mirror of
https://github.com/oddlama/nix-config.git
synced 2025-10-10 23:00:39 +02:00
feat: add ente
This commit is contained in:
oddlama
parent
ac34b94f87
commit
4c2f98f9e4
48 changed files with 904 additions and 4 deletions
|
|
@ -4,6 +4,7 @@
|
|||
./backups.nix
|
||||
./deterministic-ids.nix
|
||||
./distributed-config.nix
|
||||
./ente.nix
|
||||
./globals.nix
|
||||
./meta.nix
|
||||
./nginx-upstream-monitoring.nix
|
||||
|
|
|
|||
346
modules/ente.nix
Normal file
346
modules/ente.nix
Normal file
|
|
@ -0,0 +1,346 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
utils,
|
||||
...
|
||||
}:
|
||||
let
|
||||
inherit (lib)
|
||||
getExe
|
||||
mkDefault
|
||||
mkEnableOption
|
||||
mkIf
|
||||
mkMerge
|
||||
mkOption
|
||||
mkPackageOption
|
||||
optional
|
||||
types
|
||||
;
|
||||
|
||||
cfgApi = config.services.ente.api;
|
||||
cfgWeb = config.services.ente.web;
|
||||
|
||||
webPackage =
|
||||
enteApp:
|
||||
cfgWeb.package.override {
|
||||
inherit enteApp;
|
||||
enteMainUrl = "https://${cfgWeb.domains.photos}";
|
||||
extraBuildEnv = {
|
||||
NEXT_PUBLIC_ENTE_ENDPOINT = "https://${cfgWeb.domains.api}";
|
||||
NEXT_PUBLIC_ENTE_ALBUMS_ENDPOINT = "https://${cfgWeb.domains.albums}";
|
||||
NEXT_TELEMETRY_DISABLED = "1";
|
||||
};
|
||||
};
|
||||
|
||||
defaultUser = "ente";
|
||||
defaultGroup = "ente";
|
||||
dataDir = "/var/lib/ente";
|
||||
|
||||
yamlFormat = pkgs.formats.yaml { };
|
||||
in
|
||||
{
|
||||
options.services.ente = {
|
||||
web = {
|
||||
enable = mkEnableOption "Ente web frontend (Photos, Albums)";
|
||||
package = mkPackageOption pkgs "ente-web" { };
|
||||
|
||||
domains = {
|
||||
api = mkOption {
|
||||
type = types.str;
|
||||
description = ''
|
||||
The domain under which the api is served. This will NOT serve the api itself,
|
||||
but is a required setting to host the frontends! This will automatically be set
|
||||
for you if you enable both the api server and web frontends.
|
||||
'';
|
||||
};
|
||||
|
||||
accounts = mkOption {
|
||||
type = types.str;
|
||||
description = "The domain under which the accounts frontend will be served.";
|
||||
};
|
||||
|
||||
cast = mkOption {
|
||||
type = types.str;
|
||||
description = "The domain under which the cast frontend will be served.";
|
||||
};
|
||||
|
||||
albums = mkOption {
|
||||
type = types.str;
|
||||
description = "The domain under which the albums frontend will be served.";
|
||||
};
|
||||
|
||||
photos = mkOption {
|
||||
type = types.str;
|
||||
description = "The domain under which the photos frontend will be served.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
api = {
|
||||
enable = mkEnableOption "Museum (API server for ente.io)";
|
||||
package = mkPackageOption pkgs "museum" { };
|
||||
nginx.enable = mkEnableOption "nginx proxy for the API server";
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
default = defaultUser;
|
||||
description = "User under which museum runs.";
|
||||
};
|
||||
|
||||
group = mkOption {
|
||||
type = types.str;
|
||||
default = defaultGroup;
|
||||
description = "Group under which museum runs.";
|
||||
};
|
||||
|
||||
domain = mkOption {
|
||||
type = types.str;
|
||||
description = "The domain under which the api will be served.";
|
||||
};
|
||||
|
||||
enableLocalDB = mkEnableOption "the automatic creation of a local postgres database for museum.";
|
||||
|
||||
settings = mkOption {
|
||||
description = ''
|
||||
Museum yaml configuration. Refer to upstream [local.yaml](https://github.com/ente-io/ente/blob/main/server/configurations/local.yaml) for more information.
