1
0
Fork 0
dotfiles/system/nixos/mastodon.nix

162 lines
4.1 KiB
Nix
Raw Normal View History

2023-07-04 17:38:57 +00:00
{ pkgs, config, ... }:
2022-11-29 14:17:23 +00:00
2022-11-29 14:51:54 +00:00
let
web-domain = "mastodon.kempkens.io";
in
2022-11-29 14:17:23 +00:00
{
services.mastodon = {
enable = true;
2023-07-07 08:53:05 +00:00
package = pkgs.pkgs-master.mastodon;
2022-11-29 14:17:23 +00:00
configureNginx = false;
localDomain = "kempkens.io";
streamingPort = 55000;
webPort = 55001;
sidekiqPort = 55002;
enableUnixSocket = true;
sidekiqThreads = 12;
2022-11-29 14:17:23 +00:00
2022-11-29 14:54:13 +00:00
trustedProxy = "127.0.0.1";
2022-11-29 14:17:23 +00:00
2023-02-05 19:32:19 +00:00
vapidPublicKeyFile = config.age.secrets.mastodon-vapid-public-key.path;
secretKeyBaseFile = config.age.secrets.mastodon-secret-key-base.path;
otpSecretFile = config.age.secrets.mastodon-otp-secret.path;
vapidPrivateKeyFile = config.age.secrets.mastodon-vapid-private-key.path;
2022-11-29 14:17:23 +00:00
database = {
createLocally = true;
2022-11-29 14:17:23 +00:00
};
redis = {
createLocally = true;
2022-11-29 14:17:23 +00:00
};
2022-12-23 16:08:24 +00:00
elasticsearch = {
host = "127.0.0.1";
2022-12-23 16:08:24 +00:00
port = 9200;
};
2022-11-29 14:17:23 +00:00
smtp = {
createLocally = false;
authenticate = true;
host = "smtp.mailgun.org";
2022-11-29 16:03:25 +00:00
port = 587;
2022-11-29 14:17:23 +00:00
fromAddress = "mastodon@mg.kempkens.io";
user = "postmaster@mg.kempkens.io";
2023-02-05 19:32:19 +00:00
passwordFile = config.age.secrets.mastodon-smtp-password.path;
2022-11-29 14:17:23 +00:00
};
automaticMigrations = true;
mediaAutoRemove = {
enable = true;
startAt = "daily";
2022-12-01 21:48:43 +00:00
olderThanDays = 14;
2022-11-29 14:17:23 +00:00
};
extraConfig = {
2022-11-29 14:51:54 +00:00
WEB_DOMAIN = web-domain;
};
extraEnvFiles = [ config.age.secrets.mastodon-extra-config.path ];
2022-11-29 14:51:54 +00:00
};
2023-07-04 17:38:57 +00:00
# For services that connect to Mastodon
systemd.services.mastodon-wait-for-available = {
description = "Wait for Mastodon to be available";
after = [ "mastodon-web.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "oneshot";
ExecStart = "${pkgs.bash}/bin/bash -c 'until ${pkgs.curl}/bin/curl --fail --silent https://${web-domain} > /dev/null; do sleep 1; done'";
};
};
2023-03-06 17:23:32 +00:00
services.nginx.virtualHosts."${web-domain}" = {
2023-04-03 13:03:52 +00:00
quic = true;
2023-03-06 17:23:32 +00:00
http3 = true;
root = "${config.services.mastodon.package}/public/";
forceSSL = true;
useACMEHost = "kempkens.io";
2023-03-06 22:39:49 +00:00
extraConfig = ''
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
'';
2023-03-06 17:23:32 +00:00
locations."/system/" = {
extraConfig = ''
rewrite ^/system/?(.*)$ https://mastodon-cdn.kempkens.io/$1 permanent;
'';
};
locations."/" = {
tryFiles = "$uri @proxy";
};
locations."@proxy" = {
recommendedProxySettings = true;
proxyPass = "http://unix:/run/mastodon-web/web.socket";
proxyWebsockets = true;
extraConfig = ''
proxy_hide_header Strict-Transport-Security;
2023-03-06 17:23:32 +00:00
proxy_force_ranges on;
'';
};
locations."/api/v1/streaming/" = {
recommendedProxySettings = true;
proxyPass = "http://unix:/run/mastodon-streaming/streaming.socket";
proxyWebsockets = true;
extraConfig = ''
proxy_hide_header Strict-Transport-Security;
2023-03-06 17:23:32 +00:00
proxy_force_ranges on;
'';
2022-11-29 14:17:23 +00:00
};
};
2023-07-07 08:53:05 +00:00
services.nginx.virtualHosts."mastodon-cdn.kempkens.io" =
let
lib-base = "/var/lib/mastodon/public-system";
in
{
quic = true;
http3 = true;
kTLS = true;
2023-03-06 20:47:25 +00:00
2023-07-07 08:53:05 +00:00
root = "${config.services.mastodon.package}/public/";
forceSSL = true;
useACMEHost = "kempkens.io";
2023-03-06 20:55:07 +00:00
2023-07-07 08:53:05 +00:00
extraConfig = ''
add_header Access-Control-Allow-Origin https://mastodon.kempkens.io;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
'';
2023-03-06 21:00:48 +00:00
2023-07-07 08:53:05 +00:00
locations."/system/" = {
alias = "${lib-base}/";
extraConfig = ''
add_header Cache-Control "public, max-age=2419200, immutable";
add_header X-Content-Type-Options nosniff;
add_header Content-Security-Policy "default-src 'none'; form-action 'none'";
'';
};
# "Old" CDN paths
locations."/accounts/".alias = "${lib-base}/accounts/";
locations."/cache/".alias = "${lib-base}/cache/";
locations."/custom_emojis/".alias = "${lib-base}/custom_emojis/";
locations."/media_attachments/".alias = "${lib-base}/media_attachments/";
};
2023-03-06 20:24:46 +00:00
2022-11-29 23:16:26 +00:00
users.groups.mastodon.members = [ config.services.nginx.user ];
2022-11-29 14:17:23 +00:00
}