infrastructure/machines/web01/linkal/module.nix

127 lines
2.9 KiB
Nix
Raw Normal View History

{
config,
lib,
pkgs,
sources,
...
}:
let
inherit (lib)
mapAttrs'
mkEnableOption
mkIf
mkOption
nameValuePair
types
;
package = import sources.linkal { inherit pkgs; };
cfg = config.dgn-linkal;
jsonFormat = pkgs.formats.json { };
in
{
options.dgn-linkal = {
enable = mkEnableOption "the linkal server.";
package = mkOption {
type = types.package;
default = package.overrideAttrs (_: { buildInputs = [ ]; });
};
domain = mkOption { type = types.str; };
calendarGroups = mkOption {
type =
let
inherit (types) attrsOf port submodule;
in
attrsOf (
submodule {
options = {
port = mkOption { type = port; };
calendars = mkOption { inherit (jsonFormat) type; };
};
}
);
default = { };
};
};
config = mkIf cfg.enable {
systemd.services =
mapAttrs'
(
name:
{ port, calendars }:
nameValuePair "linkal-${name}" {
description = "Linkal - ${name}";
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
ExecStart = "${cfg.package}/bin/linkal --port ${builtins.toString port} --calendar-file ${
jsonFormat.generate "linkal-${name}.json" { inherit calendars; }
}";
};
}
)
cfg.calendarGroups;
# Configure bind for DNS certificate validation on *.cal.dgnum.eu.
# services.bind = {
# enable = true;
# ipv4Only = true;
# extraConfig = ''
# include "${config.age.secrets."named-bind_dnskeys_conf".path}";
# '';
#
# zones = [rec {
# name = "cal.dgnum.eu";
# file = "/var/db/bind/${name}";
# master = true;
# extraConfig = ''
# allow-update { key "rfc2136key.cal.dgnum.eu"; };
# '';
# }];
# };
#
# networking.firewall = {
# allowedTCPPorts = [ 53 ];
# allowedUDPPorts = [ 53 ];
# };
#
# age-secrets.options = [{ named-bind_dnskeys_conf.owner = "named"; }];
#
# # Configure ACME for DNS certificate validation
# security.acme = {
# acceptTerms = true;
# defaults = {
# dnsProvider = "rfc2136";
# credentialsFile = config.age.secrets."acme-certs_secret".path;
# dnsPropagationCheck = false;
# };
# };
services.nginx = {
enable = true;
virtualHosts =
mapAttrs'
(
name:
{ port, ... }:
nameValuePair "${name}.${cfg.domain}" {
enableACME = true;
# acmeRoot = null; # Use DNS-01 validation
forceSSL = true;
locations."/".proxyPass = "http://127.0.0.1:${builtins.toString port}/";
}
)
cfg.calendarGroups;
};
};
}