forked from
lass.pds.lassul.us/superconfig
This repository has no description
4.5 kB
154 lines
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7
8let
9 uploadPage = pkgs.writeText "paste-upload.html" ''
10 <!doctype html>
11 <title>p.krebsco.de</title>
12 <form action="/form" method="post" enctype="multipart/form-data">
13 <input type="file" name="file" required>
14 <button>upload</button>
15 </form>
16 <p>or with curl:</p>
17 <pre>
18 curl --data-binary @file https://p.krebsco.de
19 some-command | curl --data-binary @- https://p.krebsco.de
20 </pre>
21 '';
22
23 pasteCgi = pkgs.writers.writePython3 "paste-cgi" { } (
24 lib.replaceStrings
25 [ "@file@" "@exiv2@" ]
26 [ (lib.getExe pkgs.file) (lib.getExe' pkgs.exiv2 "exiv2") ]
27 (builtins.readFile ./paste.py)
28 );
29
30 # item directories of the former htgen handlers, kept for their contents
31 # and the backup paths
32 items = {
33 paste = "/var/lib/htgen-paste/items";
34 imgur = "/var/lib/htgen-imgur/items";
35 cyberlocker = "/var/lib/htgen-cyberlocker/items";
36 };
37
38 # systemd chowns them to paste if they still belong to the htgen users
39 stateDirectories = {
40 StateDirectory = map (dir: lib.removePrefix "/var/lib/" (dirOf dir)) (lib.attrValues items);
41 StateDirectoryMode = "0700";
42 };
43
44 cgi = app: itemsDir: ''
45 include ${config.services.nginx.package}/conf/fastcgi_params;
46 fastcgi_param SCRIPT_FILENAME ${pasteCgi};
47 fastcgi_param PASTE_APP ${app};
48 fastcgi_param PASTE_ITEMS ${itemsDir};
49 fastcgi_pass unix:${config.services.fcgiwrap.instances.paste.socket.address};
50 '';
51in
52{
53
54 services.nginx.virtualHosts.cyberlocker = {
55 serverAliases = [ "c.r" ];
56 locations."/".extraConfig = ''
57 client_max_body_size 4G;
58 ${cgi "cyberlocker" items.cyberlocker}
59 '';
60 extraConfig = ''
61 add_header Access-Control-Allow-Origin * always;
62 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
63 '';
64 };
65 services.nginx.virtualHosts.paste = {
66 serverAliases = [ "p.r" ];
67 locations."/".extraConfig = ''
68 client_max_body_size 4G;
69 ${cgi "paste" items.paste}
70 '';
71 locations."/image".extraConfig = ''
72 client_max_body_size 40M;
73 ${cgi "imgur" items.imgur}
74 '';
75 extraConfig = ''
76 add_header 'Access-Control-Allow-Origin' '*';
77 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
78 '';
79 };
80 services.nginx.virtualHosts."c.krebsco.de" = {
81 enableACME = true;
82 addSSL = true;
83 serverAliases = [ "c.krebsco.de" ];
84 locations."/".extraConfig = ''
85 if ($request_method != GET) {
86 return 403;
87 }
88 ${cgi "cyberlocker" items.cyberlocker}
89 '';
90 extraConfig = ''
91 add_header Access-Control-Allow-Origin * always;
92 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
93 '';
94 };
95 services.nginx.virtualHosts."p.krebsco.de" = {
96 enableACME = true;
97 addSSL = true;
98 serverAliases = [ "p.krebsco.de" ];
99 locations."/".extraConfig = ''
100 if ($request_method = 'OPTIONS') {
101 return 204;
102 }
103 if ($request_method ~ ^(GET|HEAD)$) {
104 rewrite ^/$ /_upload last;
105 }
106 client_max_body_size 4G;
107 ${cgi "paste" items.paste}
108 '';
109 locations."= /_upload".extraConfig = ''
110 internal;
111 default_type text/html;
112 alias ${uploadPage};
113 '';
114 locations."/form".extraConfig = ''
115 client_max_body_size 4G;
116 ${cgi "form" items.paste}
117 '';
118 locations."/image".extraConfig = ''
119 ${cgi "imgur" items.imgur}
120 '';
121 extraConfig = ''
122 add_header Access-Control-Allow-Headers Authorization always;
123 add_header Access-Control-Allow-Origin * always;
124 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
125 '';
126 };
127
128 services.fcgiwrap.instances.paste = {
129 # requests at a time; uploads and downloads hold a process each
130 process.prefork = 8;
131 process.user = "paste";
132 process.group = "paste";
133 socket.user = config.services.nginx.user;
134 socket.group = config.services.nginx.group;
135 };
136 systemd.services.fcgiwrap-paste.serviceConfig = stateDirectories;
137 users.users.paste = {
138 isSystemUser = true;
139 group = "paste";
140 };
141 users.groups.paste = { };
142
143 systemd.services.paste-gc = {
144 startAt = "daily";
145 serviceConfig = stateDirectories // {
146 ExecStart = ''
147 ${pkgs.findutils}/bin/find ${items.paste} -type f -mtime '+30' -exec rm {} \;
148 '';
149 User = "paste";
150 };
151 };
152
153 networking.firewall.interfaces.retiolum.allowedTCPPorts = [ 80 ];
154}