This repository has no description
3.2 kB
115 lines
1let
2 domain = "book.lassul.us";
3 port = 8772;
4in
5{
6 config,
7 lib,
8 pkgs,
9 self,
10 ...
11}:
12let
13 settings = {
14 listen = "127.0.0.1:${toString port}";
15 baseUrl = "https://${domain}";
16 owner = "lassulus";
17 intro = "Pick a time for a call: nix, nixos, infrastructure, or anything else.";
18 timezone = "Europe/Berlin";
19 eventTypes = [
20 {
21 slug = "30min";
22 title = "30 minute call";
23 minutes = 30;
24 }
25 {
26 slug = "60min";
27 title = "1 hour call";
28 minutes = 60;
29 }
30 ];
31 hours = lib.genAttrs [ "mon" "tue" "wed" "thu" "fri" ] (_: [ "10:00-18:00" ]);
32 slotStep = 30;
33 bufferMinutes = 15;
34 minNoticeHours = 24;
35 horizonDays = 28;
36 # lass/calendar is the only calendar (configs/radicale.nix): free/busy is
37 # read from it, and requests and bookings are mirrored into it, next to
38 # lass's own events and whatever Hermes adds. Book reads its events back:
39 # deleting, moving or confirming one there manages the booking.
40 caldav = {
41 url = "http://127.0.0.1:5232";
42 user = "lass";
43 calendar = "calendar";
44 };
45 # Local postfix (configs/mailserver.nix) accepts from localhost and DKIM-signs.
46 smtp = {
47 host = "127.0.0.1";
48 port = 25;
49 from = "book@lassul.us";
50 notify = "lass@lassul.us";
51 };
52 database = "/var/lib/book/book.db";
53 };
54in
55{
56 # book: request-and-approve booking page (tools/book). Requests land in
57 # radicale (configs/radicale.nix) as TENTATIVE events and in lass's inbox
58 # with an approve link.
59 systemd.services.book = {
60 description = "book.lassul.us booking page";
61 wantedBy = [ "multi-user.target" ];
62 wants = [ "radicale.service" ];
63 after = [
64 "network.target"
65 "radicale.service"
66 ];
67 serviceConfig = {
68 ExecStart = lib.escapeShellArgs [
69 (lib.getExe self.packages.${pkgs.stdenv.hostPlatform.system}.book)
70 "--config"
71 (pkgs.writeText "book.json" (builtins.toJSON settings))
72 "--caldav-password-file"
73 "%d/caldav-password"
74 ];
75 LoadCredential = "caldav-password:${
76 config.clan.core.vars.generators.radicale-lass.files."password".path
77 }";
78 DynamicUser = true;
79 StateDirectory = "book";
80 Restart = "on-failure";
81 CapabilityBoundingSet = "";
82 NoNewPrivileges = true;
83 PrivateDevices = true;
84 PrivateTmp = true;
85 ProtectHome = true;
86 ProtectSystem = "strict";
87 ProtectKernelTunables = true;
88 ProtectKernelModules = true;
89 ProtectControlGroups = true;
90 RestrictAddressFamilies = [
91 "AF_INET"
92 "AF_INET6"
93 "AF_UNIX"
94 ];
95 RestrictNamespaces = true;
96 LockPersonality = true;
97 SystemCallArchitectures = "native";
98 };
99 };
100
101 services.nginx.virtualHosts.${domain} = {
102 enableACME = true;
103 forceSSL = true;
104 locations."/" = {
105 proxyPass = "http://127.0.0.1:${toString port}";
106 # book rate-limits per X-Real-IP; set it from the socket, never from
107 # a client-supplied header.
108 extraConfig = ''
109 proxy_set_header Host $host;
110 proxy_set_header X-Real-IP $remote_addr;
111 client_max_body_size 16k;
112 '';
113 };
114 };
115}