···
64
-
peertubeCli = pkgs.writeShellScriptBin "peertube" ''
65
-
node ~/dist/server/tools/peertube.js $@
64
+
nginxCommonHeaders = lib.optionalString config.services.nginx.virtualHosts.${cfg.localDomain}.forceSSL ''
65
+
add_header Strict-Transport-Security 'max-age=31536000';
66
+
'' + lib.optionalString (config.services.nginx.virtualHosts.${cfg.localDomain}.quic && config.services.nginx.virtualHosts.${cfg.localDomain}.http3) ''
67
+
add_header Alt-Svc 'h3=":$server_port"; ma=604800';
68
-
nginxCommonHeaders = lib.optionalString cfg.enableWebHttps ''
69
-
add_header Strict-Transport-Security 'max-age=63072000; includeSubDomains';
70
-
'' + lib.optionalString config.services.nginx.virtualHosts.${cfg.localDomain}.http3 ''
71
-
add_header Alt-Svc 'h3=":443"; ma=86400';
73
-
add_header Access-Control-Allow-Origin '*';
74
-
add_header Access-Control-Allow-Methods 'GET, OPTIONS';
75
-
add_header Access-Control-Allow-Headers 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
70
+
nginxCommonHeadersExtra = ''
71
+
add_header Access-Control-Allow-Origin '*';
72
+
add_header Access-Control-Allow-Methods 'GET, OPTIONS';
73
+
add_header Access-Control-Allow-Headers 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
···
331
+
environment.systemPackages = [ cfg.package.cli ];
services.peertube.settings = lib.mkMerge [
···
tmp_persistent = lib.mkDefault "/var/lib/peertube/storage/tmp_persistent/";
bin = lib.mkDefault "/var/lib/peertube/storage/bin/";
avatars = lib.mkDefault "/var/lib/peertube/storage/avatars/";
358
-
videos = lib.mkDefault "/var/lib/peertube/storage/videos/";
358
+
web_videos = lib.mkDefault "/var/lib/peertube/storage/web-videos/";
streaming_playlists = lib.mkDefault "/var/lib/peertube/storage/streaming-playlists/";
redundancy = lib.mkDefault "/var/lib/peertube/storage/redundancy/";
logs = lib.mkDefault "/var/lib/peertube/storage/logs/";
previews = lib.mkDefault "/var/lib/peertube/storage/previews/";
thumbnails = lib.mkDefault "/var/lib/peertube/storage/thumbnails/";
364
+
storyboards = lib.mkDefault "/var/lib/peertube/storage/storyboards/";
torrents = lib.mkDefault "/var/lib/peertube/storage/torrents/";
captions = lib.mkDefault "/var/lib/peertube/storage/captions/";
cache = lib.mkDefault "/var/lib/peertube/storage/cache/";
···
431
-
path = with pkgs; [ bashInteractive ffmpeg nodejs_18 openssl yarn python3 ];
432
+
path = with pkgs; [ nodejs_18 yarn ffmpeg-headless openssl ];
···
ln -sf ${cfg.package}/config/default.yaml /var/lib/peertube/config/default.yaml
ln -sf ${cfg.package}/client/dist -T /var/lib/peertube/www/client
ln -sf ${cfg.settings.storage.client_overrides} -T /var/lib/peertube/www/client-overrides
···
services.nginx = lib.mkIf cfg.configureNginx {
492
+
upstreams."peertube".servers = {
493
+
"127.0.0.1:${toString cfg.listenHttp}".fail_timeout = "0";
virtualHosts."${cfg.localDomain}" = {
root = "/var/lib/peertube/www";
···
500
-
locations."= /api/v1/videos/upload-resumable" = {
504
+
locations."~ ^/api/v1/videos/(upload-resumable|([^/]+/source/replace-resumable))$" = {
tryFiles = "/dev/null @api";
505
-
client_max_body_size 0;
506
-
proxy_request_buffering off;
509
+
