egirls-nixos/misskey-service.nix

139 lines
3.5 KiB
Nix
Raw Normal View History

2024-02-26 17:51:53 +00:00
{ pkgs, ... }:
let
nodejs = pkgs.unstable.nodejs_20;
nodePackages = (pkgs.nodePackages.override { nodejs = nodejs; });
in {
2024-02-25 23:14:02 +00:00
services.postgresql = {
enable = true;
package = pkgs.postgresql_15;
2024-02-26 17:42:55 +00:00
ensureUsers = [
{ name = "jaina"; }
{
name = "misskey";
2024-02-26 17:46:09 +00:00
ensureDBOwnership = true;
2024-02-26 17:42:55 +00:00
}
{ name = "postgres"; }
];
ensureDatabases = [ "misskey" ];
identMap = ''
# ArbitraryMapName systemUser DBUser
superuser_map root postgres
superuser_map postgres postgres
# Let other names login as themselves
superuser_map /^(.*)$ \1
'';
2024-02-25 23:14:02 +00:00
};
2024-02-26 01:52:54 +00:00
services.redis.servers.misskey = {
port = 6379;
enable = true;
openFirewall = false;
2024-02-26 02:04:42 +00:00
requirePassFile = "/etc/nixos-secrets/redis-pass";
2024-02-26 01:52:54 +00:00
};
2024-02-25 23:14:02 +00:00
security.acme = {
acceptTerms = true;
defaults.email = "admin+acme@heartles.xyz";
certs."egirls.gay" = {
domain = "egirls.gay";
dnsProvider = "namecheap";
credentialsFile = "/etc/nixos-secrets/namecheap-acme";
group = "nginx";
};
};
2024-02-26 02:13:53 +00:00
networking.firewall.allowedTCPPorts = [ 80 443 ];
2024-02-25 23:14:02 +00:00
services.nginx = {
enable = true;
recommendedProxySettings = true;
2024-02-26 01:52:54 +00:00
upstreams."misskey".extraConfig = ''
2024-02-26 17:43:11 +00:00
server unix:/var/run/misskey/misskey.sock;
2024-02-26 01:52:54 +00:00
'';
2024-02-25 23:14:02 +00:00
virtualHosts."egirls.gay" = {
listen = [
{
port = 443;
addr = "0.0.0.0";
ssl = true;
}
{
port = 80;
addr = "0.0.0.0";
}
];
forceSSL = true;
2024-02-26 00:06:29 +00:00
useACMEHost = "egirls.gay";
2024-02-25 23:14:02 +00:00
locations."/" = {
proxyWebsockets = true;
2024-02-26 01:52:54 +00:00
proxyPass = "http://misskey";
2024-02-25 23:14:02 +00:00
extraConfig = ''
proxy_cache off;
'';
};
locations."/api/drive/files/create" = {
proxyWebsockets = true;
2024-02-26 01:52:54 +00:00
proxyPass = "http://misskey";
2024-02-25 23:14:02 +00:00
extraConfig = ''
# increase max size and don't buffer file uploads
client_max_body_size 2g;
proxy_request_buffering off;
proxy_cache off;
'';
};
locations."/.well-known/matrix/server".extraConfig = ''
add_header Content-Type application/json;
add_header Access-Control-Allow-Origin '*';
return 200 '{"m.server":"synapse.egirls.gay"}';
'';
locations."/.well-known/matrix/client".extraConfig = ''
add_header Content-Type application/json;
add_header Access-Control-Allow-Origin '*';
return 200 '{"m.homeserver":{"base_url":"https://synapse.egirls.gay"}}';
'';
};
};
2024-02-26 00:23:08 +00:00
2024-02-26 01:52:54 +00:00
users.groups.misskey = { members = [ "jaina" ]; };
users.users.misskey = {
isSystemUser = true;
group = "misskey";
};
2024-02-26 01:05:26 +00:00
# todo: figure out how to get misskey to build in nix instead of requiring a manual build process
#
# pnpm2nix does not work due to misskey using workspaces
2024-02-26 17:51:53 +00:00
environment.systemPackages =
[ nodejs nodePackages.pnpm pkgs.cypress pkgs.pkg-config pkgs.vips ];
2024-02-26 01:05:26 +00:00
environment.sessionVariables = {
CYPRESS_INSTALL_BINARY = "0";
CYPRESS_RUN_BINARY = "${pkgs.cypress}/bin/Cypress";
};
2024-02-26 01:52:54 +00:00
systemd.services.misskey = {
enable = true;
description = "Misskey daemon";
serviceConfig = {
Restart = "always";
StandardOutput = "syslog";
StandardError = "syslog";
Environment = "NODE_ENV=production";
WorkingDirectory = "/srv/misskey";
User = "misskey";
2024-02-26 18:00:57 +00:00
ExecStart = "${nodePackages.pnpm}/bin/pnpm start";
2024-02-26 17:45:27 +00:00
RuntimeDirectory = "misskey";
2024-02-26 01:52:54 +00:00
};
2024-02-26 02:06:15 +00:00
wantedBy = [ "multi-user.target" ];
2024-02-26 01:52:54 +00:00
};
2024-02-25 23:14:02 +00:00
}