|
||||
You can specify secret values in this configuration by setting `somevalue._secret = "/path/to/file"` instead of setting `somevalue` directly.
|
||||
'';
|
||||
default = { };
|
||||
type = types.submodule {
|
||||
freeformType = yamlFormat.type;
|
||||
options = {
|
||||
apps = {
|
||||
public-albums = mkOption {
|
||||
type = types.str;
|
||||
default = "https://albums.ente.io";
|
||||
description = ''
|
||||
If you're running a self hosted instance and wish to serve public links,
|
||||
set this to the URL where your albums web app is running.
|
||||
'';
|
||||
};
|
||||
|
||||
cast = mkOption {
|
||||
type = types.str;
|
||||
default = "https://cast.ente.io";
|
||||
description = ''
|
||||
Set this to the URL where your cast page is running.
|
||||
This is for browser and chromecast casting support.
|
||||
'';
|
||||
};
|
||||
|
||||
accounts = mkOption {
|
||||
type = types.str;
|
||||
default = "https://accounts.ente.io";
|
||||
description = ''
|
||||
Set this to the URL where your accounts page is running.
|
||||
This is primarily for passkey support.
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
db = {
|
||||
host = mkOption {
|
||||
type = types.str;
|
||||
description = "The database host";
|
||||
};
|
||||
|
||||
port = mkOption {
|
||||
type = types.port;
|
||||
default = 5432;
|
||||
description = "The database port";
|
||||
};
|
||||
|
||||
name = mkOption {
|
||||
type = types.str;
|
||||
description = "The database name";
|
||||
};
|
||||
|
||||
user = mkOption {
|
||||
type = types.str;
|
||||
description = "The database user";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = mkMerge [
|
||||
(mkIf cfgApi.enable {
|
||||
services.postgresql = mkIf cfgApi.enableLocalDB {
|
||||
enable = true;
|
||||
ensureUsers = [
|
||||
{
|
||||
name = "ente";
|
||||
ensureDBOwnership = true;
|
||||
}
|
||||
];
|
||||
ensureDatabases = [ "ente" ];
|
||||
};
|
||||
|
||||
services.ente.web.domains.api = mkIf cfgWeb.enable cfgApi.domain;
|
||||
services.ente.api.settings = {
|
||||
log-file = mkDefault "";
|
||||
db = mkIf cfgApi.enableLocalDB {
|
||||
host = "/run/postgresql";
|
||||
port = 5432;
|
||||
name = "ente";
|
||||
user = "ente";
|
||||
};
|
||||
};
|
||||
|
||||
systemd.services.ente = {
|
||||
description = "Ente.io Museum API Server";
|
||||
after = [ "network.target" ] ++ optional cfgApi.enableLocalDB "postgresql.service";
|
||||
requires = optional cfgApi.enableLocalDB "postgresql.service";
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
|
||||
preStart = ''
