path: root/vps-configuration.env.nix

{ config, pkgs, ... }:

let
  envsubstConfiguration = {
    TLD = "$TLD";
    nextcloudTLD = "$NEXTCLOUD_TLD";
    gitTLD = "$GIT_TLD";
    prosodyTLD = "$PROSODY_TLD";
    bonecoTLD = "$BONECO_TLD";
    pdfsTLD = "$PDFS_TLD";
    ciLogsTLD = "$CI_LOGS_TLD";
    songbooksDocumentationTLD = "$SONGBOOKS_DOCUMENTATION_TLD";
    piresDocumentationTLD = "$PIRES_DOCUMENTATION_TLD";
    mediatorDocumentationTLD = "$MEDIATOR_DOCUMENTATION_TLD";
    cementDocumentationTLD = "$CEMENT_DOCUMENTATION_TLD";
    piresProdTLD = "$PIRES_PROD_TLD";
    piresProdPort = "$PIRES_PROD_PORT";
    piresProdDir = "$PIRES_PROD_DIR";
    letsencryptEmail = "$LETSENCRYPT_EMAIL";
    authorizedKey = "$AUTHORIZED_KEY";
    userPassword = "$USER_PASSWORD";
    userName = "$USER_NAME";
    dataRoot = "$DATA_ROOT";
    staticRoot = "$STATIC_ROOT";
    ciLogsRoot = "$CI_LOGS_ROOT";
    faviconsRoot = "$FAVICONS_ROOT";
    nextcloudDatabaseUser = "$NEXTCLOUD_DATABASE_USER";
    nextcloudDatabasePassword = "$NEXTCLOUD_DATABASE_PASSWORD";
    nextcloudAdminUser = "$NEXTCLOUD_ADMIN_USER";
    nextcloudAdminPassword = "$NEXTCLOUD_ADMIN_PASSWORD";
    nextcloudTablePrefix = "$NEXTCLOUD_TABLE_PREFIX";
    gitPort = "$GIT_PORT";
    gitRoot = "$GIT_ROOT";
    systemStateVersion = "$SYSTEM_STATE_VERSION";
    prosodyConverseTLD = "$PROSODY_CONVERSE_TLD";
    prosodyAdminUser = "$PROSODY_ADMIN_USER";
    prosodyMUCTLD = "$PROSODY_MUC_TLD";
    prosodyPort = "$PROSODY_PORT";
    prosodyHTTPPort = "$PROSODY_HTTP_PORT";
    prosodyEnable = $PROSODY_ENABLE;
  };
  staticSiteFromRepo = repoName:
    pkgs.stdenv.mkDerivation {
      name = repoName;
      src = fetchTarball
        "https://git.sr.ht/~euandreh/${DOLLAR}{repoName}/archive/master.tar.gz";
      phases = "unpackPhase buildPhase";
      buildPhase = ''
        mkdir ${DOLLAR}out
        cp index.html ${DOLLAR}out
        cp favicon.ico ${DOLLAR}out
      '';
    };
  pkgsUnstable = import (builtins.fetchTarball {
    url = "https://github.com/NixOS/nixpkgs/archive/nixos-unstable.tar.gz";
  }) { };
  piresProd = pkgs.writeShellScriptBin "run-pires.sh" ''
    export FLASK_CONFIG=production

    export PIRES_PROD_DIR="$"
    if [[ ! -d ${envsubstConfiguration.piresProdDir} ]]; then
      ${pkgs.git}/bin/git clone https://gitlab.com/EuAndreh/pires.git ${envsubstConfiguration.piresProdDir}
    fi
    pushd ${envsubstConfiguration.piresProdDir}
    ${pkgs.git}/bin/git pull
    ${pkgsUnstable.poetry}/bin/poetry install --no-dev --extras "waitress"
    ${pkgsUnstable.poetry}/bin/poetry run flask inicializar-banco
    ${pkgsUnstable.poetry}/bin/poetry run waitress-serve --host localhost --port ${envsubstConfiguration.piresProdPort} --call pires:create_app
  '';
in {
  nix = {
    binaryCaches = [ "https://euandreh.cachix.org" ];
    binaryCachePublicKeys =
      [ "euandreh.cachix.org-1:ms8eOKJJtb20GJDPCf8Nvob8YI0oF8dREAMdx3XF/90=" ];
  };

  imports = [ ./hardware-configuration.nix ];

  boot.loader.grub = {
    enable = true;
    version = 2;
    device = "/dev/vda";
  };

  networking = {
    useDHCP = false;
    interfaces.ens3.useDHCP = true;
  };

  environment.systemPackages = with pkgs; [
    vim
    git
    gitAndTools.git-annex
    gotop
  ];

