Compare commits
3 commits
custom_dok
...
main
| Author | SHA1 | Date | |
|---|---|---|---|
| bb95bbed09 | |||
|
b7a96472eb | ||
|
9c43904eb2 |
11 changed files with 238 additions and 473 deletions
|
|
@ -3,4 +3,5 @@
|
||||||
drone-server = ./servers/drone.nix;
|
drone-server = ./servers/drone.nix;
|
||||||
drone-exec-runner = ./servers/drone-exec-runner.nix;
|
drone-exec-runner = ./servers/drone-exec-runner.nix;
|
||||||
wordpress = ./web-apps/wordpress;
|
wordpress = ./web-apps/wordpress;
|
||||||
|
lychee = ./web-apps/lychee;
|
||||||
}
|
}
|
||||||
|
|
|
||||||
|
|
@ -1,386 +0,0 @@
|
||||||
{ config, pkgs, lib, ... }:
|
|
||||||
|
|
||||||
with lib;
|
|
||||||
|
|
||||||
let
|
|
||||||
cfg = config.services.dokuwiki;
|
|
||||||
eachSite = cfg.sites;
|
|
||||||
user = "dokuwiki";
|
|
||||||
nginx = config.services.nginx;
|
|
||||||
stateDir = hostName: "/var/lib/dokuwiki/${hostName}/data";
|
|
||||||
|
|
||||||
dokuwikiAclAuthConfig = hostName: cfg: pkgs.writeText "acl.auth-${hostName}.php" ''
|
|
||||||
# acl.auth.php
|
|
||||||
# <?php exit()?>
|
|
||||||
#
|
|
||||||
# Access Control Lists
|
|
||||||
#
|
|
||||||
${toString cfg.acl}
|
|
||||||
'';
|
|
||||||
|
|
||||||
dokuwikiLocalConfig = hostName: cfg: pkgs.writeText "local-${hostName}.php" ''
|
|
||||||
<?php
|
|
||||||
$conf['savedir'] = '${cfg.stateDir}';
|
|
||||||
$conf['superuser'] = '${toString cfg.superUser}';
|
|
||||||
$conf['useacl'] = '${toString cfg.aclUse}';
|
|
||||||
$conf['disableactions'] = '${cfg.disableActions}';
|
|
||||||
${toString cfg.extraConfig}
|
|
||||||
'';
|
|
||||||
|
|
||||||
dokuwikiPluginsLocalConfig = hostName: cfg: pkgs.writeText "plugins.local-${hostName}.php" ''
|
|
||||||
<?php
|
|
||||||
${cfg.pluginsConfig}
|
|
||||||
'';
|
|
||||||
|
|
||||||
|
|
||||||
pkg = hostName: cfg: pkgs.stdenv.mkDerivation rec {
|
|
||||||
pname = "dokuwiki-${hostName}";
|
|
||||||
version = src.version;
|
|
||||||
src = cfg.package;
|
|
||||||
|
|
||||||
installPhase = ''
|
|
||||||
mkdir -p $out
|
|
||||||
cp -r * $out/
|
|
||||||
|
|
||||||
# symlink the dokuwiki config
|
|
||||||
ln -s ${dokuwikiLocalConfig hostName cfg} $out/share/dokuwiki/local.php
|
|
||||||
|
|
||||||
# symlink plugins config
|
|
||||||
ln -s ${dokuwikiPluginsLocalConfig hostName cfg} $out/share/dokuwiki/plugins.local.php
|
|
||||||
|
|
||||||
# symlink acl
|
|
||||||
ln -s ${dokuwikiAclAuthConfig hostName cfg} $out/share/dokuwiki/acl.auth.php
|
|
||||||
|
|
||||||
# symlink additional plugin(s) and templates(s)
|
|
||||||
${concatMapStringsSep "\n" (template: "ln -s ${template} $out/share/dokuwiki/lib/tpl/${template.name}") cfg.templates}
|
|
||||||
${concatMapStringsSep "\n" (plugin: "ln -s ${plugin} $out/share/dokuwiki/lib/plugins/${plugin.name}") cfg.plugins}
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
siteOpts = { config, lib, name, ... }:
|
|
||||||
{
|
|
||||||
options = {
|
|
||||||
enable = mkEnableOption "DokuWiki web application.";
|
|
||||||
|
|
||||||
package = mkOption {
|
|
||||||
type = types.package;
|
|
||||||
default = pkgs.dokuwiki;
|
|
||||||
defaultText = literalExpression "pkgs.dokuwiki";
|
|
||||||
description = "Which DokuWiki package to use.";
|
|
||||||
};
|
|
||||||
|
|
||||||
finalPackage = mkOption {
|
|
||||||
type = types.package;
|
|
||||||
default = pkg name config;
|
|
||||||
description = "The modified DokuWiki package used by the module.";
|
|
||||||
readOnly = true;
|
|
||||||
};
|
|
||||||
|
|
||||||
stateDir = mkOption {
|
|
||||||
type = types.path;
|
|
||||||
default = "/var/lib/dokuwiki/${name}/data";
|
|
||||||
description = "Location of the DokuWiki state directory.";
|
|
||||||
};
|
|
||||||
|
|
||||||
acl = mkOption {
|
|
||||||
type = types.nullOr types.lines;
|
|
||||||
default = null;
|
|
||||||
example = "* @ALL 8";
|
|
||||||
description = ''
|
|
||||||
Access Control Lists: see <link xlink:href="https://www.dokuwiki.org/acl"/>
|
|
||||||
Mutually exclusive with services.dokuwiki.aclFile
|
|
||||||
Set this to a value other than null to take precedence over aclFile option.
