forked from
lass.pds.lassul.us/superconfig
This repository has no description
4.8 kB
132 lines
1{
2 self,
3 config,
4 pkgs,
5 ...
6}:
7let
8 domain = "git.lassul.us";
9 port = 3010;
10 redisPort = 6380;
11 listenAddr = "127.0.0.1:${toString port}";
12in
13{
14 # Tangled appview: the web UI for repos on knot.lassul.us (knot.nix) and
15 # other knots. Users log in with their atproto account via OAuth to their
16 # PDS. Records come from Bluesky's jetstream (upstream default) and repo
17 # contents from our knotmirror (knotmirror.nix). Follows tangled's
18 # nix/modules/appview.nix, without its flake (the module files are in a
19 # fetched source, importing them would be IFD).
20
21 clan.core.vars.generators.tangled-appview = {
22 files."appview.env" = { };
23 runtimeInputs = with pkgs; [
24 atproto-goat
25 coreutils
26 gawk
27 gnugrep
28 openssl
29 ];
30 script = ''
31 {
32 echo "TANGLED_COOKIE_SECRET=$(openssl rand -hex 32)"
33 echo "TANGLED_OAUTH_CLIENT_KID=$(date +%s)"
34 echo "TANGLED_OAUTH_CLIENT_SECRET=$(goat key generate -t P-256 | grep -A1 'Secret Key' | tail -n1 | awk '{print $1}')"
35 } > "$out/appview.env"
36 '';
37 };
38
39 # 6379 is docuseal's
40 services.redis.servers.appview = {
41 enable = true;
42 port = redisPort;
43 };
44
45 systemd.services.appview = {
46 description = "tangled appview service";
47 wantedBy = [ "multi-user.target" ];
48 after = [
49 "redis-appview.service"
50 "network-online.target"
51 ];
52 requires = [ "redis-appview.service" ];
53 wants = [ "network-online.target" ];
54 path = [ pkgs.diffutils ];
55 serviceConfig = {
56 Type = "simple";
57 ExecStart = "${self.packages.${pkgs.stdenv.hostPlatform.system}.tangled.appview}/bin/appview";
58 Restart = "always";
59 RestartSec = "10s";
60 EnvironmentFile = config.clan.core.vars.generators.tangled-appview.files."appview.env".path;
61 # upstream runs it as root
62 DynamicUser = true;
63 StateDirectory = "appview";
64 WorkingDirectory = "/var/lib/appview";
65 NoNewPrivileges = true;
66 PrivateTmp = true;
67 ProtectSystem = "strict";
68 ProtectHome = true;
69 ReadWritePaths = [ "/var/lib/appview" ];
70 };
71 # upstream's defaults, except where commented
72 environment = {
73 TANGLED_DB_PATH = "/var/lib/appview/appview.db";
74 TANGLED_LISTEN_ADDR = listenAddr;
75 TANGLED_METRICS_LISTEN_ADDR = "127.0.0.1:${toString (port + 1)}";
76 TANGLED_APPVIEW_HOST = domain;
77 TANGLED_APPVIEW_NAME = domain;
78 TANGLED_DEV = "false";
79 TANGLED_REDIS_ADDR = "127.0.0.1:${toString redisPort}";
80 TANGLED_REDIS_DB = "0";
81 TANGLED_JETSTREAM_ENDPOINT = "wss://jetstream1.us-east.bsky.network/subscribe";
82 TANGLED_KNOTSTREAM_RETRY_INTERVAL = "60s";
83 TANGLED_KNOTSTREAM_MAX_RETRY_INTERVAL = "120m";
84 TANGLED_KNOTSTREAM_CONNECTION_TIMEOUT = "5s";
85 TANGLED_KNOTSTREAM_WORKER_COUNT = "64";
86 TANGLED_KNOTSTREAM_QUEUE_SIZE = "100";
87 TANGLED_SPINDLESTREAM_RETRY_INTERVAL = "60s";
88 TANGLED_SPINDLESTREAM_MAX_RETRY_INTERVAL = "120m";
89 TANGLED_SPINDLESTREAM_CONNECTION_TIMEOUT = "5s";
90 TANGLED_SPINDLESTREAM_WORKER_COUNT = "64";
91 TANGLED_SPINDLESTREAM_QUEUE_SIZE = "100";
92 TANGLED_RESEND_SENT_FROM = "noreply@notifs.tangled.sh";
93 # sends logins, searches and pushes even without an API key
94 TANGLED_POSTHOG_ENDPOINT = "http://127.0.0.1:9";
95 TANGLED_CAMO_HOST = "https://camo.tangled.sh";
96 TANGLED_AVATAR_HOST = "https://avatar.tangled.sh";
97 TANGLED_PLC_URL = "https://plc.directory";
98 TANGLED_PDS_HOST = "https://tngl.sh";
99 # records of tangled's account, fetched from its PDS at startup; repos
100 # start without labels
101 TANGLED_LABEL_DEFAULTS = "";
102 TANGLED_LABEL_GFI = "at://did:plc:wshs7t2adsemcrrd4snkeqli/sh.tangled.label.definition/good-first-issue";
103 # probed at every login, upstream's is knot1.tangled.sh
104 TANGLED_KNOT_DEFAULT = "knot.lassul.us";
105 # OG images of repos, issues and pulls, rendered by tangled
106 TANGLED_OGRE_HOST = "http://127.0.0.1:9";
107 # browsers get raw blob links to it, so not localhost
108 TANGLED_KNOTMIRROR_URL = "https://mirror.lassul.us";
109 };
110 };
111
112 # redis only caches
113 lass.backup.state.tangled-appview = {
114 preBackup = ''
115 ${pkgs.sqlite}/bin/sqlite3 -cmd ".timeout 60000" /var/lib/private/appview/appview.db ".backup /var/backup/tangled-appview.db"
116 '';
117 # WAL-mode SQLite readers need to write the -shm file
118 readWritePaths = [ "/var/lib/private/appview" ];
119 };
120
121 services.nginx.virtualHosts.${domain} = {
122 enableACME = true;
123 forceSSL = true;
124 locations."/" = {
125 proxyPass = "http://${listenAddr}";
126 recommendedProxySettings = true;
127 proxyWebsockets = true;
128 };
129 # creates tngl.sh accounts, which needs tangled's PDS admin secret
130 locations."/signup".return = "404";
131 };
132}