This repository has no description
1.2 kB
43 lines
1{
2 config,
3 pkgs,
4 ...
5}:
6{
7 services.docuseal = {
8 enable = true;
9 host = "127.0.0.1";
10 port = 3200;
11 };
12
13 clan.core.vars.generators.docuseal = {
14 files.secret-key-base = { };
15 runtimeInputs = [ pkgs.openssl ];
16 script = ''
17 openssl rand -hex 64 | tr -d '\n' > $out/secret-key-base
18 '';
19 };
20
21 services.docuseal.secretKeyBaseFile = "/run/credentials/docuseal.service/secret-key-base";
22
23 systemd.services.docuseal.serviceConfig = {
24 LoadCredential = "secret-key-base:${config.clan.core.vars.generators.docuseal.files.secret-key-base.path}";
25 # relax syscall filter — Rails/Ruby needs more syscalls than the default allows
26 SystemCallFilter = pkgs.lib.mkForce [ ];
27 SystemCallArchitectures = pkgs.lib.mkForce "";
28 };
29
30 services.nginx.virtualHosts."docuseal.lassul.us" = {
31 enableACME = true;
32 forceSSL = true;
33 locations."/" = {
34 proxyPass = "http://127.0.0.1:${toString config.services.docuseal.port}";
35 proxyWebsockets = true;
36 extraConfig = ''
37 proxy_set_header Host $host;
38 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
39 proxy_set_header X-Forwarded-Proto $scheme;
40 '';
41 };
42 };
43}