|
|
||||||
|
|
||||||
Warning: Consider using aclFile instead if you do not
|
|
||||||
want to store the ACL in the world-readable Nix store.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
aclFile = mkOption {
|
|
||||||
type = with types; nullOr str;
|
|
||||||
default = if (config.aclUse && config.acl == null) then "/var/lib/dokuwiki/${name}/acl.auth.php" else null;
|
|
||||||
description = ''
|
|
||||||
Location of the dokuwiki acl rules. Mutually exclusive with services.dokuwiki.acl
|
|
||||||
Mutually exclusive with services.dokuwiki.acl which is preferred.
|
|
||||||
Consult documentation <link xlink:href="https://www.dokuwiki.org/acl"/> for further instructions.
|
|
||||||
Example: <link xlink:href="https://github.com/splitbrain/dokuwiki/blob/master/conf/acl.auth.php.dist"/>
|
|
||||||
'';
|
|
||||||
example = "/var/lib/dokuwiki/${name}/acl.auth.php";
|
|
||||||
};
|
|
||||||
|
|
||||||
aclUse = mkOption {
|
|
||||||
type = types.bool;
|
|
||||||
default = true;
|
|
||||||
description = ''
|
|
||||||
Necessary for users to log in into the system.
|
|
||||||
Also limits anonymous users. When disabled,
|
|
||||||
everyone is able to create and edit content.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
pluginsConfig = mkOption {
|
|
||||||
type = types.lines;
|
|
||||||
default = ''
|
|
||||||
$plugins['authad'] = 0;
|
|
||||||
$plugins['authldap'] = 0;
|
|
||||||
$plugins['authmysql'] = 0;
|
|
||||||
$plugins['authpgsql'] = 0;
|
|
||||||
'';
|
|
||||||
description = ''
|
|
||||||
List of the dokuwiki (un)loaded plugins.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
superUser = mkOption {
|
|
||||||
type = types.nullOr types.str;
|
|
||||||
default = "@admin";
|
|
||||||
description = ''
|
|
||||||
You can set either a username, a list of usernames (“admin1,admin2”),
|
|
||||||
or the name of a group by prepending an @ char to the groupname
|
|
||||||
Consult documentation <link xlink:href="https://www.dokuwiki.org/config:superuser"/> for further instructions.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
usersFile = mkOption {
|
|
||||||
type = with types; nullOr str;
|
|
||||||
default = if config.aclUse then "/var/lib/dokuwiki/${name}/users.auth.php" else null;
|
|
||||||
description = ''
|
|
||||||
Location of the dokuwiki users file. List of users. Format:
|
|
||||||
login:passwordhash:Real Name:email:groups,comma,separated
|
|
||||||
Create passwordHash easily by using:$ mkpasswd -5 password `pwgen 8 1`
|
|
||||||
Example: <link xlink:href="https://github.com/splitbrain/dokuwiki/blob/master/conf/users.auth.php.dist"/>
|
|
||||||
'';
|
|
||||||
example = "/var/lib/dokuwiki/${name}/users.auth.php";
|
|
||||||
};
|
|
||||||
|
|
||||||
disableActions = mkOption {
|
|
||||||
type = types.nullOr types.str;
|
|
||||||
default = "";
|
|
||||||
example = "search,register";
|
|
||||||
description = ''
|
|
||||||
Disable individual action modes. Refer to
|
|
||||||
<link xlink:href="https://www.dokuwiki.org/config:action_modes"/>
|
|
||||||
for details on supported values.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
plugins = mkOption {
|
|
||||||
type = types.listOf types.path;
|
|
||||||
default = [];
|
|
||||||
description = ''
|
|
||||||
List of path(s) to respective plugin(s) which are copied from the 'plugin' directory.
|
|
||||||
<note><para>These plugins need to be packaged before use, see example.</para></note>
|
|
||||||
'';
|
|
||||||
example = literalExpression ''
|
|
||||||
let
|
|
||||||
# Let's package the icalevents plugin
|
|
||||||
plugin-icalevents = pkgs.stdenv.mkDerivation {
|
|
||||||
name = "icalevents";
|
|
||||||
# Download the plugin from the dokuwiki site
|
|
||||||
src = pkgs.fetchurl {
|
|
||||||
url = "https://github.com/real-or-random/dokuwiki-plugin-icalevents/releases/download/2017-06-16/dokuwiki-plugin-icalevents-2017-06-16.zip";
|
|
||||||
sha256 = "e40ed7dd6bbe7fe3363bbbecb4de481d5e42385b5a0f62f6a6ce6bf3a1f9dfa8";
|
|
||||||
};
|
|
||||||
sourceRoot = ".";
|
|
||||||
# We need unzip to build this package
|
|
||||||
buildInputs = [ pkgs.unzip ];
|
|
||||||
# Installing simply means copying all files to the output directory
|
|
||||||
installPhase = "mkdir -p $out; cp -R * $out/";
|
|
||||||
};
|
|
||||||
# And then pass this theme to the plugin list like this:
|
|
||||||
in [ plugin-icalevents ]
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
templates = mkOption {
|
|
||||||
type = types.listOf types.path;
|
|
||||||
default = [];
|
|
||||||
description = ''
|
|
||||||
List of path(s) to respective template(s) which are copied from the 'tpl' directory.
|
|
||||||
<note><para>These templates need to be packaged before use, see example.</para></note>
|
|
||||||
'';
|
|
||||||
example = literalExpression ''
|
|
||||||
let
|
|
||||||
# Let's package the bootstrap3 theme
|
|
||||||
template-bootstrap3 = pkgs.stdenv.mkDerivation {
|
|
||||||
name = "bootstrap3";
|
|
||||||
# Download the theme from the dokuwiki site
|
|
||||||
src = pkgs.fetchurl {
|
|
||||||
url = "https://github.com/giterlizzi/dokuwiki-template-bootstrap3/archive/v2019-05-22.zip";
|
|
||||||
sha256 = "4de5ff31d54dd61bbccaf092c9e74c1af3a4c53e07aa59f60457a8f00cfb23a6";
|
|
||||||
};
|
|
||||||
# We need unzip to build this package
|
|
||||||
buildInputs = [ pkgs.unzip ];
|
|
||||||
# Installing simply means copying all files to the output directory
|
|
||||||
installPhase = "mkdir -p $out; cp -R * $out/";
|
|
||||||
};
|
|
||||||
# And then pass this theme to the template list like this:
|
|
||||||
in [ template-bootstrap3 ]
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
poolConfig = mkOption {
|
|
||||||
type = with types; attrsOf (oneOf [ str int bool ]);
|
|
||||||
default = {
|
|
||||||
"pm" = "dynamic";
|
|
||||||
"pm.max_children" = 32;
|
|
||||||
"pm.start_servers" = 2;
|
|
||||||
"pm.min_spare_servers" = 2;
|
|
||||||
"pm.max_spare_servers" = 4;
|
|
||||||
"pm.max_requests" = 500;
|
|
||||||
};
|
|
||||||
description = ''
|
|
||||||
Options for the DokuWiki PHP pool. See the documentation on <literal>php-fpm.conf</literal>
|
|
||||||
for details on configuration directives.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
extraConfig = mkOption {
|
|
||||||
type = types.nullOr types.lines;
|
|
||||||
default = null;
|
|
||||||
example = ''
|
|
||||||
$conf['title'] = 'My Wiki';
|
|
||||||
$conf['userewrite'] = 1;
|
|
||||||
'';
|
|
||||||
description = ''
|
|
||||||
DokuWiki configuration. Refer to
|
|
||||||
<link xlink:href="https://www.dokuwiki.org/config"/>
|
|
||||||
for details on supported values.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
};
|
|
||||||
|
|
||||||
};
|
|
||||||
in
|
|
||||||
{
|
|
||||||
disabledModules = [ "services/web-apps/dokuwiki.nix" ];
|
|
||||||
options = {
|
|
||||||
services.dokuwiki = {
|
|
||||||
|
|
||||||
sites = mkOption {
|
|
||||||
type = types.attrsOf (types.submodule siteOpts);
|
|
||||||
default = {};
|
|
||||||
description = "Specification of one or more DokuWiki sites to serve";
|
|
||||||
};
|
|
||||||
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# implementation
|
|
