This repository has no description
3.5 kB
113 lines
1{
2 self,
3 config,
4 lib,
5 pkgs,
6 ...
7}:
8let
9 # nixpkgs marks radicle-node insecure: private repos are not encrypted
10 # between nodes. Clear the flag on the package we use instead of allowing
11 # it globally.
12 radicle-node = self.lib.secureify pkgs.radicle-node;
13in
14{
15 # Generate Radicle identity keys using clan vars
16 clan.core.vars.generators.radicle = {
17 files."radicle.key" = { };
18 files."radicle.pub".secret = false;
19 runtimeInputs = [ pkgs.openssh ];
20 script = ''
21 ssh-keygen -t ed25519 -N "" -C "radicle" -f "$out/radicle.key"
22 mv "$out/radicle.key.pub" "$out/radicle.pub"
23 '';
24 };
25
26 services.radicle = {
27 enable = true;
28 package = radicle-node;
29 # The module's checkConfig runs `rad config` from
30 # pkgs.buildPackages.radicle-node, not cfg.package, which trips the
31 # insecure check. Same validation, against our package.
32 configFile = lib.mkForce (
33 pkgs.runCommand "config.json"
34 {
35 nativeBuildInputs = [ (self.lib.secureify pkgs.buildPackages.radicle-node) ];
36 json = builtins.toJSON config.services.radicle.settings;
37 passAsFile = [ "json" ];
38 preferLocalBuild = true;
39 }
40 ''
41 install -D -m 644 "$jsonPath" $out
42 ln -s $out config.json
43 install -D -m 644 /dev/stdin keys/radicle.pub <<<"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBgFMhajUng+Rjj/sCFXI9PzG8BQjru2n7JgUVF1Kbv5 snakeoil"
44 RAD_HOME=$PWD rad config >/dev/null
45 ''
46 );
47 privateKey = config.clan.core.vars.generators.radicle.files."radicle.key".path;
48 publicKey = config.clan.core.vars.generators.radicle.files."radicle.pub".path;
49
50 node.openFirewall = true;
51
52 httpd = {
53 enable = true;
54 # The default 8080 is taken on neoprism by jitsi-videobridge's REST
55 # API (Jetty, 127.0.0.1:8080): radicle-httpd died with "Address
56 # already in use" on every restart and nginx proxied
57 # radicle.lassul.us to Jetty's 404 page instead.
58 listenPort = 8778;
59 nginx = {
60 serverName = "radicle.lassul.us";
61 enableACME = true;
62 forceSSL = true;
63 };
64 };
65
66 settings = {
67 publicExplorer = "https://app.radicle.xyz/nodes/$host/$rid$path";
68 preferredSeeds = [
69 "z6MkrLMMsiPWUcNPHcRajuMi9mDfYckSoJyPwwnknocNYPm7@seed.radicle.xyz:8776"
70 "z6Mkmqogy2qEM2ummccUthFEaaHvyYmYBYh3dbe9W4ebScxo@iris.radicle.network:8776"
71 ];
72 web.pinned.repositories = [ ];
73 cli.hints = true;
74 node = {
75 alias = config.networking.hostName;
76 listen = [ "0.0.0.0:8776" ];
77 peers.type = "dynamic";
78 connect = [ ];
79 externalAddresses = [ "radicle.lassul.us:8776" ];
80 network = "main";
81 log = "INFO";
82 relay = "auto";
83 limits = {
84 routingMaxSize = 1000;
85 routingMaxAge = 604800;
86 gossipMaxAge = 1209600;
87 fetchConcurrency = 1;
88 maxOpenFiles = 4096;
89 rate = {
90 inbound = {
91 fillRate = 5.0;
92 capacity = 1024;
93 };
94 outbound = {
95 fillRate = 10.0;
96 capacity = 2048;
97 };
98 };
99 connection = {
100 inbound = 128;
101 outbound = 16;
102 };
103 fetchPackReceive = "500.0 MiB";
104 };
105 workers = 8;
106 seedingPolicy = {
107 default = "allow";
108 scope = "all";
109 };
110 };
111 };
112 };
113}