client_max_body_size 0;
510
+
proxy_request_buffering off;
511
+
'' + nginxCommonHeaders;
locations."~ ^/api/v1/videos/(upload|([^/]+/studio/edit))$" = {
···
516
-
client_max_body_size 12G;
517
-
add_header X-File-Maximum-Size 8G always;
518
-
'' + lib.optionalString cfg.enableWebHttps ''
519
-
add_header Strict-Transport-Security 'max-age=63072000; includeSubDomains';
520
-
'' + lib.optionalString config.services.nginx.virtualHosts.${cfg.localDomain}.http3 ''
521
-
add_header Alt-Svc 'h3=":443"; ma=86400';
520
+
limit_except POST HEAD { deny all; }
522
+
client_max_body_size 12G;
523
+
add_header X-File-Maximum-Size 8G always;
524
+
'' + nginxCommonHeaders;
locations."~ ^/api/v1/runners/jobs/[^/]+/(update|success)$" = {
···
531
-
client_max_body_size 12G;
532
-
add_header X-File-Maximum-Size 8G always;
533
-
'' + lib.optionalString cfg.enableWebHttps ''
534
-
add_header Strict-Transport-Security 'max-age=63072000; includeSubDomains';
535
-
'' + lib.optionalString config.services.nginx.virtualHosts.${cfg.localDomain}.http3 ''
536
-
add_header Alt-Svc 'h3=":443"; ma=86400';
533
+
client_max_body_size 12G;
534
+
add_header X-File-Maximum-Size 8G always;
535
+
'' + nginxCommonHeaders;
locations."~ ^/api/v1/(videos|video-playlists|video-channels|users/me)" = {
···
545
-
client_max_body_size 6M;
546
-
add_header X-File-Maximum-Size 4M always;
547
-
'' + lib.optionalString cfg.enableWebHttps ''
548
-
add_header Strict-Transport-Security 'max-age=63072000; includeSubDomains';
549
-
'' + lib.optionalString config.services.nginx.virtualHosts.${cfg.localDomain}.http3 ''
550
-
add_header Alt-Svc 'h3=":443"; ma=86400';
543
+
client_max_body_size 6M;
544
+
add_header X-File-Maximum-Size 4M always;
545
+
'' + nginxCommonHeaders;
555
-
proxyPass = "http://127.0.0.1:${toString cfg.listenHttp}";
549
+
proxyPass = "http://peertube";
559
-
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
560
-
proxy_set_header Host $host;
561
-
proxy_set_header X-Real-IP $remote_addr;
553
+
proxy_set_header Host $host;
554
+
proxy_set_header X-Real-IP $remote_addr;
555
+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
563
-
proxy_connect_timeout 10m;
557
+
proxy_connect_timeout 10m;
565
-
proxy_send_timeout 10m;
566
-
proxy_read_timeout 10m;
559
+
proxy_send_timeout 10m;
560
+
proxy_read_timeout 10m;
568
-
client_max_body_size 100k;
562
+
client_max_body_size 100k;
564
+
''+ nginxCommonHeaders;
···
584
-
proxy_read_timeout 15m;
578
+
proxy_read_timeout 15m;
···
locations."@api_websocket" = {
594
-
proxyPass = "http://127.0.0.1:${toString cfg.listenHttp}";
588
+
proxyPass = "http://peertube";
598
-
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
599
-
proxy_set_header Host $host;
600
-
proxy_set_header X-Real-IP $remote_addr;
601
-
proxy_set_header Upgrade $http_upgrade;
602
-
proxy_set_header Connection 'upgrade';
592
+
proxy_http_version 1.1;
593
+
proxy_set_header Upgrade $http_upgrade;
594
+
proxy_set_header Connection 'upgrade';
595
+
proxy_set_header Host $host;
596
+
proxy_set_header X-Real-IP $remote_addr;
597
+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
604
-
proxy_http_version 1.1;
599
+
'' + nginxCommonHeaders;