|
||||
# Generate config including secret values. YAML is a superset of JSON, so we can use this here.
|
||||
${utils.genJqSecretsReplacementSnippet cfgApi.settings "/run/ente/local.yaml"}
|
||||
|
||||
# Setup paths
|
||||
mkdir -p ${dataDir}/configurations
|
||||
ln -sTf /run/ente/local.yaml ${dataDir}/configurations/local.yaml
|
||||
'';
|
||||
|
||||
serviceConfig = {
|
||||
ExecStart = getExe cfgApi.package;
|
||||
Type = "simple";
|
||||
Restart = "on-failure";
|
||||
|
||||
AmbientCapablities = [ ];
|
||||
CapabilityBoundingSet = [ ];
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateMounts = true;
|
||||
PrivateTmp = true;
|
||||
PrivateUsers = false;
|
||||
ProcSubset = "pid";
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectSystem = "strict";
|
||||
RestrictAddressFamilies = [
|
||||
"AF_INET"
|
||||
"AF_INET6"
|
||||
"AF_NETLINK"
|
||||
"AF_UNIX"
|
||||
];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallFilter = "@system-service";
|
||||
UMask = "077";
|
||||
|
||||
BindReadOnlyPaths = [
|
||||
"${cfgApi.package}/share/museum/migrations:${dataDir}/migrations"
|
||||
"${cfgApi.package}/share/museum/mail-templates:${dataDir}/mail-templates"
|
||||
];
|
||||
|
||||
User = cfgApi.user;
|
||||
Group = cfgApi.group;
|
||||
|
||||
SyslogIdentifier = "ente";
|
||||
StateDirectory = "ente";
|
||||
WorkingDirectory = dataDir;
|
||||
RuntimeDirectory = "ente";
|
||||
};
|
||||
|
||||
# Environment MUST be called local, otherwise we cannot log to stdout
|
||||
environment = {
|
||||
ENVIRONMENT = "local";
|
||||
GIN_MODE = "release";
|
||||
};
|
||||
};
|
||||
|
||||
users = {
|
||||
users = mkIf (cfgApi.user == defaultUser) {
|
||||
${defaultUser} = {
|
||||
description = "ente.io museum service user";
|
||||
inherit (cfgApi) group;
|
||||
isSystemUser = true;
|
||||
home = dataDir;
|
||||
};
|
||||
};
|
||||
groups = mkIf (cfgApi.group == defaultGroup) { ${defaultGroup} = { }; };
|
||||
};
|
||||
|
||||
services.nginx = mkIf cfgApi.nginx.enable {
|
||||
enable = true;
|
||||
upstreams.museum = {
|
||||
servers."localhost:8080" = { };
|
||||
extraConfig = ''
|
||||
zone museum 64k;
|
||||
keepalive 20;
|
||||
'';
|
||||
};
|
||||
|
||||
virtualHosts.${cfgApi.domain} = {
|
||||
forceSSL = mkDefault true;
|
||||
locations."/".proxyPass = "http://museum";
|
||||
extraConfig = ''
|
||||
client_max_body_size 4M;
|
||||
'';
|
||||
};
|
||||
};
|
||||
})
|
||||
(mkIf cfgWeb.enable {
|
||||
services.ente.api.settings = mkIf cfgApi.enable {
|
||||
apps = {
|
||||
accounts = "https://${cfgWeb.domains.accounts}";
|
||||
cast = "https://${cfgWeb.domains.cast}";
|
||||
public-albums = "https://${cfgWeb.domains.albums}";
|
||||
};
|
||||
|
||||
webauthn = {
|
||||
rpid = cfgWeb.domains.accounts;
|
||||
rporigins = [ "https://${cfgWeb.domains.accounts}" ];
|
||||
};
|
||||
};
|
||||
|
||||
services.nginx =
|
||||
let
|
||||
domainFor = app: cfgWeb.domains.${app};
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
virtualHosts.${domainFor "accounts"} = {
|
||||
forceSSL = mkDefault true;
|
||||
locations."/" = {
|
||||
root = webPackage "accounts";
|
||||
tryFiles = "$uri $uri.html /index.html";
|
||||
};
|
||||
};
|
||||
virtualHosts.${domainFor "cast"} = {
|
||||
forceSSL = mkDefault true;
|
||||
locations."/" = {
|
||||
root = webPackage "cast";
|
||||
tryFiles = "$uri $uri.html /index.html";
|
||||
};
|
||||
};
|
||||
virtualHosts.${domainFor "photos"} = {
|
||||
serverAliases = [
|
||||
(domainFor "albums") # the albums app is shared with the photos frontend
|
||||
];
|
||||
forceSSL = mkDefault true;
|
||||
locations."/" = {
|
||||
root = webPackage "photos";
|
||||
tryFiles = "$uri $uri.html /index.html";
|
||||
};
|
||||
};
|
||||
};
|
||||
})
|
||||
];
|
||||
|
||||
meta.maintainers = with lib.maintainers; [ oddlama ];
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue