dotfiles/system/nixos/mastodon.nix

216 lines
5.9 KiB
Nix
Raw Normal View History

2023-11-15 18:57:22 +00:00
{ pkgs, lib, config, ... }:
2022-11-29 14:17:23 +00:00
2022-11-29 14:51:54 +00:00
let
web-domain = "mastodon.kempkens.io";
2023-10-26 17:29:26 +00:00
2024-02-17 15:20:34 +00:00
pkg-base = pkgs.mastodon;
2024-02-01 18:32:13 +00:00
pkg-mastodon = pkg-base.overrideAttrs (_: {
mastodonModules = pkg-base.mastodonModules.overrideAttrs (oldMods:
2023-10-26 17:29:26 +00:00
let
2024-01-10 18:16:01 +00:00
tangerine-ui = pkgs.fetchFromGitHub {
owner = "nileane";
repo = "TangerineUI-for-Mastodon";
rev = "v1.9.4";
hash = "sha256-ejAmITS4DKeaLetcqZr8LEhLdlDUkKwKXlG7rY1PN1E=";
2023-10-26 17:29:26 +00:00
};
in
{
pname = "${oldMods.pname}+themes";
postPatch = ''
styleDir=$PWD/app/javascript/styles
2024-01-10 18:16:01 +00:00
cp -r ${tangerine-ui}/mastodon/app/javascript/styles/* $styleDir
2023-10-26 17:29:26 +00:00
2024-01-10 18:16:01 +00:00
echo "tangerineui: styles/tangerineui.scss" >>$PWD/config/themes.yml
echo "tangerineui-purple: styles/tangerineui-purple.scss" >>$PWD/config/themes.yml
2023-10-26 17:29:26 +00:00
'';
});
nativeBuildInputs = [ pkgs.yq-go ];
postBuild = ''
# Make theme available
2024-01-10 18:16:01 +00:00
echo "tangerineui: styles/tangerineui.scss" >>$PWD/config/themes.yml
echo "tangerineui-purple: styles/tangerineui-purple.scss" >>$PWD/config/themes.yml
2023-10-26 17:29:26 +00:00
2024-01-10 18:16:01 +00:00
yq -i '.en.themes.tangerineui = "Tangerine UI"' $PWD/config/locales/en.yml
yq -i '.en.themes.tangerineui-purple = "Tangerine UI (Purple)"' $PWD/config/locales/en.yml
2023-10-26 17:29:26 +00:00
'';
});
2022-11-29 14:51:54 +00:00
in
2022-11-29 14:17:23 +00:00
{
services.mastodon = {
enable = true;
2023-10-26 17:29:26 +00:00
package = pkg-mastodon;
2023-07-07 08:53:05 +00:00
2022-11-29 14:17:23 +00:00
configureNginx = false;
localDomain = "kempkens.io";
2023-11-15 18:57:22 +00:00
streamingProcesses = 2;
2022-11-29 14:17:23 +00:00
webPort = 55001;
sidekiqPort = 55002;
enableUnixSocket = true;
sidekiqThreads = 12;
2022-11-29 14:17:23 +00:00
2022-11-29 14:54:13 +00:00
trustedProxy = "127.0.0.1";
2022-11-29 14:17:23 +00:00
2023-02-05 19:32:19 +00:00
vapidPublicKeyFile = config.age.secrets.mastodon-vapid-public-key.path;
secretKeyBaseFile = config.age.secrets.mastodon-secret-key-base.path;
otpSecretFile = config.age.secrets.mastodon-otp-secret.path;
vapidPrivateKeyFile = config.age.secrets.mastodon-vapid-private-key.path;
2022-11-29 14:17:23 +00:00
database = {
createLocally = true;
2022-11-29 14:17:23 +00:00
};
redis = {
createLocally = true;
2022-11-29 14:17:23 +00:00
};
2022-12-23 16:08:24 +00:00
elasticsearch = {
host = "127.0.0.1";
2022-12-23 16:08:24 +00:00
port = 9200;
};
2022-11-29 14:17:23 +00:00
smtp = {
createLocally = false;
authenticate = true;
host = "smtp.mailgun.org";
2022-11-29 16:03:25 +00:00
port = 587;
2022-11-29 14:17:23 +00:00
fromAddress = "mastodon@mg.kempkens.io";
user = "postmaster@mg.kempkens.io";
2023-02-05 19:32:19 +00:00
passwordFile = config.age.secrets.mastodon-smtp-password.path;
2022-11-29 14:17:23 +00:00
};
automaticMigrations = true;
mediaAutoRemove = {
enable = true;
startAt = "daily";
2022-12-01 21:48:43 +00:00
olderThanDays = 14;
2022-11-29 14:17:23 +00:00
};
extraConfig = {
2022-11-29 14:51:54 +00:00
WEB_DOMAIN = web-domain;
};
extraEnvFiles = [ config.age.secrets.mastodon-extra-config.path ];
