fix

config-paths-needed.json

@@ -7,5 +7,6 @@
   [ "selfprivacy", "passthru", "auth", "oauth2-provider-name" ],
   [ "selfprivacy", "sso", "enable" ],
   [ "selfprivacy", "useBinds" ],
-  [ "services", "kanidm", "serverSettings", "origin" ]
+  [ "services", "kanidm", "serverSettings", "origin" ],
+  [ "services", "writefreely" ]
 ]

flake.nix

@@ -11,7 +11,7 @@
           spModuleSchemaVersion = 1;
           id = "writefreely";
           name = "WriteFreely";
-          description = "An open source platform for building a writing space on the web.";
+          description = "An open source platform for building a writing space on the web. Notice that the first signed in user will become the only admin automatically, and there is no possibility to change this.";
           svgIcon = builtins.readFile ./icon.svg;
           isMovable = true;
           isRequired = false;
@@ -27,7 +27,7 @@
           ];
           homepage = "https://writefreely.org";
           sourcePage = "https://github.com/writefreely/writefreely";
-          supportLevel = "normal";
+          supportLevel = "experimental";
           sso = {
             userGroup = "sp.writefreely.users";
           };

module.nix

@@ -41,7 +41,7 @@ in
       (lib.mkOption {
         default = "writefreely";
         type = lib.types.strMatching "[A-Za-z0-9][A-Za-z0-9\-]{0,61}[A-Za-z0-9]";
-        description = "Subdomain (changing subdomain after setting up will cause breakage of the federation!)";
+        description = "Subdomain (changing subdomain after enabling the federation will cause its breakage!)";
       })
       // {
         meta = {
@@ -51,6 +51,30 @@ in
           weight = 0;
         };
       };
+    appName =
+      (lib.mkOption {
+        default = "WriteFreely";
+        type = lib.types.str;
+        description = "Name of the WriteFreely instance.";
+      })
+      // {
+        meta = {
+          type = "string";
+          weight = 1;
+        };
+      };
+    description =
+      (lib.mkOption {
+        default = "WriteFreely instance.";
+        type = lib.types.str;
+        description = "Description of the WriteFreely instance. This makes no sense if the federation is not enabled.";
+      })
+      // {
+        meta = {
+          type = "string";
+          weight = 2;
+        };
+      };
     enableFederation =
       (lib.mkOption {
         default = false;
@@ -60,19 +84,7 @@ in
       // {
         meta = {
           type = "bool";
-          weight = 1;
-        };
-      };
-    title =
-      (lib.mkOption {
-        default = "WriteFreely";
-        type = lib.types.str;
-        description = "Name of the WriteFreely instance.";
-      })
-      // {
-        meta = {
-          type = "str";
-          weight = 2;
+          weight = 3;
         };
       };
   };
@@ -88,7 +100,7 @@ in
     fileSystems = lib.mkIf sp.useBinds {
       "/var/lib/writefreely" = {
         device = "/volumes/${cfg.location}/writefreely";
-        options = [ "bind" ];
+        options = [ "bind" "uid=writefreely" "gid=writefreely" ];
       };
     };
 
@@ -99,11 +111,13 @@ in
       settings = {
         server.port = 8081;
         app = {
-          site_name = cfg.title;
+          host = lib.mkForce "https://${cfg.subdomain}.${sp.domain}";
+          site_name = cfg.appName;
+          site_description = cfg.description;
           single_user = false;
           federation = cfg.enableFederation;
           disable_password_auth = true;
-          open_registration = false;
+          open_registration = true;
         };
 
         "oauth.generic" = {
@@ -113,32 +127,42 @@ in
           token_endpoint = "/oauth2/token";
           inspect_endpoint = "/oauth2/openid/${oauthClientID}/userinfo";
           auth_endpoint = "/ui/oauth2";
+          client_secret = "@replace_oauth_secret@";
+          map_user_id = "preferred_username";
+          map_username = "preferred_username";
+          scope = "openid email profile";
         };
       };
     };
 
     systemd = {
       services.writefreely = {
-        requeres = [ "writefreely-secrets.service" ];
+        requires = [ "writefreely-sqlite-init.service" ];
+        path = [ pkgs.openssl ];
         unitConfig.RequiresMountsFor = lib.mkIf sp.useBinds "/volumes/${cfg.location}/writefreely";
         serviceConfig.Slice = "writefreely.slice";
+        restartTriggers = [ (
+          pkgs.writeText "writefreely-restart-trigger"
+            (builtins.toJSON config.services.writefreely.settings)
+        ) ];
       };
 
-      services.writefreely-secrets = let inherit (config.services.writefreely) stateDir;
+      services.writefreely-sqlite-init = let
+        cfgFile = "${config.services.writefreely.stateDir}/config.ini";
       in {
-        wantedBy = [ "multi-user.target" ];
-        requiredBy = [ "writefreely.service" ];
-
-        serviceConfig = {
-          Type = "oneshot";
-          Slice = "writefreely.slice";
-        };
-
-        script = let crudini = lib.getExe pkgs.crudini;
-        in ''
-          ${crudini} --set ${stateDir}/config.ini oauth.generic client_secret '$(cat ${oauthClientSecretFP})'
+        postStart = ''
+          chmod 660 '${cfgFile}'
+          ${lib.getExe pkgs.replace-secret} "@replace_oauth_secret@" "${oauthClientSecretFP}" "${cfgFile}"
+          chmod 440 '${cfgFile}'
         '';
 
+        unitConfig.RequiresMountsFor = lib.mkIf sp.useBinds "/volumes/${cfg.location}/writefreely";
+        serviceConfig = {
+          Slice = "writefreely.slice";
+          ExecStartPre = [
+            "+${pkgs.coreutils}/bin/chown writefreely:writefreely /var/lib/writefreely"
+          ];
+        };
       };
 
       slices.writefreely = {
@@ -146,13 +170,26 @@ in
       };
     };
 
+    services.nginx.virtualHosts."${cfg.subdomain}.${sp.domain}" = {
+      useACMEHost = sp.domain;
+      forceSSL = true;
+      locations = {
+        "/" = {
+          proxyPass = "http://127.0.0.1:8081";
+        };
+      };
+    };
+
     selfprivacy.auth.clients.${oauthClientID} = {
       inherit usersGroup;
       subdomain = cfg.subdomain;
       originLanding = "https://${cfg.subdomain}.${sp.domain}/";
-      originUrl = "https://${cfg.subdomain}.${sp.domain}/auth/oauth2/callback";
+      originUrl = "https://${cfg.subdomain}.${sp.domain}/oauth/callback/generic";
       clientSystemdUnits = [ "writefreely.service" ];
       enablePkce = false;
+      scopeMaps = {
+        "${usersGroup}" = [ "email" "openid" "profile" ];
+      };
       linuxUserOfClient = "writefreely";
       linuxGroupOfClient = "writefreely";
     };