||||||
config = mkIf (eachSite != {}) (mkMerge [{
|
|
||||||
|
|
||||||
assertions = flatten (mapAttrsToList (hostName: cfg:
|
|
||||||
[{
|
|
||||||
assertion = cfg.aclUse -> (cfg.acl != null || cfg.aclFile != null);
|
|
||||||
message = "Either services.dokuwiki.sites.${hostName}.acl or services.dokuwiki.sites.${hostName}.aclFile is mandatory if aclUse true";
|
|
||||||
}
|
|
||||||
{
|
|
||||||
assertion = cfg.usersFile != null -> cfg.aclUse != false;
|
|
||||||
message = "services.dokuwiki.sites.${hostName}.aclUse must must be true if usersFile is not null";
|
|
||||||
}
|
|
||||||
]) eachSite);
|
|
||||||
|
|
||||||
services.phpfpm.pools = mapAttrs' (hostName: cfg: (
|
|
||||||
nameValuePair "dokuwiki-${hostName}" {
|
|
||||||
inherit user;
|
|
||||||
group = nginx.group;
|
|
||||||
|
|
||||||
# Not yet compatible with php 8 https://www.dokuwiki.org/requirements
|
|
||||||
# https://github.com/splitbrain/dokuwiki/issues/3545
|
|
||||||
phpPackage = pkgs.php74;
|
|
||||||
phpEnv = {
|
|
||||||
DOKUWIKI_LOCAL_CONFIG = "${dokuwikiLocalConfig hostName cfg}";
|
|
||||||
DOKUWIKI_PLUGINS_LOCAL_CONFIG = "${dokuwikiPluginsLocalConfig hostName cfg}";
|
|
||||||
DOKUWIKI_ROOT = "${cfg.finalPackage}/share/dokuwiki/";
|
|
||||||
} // optionalAttrs (cfg.usersFile != null) {
|
|
||||||
DOKUWIKI_USERS_AUTH_CONFIG = "${cfg.usersFile}";
|
|
||||||
} //optionalAttrs (cfg.aclUse) {
|
|
||||||
DOKUWIKI_ACL_AUTH_CONFIG = if (cfg.acl != null) then "${dokuwikiAclAuthConfig hostName cfg}" else "${toString cfg.aclFile}";
|
|
||||||
};
|
|
||||||
|
|
||||||
settings = {
|
|
||||||
"listen.owner" = nginx.user;
|
|
||||||
"listen.group" = nginx.group;
|
|
||||||
} // cfg.poolConfig;
|
|
||||||
}
|
|
||||||
)) eachSite;
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
{
|
|
||||||
systemd.tmpfiles.rules = flatten (mapAttrsToList (hostName: cfg: [
|
|
||||||
"d ${stateDir hostName}/attic 0750 ${user} ${nginx.group} - -"
|
|
||||||
"d ${stateDir hostName}/cache 0750 ${user} ${nginx.group} - -"
|
|
||||||
"d ${stateDir hostName}/index 0750 ${user} ${nginx.group} - -"
|
|
||||||
"d ${stateDir hostName}/locks 0750 ${user} ${nginx.group} - -"
|
|
||||||
"d ${stateDir hostName}/media 0750 ${user} ${nginx.group} - -"
|
|
||||||
"d ${stateDir hostName}/media_attic 0750 ${user} ${nginx.group} - -"
|
|
||||||
"d ${stateDir hostName}/media_meta 0750 ${user} ${nginx.group} - -"
|
|
||||||
"d ${stateDir hostName}/meta 0750 ${user} ${nginx.group} - -"
|
|
||||||
"d ${stateDir hostName}/pages 0750 ${user} ${nginx.group} - -"
|
|
||||||
"d ${stateDir hostName}/tmp 0750 ${user} ${nginx.group} - -"
|
|
||||||
] ++ lib.optional (cfg.aclFile != null) "C ${cfg.aclFile} 0640 ${user} ${nginx.group} - ${pkg hostName cfg}/share/dokuwiki/conf/acl.auth.php.dist"
|
|
||||||
++ lib.optional (cfg.usersFile != null) "C ${cfg.usersFile} 0640 ${user} ${nginx.group} - ${pkg hostName cfg}/share/dokuwiki/conf/users.auth.php.dist"
|
|
||||||
) eachSite);
|
|
||||||
|
|
||||||
users.users.${user} = {
|
|
||||||
group = nginx.group;
|
|
||||||
isSystemUser = true;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
{
|
|
||||||
services.nginx = {
|
|
||||||
enable = true;
|
|
||||||
virtualHosts = mapAttrs (hostName: cfg: {
|
|
||||||
serverName = mkDefault hostName;
|
|
||||||
root = "${pkg hostName cfg}/share/dokuwiki";
|
|
||||||
|
|
||||||
locations = {
|
|
||||||
"~ /(conf/|bin/|inc/|install.php)" = {
|
|
||||||
extraConfig = "deny all;";
|
|
||||||
};
|
|
||||||
|
|
||||||
"~ ^/data/" = {
|
|
||||||
root = "${stateDir hostName}";
|
|
||||||
extraConfig = "internal;";
|
|
||||||
};
|
|
||||||
|
|
||||||
"~ ^/lib.*\.(js|css|gif|png|ico|jpg|jpeg)$" = {
|
|
||||||
extraConfig = "expires 365d;";
|
|
||||||
};
|
|
||||||
|
|
||||||
"/" = {
|
|
||||||
priority = 1;
|
|
||||||
index = "doku.php";
