pyrox.dev
1{ config, lib, pkgs, ...}:
2
3with lib;
4
5let
6 cfg = config.services.varnish;
7
8 commandLine = "-f ${pkgs.writeText "default.vcl" cfg.config}" +
9 optionalString (cfg.extraModules != []) " -p vmod_path='${makeSearchPathOutput "lib" "lib/varnish/vmods" ([cfg.package] ++ cfg.extraModules)}' -r vmod_path";
10in
11{
12 options = {
13 services.varnish = {
14 enable = mkEnableOption (lib.mdDoc "Varnish Server");
15
16 enableConfigCheck = mkEnableOption (lib.mdDoc "checking the config during build time") // { default = true; };
17
18 package = mkOption {
19 type = types.package;
20 default = pkgs.varnish;
21 defaultText = literalExpression "pkgs.varnish";
22 description = lib.mdDoc ''
23 The package to use
24 '';
25 };
26
27 http_address = mkOption {
28 type = types.str;
29 default = "*:6081";
30 description = lib.mdDoc ''
31 HTTP listen address and port.
32 '';
33 };
34
35 config = mkOption {
36 type = types.lines;
37 description = lib.mdDoc ''
38 Verbatim default.vcl configuration.
39 '';
40 };
41
42 stateDir = mkOption {
43 type = types.path;
44 default = "/var/spool/varnish/${config.networking.hostName}";
45 defaultText = literalExpression ''"/var/spool/varnish/''${config.networking.hostName}"'';
46 description = lib.mdDoc ''
47 Directory holding all state for Varnish to run.
48 '';
49 };
50
51 extraModules = mkOption {
52 type = types.listOf types.package;
53 default = [];
54 example = literalExpression "[ pkgs.varnishPackages.geoip ]";
55 description = lib.mdDoc ''
56 Varnish modules (except 'std').
57 '';
58 };
59
60 extraCommandLine = mkOption {
61 type = types.str;
62 default = "";
63 example = "-s malloc,256M";
64 description = lib.mdDoc ''
65 Command line switches for varnishd (run 'varnishd -?' to get list of options)
66 '';
67 };
68 };
69
70 };
71
72 config = mkIf cfg.enable {
73
74 systemd.services.varnish = {
75 description = "Varnish";
76 wantedBy = [ "multi-user.target" ];
77 after = [ "network.target" ];
78 preStart = ''
79 mkdir -p ${cfg.stateDir}
80 chown -R varnish:varnish ${cfg.stateDir}
81 '';
82 postStop = ''
83 rm -rf ${cfg.stateDir}
84 '';
85 serviceConfig = {
86 Type = "simple";
87 PermissionsStartOnly = true;
88 ExecStart = "${cfg.package}/sbin/varnishd -a ${cfg.http_address} -n ${cfg.stateDir} -F ${cfg.extraCommandLine} ${commandLine}";
89 Restart = "always";
90 RestartSec = "5s";
91 User = "varnish";
92 Group = "varnish";
93 AmbientCapabilities = "cap_net_bind_service";
94 NoNewPrivileges = true;
95 LimitNOFILE = 131072;
96 };
97 };
98
99 environment.systemPackages = [ cfg.package ];
100
101 # check .vcl syntax at compile time (e.g. before nixops deployment)
102 system.checks = mkIf cfg.enableConfigCheck [
103 (pkgs.runCommand "check-varnish-syntax" {} ''
104 ${cfg.package}/bin/varnishd -C ${commandLine} 2> $out || (cat $out; exit 1)
105 '')
106 ];
107
108 users.users.varnish = {
109 group = "varnish";
110 uid = config.ids.uids.varnish;
111 };
112
113 users.groups.varnish.gid = config.ids.uids.varnish;
114 };
115}