This repository has no description
2.4 kB
89 lines
1{
2 lib,
3 config,
4 pkgs,
5 ...
6}:
7{
8 options.clan.hedgedoc = {
9 domain = lib.mkOption {
10 type = lib.types.str;
11 description = "The domain of the hedgedoc instance.";
12 };
13 };
14 config = {
15
16 security.acme.certs.${config.clan.hedgedoc.domain}.group = "hedgecert";
17 users.groups.hedgecert.members = [
18 "hedgedoc"
19 "nginx"
20 ];
21
22 security.dhparams = {
23 enable = true;
24 params.hedgedoc = { };
25 };
26
27 services.hedgedoc = {
28 enable = true;
29 settings = {
30 allowOrigin = [
31 "localhost"
32 config.clan.hedgedoc.domain
33 ];
34 useCDN = true;
35 port = 3091;
36 domain = config.clan.hedgedoc.domain;
37 allowFreeURL = true;
38 defaultPermission = "freely";
39 # debug = true;
40 # useSSL = true;
41 # hsts.enable = false;
42 # protocolUseSSL = true;
43
44 useSSL = true;
45 protocolUseSSL = true;
46 sslCAPath = [ "/etc/ssl/certs/ca-certificates.crt" ];
47 sslCertPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/cert.pem";
48 sslKeyPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/key.pem";
49 dhParamPath = config.security.dhparams.params.hedgedoc.path;
50 };
51 };
52
53 systemd.services.hedgedoc.serviceConfig.SystemCallFilter = [
54 "fchown"
55 ];
56
57 systemd.services.hedgedoc.serviceConfig.EnvironmentFile = [
58 config.clan.core.vars.generators.hedgedoc.files."hedgedoc.env".path
59 ];
60 clan.core.vars.generators.hedgedoc = {
61 files."hedgedoc.env" = { };
62 runtimeInputs = [ pkgs.pwgen ];
63 script = ''
64 pwgen -s 64 1 > session_secret
65 cat >> "$out/hedgedoc.env" <<EOF
66 CMD_SESSION_SECRET=$(cat session_secret)
67 EOF
68 '';
69 };
70
71 services.nginx.virtualHosts.${config.clan.hedgedoc.domain} = {
72 enableACME = true;
73 forceSSL = true;
74 locations."/" = {
75 # proxyPass = "https://localhost:3091";
76 proxyPass = "https://localhost:${toString config.services.hedgedoc.settings.port}";
77 recommendedProxySettings = true;
78 # proxyWebsockets = true;
79 };
80 locations."/socket.io/" = {
81 # proxyPass = "https://localhost:3091";
82 proxyPass = "https://localhost:${toString config.services.hedgedoc.settings.port}";
83 recommendedProxySettings = true;
84 proxyWebsockets = true;
85 };
86 };
87
88 };
89}