This repository has no description
3.8 kB
115 lines
1{
2 lib,
3 config,
4 pkgs,
5 ...
6}:
7{
8 options.clan.hedgedoc = {
9 domain = lib.mkOption {
10 type = lib.types.str;
11 description = "The domain of the hedgedoc instance.";
12 };
13 };
14 config = {
15
16 security.acme.certs.${config.clan.hedgedoc.domain}.group = "hedgecert";
17 users.groups.hedgecert.members = [
18 "hedgedoc"
19 "nginx"
20 ];
21
22 services.hedgedoc = {
23 enable = true;
24 # Adds the krebspaste upload type (images to p.krebsco.de/image, other
25 # files as pastes to p.krebsco.de, GCed after 30 days),
26 # allowedUploadMimeTypes = [ "*" ] for any file type, and links
27 # non-image uploads as [name](url) instead of embedding them.
28 package = pkgs.hedgedoc.overrideAttrs (old: {
29 patches = (old.patches or [ ]) ++ [ ./upload-any-file.patch ];
30 });
31 settings = {
32 allowOrigin = [
33 "localhost"
34 config.clan.hedgedoc.domain
35 ];
36 useCDN = true;
37 port = 3091;
38 domain = config.clan.hedgedoc.domain;
39 allowFreeURL = true;
40 defaultPermission = "freely";
41 # No "you are leaving HedgeDoc" interstitial on external links.
42 externalLinkWarning = false;
43 allowedUploadMimeTypes = [ "*" ];
44 imageUploadType = "krebspaste";
45 # debug = true;
46 # useSSL = true;
47 # hsts.enable = false;
48 # protocolUseSSL = true;
49
50 useSSL = true;
51 protocolUseSSL = true;
52 sslCAPath = [ "/etc/ssl/certs/ca-certificates.crt" ];
53 sslCertPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/cert.pem";
54 sslKeyPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/key.pem";
55 dhParamPath = "/var/lib/dhparams/hedgedoc.pem";
56 };
57 };
58
59 # security.dhparams was removed from nixpkgs (RFC 7919), but HedgeDoc's
60 # HTTPS listener unconditionally reads dhParamPath. Generate the params
61 # ourselves if missing so the service stays self-contained.
62 systemd.services.hedgedoc.serviceConfig.ExecStartPre = [
63 (
64 "+"
65 + pkgs.writeShellScript "hedgedoc-dhparam" ''
66 set -eu
67 if [ ! -s /var/lib/dhparams/hedgedoc.pem ]; then
68 mkdir -p /var/lib/dhparams
69 ${pkgs.openssl}/bin/openssl dhparam -out /var/lib/dhparams/hedgedoc.pem 2048
70 chmod 644 /var/lib/dhparams/hedgedoc.pem
71 fi
72 ''
73 )
74 ];
75
76 systemd.services.hedgedoc.serviceConfig.SystemCallFilter = [
77 "fchown"
78 ];
79 systemd.services.hedgedoc.serviceConfig.MemoryMax = "1G";
80 systemd.services.hedgedoc.serviceConfig.Restart = "always";
81 systemd.services.hedgedoc.environment.NODE_OPTIONS = "--max-old-space-size=512";
82
83 systemd.services.hedgedoc.serviceConfig.EnvironmentFile = [
84 config.clan.core.vars.generators.hedgedoc.files."hedgedoc.env".path
85 ];
86 clan.core.vars.generators.hedgedoc = {
87 files."hedgedoc.env" = { };
88 runtimeInputs = [ pkgs.pwgen ];
89 script = ''
90 pwgen -s 64 1 > session_secret
91 cat >> "$out/hedgedoc.env" <<EOF
92 CMD_SESSION_SECRET=$(cat session_secret)
93 EOF
94 '';
95 };
96
97 services.nginx.virtualHosts.${config.clan.hedgedoc.domain} = {
98 enableACME = true;
99 forceSSL = true;
100 locations."/" = {
101 # proxyPass = "https://localhost:3091";
102 proxyPass = "https://localhost:${toString config.services.hedgedoc.settings.port}";
103 recommendedProxySettings = true;
104 # proxyWebsockets = true;
105 };
106 locations."/socket.io/" = {
107 # proxyPass = "https://localhost:3091";
108 proxyPass = "https://localhost:${toString config.services.hedgedoc.settings.port}";
109 recommendedProxySettings = true;
110 proxyWebsockets = true;
111 };
112 };
113
114 };
115}