# Bypass PeerTube for performance reasons.
locations."~ ^/client/(assets/images/(icons/icon-36x36\.png|icons/icon-48x48\.png|icons/icon-72x72\.png|icons/icon-96x96\.png|icons/icon-144x144\.png|icons/icon-192x192\.png|icons/icon-512x512\.png|logo\.svg|favicon\.png|default-playlist\.jpg|default-avatar-account\.png|default-avatar-account-48x48\.png|default-avatar-video-channel\.png|default-avatar-video-channel-48x48\.png))$" = {
tryFiles = "/client-overrides/$1 /client/$1 $1";
607
+
extraConfig = nginxCommonHeaders;
locations."~ ^/client/(.*\.(js|css|png|svg|woff2|otf|ttf|woff|eot))$" = {
alias = "${cfg.package}/client/dist/$1";
618
-
add_header Cache-Control 'public, max-age=604800, immutable';
619
-
'' + lib.optionalString cfg.enableWebHttps ''
620
-
add_header Strict-Transport-Security 'max-age=63072000; includeSubDomains';
621
-
'' + lib.optionalString config.services.nginx.virtualHosts.${cfg.localDomain}.http3 ''
622
-
add_header Alt-Svc 'h3=":443"; ma=86400';
614
+
add_header Cache-Control 'public, max-age=604800, immutable';
615
+
'' + nginxCommonHeaders;
locations."^~ /download/" = {
627
-
proxyPass = "http://127.0.0.1:${toString cfg.listenHttp}";
619
+
proxyPass = "http://peertube";
630
-
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
631
-
proxy_set_header Host $host;
632
-
proxy_set_header X-Real-IP $remote_addr;
622
+
proxy_set_header Host $host;
623
+
proxy_set_header X-Real-IP $remote_addr;
624
+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
634
-
proxy_limit_rate 5M;
626
+
proxy_limit_rate 5M;
627
+
'' + nginxCommonHeaders;
638
-
locations."^~ /static/streaming-playlists/private/" = {
639
-
proxyPass = "http://127.0.0.1:${toString cfg.listenHttp}";
630
+
locations."^~ /static/streaming-playlists/hls/private/" = {
631
+
proxyPass = "http://peertube";
642
-
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
643
-
proxy_set_header Host $host;
644
-
proxy_set_header X-Real-IP $remote_addr;
634
+
proxy_set_header Host $host;
635
+
proxy_set_header X-Real-IP $remote_addr;
636
+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
646
-
proxy_limit_rate 5M;
638
+
proxy_limit_rate 5M;
639
+
'' + nginxCommonHeaders;
locations."^~ /static/web-videos/private/" = {
651
-
proxyPass = "http://127.0.0.1:${toString cfg.listenHttp}";
643
+
proxyPass = "http://peertube";
654
-
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
655
-
proxy_set_header Host $host;
656
-
proxy_set_header X-Real-IP $remote_addr;
646
+
proxy_set_header Host $host;
647
+
proxy_set_header X-Real-IP $remote_addr;
648
+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
658
-
proxy_limit_rate 5M;
650
+
proxy_limit_rate 5M;
651
+
'' + nginxCommonHeaders;
locations."^~ /static/webseed/private/" = {
663
-
proxyPass = "http://127.0.0.1:${toString cfg.listenHttp}";
655
+
proxyPass = "http://peertube";
666
-
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
667
-
proxy_set_header Host $host;
668
-
proxy_set_header X-Real-IP $remote_addr;
658
+
proxy_set_header Host $host;
659
+
proxy_set_header X-Real-IP $remote_addr;
660
+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
670
-
proxy_limit_rate 5M;
662
+
proxy_limit_rate 5M;
663
+
'' + nginxCommonHeaders;
locations."^~ /static/redundancy/" = {
···
root = cfg.settings.storage.redundancy;
679
-
set $peertube_limit_rate 800k;
671
+
set $peertube_limit_rate 800k;
if ($request_uri ~ -fragmented.mp4$) {
682
-
set $peertube_limit_rate 5M;
674
+
set $peertube_limit_rate 5M;
if ($request_method = 'OPTIONS') {
687
-
add_header Access-Control-Max-Age 1728000;
688
-
add_header Content-Type 'text/plain charset=UTF-8';
689
-
add_header Content-Length 0;
679
+
${nginxCommonHeadersExtra}
680
+
add_header Access-Control-Max-Age 1728000;
681
+
add_header Content-Type 'text/plain charset=UTF-8';
682
+
add_header Content-Length 0;
if ($request_method = 'GET') {
687
+