  networking.firewall.allowedTCPPorts = [
    # SSH: OpenSSH
    22

    # HTTP and HTPPS: NGINX
    80
    443
  ] ++ (if prosodyEnable then
    [
      # XMPP: Prosody
      # https://prosody.im/doc/ports
      5000
      5222
      5269
      5280
      5281
      5347
      5582
    ] else []);

  security.acme = {
    acceptTerms = true;
    email = envsubstConfiguration.letsencryptEmail;
  };

  services = {
    openssh = {
      enable = true;
      permitRootLogin = "no";
      passwordAuthentication = false;
    };

    nginx = {
      enable = true;
      recommendedGzipSettings = true;
      recommendedOptimisation = true;
      recommendedProxySettings = true;
      recommendedTlsSettings = true;
      virtualHosts = {
        "${envsubstConfiguration.nextcloudTLD}" = {
          forceSSL = true;
          enableACME = true;
        };
        "${envsubstConfiguration.gitTLD}" = {
          forceSSL = true;
          enableACME = true;
          extraConfig = ''
            location = /favicon.ico {
                    alias ${envsubstConfiguration.dataRoot}/favicons/git.ico;
            }
            location / {
                    proxy_pass http://localhost:${envsubstConfiguration.gitPort};
            }
          '';
        };
        "${envsubstConfiguration.bonecoTLD}" = {
          forceSSL = true;
          enableACME = true;
          root = staticSiteFromRepo "boneco";
        };
        "${envsubstConfiguration.pdfsTLD}" = {
          forceSSL = true;
          enableACME = true;
          root = staticSiteFromRepo "pdfs-da-d-maria";
        };
        "${envsubstConfiguration.ciLogsTLD}" = {
          forceSSL = true;
          enableACME = true;
          root = "${envsubstConfiguration.ciLogsRoot}";
        };
        "${envsubstConfiguration.mediatorDocumentationTLD}" = {
          forceSSL = true;
          enableACME = true;
          extraConfig = ''
            location = / {
                    return 301 master/;
            }
            root ${envsubstConfiguration.staticRoot}/mediator/;
          '';
        };
        "${envsubstConfiguration.cementDocumentationTLD}" = {
          forceSSL = true;
          enableACME = true;
          extraConfig = ''
            location = / {
                    return 301 master/;
            }
            root ${envsubstConfiguration.staticRoot}/cement/;
          '';
        };
        "${envsubstConfiguration.songbooksDocumentationTLD}" = {
          forceSSL = true;
          enableACME = true;
          extraConfig = ''
            location = / {
                    return 301 en/master/;
            }
            root ${envsubstConfiguration.staticRoot}/songbooks/;
          '';
        };
        "${envsubstConfiguration.piresDocumentationTLD}" = {
          forceSSL = true;
          enableACME = true;
          root = "${envsubstConfiguration.staticRoot}/pires/";
        };
        "${envsubstConfiguration.piresProdTLD}" = {
          forceSSL = true;
          enableACME = true;
          locations = {
            "/" = {
              proxyPass =
                "http://localhost:${envsubstConfiguration.piresProdPort}/";
            };
          };
        };
        # Generate and maintain TLS certificate with NGINX
        # to be used by Prosody
        "${envsubstConfiguration.prosodyTLD}" = {
          forceSSL = true;
          enableACME = true;
        };
        "${envsubstConfiguration.prosodyConverseTLD}" = {
          forceSSL = true;
          enableACME = true;
          extraConfig = ''
            location = /favicon.ico {
                    alias ${envsubstConfiguration.dataRoot}/favicons/conversejs.ico;
            }
            location = / {
                    return 301 conversejs;
            }
            location / {
                    proxy_pass http://localhost:${envsubstConfiguration.prosodyHTTPPort}/;
            }
          '';
        };
      };
    };

    postgresql = {
      enable = true;
      ensureDatabases = [ "nextcloud" ];
      package = pkgs.postgresql_11;
      ensureUsers = [{
        name = "nextcloud";
        ensurePermissions."DATABASE nextcloud" = "ALL PRIVILEGES";
      }];
    };

    nextcloud = {
      enable = true;
      package = pkgs.nextcloud19;
      nginx.enable = true;
      hostName = envsubstConfiguration.nextcloudTLD;
      https = true;
      maxUploadSize = "4G";
      autoUpdateApps.enable = true;
      config = {
        overwriteProtocol = "https";
        dbtype = "pgsql";
        dbhost = "/run/postgresql";
        dbuser = envsubstConfiguration.nextcloudDatabaseUser;
        dbpass = envsubstConfiguration.nextcloudDatabasePassword;
        dbtableprefix = envsubstConfiguration.nextcloudTablePrefix;
        adminuser = envsubstConfiguration.nextcloudAdminUser;
        adminpass = envsubstConfiguration.nextcloudAdminPassword;
      };
    };

