From 4c056076221520bdd18d61e15a3da2a2599cfd17 Mon Sep 17 00:00:00 2001 From: Antoine Martin Date: Mon, 7 Nov 2022 22:37:52 +0100 Subject: [PATCH] hades: add pleroma service --- hosts/hades/default.nix | 6 ++ hosts/hades/secrets.nix | 4 + modules/secrets/pleroma/pleroma-config.age | Bin 0 -> 956 bytes modules/secrets/secrets.nix | 2 + services/default.nix | 1 + services/pleroma.nix | 112 +++++++++++++++++++++ 6 files changed, 125 insertions(+) create mode 100644 modules/secrets/pleroma/pleroma-config.age create mode 100644 services/pleroma.nix diff --git a/hosts/hades/default.nix b/hosts/hades/default.nix index c44a4a1..d573e98 100644 --- a/hosts/hades/default.nix +++ b/hosts/hades/default.nix @@ -99,6 +99,12 @@ in { port = 8084; }; + pleroma = { + enable = true; + port = 8086; + secretConfigFile = config.age.secrets."pleroma/pleroma-config".path; + }; + restic-backup = { enable = true; repo = "b2:hades-backup-alarsyo"; diff --git a/hosts/hades/secrets.nix b/hosts/hades/secrets.nix index 28b5d07..40373ec 100644 --- a/hosts/hades/secrets.nix +++ b/hosts/hades/secrets.nix @@ -28,6 +28,10 @@ "paperless/admin-password" = {}; "paperless/secret-key" = {}; + "pleroma/pleroma-config" = { + owner = "pleroma"; + }; + "restic-backup/hades-credentials" = {}; "restic-backup/hades-password" = {}; diff --git a/modules/secrets/pleroma/pleroma-config.age b/modules/secrets/pleroma/pleroma-config.age new file mode 100644 index 0000000000000000000000000000000000000000..9b1463967dbb6cdc6356fc2db12d938a5f6fd633 GIT binary patch literal 956 zcmV;t14H~_XJsvAZewzJaCB*JZZ2b>7Wo&0pIWSU3ZbMo#LojS}RCG*KVPQs9cQr9sFlSYHb8t>~Xmbi0Xhv&vWKlPHNo+J!cvT85J|J^*Xf0)AGBq_ZIUsOY zIC(N>AW~~rW<_IePEl}9MObM#Pew9kc6LxTbv86FX?j{PSvPBQbxCtcZB|Ba3UD$| zPjgUsF;7BxNOLe`G+9PTVpTF`b4zD+PGvS#cS3SQcSdtTYf?u=3N1b$d~!cbJ1u8& zWnpt=3S~$zc``#xVK7s0VKh*1VM0zwbwf8xP)Im)3N0-yAa!tZF+@&hXH;o1SaW)A zH91r>W>!sYb3`jKGGuQyadt67O;k8~F>`ru3a&>YMWx8<%)vqrig*3`tF-tKyj|X& z{8y=eHXXnuT$&%SFYYsDQKJFjvMu>WF&!Wu?;TngKcdQwZRdq#tiyCb9dZ2ILL3^O z-N?xt2ap%n#p$nuEXQOhCXV9n6x=2#_;-Gchf|=23%6+lN?#%tm^YD(V)~doc~wKW z)|(L-VGs|MSH7|A*bIAq+Y!{po>!(?PN6&q-IY3emy(VKZt3oZJ*?JZH!#fl7q-?P z7%dmQQz=i&|NP?Vt8+MNwrVX;=8>08MO2JyXq_`5{_^6Gqs|TQzx3~hMZd7-6o<8e ziERqbBZGd5P5e8J(SH%?9H0ptGpLMtraOCO8GE>+F&p5iQd|<}z8`ma^X9UkHCo9$ zFs(unepNQ{NN6|2&yeW=>jAo|F*ln{DMr)jO^#@riHYnl?Z{&UULZ&3*brE`sTw!M z+o@z@z^otp;+9+TT5TkW@Tu1umy z(z~{p{m-V9=Rk@hfg)x9MF9*1-4ciy5^_+^xmqy}ek#=K%pyx&3Jg#w@gvQ2Oq+ zE(}-(0mK=X|GGEAK%_if87tayKVLD3Aefv@jowrh&N~suWqhlQ6JHM==+EZLNU3@Y z9vG)|SNUzn71^1RO)Jd%ezpDz!Esh_`*0l3iJbTjvD{0stg#VnYgBUc6`9<*+x$vFTsO!yiM-C11Jf)#ox0hM#x< literal 0 HcmV?d00001 diff --git a/modules/secrets/secrets.nix b/modules/secrets/secrets.nix index c5e3a36..112685e 100644 --- a/modules/secrets/secrets.nix +++ b/modules/secrets/secrets.nix @@ -24,6 +24,8 @@ in { "paperless/admin-password.age".publicKeys = [alarsyo hades]; "paperless/secret-key.age".publicKeys = [alarsyo hades]; + "pleroma/pleroma-config.age".publicKeys = [alarsyo hades]; + "restic-backup/boreal-password.age".publicKeys = [alarsyo boreal]; "restic-backup/boreal-credentials.age".publicKeys = [alarsyo boreal]; "restic-backup/hades-password.age".publicKeys = [alarsyo hades]; diff --git a/services/default.nix b/services/default.nix index c129d03..44c7def 100644 --- a/services/default.nix +++ b/services/default.nix @@ -16,6 +16,7 @@ ./paperless.nix ./photoprism.nix ./pipewire.nix + ./pleroma.nix ./postgresql-backup.nix ./postgresql.nix ./restic-backup.nix diff --git a/services/pleroma.nix b/services/pleroma.nix new file mode 100644 index 0000000..2593c81 --- /dev/null +++ b/services/pleroma.nix @@ -0,0 +1,112 @@ +{ + config, + lib, + pkgs, + ... +}: let + inherit + (lib) + mkEnableOption + mkIf + mkOption + ; + + cfg = config.my.services.pleroma; + my = config.my; + + domain = config.networking.domain; + hostname = config.networking.hostName; + fqdn = "${hostname}.${domain}"; +in { + options.my.services.pleroma = let + inherit (lib) types; + in { + enable = mkEnableOption "Pleroma"; + + port = mkOption { + type = types.port; + default = 8080; + example = 8080; + description = "Pleroma server port"; + }; + + secretConfigFile = mkOption { + type = types.str; + default = "/var/lib/pleroma/secrets.exs"; + }; + }; + + config = mkIf cfg.enable { + systemd.services.pleroma = { + path = [ + pkgs.hexdump + pkgs.exiftool + ]; + }; + + services.pleroma = { + enable = true; + secretConfigFile = cfg.secretConfigFile; + + configs = [ + '' + import Config + + config :pleroma, Pleroma.Web.Endpoint, + url: [host: "social.${domain}", scheme: "https", port: 443], + http: [ip: {127, 0, 0, 1}, port: ${toString cfg.port}] + + config :pleroma, :instance, + name: "social.alarsyo.net", + email: "contact+pleroma@alarsyo.net", + notify_email: "pleroma@alarsyo.net", + limit: 5000, + registrations_open: false + + config :pleroma, :media_proxy, + enabled: false, + redirect_on_failure: true + #base_url: "https://cache.pleroma.social" + + config :pleroma, Pleroma.Repo, + adapter: Ecto.Adapters.Postgres, + username: "pleroma", + database: "pleroma", + hostname: "localhost" + + # Configure web push notifications + config :web_push_encryption, :vapid_details, + subject: "mailto:contact+pleroma@alarsyo.net" + + config :pleroma, :database, rum_enabled: false + config :pleroma, :instance, static_dir: "/var/lib/pleroma/static" + config :pleroma, Pleroma.Uploaders.Local, uploads: "/var/lib/pleroma/uploads" + + # Enable Strict-Transport-Security once SSL is working: + # config :pleroma, :http_security, + # sts: true + + config :pleroma, configurable_from_database: false + + config :pleroma, Pleroma.Upload, filters: [Pleroma.Upload.Filter.AnonymizeFilename] + '' + ]; + }; + + services.nginx.virtualHosts."social.${domain}" = { + forceSSL = true; + useACMEHost = fqdn; + + locations."/" = { + proxyPass = "http://127.0.0.1:${toString cfg.port}/"; + proxyWebsockets = true; + extraConfig = '' + etag on; + client_max_body_size 50m; + ''; + }; + }; + + security.acme.certs.${fqdn}.extraDomainNames = ["social.${domain}"]; + }; +}