nitter: Use package
This commit is contained in:
parent
737ebdd710
commit
d28d28d6ee
3 changed files with 53 additions and 29 deletions
|
@ -68,6 +68,7 @@
|
||||||
|
|
||||||
nitter-config = {
|
nitter-config = {
|
||||||
file = ./nitter/config.age;
|
file = ./nitter/config.age;
|
||||||
|
mode = "444";
|
||||||
};
|
};
|
||||||
|
|
||||||
nitter-auth = {
|
nitter-auth = {
|
||||||
|
|
Binary file not shown.
|
@ -1,31 +1,55 @@
|
||||||
{ config, ... }:
|
{ pkgs, config, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
|
nitter-pkg = pkgs.nitter-unstable;
|
||||||
|
|
||||||
proxy-no-auth = {
|
proxy-no-auth = {
|
||||||
recommendedProxySettings = true;
|
recommendedProxySettings = true;
|
||||||
proxyPass = "http://127.0.0.1:8001";
|
proxyPass = "http://127.0.0.1:8001";
|
||||||
};
|
};
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
virtualisation.arion.projects.nitter.settings = {
|
# Based on: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/nixos/modules/services/misc/nitter.nix
|
||||||
services = {
|
|
||||||
nitter = {
|
systemd.services.nitter = {
|
||||||
service = {
|
description = "Nitter (An alternative Twitter front-end)";
|
||||||
image = "zedeus/nitter:latest";
|
wantedBy = [ "multi-user.target" ];
|
||||||
container_name = "nitter";
|
after = [ "network.target" ];
|
||||||
restart = "unless-stopped";
|
serviceConfig = {
|
||||||
ports = [ "127.0.0.1:8001:8080" ];
|
DynamicUser = true;
|
||||||
environment = {
|
StateDirectory = "nitter";
|
||||||
"TZ" = "Europe/Berlin";
|
Environment = [ "NITTER_CONF_FILE=${config.age.secrets.nitter-config.path}" ];
|
||||||
};
|
# Some parts of Nitter expect `public` folder in working directory,
|
||||||
volumes = [
|
# see https://github.com/zedeus/nitter/issues/414
|
||||||
"${config.age.secrets.nitter-config.path}:/src/nitter.conf:ro"
|
WorkingDirectory = "${nitter-pkg}/share/nitter";
|
||||||
];
|
ExecStart = "${nitter-pkg}/bin/nitter";
|
||||||
labels = {
|
Restart = "on-failure";
|
||||||
"com.centurylinklabs.watchtower.enable" = "true";
|
RestartSec = "5s";
|
||||||
};
|
# Hardening
|
||||||
};
|
CapabilityBoundingSet = [ "" ];
|
||||||
};
|
DeviceAllow = [ "" ];
|
||||||
|
LockPersonality = true;
|
||||||
|
MemoryDenyWriteExecute = true;
|
||||||
|
PrivateDevices = true;
|
||||||
|
# A private user cannot have process capabilities on the host's user
|
||||||
|
# namespace and thus CAP_NET_BIND_SERVICE has no effect.
|
||||||
|
PrivateUsers = true;
|
||||||
|
ProcSubset = "pid";
|
||||||
|
ProtectClock = true;
|
||||||
|
ProtectControlGroups = true;
|
||||||
|
ProtectHome = true;
|
||||||
|
ProtectHostname = true;
|
||||||
|
ProtectKernelLogs = true;
|
||||||
|
ProtectKernelModules = true;
|
||||||
|
ProtectKernelTunables = true;
|
||||||
|
ProtectProc = "invisible";
|
||||||
|
RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];
|
||||||
|
RestrictNamespaces = true;
|
||||||
|
RestrictRealtime = true;
|
||||||
|
RestrictSUIDSGID = true;
|
||||||
|
SystemCallArchitectures = "native";
|
||||||
|
SystemCallFilter = [ "@system-service" "~@privileged" "~@resources" ];
|
||||||
|
UMask = "0077";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
@ -39,23 +63,22 @@ in
|
||||||
}
|
}
|
||||||
];
|
];
|
||||||
|
|
||||||
|
root = "${nitter-pkg}/share/nitter/public/";
|
||||||
forceSSL = false;
|
forceSSL = false;
|
||||||
enableACME = false;
|
enableACME = false;
|
||||||
|
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
basicAuthFile = config.age.secrets.nitter-auth.path;
|
tryFiles = "$uri @proxy";
|
||||||
|
};
|
||||||
|
|
||||||
|
locations."/pic/" = proxy-no-auth;
|
||||||
|
locations."/video/" = proxy-no-auth;
|
||||||
|
|
||||||
|
locations."@proxy" = {
|
||||||
|
basicAuthFile = config.age.secrets.nitter-auth.path;
|
||||||
recommendedProxySettings = true;
|
recommendedProxySettings = true;
|
||||||
proxyPass = "http://127.0.0.1:8001";
|
proxyPass = "http://127.0.0.1:8001";
|
||||||
};
|
};
|
||||||
|
|
||||||
# Disable auth for certain paths
|
|
||||||
locations."/pic/" = proxy-no-auth;
|
|
||||||
locations."/video/" = proxy-no-auth;
|
|
||||||
locations."/favicon.ico" = proxy-no-auth;
|
|
||||||
locations."/favicon-32x32.png" = proxy-no-auth;
|
|
||||||
locations."/favicon-16x16.png" = proxy-no-auth;
|
|
||||||
locations."/apple-touch-icon.png" = proxy-no-auth;
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
Loading…
Reference in a new issue