|
|
||||||
extraConfig = ''try_files $uri $uri/ @dokuwiki;'';
|
|
||||||
};
|
|
||||||
|
|
||||||
"@dokuwiki" = {
|
|
||||||
extraConfig = ''
|
|
||||||
# rewrites "doku.php/" out of the URLs if you set the userwrite setting to .htaccess in dokuwiki config page
|
|
||||||
rewrite ^/_media/(.*) /lib/exe/fetch.php?media=$1 last;
|
|
||||||
rewrite ^/_detail/(.*) /lib/exe/detail.php?media=$1 last;
|
|
||||||
rewrite ^/_export/([^/]+)/(.*) /doku.php?do=export_$1&id=$2 last;
|
|
||||||
rewrite ^/(.*) /doku.php?id=$1&$args last;
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
"~ \\.php$" = {
|
|
||||||
extraConfig = ''
|
|
||||||
try_files $uri $uri/ /doku.php;
|
|
||||||
include ${config.services.nginx.package}/conf/fastcgi_params;
|
|
||||||
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
|
||||||
fastcgi_param REDIRECT_STATUS 200;
|
|
||||||
fastcgi_pass unix:${config.services.phpfpm.pools."dokuwiki-${hostName}".socket};
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
};
|
|
||||||
}) eachSite;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
]);
|
|
||||||
}
|
|
||||||
187
modules/web-apps/lychee/default.nix
Normal file
187
modules/web-apps/lychee/default.nix
Normal file
|
|
@ -0,0 +1,187 @@
|
||||||
|
{ pkgs, lib, config, ... }:
|
||||||
|
let
|
||||||
|
cfg = config.services.lychee;
|
||||||
|
src = cfg.package;
|
||||||
|
envConf = cfg.settings;
|
||||||
|
in {
|
||||||
|
options.services.lychee = {
|
||||||
|
enable = lib.mkEnableOption "Whether to enable lychee";
|
||||||
|
website = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "localhost";
|
||||||
|
example = "www.example.com";
|
||||||
|
};
|
||||||
|
package = lib.mkOption { type = lib.types.path; };
|
||||||
|
forceSSL = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = false;
|
||||||
|
description = "Whether to force SSL for the nginx virtual host";
|
||||||
|
};
|
||||||
|
enableACME = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
default = false;
|
||||||
|
description = "Whether to enableACME for the nginx virtual host";
|
||||||
|
};
|
||||||
|
upload_max_filesize = lib.mkOption {
|
||||||
|
type = lib.types.ints.positive;
|
||||||
|
default = 30;
|
||||||
|
description = "Max uploaded file size";
|
||||||
|
};
|
||||||
|
post_max_size = lib.mkOption {
|
||||||
|
type = lib.types.ints.positive;
|
||||||
|
default = 100;
|
||||||
|
description = "Max post request size";
|
||||||
|
};
|
||||||
|
user = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "lychee";
|
||||||
|
description = "The user that will operate on mutable files";
|
||||||
|
};
|
||||||
|
settings = lib.mkOption {
|
||||||
|
default = { };
|
||||||
|
type = lib.types.submodule {
|
||||||
|
freeformType = with lib.types; attrsOf str;
|
||||||
|
options = {
|
||||||
|
APP_URL = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "http://${cfg.website}";
|
||||||
|
};
|
||||||
|
DB_CONNECTION = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "sqlite";
|
||||||
|
};
|
||||||
|
DB_LOG_SQL = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = ''"false"'';
|
||||||
|
};
|
||||||
|
CACHE_DRIVER = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "file";
|
||||||
|
};
|
||||||
|
SESSION_DRIVER = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "file";
|
||||||
|
};
|
||||||
|
SESSION_LIFETIME = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "120";
|
||||||
|
};
|
||||||
|
SECURITY_HEADER_HSTS_ENABLE = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = ''"false"'';
|
||||||
|
};
|
||||||
|
SESSION_SECURE_COOKIE = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = ''"false"'';
|
||||||
|
};
|
||||||
|
REDIS_PASSWORD = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = ''"null"'';
|
||||||
|
};
|
||||||
|
REDIS_PORT = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "6379";
