c1ed3a522c
Nix store is world-readable, and while nix repl fails to get the secret due to file permissions, we should still set up secrets without getting them in Nix store. In the past tmpfiles.d was used, but its entire contents get to the nix store. Now, all files with secrets are generated in activation scripts, with the help of jq and sed. Also dead Pleroma code was deleted, but CAPTCHA is still broken. Co-authored-by: inexcode <inex.code@selfprivacy.org> Reviewed-on: https://git.selfprivacy.org/SelfPrivacy/selfprivacy-nixos-config/pulls/19 Co-authored-by: Inex Code <inex.code@selfprivacy.org> Co-committed-by: Inex Code <inex.code@selfprivacy.org>
103 lines
3.5 KiB
Nix
103 lines
3.5 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
cfg = config.services.selfprivacy-api;
|
|
directionArg =
|
|
if cfg.direction == ""
|
|
then ""
|
|
else "--direction=${cfg.direction}";
|
|
in
|
|
{
|
|
options.services.selfprivacy-api = {
|
|
enable = mkOption {
|
|
default = true;
|
|
type = types.bool;
|
|
description = ''
|
|
Enable SelfPrivacy API service
|
|
'';
|
|
};
|
|
enableSwagger = mkOption {
|
|
default = false;
|
|
type = types.bool;
|
|
description = ''
|
|
Enable Swagger UI
|
|
'';
|
|
};
|
|
b2Bucket = mkOption {
|
|
type = types.str;
|
|
description = ''
|
|
B2 bucket
|
|
'';
|
|
};
|
|
};
|
|
config = lib.mkIf cfg.enable {
|
|
|
|
systemd.services.selfprivacy-api = {
|
|
description = "API Server used to control system from the mobile application";
|
|
environment = config.nix.envVars // {
|
|
inherit (config.environment.sessionVariables) NIX_PATH;
|
|
HOME = "/root";
|
|
PYTHONUNBUFFERED = "1";
|
|
ENABLE_SWAGGER = (if cfg.enableSwagger then "1" else "0");
|
|
B2_BUCKET = cfg.b2Bucket;
|
|
} // config.networking.proxy.envVars;
|
|
path = [ "/var/" "/var/dkim/" pkgs.coreutils pkgs.gnutar pkgs.xz.bin pkgs.gzip pkgs.gitMinimal config.nix.package.out pkgs.nixos-rebuild pkgs.restic pkgs.mkpasswd ];
|
|
after = [ "network-online.target" ];
|
|
wantedBy = [ "network-online.target" ];
|
|
serviceConfig = {
|
|
User = "root";
|
|
ExecStart = "${pkgs.selfprivacy-api}/bin/app.py";
|
|
Restart = "always";
|
|
RestartSec = "5";
|
|
};
|
|
};
|
|
# One shot systemd service to rebuild NixOS using nixos-rebuild
|
|
systemd.services.sp-nixos-rebuild = {
|
|
description = "Upgrade NixOS using nixos-rebuild";
|
|
environment = config.nix.envVars // {
|
|
inherit (config.environment.sessionVariables) NIX_PATH;
|
|
HOME = "/root";
|
|
} // config.networking.proxy.envVars;
|
|
path = [ pkgs.coreutils pkgs.gnutar pkgs.xz.bin pkgs.gzip pkgs.gitMinimal config.nix.package.out pkgs.nixos-rebuild ];
|
|
serviceConfig = {
|
|
User = "root";
|
|
ExecStart = "${pkgs.nixos-rebuild}/bin/nixos-rebuild switch";
|
|
KillMode = "none";
|
|
SendSIGKILL = "no";
|
|
};
|
|
};
|
|
# One shot systemd service to upgrade NixOS using nixos-rebuild
|
|
systemd.services.sp-nixos-upgrade = {
|
|
description = "Upgrade NixOS using nixos-rebuild";
|
|
environment = config.nix.envVars // {
|
|
inherit (config.environment.sessionVariables) NIX_PATH;
|
|
HOME = "/root";
|
|
} // config.networking.proxy.envVars;
|
|
path = [ pkgs.coreutils pkgs.gnutar pkgs.xz.bin pkgs.gzip pkgs.gitMinimal config.nix.package.out pkgs.nixos-rebuild ];
|
|
serviceConfig = {
|
|
User = "root";
|
|
ExecStart = "${pkgs.nixos-rebuild}/bin/nixos-rebuild switch --upgrade";
|
|
KillMode = "none";
|
|
SendSIGKILL = "no";
|
|
};
|
|
};
|
|
# One shot systemd service to rollback NixOS using nixos-rebuild
|
|
systemd.services.sp-nixos-rollback = {
|
|
description = "Rollback NixOS using nixos-rebuild";
|
|
environment = config.nix.envVars // {
|
|
inherit (config.environment.sessionVariables) NIX_PATH;
|
|
HOME = "/root";
|
|
} // config.networking.proxy.envVars;
|
|
path = [ pkgs.coreutils pkgs.gnutar pkgs.xz.bin pkgs.gzip pkgs.gitMinimal config.nix.package.out pkgs.nixos-rebuild ];
|
|
serviceConfig = {
|
|
User = "root";
|
|
ExecStart = "${pkgs.nixos-rebuild}/bin/nixos-rebuild switch --rollback";
|
|
KillMode = "none";
|
|
SendSIGKILL = "no";
|
|
};
|
|
};
|
|
};
|
|
}
|