infrastructure/machines/web01/linkal/module.nix

120 lines
2.7 KiB
Nix

{
config,
lib,
pkgs,
sources,
...
}:
let
inherit (lib)
mapAttrs'
mkEnableOption
mkIf
mkOption
nameValuePair
types
;
package = import sources.linkal { inherit pkgs; };
cfg = config.dgn-linkal;
jsonFormat = pkgs.formats.json { };
in
{
options.dgn-linkal = {
enable = mkEnableOption "the linkal server.";
package = mkOption {
type = types.package;
default = package.overrideAttrs (_: {
buildInputs = [ ];
});
};
domain = mkOption { type = types.str; };
calendarGroups = mkOption {
type =
let
inherit (types) attrsOf port submodule;
in
attrsOf (submodule {
options = {
port = mkOption { type = port; };
calendars = mkOption { inherit (jsonFormat) type; };
};
});
default = { };
};
};
config = mkIf cfg.enable {
systemd.services = mapAttrs' (
name:
{ port, calendars }:
nameValuePair "linkal-${name}" {
description = "Linkal - ${name}";
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
ExecStart = "${cfg.package}/bin/linkal --port ${builtins.toString port} --calendar-file ${
jsonFormat.generate "linkal-${name}.json" { inherit calendars; }
}";
};
}
) cfg.calendarGroups;
# Configure bind for DNS certificate validation on *.cal.dgnum.eu.
# services.bind = {
# enable = true;
# ipv4Only = true;
# extraConfig = ''
# include "${config.age.secrets."named-bind_dnskeys_conf".path}";
# '';
#
# zones = [rec {
# name = "cal.dgnum.eu";
# file = "/var/db/bind/${name}";
# master = true;
# extraConfig = ''
# allow-update { key "rfc2136key.cal.dgnum.eu"; };
# '';
# }];
# };
#
# networking.firewall = {
# allowedTCPPorts = [ 53 ];
# allowedUDPPorts = [ 53 ];
# };
#
# age-secrets.options = [{ named-bind_dnskeys_conf.owner = "named"; }];
#
# # Configure ACME for DNS certificate validation
# security.acme = {
# acceptTerms = true;
# defaults = {
# dnsProvider = "rfc2136";
# credentialsFile = config.age.secrets."acme-certs_secret".path;
# dnsPropagationCheck = false;
# };
# };
services.nginx = {
enable = true;
virtualHosts = mapAttrs' (
name:
{ port, ... }:
nameValuePair "${name}.${cfg.domain}" {
enableACME = true;
# acmeRoot = null; # Use DNS-01 validation
forceSSL = true;
locations."/".proxyPass = "http://127.0.0.1:${builtins.toString port}/";
}
) cfg.calendarGroups;
};
};
}