|
||||||
|
};
|
||||||
|
MAIL_DRIVER = lib.mkOption {
|
||||||
|
type = lib.types.str;
|
||||||
|
default = "smtp";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
config = lib.mkIf cfg.enable {
|
||||||
|
services.nginx = {
|
||||||
|
enable = true;
|
||||||
|
virtualHosts.${cfg.website} = {
|
||||||
|
root = "/var/lib/lychee/public/";
|
||||||
|
forceSSL = lib.mkDefault cfg.forceSSL;
|
||||||
|
enableACME = lib.mkDefault cfg.enableACME;
|
||||||
|
locations = {
|
||||||
|
"^~ /index.php" = {
|
||||||
|
fastcgiParams = {
|
||||||
|
SCRIPT_FILENAME = "$document_root$fastcgi_script_name";
|
||||||
|
};
|
||||||
|
extraConfig = ''
|
||||||
|
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
|
||||||
|
fastcgi_pass unix:${
|
||||||
|
config.services.phpfpm.pools."${cfg.website}".socket
|
||||||
|
};
|
||||||
|
fastcgi_index index.php;
|
||||||
|
client_max_body_size ${
|
||||||
|
builtins.toString cfg.upload_max_filesize
|
||||||
|
}M;
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
"~ [^/].php(/|$)" = { return = "403"; };
|
||||||
|
};
|
||||||
|
extraConfig = ''
|
||||||
|
index index.php;
|
||||||
|
if (!-e $request_filename)
|
||||||
|
{
|
||||||
|
rewrite ^/(.*)$ /index.php?/$1 last;
|
||||||
|
break;
|
||||||
|
}
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
systemd.services."lychee-install" = {
|
||||||
|
wantedBy = [ "phpfpm-${cfg.website}.service" ];
|
||||||
|
before = [ "phpfpm-${cfg.website}.service" ];
|
||||||
|
script = let rsync = pkgs.rsync;
|
||||||
|
in ''
|
||||||
|
${rsync}/bin/rsync -a --ignore-existing ${src}/ $STATE_DIRECTORY
|
||||||
|
chmod u+w $STATE_DIRECTORY/
|
||||||
|
chmod u+w $STATE_DIRECTORY/.env
|
||||||
|
chmod u+w $STATE_DIRECTORY/database/
|
||||||
|
chmod u+w $STATE_DIRECTORY/database/database.sqlite
|
||||||
|
chmod -R u+w $STATE_DIRECTORY/storage/
|
||||||
|
chmod -R u+w $STATE_DIRECTORY/public/
|
||||||
|
chmod -R u+w $STATE_DIRECTORY/bootstrap/cache/
|
||||||
|
'';
|
||||||
|
serviceConfig = {
|
||||||
|
Type = "oneshot";
|
||||||
|
StateDirectory = "lychee";
|
||||||
|
User = cfg.user;
|
||||||
|
Restart = "on-failure";
|
||||||
|
ProtectHome = true;
|
||||||
|
ProtectSystem = "strict";
|
||||||
|
PrivateTmp = true;
|
||||||
|
PrivateDevices = true;
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectClock = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectKernelLogs = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
NoNewPrivileges = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
RestrictSUIDSGID = true;
|
||||||
|
RemoveIPC = true;
|
||||||
|
PrivateMounts = true;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
services.phpfpm.pools.${cfg.website} = {
|
||||||
|
user = cfg.user;
|
||||||
|
phpPackage = pkgs.php81.withExtensions ({ enabled, all }:
|
||||||
|
enabled ++ [ all.imagick all.bcmath all.mbstring all.gd ]);
|
||||||
|
phpOptions = ''
|
||||||
|
upload_max_filesize = ${builtins.toString cfg.upload_max_filesize}M
|
||||||
|
post_max_size = ${builtins.toString cfg.post_max_size}M
|
||||||
|
'';
|
||||||
|
settings = {
|
||||||
|
"pm" = "dynamic";
|
||||||
|
"listen.owner" = config.services.nginx.user;
|
||||||
|
"listen.group" = config.services.nginx.group;
|
||||||
|
};
|
||||||
|
phpEnv = { "PATH" = lib.makeBinPath [ pkgs.ffmpeg ]; } // envConf;
|
||||||
|
};
|
||||||
|
users.users.${cfg.user} = {
|
||||||
|
isSystemUser = lib.mkDefault true;
|
||||||
|
home = lib.mkDefault src;
|
||||||
|
group = lib.mkDefault cfg.user;
|
||||||
|
};
|
||||||
|
users.groups.${cfg.user} = { };
|
||||||
|
};
|
||||||
|
}
|
||||||
|
|
||||||
31
modules/web-apps/lychee/test.nix
Normal file
31
modules/web-apps/lychee/test.nix
Normal file
|
|
@ -0,0 +1,31 @@
|
||||||
|
{ pkgs ? import <nixpkgs> { }, myPkgs ? import ../.. { } }:
