This repository has no description
2.6 kB
92 lines
1{
2 lib,
3 config,
4 pkgs,
5 ...
6}:
7{
8 options.clan.hedgedoc = {
9 domain = lib.mkOption {
10 type = lib.types.str;
11 description = "The domain of the hedgedoc instance.";
12 };
13 };
14 config = {
15
16 security.acme.certs.${config.clan.hedgedoc.domain}.group = "hedgecert";
17 users.groups.hedgecert.members = [
18 "hedgedoc"
19 "nginx"
20 ];
21
22 security.dhparams = {
23 enable = true;
24 params.hedgedoc = { };
25 };
26
27 services.hedgedoc = {
28 enable = true;
29 settings = {
30 allowOrigin = [
31 "localhost"
32 config.clan.hedgedoc.domain
33 ];
34 useCDN = true;
35 port = 3091;
36 domain = config.clan.hedgedoc.domain;
37 allowFreeURL = true;
38 defaultPermission = "freely";
39 # debug = true;
40 # useSSL = true;
41 # hsts.enable = false;
42 # protocolUseSSL = true;
43
44 useSSL = true;
45 protocolUseSSL = true;
46 sslCAPath = [ "/etc/ssl/certs/ca-certificates.crt" ];
47 sslCertPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/cert.pem";
48 sslKeyPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/key.pem";
49 dhParamPath = config.security.dhparams.params.hedgedoc.path;
50 };
51 };
52
53 systemd.services.hedgedoc.serviceConfig.SystemCallFilter = [
54 "fchown"
55 ];
56 systemd.services.hedgedoc.serviceConfig.MemoryMax = "1G";
57 systemd.services.hedgedoc.serviceConfig.Restart = "always";
58 systemd.services.hedgedoc.environment.NODE_OPTIONS = "--max-old-space-size=512";
59
60 systemd.services.hedgedoc.serviceConfig.EnvironmentFile = [
61 config.clan.core.vars.generators.hedgedoc.files."hedgedoc.env".path
62 ];
63 clan.core.vars.generators.hedgedoc = {
64 files."hedgedoc.env" = { };
65 runtimeInputs = [ pkgs.pwgen ];
66 script = ''
67 pwgen -s 64 1 > session_secret
68 cat >> "$out/hedgedoc.env" <<EOF
69 CMD_SESSION_SECRET=$(cat session_secret)
70 EOF
71 '';
72 };
73
74 services.nginx.virtualHosts.${config.clan.hedgedoc.domain} = {
75 enableACME = true;
76 forceSSL = true;
77 locations."/" = {
78 # proxyPass = "https://localhost:3091";
79 proxyPass = "https://localhost:${toString config.services.hedgedoc.settings.port}";
80 recommendedProxySettings = true;
81 # proxyWebsockets = true;
82 };
83 locations."/socket.io/" = {
84 # proxyPass = "https://localhost:3091";
85 proxyPass = "https://localhost:${toString config.services.hedgedoc.settings.port}";
86 recommendedProxySettings = true;
87 proxyWebsockets = true;
88 };
89 };
90
91 };
92}