100 lines
2.3 KiB
Nix
100 lines
2.3 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
{
|
|
sops.secrets.nerd_secret = {
|
|
owner = "nerd";
|
|
restartUnits = [ "nerd.service" ];
|
|
};
|
|
|
|
systemd.services.nerd = let
|
|
nerdCfg = pkgs.writeText "nerd.cfg" ''
|
|
[django]
|
|
secret = !!DJANGO_SECRET!!
|
|
allowed_hosts = nerd.bula22.de
|
|
debug = False
|
|
language_code = de-de
|
|
time_zone = Europe/Berlin
|
|
csrf_trusted_origins = https://nerd.bula22.de
|
|
|
|
[database]
|
|
engine = postgresql_psycopg2
|
|
name = nerd
|
|
user =
|
|
password =
|
|
host = /run/postgresql
|
|
port =
|
|
'';
|
|
in {
|
|
after = [ "network.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
environment = {
|
|
NERD_CONFIG_FILE = "/etc/nerd/nerd.cfg";
|
|
PYTHONPATH = "${pkgs.python3.pkgs.nerd.pythonPath}:${pkgs.python3.pkgs.nerd}/${pkgs.python3.sitePackages}:${pkgs.python3Packages.psycopg2}/${pkgs.python3.sitePackages}";
|
|
};
|
|
|
|
preStart = ''
|
|
export DJANGO_SECRET=$(cat ${config.sops.secrets.nerd_secret.path})
|
|
${pkgs.gnused}/bin/sed -e "s/!!DJANGO_SECRET!!/$DJANGO_SECRET/g" ${nerdCfg} > /etc/nerd/nerd.cfg
|
|
|
|
${pkgs.python3.pkgs.nerd}/bin/nerd migrate
|
|
'';
|
|
|
|
serviceConfig = {
|
|
User = "nerd";
|
|
Group = "nerd";
|
|
ConfigurationDirectory = "nerd";
|
|
ExecStart = ''
|
|
${pkgs.python3Packages.gunicorn}/bin/gunicorn \
|
|
--bind 0.0.0.0:10510 \
|
|
--access-logfile - \
|
|
nerd.wsgi
|
|
'';
|
|
};
|
|
};
|
|
|
|
services.postgresql = {
|
|
enable = true;
|
|
ensureDatabases = [ "nerd" ];
|
|
ensureUsers = [
|
|
{
|
|
name = "nerd";
|
|
ensurePermissions = {
|
|
"DATABASE nerd" = "ALL PRIVILEGES";
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
users.users.nerd = {
|
|
isSystemUser = true;
|
|
group = "nerd";
|
|
};
|
|
users.groups.nerd = {};
|
|
|
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
|
|
services.nginx.enable = lib.mkForce false;
|
|
services.caddy = {
|
|
enable = true;
|
|
virtualHosts."nerd.bula22.de" = {
|
|
extraConfig = ''
|
|
@disallow_export {
|
|
not remote_ip 10.42.10.0/24 2a01:4f8:1c0c:8221::/64
|
|
path /export.json*
|
|
}
|
|
|
|
route {
|
|
file_server /static/*
|
|
respond @disallow_export 403 {
|
|
close
|
|
}
|
|
reverse_proxy * http://127.0.0.1:10510
|
|
}
|
|
|
|
root * ${pkgs.python3.pkgs.nerd}/var/lib/nerd/
|
|
'';
|
|
};
|
|
};
|
|
}
|