|
||||||
|
pkgs.nixosTest ({
|
||||||
|
# NixOS tests are run inside a virtual machine, and here we specify system of the machine.
|
||||||
|
nodes = {
|
||||||
|
server = { config, pkgs, ... }: {
|
||||||
|
imports = [ myPkgs.modules.lychee ];
|
||||||
|
|
||||||
|
security.acme.acceptTerms = true;
|
||||||
|
security.acme.defaults.email = "test@test.fr";
|
||||||
|
services.lychee = {
|
||||||
|
enable = true;
|
||||||
|
package = myPkgs.lychee-gallery;
|
||||||
|
forceSSL = true;
|
||||||
|
enableACME = true;
|
||||||
|
};
|
||||||
|
environment.systemPackages = [ pkgs.w3m ];
|
||||||
|
|
||||||
|
users = {
|
||||||
|
mutableUsers = false;
|
||||||
|
users = {
|
||||||
|
# For ease of debugging the VM as the `root` user
|
||||||
|
root.password = "";
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
testScript = ''
|
||||||
|
start_all()
|
||||||
|
server.wait_for_unit("phpfpm-localhost.service")
|
||||||
|
'';
|
||||||
|
})
|
||||||
|
|
@ -9,11 +9,7 @@ let
|
||||||
callPackage f (subsetArgs // extraArgs);
|
callPackage f (subsetArgs // extraArgs);
|
||||||
self = rec {
|
self = rec {
|
||||||
acme-dns = callPackage ./servers/acme-dns.nix {};
|
acme-dns = callPackage ./servers/acme-dns.nix {};
|
||||||
dokuwikiExtensions.templates.bootstrap3 = callPackage ./servers/dokuwiki/templateBootstrap3.nix {};
|
lychee-gallery = callPackage ./web-apps/lychee-gallery.nix {};
|
||||||
dokuwikiExtensions.plugins.commonmark = callPackage ./servers/dokuwiki/pluginCommonmark.nix {};
|
|
||||||
dokuwikiExtensions.plugins.catlist = callPackage ./servers/dokuwiki/pluginCatlist.nix {};
|
|
||||||
dokuwikiExtensions.plugins.oauth = callPackage ./servers/dokuwiki/pluginOauth.nix {};
|
|
||||||
dokuwikiExtensions.plugins.keycloak = callPackage ./servers/dokuwiki/pluginKeycloak.nix {};
|
|
||||||
};
|
};
|
||||||
in
|
in
|
||||||
self
|
self
|
||||||
|
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
{ stdenv, fetchFromGitHub }:
|
|
||||||
stdenv.mkDerivation {
|
|
||||||
name = "catlist";
|
|
||||||
# Download the theme from the dokuwiki site
|
|
||||||
src = fetchFromGitHub {
|
|
||||||
owner = "xif-fr";
|
|
||||||
repo = "dokuwiki-plugin-catlist";
|
|
||||||
rev = "065f8d2f4817409989b9342b901163452fb9f547";
|
|
||||||
sha256 = "1l7bvnqkai8qkqqb67w8yy7fbs30dviqc36pyqggzfjhi558i9ih";
|
|
||||||
};
|
|
||||||
# Installing simply means copying all files to the output directory
|
|
||||||
installPhase = ''
|
|
||||||
mkdir -p $out
|
|
||||||
cp -R * $out/
|
|
||||||
'';
|
|
||||||
}
|
|
||||||
|
|
@ -1,14 +0,0 @@
|
||||||
{ stdenv, fetchzip }:
|
|
||||||
stdenv.mkDerivation {
|
|
||||||
name = "commonmark";
|
|
||||||
# Download the theme from the dokuwiki site
|
|
||||||
src = fetchzip {
|
|
||||||
url = "https://github.com/clockoon/dokuwiki-plugin-commonmark/releases/download/v1.2.0/release.tar.gz";
|
|
||||||
