From 6171b772aab6db249f26ed80d8ea21386642cb73 Mon Sep 17 00:00:00 2001 From: Xe Iaso Date: Fri, 30 Dec 2022 10:09:08 -0500 Subject: add xesite NixOS module Signed-off-by: Xe Iaso --- flake.nix | 150 ++++++---------------------------------------- nix/dhall-yaml.nix | 5 -- nix/rust.nix | 10 ---- nix/sources.json | 69 --------------------- nix/sources.nix | 171 ----------------------------------------------------- xesite.nix | 153 +++++++++++++++++++++++++++++++++++++++++++++++ 6 files changed, 172 insertions(+), 386 deletions(-) delete mode 100644 nix/dhall-yaml.nix delete mode 100644 nix/rust.nix delete mode 100644 nix/sources.json delete mode 100644 nix/sources.nix create mode 100644 xesite.nix diff --git a/flake.nix b/flake.nix index 3894bb5..f7d2a3f 100644 --- a/flake.nix +++ b/flake.nix @@ -88,25 +88,22 @@ }; frontend = let - build = { entrypoint, name ? entrypoint, minify ? true }: pkgs.deno2nix.mkBundled { - pname = "xesite-frontend-${name}"; - inherit (bin) version; - - src = ./src/frontend; - lockfile = ./src/frontend/deno.lock; - - output = "${entrypoint}.js"; - outPath = "static/js"; - entrypoint = "./${entrypoint}.tsx"; - importMap = "./import_map.json"; - inherit minify; - }; - share-button = build { - entrypoint = "mastodon_share_button"; - }; - wasiterm = build { - entrypoint = "wasiterm"; - }; + build = { entrypoint, name ? entrypoint, minify ? true }: + pkgs.deno2nix.mkBundled { + pname = "xesite-frontend-${name}"; + inherit (bin) version; + + src = ./src/frontend; + lockfile = ./src/frontend/deno.lock; + + output = "${entrypoint}.js"; + outPath = "static/js"; + entrypoint = "./${entrypoint}.tsx"; + importMap = "./import_map.json"; + inherit minify; + }; + share-button = build { entrypoint = "mastodon_share_button"; }; + wasiterm = build { entrypoint = "wasiterm"; }; in pkgs.symlinkJoin { name = "xesite-frontend-${bin.version}"; paths = [ share-button wasiterm ]; @@ -197,116 +194,7 @@ GITHUB_SHA = "devel"; DHALL_PRELUDE = "${pkgs.dhallPackages.Prelude}"; }; - - nixosModules.bot = { config, lib, ... }: - with lib; - let cfg = config.xeserv.services.xesite; - in { - options.within.services.xesite = { - enable = mkEnableOption "Activates my personal website"; - useACME = mkEnableOption "Enables ACME for cert stuff"; - - port = mkOption { - type = types.port; - default = 32837; - example = 9001; - description = - "The port number xesite should listen on for HTTP traffic"; - }; - - domain = mkOption { - type = types.str; - default = "xesite.akua"; - example = "xeiaso.net"; - description = - "The domain name that nginx should check against for HTTP hostnames"; - }; - - sockPath = mkOption rec { - type = types.str; - default = "/srv/within/run/xesite.sock"; - example = default; - description = - "The unix domain socket that xesite should listen on"; - }; - }; - - config = mkIf cfg.enable { - users.users.xesite = { - createHome = true; - description = "github.com/Xe/site"; - isSystemUser = true; - group = "within"; - home = "/srv/within/xesite"; - extraGroups = [ "keys" ]; - }; - - systemd.services.xesite = { - wantedBy = [ "multi-user.target" ]; - - serviceConfig = { - User = "xesite"; - Group = "within"; - Restart = "on-failure"; - WorkingDirectory = "/srv/within/xesite"; - RestartSec = "30s"; - Type = "notify"; - - # Security - CapabilityBoundingSet = ""; - DeviceAllow = [ ]; - NoNewPrivileges = "true"; - ProtectControlGroups = "true"; - ProtectClock = "true"; - PrivateDevices = "true"; - PrivateUsers = "true"; - ProtectHome = "true"; - ProtectHostname = "true"; - ProtectKernelLogs = "true"; - ProtectKernelModules = "true"; - ProtectKernelTunables = "true"; - ProtectSystem = "true"; - ProtectProc = "invisible"; - RemoveIPC = "true"; - RestrictSUIDSGID = "true"; - RestrictRealtime = "true"; - SystemCallArchitectures = "native"; - SystemCallFilter = [ - "~@reboot" - "~@module" - "~@mount" - "~@swap" - "~@resources" - "~@cpu-emulation" - "~@obsolete" - "~@debug" - "~@privileged" - ]; - UMask = "007"; - }; - - script = let site = packages.default; - in '' - export SOCKPATH=${cfg.sockPath} - export DOMAIN=${toString cfg.domain} - cd ${site} - exec ${site}/bin/xesite - ''; - }; - - services.nginx.virtualHosts."xesite" = { - serverName = "${cfg.domain}"; - locations."/" = { - proxyPass = "http://unix:${toString cfg.sockPath}"; - proxyWebsockets = true; - }; - forceSSL = cfg.useACME; - useACMEHost = "xeiaso.net"; - extraConfig = '' - access_log /var/log/nginx/xesite.access.log; - ''; - }; - }; - }; - }); + }) // { + nixosModules.default = import ./nix/xesite.nix self; + }; } diff --git a/nix/dhall-yaml.nix b/nix/dhall-yaml.nix deleted file mode 100644 index ddb8c3d..0000000 --- a/nix/dhall-yaml.nix +++ /dev/null @@ -1,5 +0,0 @@ -let - sources = import ./sources.nix; - pkgs = import sources.nixpkgs { }; - dhall = import sources.easy-dhall-nix { inherit pkgs; }; -in dhall.dhall-yaml-simple diff --git a/nix/rust.nix b/nix/rust.nix deleted file mode 100644 index 02512df..0000000 --- a/nix/rust.nix +++ /dev/null @@ -1,10 +0,0 @@ -{ sources ? import ./sources.nix }: - -let - pkgs = - import sources.nixpkgs { overlays = [ (import sources.nixpkgs-mozilla) ]; }; - channel = "nightly"; - date = "2022-08-08"; - targets = [ ]; - chan = pkgs.rustChannelOfTargets channel date targets; -in chan diff --git a/nix/sources.json b/nix/sources.json deleted file mode 100644 index 67003df..0000000 --- a/nix/sources.json +++ /dev/null @@ -1,69 +0,0 @@ -{ - "easy-dhall-nix": { - "branch": "master", - "description": "Derivations for easily downloading Dhall binaries and putting them to use.", - "homepage": "", - "owner": "justinwoo", - "repo": "easy-dhall-nix", - "rev": "dce9acbb99776a7f1344db4751d6080380f76f57", - "sha256": "0ckp6515gfvbxm08yyll87d9vg8sq2l21gwav2npzvwc3xz2lccf", - "type": "tarball", - "url": "https://github.com/justinwoo/easy-dhall-nix/archive/dce9acbb99776a7f1344db4751d6080380f76f57.tar.gz", - "url_template": "https://github.com///archive/.tar.gz" - }, - "naersk": { - "branch": "master", - "description": "Build rust crates in Nix. No configuration, no code generation, no IFD. Sandbox friendly.", - "homepage": "", - "owner": "nmattia", - "repo": "naersk", - "rev": "6944160c19cb591eb85bbf9b2f2768a935623ed3", - "sha256": "01i282zrx651mpvnmlgk4fgwg56nbr1yljpzcj5irqxf18cqx3gn", - "type": "tarball", - "url": "https://github.com/nmattia/naersk/archive/6944160c19cb591eb85bbf9b2f2768a935623ed3.tar.gz", - "url_template": "https://github.com///archive/.tar.gz" - }, - "niv": { - "branch": "master", - "description": "Easy dependency management for Nix projects", - "homepage": "https://github.com/nmattia/niv", - "owner": "nmattia", - "repo": "niv", - "rev": "351d8bc316bf901a81885bab5f52687ec8ccab6e", - "sha256": "1yzhz7ihkh6p2sxhp3amqfbmm2yqzaadqqii1xijymvl8alw5rrr", - "type": "tarball", - "url": "https://github.com/nmattia/niv/archive/351d8bc316bf901a81885bab5f52687ec8ccab6e.tar.gz", - "url_template": "https://github.com///archive/.tar.gz" - }, - "nixpkgs": { - "branch": "nixpkgs-unstable", - "description": "A read-only mirror of NixOS/nixpkgs tracking the released channels. Send issues and PRs