    prosody = let
      XMPP = {
        fullchainPEM =
          "/var/lib/acme/${envsubstConfiguration.prosodyTLD}/fullchain.pem";
        keyPEM = "/var/lib/acme/${envsubstConfiguration.prosodyTLD}/key.pem";
      };
      ConverseJS = {
        fullchainPEM =
          "/var/lib/acme/${envsubstConfiguration.prosodyConverseTLD}/fullchain.pem";
        keyPEM =
          "/var/lib/acme/${envsubstConfiguration.prosodyConverseTLD}/key.pem";
      };
    in {
      enable = prosodyEnable;
      admins = [ envsubstConfiguration.prosodyAdminUser ];
      allowRegistration = false;
      modules = { websocket = true; };
      package = pkgs.prosody.override {
        withCommunityModules = [ "http_upload" "conversejs" "bookmarks" ];
      };
      extraModules = [ "http_upload" "conversejs" "bookmarks" ];
      virtualHosts = {
        "${envsubstConfiguration.prosodyTLD}" = {
          enabled = true;
          domain = "${envsubstConfiguration.prosodyTLD}";
          ssl = {
            cert = XMPP.fullchainPEM;
            key = XMPP.keyPEM;
          };
        };
        "${envsubstConfiguration.prosodyConverseTLD}" = {
          enabled = true;
          domain = "${envsubstConfiguration.prosodyConverseTLD}";
          ssl = {
            cert = ConverseJS.fullchainPEM;
            key = ConverseJS.keyPEM;
          };
        };
      };
    };

    lighttpd = {
      enable = true;
      port = pkgs.lib.toInt envsubstConfiguration.gitPort;
      cgit = {
        enable = true;
        subdir = "";
        configText = ''
          enable-blame=1
          enable-commit-graph=1
          enable-follow-links=1
          enable-index-owner=0
          enable-log-filecount=1
          enable-log-linecount=1
          root-desc=public repositories
          root-readme=${envsubstConfiguration.gitRoot}/about.html
          readme=:README.md
          readme=:README
          readme=:README.rst
          readme=:README.org
          max-repodesc-length=120
          remove-suffix=1
          root-title=EuAndreh's git repositories
          snapshots=tar.gz zip
          source-filter=${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py
          about-filter=${pkgs.cgit}/lib/cgit/filters/about-formatting.sh
          scan-path=${envsubstConfiguration.gitRoot}
        '';
      };
    };

    logrotate = {
      enable =
        false; # disabled due to extraConfig not being yet out of unstable
      # extraConfig = ''
      #   compress

      #   ${envsubstConfiguration.ciLogsRoot}/*/*.log {
      #     rotate 5
      #     daily
      #     olddir ${envsubstConfiguration.staticRoot}/logrorate/
      #     createolddir 744 andreh users
      #     su andreh users
      #   }
      # '';
    };
  };

  systemd.services = {
    "nextcloud-setup" = {
      requires = [ "postgresql.service" ];
      after = [ "postgresql.service" ];
    };
    "data-folder-init" = {
      enable = true;
      description = "Setup data folders and permissions";
      wantedBy = [ "multi-user.target" ];
      script = pkgs.lib.fold (p: acc:
        acc + ''
          mkdir -p ${DOLLAR}{p}
          chown -R andreh:users ${DOLLAR}{p}
          chmod -R 755 ${DOLLAR}{p}
        '') "" (with envsubstConfiguration; [
          staticRoot
          gitRoot
          faviconsRoot
          ciLogsRoot
          dataRoot
        ]);
      serviceConfig = { Type = "oneshot"; };
    };
    "poor-mans-logrotate" = {
      enable = true;
      description = "Delete old CI log files";
      wantedBy = [ "multi-user.target" ];
      script = ''
        pushd ${envsubstConfiguration.ciLogsRoot}
        find . -type f -name '*.log' -mtime 1 -delete
        find . -type d -empty -delete
        ${pkgs.bash}/bin/bash ci-gen-index.sh
      '';
      serviceConfig = { Type = "oneshot"; };
    };
    "pires-prod" = {
      enable = true;
      # Unit
      description = "Service for pires server deployment";
      after = [ "network.target" ];
      # Service
      serviceConfig = {
        User = "${envsubstConfiguration.userName}";
        ExecStart = "${DOLLAR}{piresProd}/bin/run-pires.sh";
        Restart = "always";
      };
      # Install
      wantedBy = [ "multi-user.target" ];
    };
  };

  users.extraUsers."${envsubstConfiguration.userName}" = {
    uid = 1000;
    isNormalUser = true;
    extraGroups = [ "wheel" ];
    password = envsubstConfiguration.userPassword;
    openssh.authorizedKeys.keys = [ envsubstConfiguration.authorizedKey ];
  };

  system.stateVersion = envsubstConfiguration.systemStateVersion;
}