sha256 = "10SVyqkbkwzF/m4aTHB/ssXJK5rjQbLxYOAFDKYOxTY=";
|
|
||||||
};
|
|
||||||
# Installing simply means copying all files to the output directory
|
|
||||||
installPhase = ''
|
|
||||||
mkdir -p $out
|
|
||||||
cp -R * $out/
|
|
||||||
'';
|
|
||||||
}
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
{ stdenv, fetchFromGitHub }:
|
|
||||||
stdenv.mkDerivation {
|
|
||||||
name = "oauth";
|
|
||||||
# Download the theme from the dokuwiki site
|
|
||||||
src = fetchFromGitHub {
|
|
||||||
owner = "cosmocode";
|
|
||||||
repo = "dokuwiki-plugin-oauth";
|
|
||||||
rev = "2022-01-13";
|
|
||||||
sha256 = "ruaw8MqSMgopULD7vxed44nbowjVc1e4H0Q7JEL9pD0=";
|
|
||||||
};
|
|
||||||
# Installing simply means copying all files to the output directory
|
|
||||||
installPhase = ''
|
|
||||||
mkdir -p $out
|
|
||||||
cp -R * $out/
|
|
||||||
'';
|
|
||||||
}
|
|
||||||
|
|
@ -1,16 +0,0 @@
|
||||||
{ stdenv, fetchFromGitHub }:
|
|
||||||
stdenv.mkDerivation {
|
|
||||||
name = "oauth";
|
|
||||||
# Download the theme from the dokuwiki site
|
|
||||||
src = fetchFromGitHub {
|
|
||||||
owner = "cosmocode";
|
|
||||||
repo = "dokuwiki-plugin-oauth";
|
|
||||||
rev = "2022-01-13";
|
|
||||||
sha256 = "ruaw8MqSMgopULD7vxed44nbowjVc1e4H0Q7JEL9pD0=";
|
|
||||||
};
|
|
||||||
# Installing simply means copying all files to the output directory
|
|
||||||
installPhase = ''
|
|
||||||
mkdir -p $out
|
|
||||||
cp -R * $out/
|
|
||||||
'';
|
|
||||||
}
|
|
||||||
|
|
@ -1,17 +0,0 @@
|
||||||
{ stdenv, fetchFromGitHub }:
|
|
||||||
stdenv.mkDerivation {
|
|
||||||
name = "bootstrap3";
|
|
||||||
# Download the theme from the dokuwiki site
|
|
||||||
src = fetchFromGitHub {
|
|
||||||
owner = "giterlizzi";
|
|
||||||
repo = "dokuwiki-template-bootstrap3";
|
|
||||||
rev="v2020-07-29";
|
|
||||||
sha256="05d6si1lci3a2pgd10iwpwrgl969y7gq4qsn5p1lbgxkraad17af";
|
|
||||||
};
|
|
||||||
# Installing simply means copying all files to the output directory
|
|
||||||
installPhase = ''
|
|
||||||
mkdir -p $out
|
|
||||||
cp -R * $out/
|
|
||||||
echo "<?php define('DOKU_INC', getenv('DOKUWIKI_ROOT'));" > $out/doku_inc.php # Lien vers le dokuwiki
|
|
||||||
'';
|
|
||||||
}
|
|
||||||
15
pkgs/web-apps/lychee-gallery.nix
Normal file
15
pkgs/web-apps/lychee-gallery.nix
Normal file
|
|
@ -0,0 +1,15 @@
|
||||||
|
{ stdenv, fetchzip, pkgs, env ? {} }:
|
||||||
|
stdenv.mkDerivation rec {
|
||||||
|
pname = "Lychee";
|
||||||
|
version = "4.6.2";
|
||||||
|
src = fetchzip {
|
||||||
|
url = "https://github.com/LycheeOrg/Lychee/releases/download/v${version}/Lychee.zip";
|
||||||
|
sha256 = "sha256-dNujUTGaxvc6uZgyanNh9kIzRqfFA9yFhAtexu1sVc4=";
|
||||||
|
};
|
||||||
|
installPhase = ''
|
||||||
|
shopt -s dotglob
|
||||||
|
mkdir $out
|
||||||
|
mv .env.example .env
|
||||||
|
mv * $out/
|
||||||
|
'';
|
||||||
|
}
|
||||||
Loading…
Reference in a new issue