence service";
32
33 user = mkOption {
34 type = types.str;
35 default = "confluence";
36 description = "User which runs confluence.";
37 };
38
39 group = mkOption {
40 type = types.str;
41 default = "confluence";
42 description = "Group which runs confluence.";
43 };
44
45 home = mkOption {
46 type = types.str;
47 default = "/var/lib/confluence";
48 description = "Home directory of the confluence instance.";
49 };
50
51 listenAddress = mkOption {
52 type = types.str;
53 default = "127.0.0.1";
54 description = "Address to listen on.";
55 };
56
57 listenPort = mkOption {
58 type = types.int;
59 default = 8090;
60 description = "Port to listen on.";
61 };
62
63 catalinaOptions = mkOption {
64 type = types.listOf types.str;
65 default = [];
66 example = [ "-Xms1024m" "-Xmx2048m" "-Dconfluence.disable.peopledirectory.all=true" ];
67 description = "Java options to pass to catalina/tomcat.";
68 };
69
70 proxy = {
71 enable = mkEnableOption "proxy support";
72
73 name = mkOption {
74 type = types.str;
75 example = "confluence.example.com";
76 description = "Virtual hostname at the proxy";
77 };
78
79 port = mkOption {
80 type = types.int;
81 default = 443;
82 example = 80;
83 description = "Port used at the proxy";
84 };
85
86 scheme = mkOption {
87 type = types.str;
88 default = "https";
89 example = "http";
90 description = "Protocol used at the proxy.";
91 };
92 };
93
94 sso = {
95 enable = mkEnableOption "SSO with Atlassian Crowd";
96
97 crowd = mkOption {
98 type = types.str;
99 example = "http://localhost:8095/crowd";
100 description = "Crowd Base URL without trailing slash";
101 };
102
103 applicationName = mkOption {
104 type = types.str;
105 example = "jira";
106 description = "Exact name of this Confluence instance in Crowd";
107 };
108
109 applicationPassword = mkOption {
110 type = types.str;
111 description = "Application password of this Confluence instance in Crowd";
112 };
113
114 validationInterval = mkOption {
115 type = types.int;
116 default = 2;
117 example = 0;
118 description = ''
119 Set to 0, if you want authentication checks to occur on each
120 request. Otherwise set to the number of minutes between request
121 to validate if the user is logged in or out of the Crowd SSO
122 server. Setting this value to 1 or higher will increase the
123 performance of Crowd's integration.
124 '';
125 };
126 };
127
128
129
130 jrePackage = mkOption {
131 type = types.package;
132 default = pkgs.oraclejre8;
133 defaultText = "pkgs.oraclejre8";
134 description = "Note that Atlassian only support the Oracle JRE (JRASERVER-46152).";
135 };
136 };
137 };
138
139 config = mkIf cfg.enable {
140 users.users."${cfg.user}" = {
141 isSystemUser = true;
142 group = cfg.group;
143 };
144
145 users.groups."${cfg.group}" = {};
146
147 systemd.services.confluence = {
148 description = "Atlassian Confluence";
149
150 wantedBy = [ "multi-user.target" ];
151 requires = [ "postgresql.service" ];
152 after = [ "postgresql.service" ];
153
154 path = [ cfg.jrePackage pkgs.bash ];
155
156 environment = {
157 CONF_USER = cfg.user;
158 JAVA_HOME = "${cfg.jrePackage}";
159 CATALINA_OPTS = concatStringsSep " " cfg.catalinaOptions;
160 };
161
162 preStart = ''
163 mkdir -p ${cfg.home}/{logs,work,temp,deploy}
164
165 mkdir -p /run/confluence
166 ln -sf ${cfg.home}/{logs,work,temp,server.xml} /run/confluence
167 ln -sf ${cfg.home} /run/confluence/home
168
169 chown -R ${cfg.user} ${cfg.home}
170
171 sed -e 's,port="8090",port="${toString cfg.listenPort}" address="${cfg.listenAddress}",' \
172 '' + (lib.optionalString cfg.proxy.enable ''
173 -e 's,protocol="org.apache.coyote.http11.Http11NioProtocol",protocol="org.apache.coyote.http11.Http11NioProtocol" proxyName="${cfg.proxy.name}" proxyPort="${toString cfg.proxy.port}" scheme="${cfg.proxy.scheme}",' \
174 '') + ''
175 ${pkg}/conf/server.xml.dist > ${cfg.home}/server.xml
176 '';
177
178 serviceConfig = {
179 User = cfg.user;
180 Group = cfg.group;
181 PrivateTmp = true;
182 PermissionsStartOnly = true;
183 ExecStart = "${pkg}/bin/start-confluence.sh -fg";
184 ExecStop = "${pkg}/bin/stop-confluence.sh";
185 };
186 };
187 };
188}