···
1
+
{ config, lib, pkgs, ... }:
5
+
# TODO: are these php-packages needed?
7
+
#php-geoip -> php.ini: extension = geoip.so
11
+
cfg = config.services.restya-board;
13
+
runDir = "/run/restya-board";
15
+
poolName = "restya-board";
16
+
phpfpmSocketName = "/var/run/phpfpm/${poolName}.sock";
26
+
services.restya-board = {
28
+
enable = mkEnableOption "restya-board";
30
+
dataDir = mkOption {
32
+
default = "/var/lib/restya-board";
33
+
example = "/var/lib/restya-board";
35
+
Data of the application.
41
+
default = "restya-board";
42
+
example = "restya-board";
44
+
User account under which the web-application runs.
53
+
Group account under which the web-application runs.
58
+
serverName = mkOption {
60
+
default = "restya.board";
62
+
Name of the nginx virtualhost to use.
66
+
listenHost = mkOption {
68
+
default = "localhost";
70
+
Listen address for the virtualhost to use.
74
+
listenPort = mkOption {
78
+
Listen port for the virtualhost to use.
85
+
type = types.nullOr types.str;
88
+
Host of the database. Leave 'null' to use a local PostgreSQL database.
89
+
A local PostgreSQL database is initialized automatically.
94
+
type = types.nullOr types.int;
97
+
The database's port.
103
+
default = "restya_board";
105
+
Name of the database. The database must exist.
111
+
default = "restya_board";
113
+
The database user. The user must exist and have access to
114
+
the specified database.
118
+
passwordFile = mkOption {
119
+
type = types.nullOr types.str;
122
+
The database user's password. 'null' if no password is set.
128
+
server = mkOption {
129
+
type = types.nullOr types.str;
131
+
example = "localhost";
133
+
Hostname to send outgoing mail. Null to use the system MTA.
141
+
Port used to connect to SMTP server.
149
+
SMTP authentication login used when sending outgoing mail.
153
+
password = mkOption {
157
+
SMTP authentication password used when sending outgoing mail.
159
+
ATTENTION: The password is stored world-readable in the nix-store!
164
+
timezone = mkOption {
165
+
type = types.lines;
168
+
Timezone the web-app runs in.
177
+
###### implementation
179
+
config = mkIf cfg.enable {
181
+
services.phpfpm.poolConfigs = {
183
+
listen = "${phpfpmSocketName}";
184
+
listen.owner = nginx
185
+
listen.group = nginx
188
+
group = ${cfg.group}
190
+
pm.max_children = 75
191
+
pm.start_servers = 10
192
+
pm.min_spare_servers = 5
193
+
pm.max_spare_servers = 20
194
+
pm.max_requests = 500
195
+
catch_workers_output = 1
199
+
services.phpfpm.phpOptions = ''
200
+
date.timezone = "CET"
202
+
${optionalString (!isNull cfg.email.server) ''
203
+
SMTP = ${cfg.email.server}
204
+
smtp_port = ${toString cfg.email.port}
205
+
auth_username = ${cfg.email.login}
206
+
auth_password = ${cfg.email.password}
210
+
services.nginx.enable = true;
211
+
services.nginx.virtualHosts."${cfg.virtualHost.serverName}" = {
212
+
listen = [ { addr = cfg.virtualHost.listenHost; port = cfg.virtualHost.listenPort; } ];
213
+
serverName = cfg.virtualHost.serverName;
216
+
index index.html index.php;
219
+
gzip_disable "msie6";
222
+
gzip_min_length 1100;
223
+
gzip_buffers 16 8k;
225
+