${nginxCommonHeadersExtra}
700
-
sendfile_max_chunk 1M;
694
+
sendfile_max_chunk 1M;
702
-
limit_rate $peertube_limit_rate;
703
-
limit_rate_after 5M;
696
+
limit_rate $peertube_limit_rate;
697
+
limit_rate_after 5M;
705
-
rewrite ^/static/redundancy/(.*)$ /$1 break;
699
+
rewrite ^/static/redundancy/(.*)$ /$1 break;
···
root = cfg.settings.storage.streaming_playlists;
714
-
set $peertube_limit_rate 800k;
708
+
set $peertube_limit_rate 800k;
if ($request_uri ~ -fragmented.mp4$) {
717
-
set $peertube_limit_rate 5M;
711
+
set $peertube_limit_rate 5M;
if ($request_method = 'OPTIONS') {
722
-
add_header Access-Control-Max-Age 1728000;
723
-
add_header Content-Type 'text/plain charset=UTF-8';
724
-
add_header Content-Length 0;
716
+
${nginxCommonHeadersExtra}
717
+
add_header Access-Control-Max-Age 1728000;
718
+
add_header Content-Type 'text/plain charset=UTF-8';
719
+
add_header Content-Length 0;
if ($request_method = 'GET') {
724
+
${nginxCommonHeadersExtra}
735
-
sendfile_max_chunk 1M;
731
+
sendfile_max_chunk 1M;
737
-
limit_rate $peertube_limit_rate;
738
-
limit_rate_after 5M;
733
+
limit_rate $peertube_limit_rate;
734
+
limit_rate_after 5M;
740
-
rewrite ^/static/streaming-playlists/(.*)$ /$1 break;
736
+
rewrite ^/static/streaming-playlists/(.*)$ /$1 break;
locations."^~ /static/web-videos/" = {
746
-
root = cfg.settings.storage.streaming_playlists;
742
+
root = cfg.settings.storage.web_videos;
749
-
set $peertube_limit_rate 800k;
745
+
set $peertube_limit_rate 800k;
if ($request_uri ~ -fragmented.mp4$) {
752
-
set $peertube_limit_rate 5M;
748
+
set $peertube_limit_rate 5M;
if ($request_method = 'OPTIONS') {
757
-
add_header Access-Control-Max-Age 1728000;
758
-
add_header Content-Type 'text/plain charset=UTF-8';
759
-
add_header Content-Length 0;
753
+
${nginxCommonHeadersExtra}
754
+
add_header Access-Control-Max-Age 1728000;
755
+
add_header Content-Type 'text/plain charset=UTF-8';
756
+
add_header Content-Length 0;
if ($request_method = 'GET') {
761
+
${nginxCommonHeadersExtra}
770
-
sendfile_max_chunk 1M;
768
+
sendfile_max_chunk 1M;
772
-
limit_rate $peertube_limit_rate;
773
-
limit_rate_after 5M;
770
+
limit_rate $peertube_limit_rate;
771
+
limit_rate_after 5M;
775
-
rewrite ^/static/streaming-playlists/(.*)$ /$1 break;
773
+
rewrite ^/static/web-videos/(.*)$ /$1 break;
locations."^~ /static/webseed/" = {
781
-
root = cfg.settings.storage.videos;
779
+
root = cfg.settings.storage.web_videos;
784
-
set $peertube_limit_rate 800k;
782
+
set $peertube_limit_rate 800k;
if ($request_uri ~ -fragmented.mp4$) {
787
-
set $peertube_limit_rate 5M;
785
+
set $peertube_limit_rate 5M;
if ($request_method = 'OPTIONS') {
792
-
add_header Access-Control-Max-Age 1728000;
793
-
add_header Content-Type 'text/plain charset=UTF-8';
794
-
add_header Content-Length 0;
790
+
${nginxCommonHeadersExtra}
791
+
add_header Access-Control-Max-Age 1728000;
792
+
add_header Content-Type 'text/plain charset=UTF-8';
793
+
add_header Content-Length 0;
if ($request_method = 'GET') {
798
+
${nginxCommonHeadersExtra}
805
-
sendfile_max_chunk 1M;
805
+
sendfile_max_chunk 1M;
807
-
limit_rate $peertube_limit_rate;
808
-
limit_rate_after 5M;
807
+
limit_rate $peertube_limit_rate;
808
+
limit_rate_after 5M;
810
-
rewrite ^/static/webseed/(.*)$ /$1 break;
810
+
rewrite ^/static/webseed/(.*)$ /web-videos/$1 break;
814
-
extraConfig = lib.optionalString cfg.enableWebHttps ''
815
-
add_header Strict-Transport-Security 'max-age=63072000; includeSubDomains';
···
851
-
(lib.attrsets.setAttrByPath [ cfg.user "packages" ] [ cfg.package peertubeEnv peertubeCli pkgs.ffmpeg pkgs.nodejs_18 pkgs.yarn ])
847
+
(lib.attrsets.setAttrByPath [ cfg.user "packages" ] [ peertubeEnv pkgs.nodejs_18 pkgs.yarn pkgs.ffmpeg-headless ])
(lib.mkIf cfg.redis.enableUnixSocket {${config.services.peertube.user}.extraGroups = [ "redis-peertube" ];})
pyrox.dev