2022-11-29 14:51:54 +00:00
};
2023-07-04 17:38:57 +00:00
# For services that connect to Mastodon
systemd.services.mastodon-wait-for-available = {
description = "Wait for Mastodon to be available";
after = [ "mastodon-web.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
2023-12-13 23:29:09 +00:00
ExecStart = "${lib.getExe pkgs.bash} -c 'until ${lib.getExe pkgs.curl} --fail --silent https://${web-domain} > /dev/null; do sleep 1; done'";
2023-07-04 17:38:57 +00:00
};
};
2023-11-15 18:57:22 +00:00
services.nginx = {
upstreams.mastodon-streaming = {
2023-03-06 17:23:32 +00:00
extraConfig = ''
2023-11-15 18:57:22 +00:00
least_conn;
2023-03-06 17:23:32 +00:00
'';
2023-11-15 18:57:22 +00:00
servers = builtins.listToAttrs
(map
(i: {
name = "unix:/run/mastodon-streaming/streaming-${toString i}.socket";
value = { };
})
(lib.range 1 config.services.mastodon.streamingProcesses));
2023-03-06 17:23:32 +00:00
};
2023-11-15 18:57:22 +00:00
virtualHosts = {
"${web-domain}" = {
quic = true;
http3 = true;
2023-03-06 17:23:32 +00:00
2023-11-15 18:57:22 +00:00
root = "${config.services.mastodon.package}/public/";
forceSSL = true;
useACMEHost = "kempkens.io";
2023-03-06 17:23:32 +00:00
2023-11-15 18:57:22 +00:00
extraConfig = ''
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
'';
2023-03-06 17:23:32 +00:00
2023-11-15 18:57:22 +00:00
locations."/system/" = {
extraConfig = ''
rewrite ^/system/?(.*)$ https://mastodon-cdn.kempkens.io/$1 permanent;
'';
};
2022-11-29 14:17:23 +00:00
2023-11-15 18:57:22 +00:00
locations."/" = {
tryFiles = "$uri @proxy";
};
2023-03-06 20:47:25 +00:00
2023-11-15 18:57:22 +00:00
locations."@proxy" = {
recommendedProxySettings = true;
proxyPass = "http://unix:/run/mastodon-web/web.socket";
proxyWebsockets = true;
2023-03-06 20:55:07 +00:00
2023-11-15 18:57:22 +00:00
extraConfig = ''
proxy_hide_header Strict-Transport-Security;
proxy_force_ranges on;
'';
};
2023-03-06 21:00:48 +00:00
2023-11-15 18:57:22 +00:00
locations."/api/v1/streaming/" = {
recommendedProxySettings = true;
proxyPass = "http://mastodon-streaming";
proxyWebsockets = true;
2023-07-07 08:53:05 +00:00
2023-11-15 18:57:22 +00:00
extraConfig = ''
proxy_hide_header Strict-Transport-Security;
proxy_force_ranges on;
'';
};
2023-07-07 08:53:05 +00:00
};
2023-11-15 18:57:22 +00:00
"mastodon-cdn.kempkens.io" =
let
lib-base = "/var/lib/mastodon/public-system";
in
{
quic = true;
http3 = true;
kTLS = true;
root = "${config.services.mastodon.package}/public/";
forceSSL = true;
useACMEHost = "kempkens.io";
extraConfig = ''
add_header Access-Control-Allow-Origin https://mastodon.kempkens.io;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
'';
locations."/system/" = {
alias = "${lib-base}/";
extraConfig = ''
add_header Cache-Control "public, max-age=2419200, immutable";
add_header X-Content-Type-Options nosniff;
add_header Content-Security-Policy "default-src 'none'; form-action 'none'";
'';
};
# "Old" CDN paths
locations."/accounts/".alias = "${lib-base}/accounts/";
locations."/cache/".alias = "${lib-base}/cache/";
locations."/custom_emojis/".alias = "${lib-base}/custom_emojis/";
locations."/media_attachments/".alias = "${lib-base}/media_attachments/";
};
2023-07-07 08:53:05 +00:00
};
2023-11-15 18:57:22 +00:00
};
2023-03-06 20:24:46 +00:00
2022-11-29 23:16:26 +00:00
users.groups.mastodon.members = [ config.services.nginx.user ];
2022-11-29 14:17:23 +00:00
}