to", - "homepage": "https://github.com/NixOS/nixpkgs", - "owner": "NixOS", - "repo": "nixpkgs-channels", - "rev": "502845c3e31ef3de0e424f3fcb09217df2ce6df6", - "sha256": "0fcqpsy6y7dgn0y0wgpa56gsg0b0p8avlpjrd79fp4mp9bl18nda", - "type": "tarball", - "url": "https://github.com/NixOS/nixpkgs-channels/archive/502845c3e31ef3de0e424f3fcb09217df2ce6df6.tar.gz", - "url_template": "https://github.com///archive/.tar.gz" - }, - "nixpkgs-mozilla": { - "branch": "master", - "description": "mozilla related nixpkgs (extends nixos/nixpkgs repo)", - "homepage": null, - "owner": "mozilla", - "repo": "nixpkgs-mozilla", - "rev": "80627b282705101e7b38e19ca6e8df105031b072", - "sha256": "11g9lppm53f5aq7a0fnwh5hivdhn2p1wmhwgmz1052x10hfqjrah", - "type": "tarball", - "url": "https://github.com/mozilla/nixpkgs-mozilla/archive/80627b282705101e7b38e19ca6e8df105031b072.tar.gz", - "url_template": "https://github.com///archive/.tar.gz" - }, - "xepkgs": { - "branch": "master", - "ref": "master", - "repo": "https://tulpa.dev/Xe/nixpkgs", - "rev": "5621d41482bca79d05c97758bb86eeb9099e26c9", - "type": "git" - } -} diff --git a/nix/sources.nix b/nix/sources.nix deleted file mode 100644 index b796fff..0000000 --- a/nix/sources.nix +++ /dev/null @@ -1,171 +0,0 @@ -# This file has been generated by Niv. - -let - - # - # The fetchers. fetch_ fetches specs of type . - # - - fetch_file = pkgs: name: spec: - let - name' = sanitizeName name + "-src"; - in - if spec.builtin or true then - builtins_fetchurl { inherit (spec) url sha256; name = name'; } - else - pkgs.fetchurl { inherit (spec) url sha256; name = name'; }; - - fetch_tarball = pkgs: name: spec: - let - name' = sanitizeName name + "-src"; - in - if spec.builtin or true then - builtins_fetchTarball { name = name'; inherit (spec) url sha256; } - else - pkgs.fetchzip { name = name'; inherit (spec) url sha256; }; - - fetch_git = name: spec: - let - ref = - if spec ? ref then spec.ref else - if spec ? branch then "refs/heads/${spec.branch}" else - if spec ? tag then "refs/tags/${spec.tag}" else - abort "In git source '${name}': Please specify `ref`, `tag` or `branch`!"; - in - builtins.fetchGit { url = spec.repo; inherit (spec) rev; inherit ref; }; - - fetch_local = spec: spec.path; - - fetch_builtin-tarball = name: throw - ''[${name}] The niv type "builtin-tarball" is deprecated. You should instead use `builtin = true`. - $ niv modify ${name} -a type=tarball -a builtin=true''; - - fetch_builtin-url = name: throw - ''[${name}] The niv type "builtin-url" will soon be deprecated. You should instead use `builtin = true`. - $ niv modify ${name} -a type=file -a builtin=true''; - - # - # Various helpers - # - - # https://github.com/NixOS/nixpkgs/pull/83241/files#diff-c6f540a4f3bfa4b0e8b6bafd4cd54e8bR695 - sanitizeName = name: - ( - concatMapStrings (s: if builtins.isList s then "-" else s) - ( - builtins.split "[^[:alnum:]+._?=-]+" - ((x: builtins.elemAt (builtins.match "\\.*(.*)" x) 0) name) - ) - ); - - # The set of packages used when specs are fetched using non-builtins. - mkPkgs = sources: system: - let - sourcesNixpkgs = - import (builtins_fetchTarball { inherit (sources.nixpkgs) url sha256; }) { inherit system; }; - hasNixpkgsPath = builtins.any (x: x.prefix == "nixpkgs") builtins.nixPath; - hasThisAsNixpkgsPath = == ./.; - in - if builtins.hasAttr "nixpkgs" sources - then sourcesNixpkgs - else if hasNixpkgsPath && ! hasThisAsNixpkgsPath then - import {} - else - abort - '' - Please specify either (through -I or NIX_PATH=nixpkgs=...) or - add a package called "nixpkgs" to your sources.json. - ''; - - # The actual fetching function. - fetch = pkgs: name: spec: - - if ! builtins.hasAttr "type" spec then - abort "ERROR: niv spec ${name} does not have a 'type' attribute" - else if spec.type == "file" then fetch_file pkgs name spec - else if spec.type == "tarball" then fetch_tarball pkgs name