gzip_types text/plain application/xml text/css text/js text/xml application/x-javascript text/javascript application/json application/xml+rss;
227
+
client_max_body_size 300M;
229
+
rewrite ^/oauth/authorize$ /server/php/authorize.php last;
230
+
rewrite ^/oauth_callback/([a-zA-Z0-9_\.]*)/([a-zA-Z0-9_\.]*)$ /server/php/oauth_callback.php?plugin=$1&code=$2 last;
231
+
rewrite ^/download/([0-9]*)/([a-zA-Z0-9_\.]*)$ /server/php/download.php?id=$1&hash=$2 last;
232
+
rewrite ^/ical/([0-9]*)/([0-9]*)/([a-z0-9]*).ics$ /server/php/ical.php?board_id=$1&user_id=$2&hash=$3 last;
233
+
rewrite ^/api/(.*)$ /server/php/R/r.php?_url=$1&$args last;
234
+
rewrite ^/api_explorer/api-docs/$ /client/api_explorer/api-docs/index.php last;
237
+
locations."/".root = "${runDir}/client";
239
+
locations."~ \.php$" = {
240
+
tryFiles = "$uri =404";
242
+
include ${pkgs.nginx}/conf/fastcgi_params;
243
+
fastcgi_pass unix:${phpfpmSocketName};
244
+
fastcgi_index index.php;
245
+
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
246
+
fastcgi_param PHP_VALUE "upload_max_filesize=9G \n post_max_size=9G \n max_execution_time=200 \n max_input_time=200 \n memory_limit=256M";
250
+
locations."~* \.(css|js|less|html|ttf|woff|jpg|jpeg|gif|png|bmp|ico)" = {
251
+
root = "${runDir}/client";
253
+
if (-f $request_filename) {
256
+
rewrite ^/img/([a-zA-Z_]*)/([a-zA-Z_]*)/([a-zA-Z0-9_\.]*)$ /server/php/image.php?size=$1&model=$2&filename=$3 last;
257
+
add_header Cache-Control public;
258
+
add_header Cache-Control must-revalidate;
264
+
systemd.services.restya-board-init = {
265
+
description = "Restya board initialization";
266
+
serviceConfig.Type = "oneshot";
267
+
serviceConfig.RemainAfterExit = true;
269
+
wantedBy = [ "multi-user.target" ];
270
+
requires = [ "postgresql.service" ];
271
+
after = [ "network.target" "postgresql.service" ];
275
+
mkdir -m 750 -p "${runDir}"
276
+
cp -r "${pkgs.restya-board}/"* "${runDir}"
277
+
sed -i "s/@restya.com/@${cfg.virtualHost.serverName}/g" "${runDir}/sql/restyaboard_with_empty_data.sql"
278
+
rm -rf "${runDir}/media"
279
+
rm -rf "${runDir}/client/img"
280
+
chmod -R 0750 "${runDir}"
282
+
sed -i "s@^php@${config.services.phpfpm.phpPackage}/bin/php@" "${runDir}/server/php/shell/"*.sh
284
+
${if (isNull cfg.database.host) then ''
285
+
sed -i "s/^.*'R_DB_HOST'.*$/define('R_DB_HOST', 'localhost');/g" "${runDir}/server/php/config.inc.php"
286
+
sed -i "s/^.*'R_DB_PASSWORD'.*$/define('R_DB_PASSWORD', 'restya');/g" "${runDir}/server/php/config.inc.php"
288
+
sed -i "s/^.*'R_DB_HOST'.*$/define('R_DB_HOST', '${cfg.database.host}');/g" "${runDir}/server/php/config.inc.php"
289
+
sed -i "s/^.*'R_DB_PASSWORD'.*$/define('R_DB_PASSWORD', '$(<${cfg.database.dbPassFile})');/g" "${runDir}/server/php/config.inc.php"
291
+
sed -i "s/^.*'R_DB_PORT'.*$/define('R_DB_PORT', '${toString cfg.database.port}');/g" "${runDir}/server/php/config.inc.php"
292
+
sed -i "s/^.*'R_DB_NAME'.*$/define('R_DB_NAME', '${cfg.database.name}');/g" "${runDir}/server/php/config.inc.php"
293
+
sed -i "s/^.*'R_DB_USER'.*$/define('R_DB_USER', '${cfg.database.user}');/g" "${runDir}/server/php/config.inc.php"
295
+
chmod 0400 "${runDir}/server/php/config.inc.php"
