193 lines
4.8 KiB
Nix
193 lines
4.8 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}: let
|
|
cfg = config.services.wakapi;
|
|
settingsFormat = pkgs.formats.yaml {};
|
|
inherit (lib) types;
|
|
|
|
settingsFile = settingsFormat.generate "wakapi-settings" cfg.settings;
|
|
|
|
serviceConfig = {
|
|
systemd.services.wakapi = {
|
|
description = "Wakapi (self-hosted WakaTime-compatible backend)";
|
|
wants = ["network-online.target"];
|
|
after = ["network-online.target"];
|
|
wantedBy = ["multi-user.target"];
|
|
|
|
script = ''
|
|
exec ${pkgs.wakapi}/bin/wakapi -config ${settingsFile}
|
|
'';
|
|
|
|
serviceConfig = {
|
|
Environment = lib.mkIf (cfg.passwordSalt != null) "WAKAPI_PASSWORD_SALT=${cfg.passwordSalt}";
|
|
EnvironmentFile = lib.mkIf (cfg.passwordSaltFile != null) cfg.passwordSaltFile;
|
|
|
|
User = "wakapi";
|
|
Group = "wakapi";
|
|
|
|
DynamicUser = true;
|
|
ProtectHome = true;
|
|
ProtectHostname = true;
|
|
ProtectKernelLogs = true;
|
|
ProtectKernelModules = true;
|
|
ProtectKernelTunables = true;
|
|
ProtectProc = "invisible";
|
|
ProtectSystem = "strict";
|
|
RestrictAddressFamilies = ["AF_INET" "AF_INET6" "AF_UNIX"];
|
|
RestrictNamespaces = true;
|
|
RestrictRealtime = true;
|
|
RestrictSUIDSGID = true;
|
|
};
|
|
};
|
|
|
|
services.wakapi.settings = {
|
|
env = lib.mkDefault "production";
|
|
inherit (cfg) db;
|
|
server = {
|
|
inherit (cfg) port;
|
|
};
|
|
};
|
|
|
|
assertions = [
|
|
{
|
|
assertion = cfg.passwordSalt != null || cfg.passwordSaltFile != null;
|
|
message = "Either `passwordSalt` or `passwordSaltFile` must be set.";
|
|
}
|
|
];
|
|
};
|
|
|
|
databaseConfig = {
|
|
services.postgresql = {
|
|
enable = true;
|
|
ensureDatabases = lib.singleton cfg.settings.db.name;
|
|
ensureUsers = lib.singleton {
|
|
name = cfg.settings.db.user;
|
|
ensureDBOwnership = true;
|
|
};
|
|
authentication = ''
|
|
host ${cfg.settings.db.name} ${cfg.settings.db.user} 127.0.0.1/32 trust
|
|
'';
|
|
};
|
|
|
|
services.wakapi.settings.db = {
|
|
dialect = "postgres";
|
|
};
|
|
|
|
systemd.services.wakapi = {
|
|
requires = ["postgresql.service"];
|
|
after = ["postgresql.service"];
|
|
};
|
|
};
|
|
|
|
nginxConfig = lib.mkIf cfg.nginx.enable {
|
|
services.nginx = {
|
|
enable = true;
|
|
virtualHosts.${cfg.domain} = {
|
|
locations."/".proxyPass = "http://127.0.0.1:${toString cfg.port}";
|
|
|
|
enableACME = lib.mkDefault true;
|
|
forceSSL = lib.mkDefault true;
|
|
};
|
|
};
|
|
|
|
services.wakapi.settings.server = {
|
|
public_url = lib.mkDefault cfg.domain;
|
|
};
|
|
};
|
|
in {
|
|
options.services.wakapi = {
|
|
enable = lib.mkEnableOption "Wakapi";
|
|
package = lib.mkPackageOption pkgs "wakapi" {};
|
|
|
|
port = lib.mkOption {
|
|
type = types.int;
|
|
default = 3000;
|
|
description = ''
|
|
The port to serve Wakapi on.
|
|
This is used to configure nginx.
|
|
'';
|
|
};
|
|
domain = lib.mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = ''
|
|
The FQDN of the domain to serve Wakapi on.
|
|
This is used to configure nginx.
|
|
'';
|
|
};
|
|
|
|
db = {
|
|
host = lib.mkOption {
|
|
type = types.str;
|
|
default = "127.0.0.1";
|
|
description = ''
|
|
The database host to use for Wakapi.
|
|
'';
|
|
};
|
|
port = lib.mkOption {
|
|
type = types.int;
|
|
default = 5432;
|
|
description = ''
|
|
The port to use for the database.
|
|
'';
|
|
};
|
|
name = lib.mkOption {
|
|
type = types.str;
|
|
default = "wakapi";
|
|
description = ''
|
|
The database name to use for Wakapi.
|
|
'';
|
|
};
|
|
user = lib.mkOption {
|
|
type = types.str;
|
|
default = "wakapi";
|
|
description = ''
|
|
The database user to use for Wakapi.
|
|
'';
|
|
};
|
|
password = lib.mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = ''
|
|
The database password to use for Wakapi.
|
|
'';
|
|
};
|
|
};
|
|
|
|
nginx.enable = lib.mkEnableOption "Wakapi Nginx";
|
|
|
|
passwordSalt = lib.mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = ''
|
|
The password salt to use for Wakapi.
|
|
'';
|
|
};
|
|
passwordSaltFile = lib.mkOption {
|
|
type = types.nullOr types.path;
|
|
default = null;
|
|
description = ''
|
|
The path to a file containing the password salt to use for Wakapi.
|
|
'';
|
|
};
|
|
|
|
settings = lib.mkOption {
|
|
type = settingsFormat.type;
|
|
default = {};
|
|
description = lib.mkDoc ''
|
|
Settings for Wakapi.
|
|
|
|
See [config.default.yml](https://github.com/muety/wakapi/blob/master/config.default.yml) for a list of all possible options.
|
|
'';
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable (lib.mkMerge [
|
|
databaseConfig
|
|
nginxConfig
|
|
serviceConfig
|
|
]);
|
|
}
|