This repository has no description
3.1 kB
113 lines
1let
2 domain = "book.lassul.us";
3 port = 8772;
4in
5{
6 config,
7 lib,
8 pkgs,
9 self,
10 ...
11}:
12let
13 settings = {
14 listen = "127.0.0.1:${toString port}";
15 baseUrl = "https://${domain}";
16 owner = "lassulus";
17 intro = "Pick a time for a call: nix, nixos, infrastructure, or anything else.";
18 timezone = "Europe/Berlin";
19 eventTypes = [
20 {
21 slug = "30min";
22 title = "30 minute call";
23 minutes = 30;
24 }
25 {
26 slug = "60min";
27 title = "1 hour call";
28 minutes = 60;
29 }
30 ];
31 hours = lib.genAttrs [ "mon" "tue" "wed" "thu" "fri" ] (_: [ "10:00-18:00" ]);
32 slotStep = 30;
33 bufferMinutes = 15;
34 minNoticeHours = 24;
35 horizonDays = 28;
36 # Free/busy is read from every calendar of this radicale user; requests
37 # and bookings are written to its `calendar` collection (created on demand).
38 caldav = {
39 url = "http://127.0.0.1:5232";
40 user = "lass";
41 calendar = "bookings";
42 };
43 # Local postfix (configs/mailserver.nix) accepts from localhost and DKIM-signs.
44 smtp = {
45 host = "127.0.0.1";
46 port = 25;
47 from = "book@lassul.us";
48 notify = "lass@lassul.us";
49 };
50 database = "/var/lib/book/book.db";
51 };
52in
53{
54 # book: request-and-approve booking page (tools/book). Requests land in
55 # radicale (configs/radicale.nix) as TENTATIVE events and in lass's inbox
56 # with an approve link.
57 systemd.services.book = {
58 description = "book.lassul.us booking page";
59 wantedBy = [ "multi-user.target" ];
60 wants = [ "radicale.service" ];
61 after = [
62 "network.target"
63 "radicale.service"
64 ];
65 serviceConfig = {
66 ExecStart = lib.escapeShellArgs [
67 (lib.getExe self.packages.${pkgs.stdenv.hostPlatform.system}.book)
68 "--config"
69 (pkgs.writeText "book.json" (builtins.toJSON settings))
70 "--caldav-password-file"
71 "%d/caldav-password"
72 ];
73 LoadCredential = "caldav-password:${
74 config.clan.core.vars.generators.radicale-lass.files."password".path
75 }";
76 DynamicUser = true;
77 StateDirectory = "book";
78 Restart = "on-failure";
79 CapabilityBoundingSet = "";
80 NoNewPrivileges = true;
81 PrivateDevices = true;
82 PrivateTmp = true;
83 ProtectHome = true;
84 ProtectSystem = "strict";
85 ProtectKernelTunables = true;
86 ProtectKernelModules = true;
87 ProtectControlGroups = true;
88 RestrictAddressFamilies = [
89 "AF_INET"
90 "AF_INET6"
91 "AF_UNIX"
92 ];
93 RestrictNamespaces = true;
94 LockPersonality = true;
95 SystemCallArchitectures = "native";
96 };
97 };
98
99 services.nginx.virtualHosts.${domain} = {
100 enableACME = true;
101 forceSSL = true;
102 locations."/" = {
103 proxyPass = "http://127.0.0.1:${toString port}";
104 # book rate-limits per X-Real-IP; set it from the socket, never from
105 # a client-supplied header.
106 extraConfig = ''
107 proxy_set_header Host $host;
108 proxy_set_header X-Real-IP $remote_addr;
109 client_max_body_size 16k;
110 '';
111 };
112 };
113}