297
+
ln -sf "${cfg.dataDir}/media" "${runDir}/media"
298
+
ln -sf "${cfg.dataDir}/client/img" "${runDir}/client/img"
300
+
chmod g+w "${runDir}/tmp/cache"
301
+
chown -R "${cfg.user}"."${cfg.group}" "${runDir}"
304
+
mkdir -m 0750 -p "${cfg.dataDir}"
305
+
mkdir -m 0750 -p "${cfg.dataDir}/media"
306
+
mkdir -m 0750 -p "${cfg.dataDir}/client/img"
307
+
cp -r "${pkgs.restya-board}/media/"* "${cfg.dataDir}/media"
308
+
cp -r "${pkgs.restya-board}/client/img/"* "${cfg.dataDir}/client/img"
309
+
chown "${cfg.user}"."${cfg.group}" "${cfg.dataDir}"
310
+
chown -R "${cfg.user}"."${cfg.group}" "${cfg.dataDir}/media"
311
+
chown -R "${cfg.user}"."${cfg.group}" "${cfg.dataDir}/client/img"
313
+
${optionalString (isNull cfg.database.host) ''
314
+
if ! [ -e "${cfg.dataDir}/.db-initialized" ]; then
315
+
${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} \
316
+
${config.services.postgresql.package}/bin/psql -U ${config.services.postgresql.superUser} \
317
+
-c "CREATE USER ${cfg.database.user} WITH ENCRYPTED PASSWORD 'restya'"
319
+
${pkgs.sudo}/bin/sudo -u ${config.services.postgresql.superUser} \
320
+
${config.services.postgresql.package}/bin/psql -U ${config.services.postgresql.superUser} \
321
+
-c "CREATE DATABASE ${cfg.database.name} OWNER ${cfg.database.user} ENCODING 'UTF8' TEMPLATE template0"
323
+
${pkgs.sudo}/bin/sudo -u ${cfg.user} \
324
+
${config.services.postgresql.package}/bin/psql -U ${cfg.database.user} \
325
+
-d ${cfg.database.name} -f "${runDir}/sql/restyaboard_with_empty_data.sql"
327
+
touch "${cfg.dataDir}/.db-initialized"
333
+
systemd.timers.restya-board = {
334
+
description = "restya-board scripts for e.g. email notification";
335
+
wantedBy = [ "timers.target" ];
336
+
after = [ "restya-board-init.service" ];
337
+
requires = [ "restya-board-init.service" ];
339
+
OnUnitInactiveSec = "60s";
340
+
Unit = "restya-board-timers.service";
344
+
systemd.services.restya-board-timers = {
345
+
description = "restya-board scripts for e.g. email notification";
346
+
serviceConfig.Type = "oneshot";
347
+
serviceConfig.User = cfg.user;
349
+
after = [ "restya-board-init.service" ];
350
+
requires = [ "restya-board-init.service" ];
353
+
/bin/sh ${runDir}/server/php/shell/instant_email_notification.sh 2> /dev/null || true
354
+
/bin/sh ${runDir}/server/php/shell/periodic_email_notification.sh 2> /dev/null || true
355
+
/bin/sh ${runDir}/server/php/shell/imap.sh 2> /dev/null || true
356
+
/bin/sh ${runDir}/server/php/shell/webhook.sh 2> /dev/null || true
357
+
/bin/sh ${runDir}/server/php/shell/card_due_notification.sh 2> /dev/null || true
361
+
users.extraUsers.restya-board = {
362
+
isSystemUser = true;
363
+
createHome = false;
365
+
group = "restya-board";
367
+
users.extraGroups.restya-board = {};
369
+
services.postgresql.enable = mkIf (isNull cfg.database.host) true;
371
+
services.postgresql.identMap = optionalString (isNull cfg.database.host)
373
+
restya-board-users restya-board restya_board
376
+
services.postgresql.authentication = optionalString (isNull cfg.database.host)
378
+
local restya_board all ident map=restya-board-users
pyrox.dev