{ config, lib, pkgs, sources, ... }: let inherit (lib) mapAttrsToList; port = 9889; python3 = pkgs.python312; pythonEnv = python3.withPackages (ps: [ ps.django ps.ldap3 ps.gunicorn ps.psycopg # Local packages (ps.callPackage ./packages/django-browser-reload { }) (ps.callPackage ./packages/django-bulma-forms { }) (ps.callPackage ./packages/django-cas-server { }) (ps.callPackage ./packages/loadcredential { }) ]); staticDrv = pkgs.stdenv.mkDerivation { name = "cas_eleves-static"; src = sources.cas-eleves; nativeBuildInputs = [ pythonEnv ]; configurePhase = '' export CE_STATIC_ROOT=$out/static export CE_DEBUG=true export CREDENTIALS_DIRECTORY=$(pwd)/.credentials ''; buildPhase = '' mkdir -p $out/static ''; installPhase = '' python3 manage.py collectstatic ''; }; in { systemd.services = { django-cas-eleves = { description = "ENS CAS server"; wantedBy = [ "multi-user.target" ]; after = [ "network.target" "postgresql.service" ]; serviceConfig = { DynamicUser = true; LoadCredential = mapAttrsToList (name: value: "${name}:${value}") { SECRET_KEY = config.age.secrets."cas_eleves-secret_key_file".path; }; StateDirectory = "django-cas-eleves"; User = "cas_server"; WorkingDirectory = sources.cas-eleves; }; environment = { CE_ALLOWED_HOSTS = builtins.toJSON [ "cas-eleves.dgnum.eu" "cas.eleves.ens.fr" ]; CE_STATIC_ROOT = staticDrv; }; path = [ pythonEnv ]; script = '' python3 manage.py migrate gunicorn app.wsgi --pythonpath ${sources.cas-eleves} -b 127.0.0.1:${builtins.toString port} --workers=2 --threads=4 ''; }; cas-eleves-cleanup = { description = "Periodic cleanup of cas_server database"; startAt = "daily"; serviceConfig = { Type = "oneshot"; LoadCredential = mapAttrsToList (name: value: "${name}:${value}") { SECRET_KEY = config.age.secrets."cas_eleves-secret_key_file".path; }; StateDirectory = "django-cas-eleves"; User = "cas_server"; WorkingDirectory = sources.cas-eleves; }; path = [ pythonEnv ]; script = '' python3 manage.py clearsessions python3 manage.py cas_clean_sessions python3 manage.py cas_clean_tickets ''; }; }; services = { postgresql = { ensureDatabases = [ "cas_server" ]; ensureUsers = [ { name = "cas_server"; ensureDBOwnership = true; } ]; }; nginx.virtualHosts."cas-eleves.dgnum.eu" = { enableACME = true; forceSSL = true; locations = { "/".proxyPass = "http://127.0.0.1:${builtins.toString port}"; "/static/".root = staticDrv; "= /robots.txt".root = "${staticDrv}/static"; }; }; }; }