infrastructure/machines/web02/kadenios/default.nix
Tom Hubrecht 2f06f22ac7
All checks were successful
Check meta / check_meta (pull_request) Successful in 18s
Check meta / check_dns (pull_request) Successful in 16s
build configuration / build_and_cache_storage01 (pull_request) Successful in 1m22s
build configuration / build_and_cache_rescue01 (pull_request) Successful in 1m20s
build configuration / build_and_cache_krz01 (pull_request) Successful in 2m2s
build configuration / build_and_cache_compute01 (pull_request) Successful in 1m40s
build configuration / build_and_cache_geo01 (pull_request) Successful in 1m4s
lint / check (pull_request) Successful in 25s
build configuration / build_and_cache_geo02 (pull_request) Successful in 1m4s
build configuration / build_and_cache_web02 (pull_request) Successful in 1m16s
build configuration / build_and_cache_bridge01 (pull_request) Successful in 1m9s
build configuration / build_and_cache_web01 (pull_request) Successful in 1m54s
build configuration / build_and_cache_vault01 (pull_request) Successful in 1m23s
build configuration / build_and_cache_storage01 (push) Successful in 1m14s
build configuration / build_and_cache_compute01 (push) Successful in 1m33s
build configuration / build_and_cache_krz01 (push) Successful in 2m1s
build configuration / build_and_cache_rescue01 (push) Successful in 1m15s
build configuration / build_and_cache_geo01 (push) Successful in 1m0s
build configuration / build_and_cache_geo02 (push) Successful in 1m4s
build configuration / build_and_cache_vault01 (push) Successful in 1m21s
lint / check (push) Successful in 24s
build configuration / build_and_cache_web02 (push) Successful in 1m7s
build configuration / build_and_cache_web01 (push) Successful in 1m41s
build configuration / build_and_cache_bridge01 (push) Successful in 1m5s
feat(nginx): Switch to simpleProxies for the majority of configs
2024-10-12 20:00:54 +02:00

186 lines
4.2 KiB
Nix

{
config,
lib,
pkgs,
sources,
...
}:
let
inherit (lib) mapAttrsToList optionals;
host = "vote.dgnum.eu";
port = 9888;
python3 =
let
nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
in
pkgs.python3.override {
packageOverrides = _: _: {
inherit (nix-pkgs)
authens
django-background-tasks
django-browser-reload
django-bulma-forms
django-translated-fields
loadcredential
;
};
};
pythonEnv =
{
debug ? false,
}:
python3.withPackages (
ps:
[
ps.django
ps.gunicorn
ps.markdown
ps.numpy
ps.networkx
ps.psycopg
ps.authens
ps.django-background-tasks
ps.django-bulma-forms
ps.django-translated-fields
ps.loadcredential
]
++ (optionals debug [
ps.django-browser-reload
ps.django-debug-toolbar
])
);
manage = pkgs.writeShellApplication {
name = "kadenios-manage";
runtimeInputs = path ++ [
config.systemd.package
pkgs.util-linux
];
text = ''
MainPID=$(systemctl show -p MainPID --value django-kadenios.service)
nsenter -e -a -t "$MainPID" -G follow -S follow python ${sources.kadenios}/manage.py "$@"
'';
};
staticDrv = pkgs.stdenv.mkDerivation {
name = "kadenios-static";
src = sources.kadenios;
nativeBuildInputs = [ (pythonEnv { debug = true; }) ];
configurePhase = ''
export KADENIOS_STATIC_ROOT=$out/static
export KADENIOS_DEBUG=true
export CREDENTIALS_DIRECTORY=$(pwd)/.credentials
'';
doBuild = false;
installPhase = ''
mkdir -p $out/static
python3 manage.py collectstatic
'';
};
environment = builtins.mapAttrs (_: builtins.toJSON) {
KADENIOS_ALLOWED_HOSTS = [ "vote.dgnum.eu" ];
KADENIOS_STATIC_ROOT = staticDrv;
KADENIOS_DATABASES = {
default = {
ENGINE = "django.db.backends.postgresql";
NAME = "kadenios";
};
};
KADENIOS_EMAIL_HOST_USER = "web-services@infra.dgnum.eu";
KADENIOS_EMAIL_USE_SSL = true;
KADENIOS_FROM_EMAIL = "Kadenios <vote@infra.dgnum.eu>";
KADENIOS_SERVER_EMAIL = "kadenios@infra.dgnum.eu";
};
path = [ (pythonEnv { }) ];
in
{
environment.systemPackages = [ manage ];
systemd.services = {
django-kadenios = {
description = "ENS simple voting server";
wantedBy = [ "multi-user.target" ];
after = [
"network.target"
"postgresql.service"
];
serviceConfig = {
DynamicUser = true;
LoadCredential = mapAttrsToList (name: value: "${name}:${value}") {
SECRET_KEY = config.age.secrets."kadenios-secret_key_file".path;
EMAIL_HOST_PASSWORD = config.age.secrets."kadenios-email_password_file".path;
};
StateDirectory = "django-kadenios";
User = "kadenios";
};
inherit environment path;
script = ''
python3 ${sources.kadenios}/manage.py migrate
gunicorn app.wsgi --pythonpath ${sources.kadenios} -b 127.0.0.1:${builtins.toString port} --workers=2 --threads=4
'';
};
django-kadenios-tasks = {
description = "Background tasks worker for Kadenios";
wantedBy = [ "multi-user.target" ];
after = [
"network.target"
"postgresql.service"
"django-kadenios.service"
];
serviceConfig = {
DynamicUser = true;
LoadCredential = mapAttrsToList (name: value: "${name}:${value}") {
SECRET_KEY = config.age.secrets."kadenios-secret_key_file".path;
EMAIL_HOST_PASSWORD = config.age.secrets."kadenios-email_password_file".path;
};
StateDirectory = "django-kadenios";
User = "kadenios";
WorkingDirectory = sources.kadenios;
};
inherit environment path;
script = ''
python3 manage.py process_tasks
'';
};
};
dgn-web.simpleProxies.kadenios = {
inherit host port;
vhostConfig.locations."/static/".root = staticDrv;
};
services.postgresql = {
ensureDatabases = [ "kadenios" ];
ensureUsers = [
{
name = "kadenios";
ensureDBOwnership = true;
}
];
};
}