spec - else if spec.type == "git" then fetch_git name spec - else if spec.type == "local" then fetch_local spec - else if spec.type == "builtin-tarball" then fetch_builtin-tarball name - else if spec.type == "builtin-url" then fetch_builtin-url name - else - abort "ERROR: niv spec ${name} has unknown type ${builtins.toJSON spec.type}"; - - # If the environment variable NIV_OVERRIDE_${name} is set, then use - # the path directly as opposed to the fetched source. - replace = name: drv: - let - saneName = stringAsChars (c: if isNull (builtins.match "[a-zA-Z0-9]" c) then "_" else c) name; - ersatz = builtins.getEnv "NIV_OVERRIDE_${saneName}"; - in - if ersatz == "" then drv else ersatz; - - # Ports of functions for older nix versions - - # a Nix version of mapAttrs if the built-in doesn't exist - mapAttrs = builtins.mapAttrs or ( - f: set: with builtins; - listToAttrs (map (attr: { name = attr; value = f attr set.${attr}; }) (attrNames set)) - ); - - # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/lists.nix#L295 - range = first: last: if first > last then [] else builtins.genList (n: first + n) (last - first + 1); - - # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L257 - stringToCharacters = s: map (p: builtins.substring p 1 s) (range 0 (builtins.stringLength s - 1)); - - # https://github.com/NixOS/nixpkgs/blob/0258808f5744ca980b9a1f24fe0b1e6f0fecee9c/lib/strings.nix#L269 - stringAsChars = f: s: concatStrings (map f (stringToCharacters s)); - concatMapStrings = f: list: concatStrings (map f list); - concatStrings = builtins.concatStringsSep ""; - - # https://github.com/NixOS/nixpkgs/blob/8a9f58a375c401b96da862d969f66429def1d118/lib/attrsets.nix#L331 - optionalAttrs = cond: as: if cond then as else {}; - - # fetchTarball version that is compatible between all the versions of Nix - builtins_fetchTarball = { url, name ? null, sha256 }@attrs: - let - inherit (builtins) lessThan nixVersion fetchTarball; - in - if lessThan nixVersion "1.12" then - fetchTarball ({ inherit url; } // (optionalAttrs (!isNull name) { inherit name; })) - else - fetchTarball attrs; - - # fetchurl version that is compatible between all the versions of Nix - builtins_fetchurl = { url, name ? null, sha256 }@attrs: - let - inherit (builtins) lessThan nixVersion fetchurl; - in - if lessThan nixVersion "1.12" then - fetchurl ({ inherit url; } // (optionalAttrs (!isNull name) { inherit name; })) - else - fetchurl attrs; - - # Create the final "sources" from the config - mkSources = config: - mapAttrs ( - name: spec: - if builtins.hasAttr "outPath" spec - then abort - "The values in sources.json should not have an 'outPath' attribute" - else - spec // { outPath = replace name (fetch config.pkgs name spec); } - ) config.sources; - - # The "config" used by the fetchers - mkConfig = - { sourcesFile ? if builtins.pathExists ./sources.json then ./sources.json else null - , sources ? if isNull sourcesFile then {} else builtins.fromJSON (builtins.readFile sourcesFile) - , system ? builtins.currentSystem - , pkgs ? mkPkgs sources system - }: rec { - # The sources, i.e. the attribute set of spec name to spec - inherit sources; - - # The "pkgs" (evaluated nixpkgs) to use for e.g. non-builtin fetchers - inherit pkgs; - }; - -in -mkSources (mkConfig {}) // { __functor = _: settings: mkSources (mkConfig settings); } diff --git a/xesite.nix b/xesite.nix new file mode 100644 index 0000000..a6d0156 --- /dev/null +++ b/xesite.nix @@ -0,0 +1,153 @@ +self: +{ config, lib, ... }: +with lib; +let cfg = config.xeserv.services.xesite; +in { + options.xeserv.services.xesite = { + enable = mkEnableOption "Activates my personal website"; + useACME = mkEnableOption "Enables ACME for cert stuff"; + + port = mkOption { + type = types.port; + default = 32837; + example = 9001; + description = "The port number xesite should listen on for HTTP traffic"; + }; + + domain = mkOption { + type = types.str; + default = "${config.networking.hostName}.shark-harmonic.ts.net"; + example = "xeiaso.net"; + description = + "The domain name that nginx should check against for HTTP hostnames"; + }; + + sockPath = mkOption rec { + type = types.str; + default = "/srv/within/run/xesite.sock"; + example = default; + description = "The unix domain socket that xesite should listen on"; + }; + }; + + config = mkIf cfg.enable { + users.users.xesite = { + createHome = true; + description = "github.com/Xe/site"; + isSystemUser = true; + group = "within"; + home = "/srv/within/xesite"; + extraGroups = [ "keys" ]; + }; + + systemd.services.xesite = { + wantedBy = [ "multi-user.target" ]; + + serviceConfig = { + User = "xesite"; + Group = "within"; + Restart = "on-failure"; + WorkingDirectory = "/srv/within/xesite"; + RestartSec = "30s"; + Type = "notify"; + + # Security + CapabilityBoundingSet = ""; + DeviceAllow = [ ]; + NoNewPrivileges = "true"; + ProtectControlGroups = "true"; + ProtectClock = "true"; + PrivateDevices = "true"; + PrivateUsers = "true"; + ProtectHome = "true"; + ProtectHostname = "true"; + ProtectKernelLogs = "true"; + ProtectKernelModules = "true"; + ProtectKernelTunables = "true"; + ProtectSystem = "true"; + ProtectProc = "invisible"; + RemoveIPC = "true"; + RestrictSUIDSGID = "true"; + RestrictRealtime = "true"; + SystemCallArchitectures = "native"; + SystemCallFilter = [ + "~@reboot" + "~@module" + "~@mount" + "~@swap" + "~@resources" + "~@cpu-emulation" + "~@obsolete" + "~@debug" + "~@privileged" + ]; + UMask = "007"; + }; + + script = let site = self.packages.${system}.default; + in '' + [ -f /srv/within/xesite/.env ] && export $(cat /srv/within/xesite/.env | xargs) + export SOCKPATH=${cfg.sockPath} + export DOMAIN=${toString cfg.domain} + cd ${site} + exec ${site}/bin/xesite + ''; + }; + + services.nginx.virtualHosts."xelaso.net" = let + proxyOld = { + proxyPass = "http://unix:${toString cfg.sockPath}"; + proxyWebsockets = true; + }; + in { + locations."/jsonfeed" = proxyOld; + locations."/.within/health" = proxyOld; + locations."/.within/website.within.xesite/new_post" = proxyOld; + locations."/blog.rss" = proxyOld; + locations."/blog.atom" = proxyOld; + locations."/blog.json" = proxyOld; + locations."/".extraConfig = '' + return 301 https://xeiaso.net$request_uri; + ''; + forceSSL = cfg.useACME; + useACMEHost = "xeiaso.net"; + extraConfig = '' + access_log /var/log/nginx/xesite_old.access.log; + ''; + }; + + services.nginx.virtualHosts."christine.website" = let + proxyOld = { + proxyPass = "http://unix:${toString cfg.sockPath}"; + proxyWebsockets = true; + }; + in { + locations."/jsonfeed" = proxyOld; + locations."/.within/health" = proxyOld; + locations."/.within/website.within.xesite/new_post" = proxyOld; + locations."/blog.rss" = proxyOld; + locations."/blog.atom" = proxyOld; + locations."/blog.json" = proxyOld; + locations."/".extraConfig = '' + return 301 https://xeiaso.net$request_uri; + ''; + forceSSL = cfg.useACME; + useACMEHost = "christine.website"; + extraConfig = '' + access_log /var/log/nginx/xesite_old.access.log; + ''; + }; + + services.nginx.virtualHosts."xeiaso.net" = { + locations."/" = { + proxyPass = "http://unix:${toString cfg.sockPath}"; + proxyWebsockets = true; + }; + forceSSL = cfg.useACME; + useACMEHost = "xeiaso.net"; + extraConfig = '' + access_log /var/log/nginx/xesite.access.log; + ''; + }; + }; +} -- cgit v1.2.3