This repository has no description
3.2 kB
104 lines
1{
2 lib,
3 config,
4 pkgs,
5 ...
6}:
7{
8 options.clan.hedgedoc = {
9 domain = lib.mkOption {
10 type = lib.types.str;
11 description = "The domain of the hedgedoc instance.";
12 };
13 };
14 config = {
15
16 security.acme.certs.${config.clan.hedgedoc.domain}.group = "hedgecert";
17 users.groups.hedgecert.members = [
18 "hedgedoc"
19 "nginx"
20 ];
21
22 services.hedgedoc = {
23 enable = true;
24 settings = {
25 allowOrigin = [
26 "localhost"
27 config.clan.hedgedoc.domain
28 ];
29 useCDN = true;
30 port = 3091;
31 domain = config.clan.hedgedoc.domain;
32 allowFreeURL = true;
33 defaultPermission = "freely";
34 # debug = true;
35 # useSSL = true;
36 # hsts.enable = false;
37 # protocolUseSSL = true;
38
39 useSSL = true;
40 protocolUseSSL = true;
41 sslCAPath = [ "/etc/ssl/certs/ca-certificates.crt" ];
42 sslCertPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/cert.pem";
43 sslKeyPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/key.pem";
44 dhParamPath = "/var/lib/dhparams/hedgedoc.pem";
45 };
46 };
47
48 # security.dhparams was removed from nixpkgs (RFC 7919), but HedgeDoc's
49 # HTTPS listener unconditionally reads dhParamPath. Generate the params
50 # ourselves if missing so the service stays self-contained.
51 systemd.services.hedgedoc.serviceConfig.ExecStartPre = [
52 (
53 "+"
54 + pkgs.writeShellScript "hedgedoc-dhparam" ''
55 set -eu
56 if [ ! -s /var/lib/dhparams/hedgedoc.pem ]; then
57 mkdir -p /var/lib/dhparams
58 ${pkgs.openssl}/bin/openssl dhparam -out /var/lib/dhparams/hedgedoc.pem 2048
59 chmod 644 /var/lib/dhparams/hedgedoc.pem
60 fi
61 ''
62 )
63 ];
64
65 systemd.services.hedgedoc.serviceConfig.SystemCallFilter = [
66 "fchown"
67 ];
68 systemd.services.hedgedoc.serviceConfig.MemoryMax = "1G";
69 systemd.services.hedgedoc.serviceConfig.Restart = "always";
70 systemd.services.hedgedoc.environment.NODE_OPTIONS = "--max-old-space-size=512";
71
72 systemd.services.hedgedoc.serviceConfig.EnvironmentFile = [
73 config.clan.core.vars.generators.hedgedoc.files."hedgedoc.env".path
74 ];
75 clan.core.vars.generators.hedgedoc = {
76 files."hedgedoc.env" = { };
77 runtimeInputs = [ pkgs.pwgen ];
78 script = ''
79 pwgen -s 64 1 > session_secret
80 cat >> "$out/hedgedoc.env" <<EOF
81 CMD_SESSION_SECRET=$(cat session_secret)
82 EOF
83 '';
84 };
85
86 services.nginx.virtualHosts.${config.clan.hedgedoc.domain} = {
87 enableACME = true;
88 forceSSL = true;
89 locations."/" = {
90 # proxyPass = "https://localhost:3091";
91 proxyPass = "https://localhost:${toString config.services.hedgedoc.settings.port}";
92 recommendedProxySettings = true;
93 # proxyWebsockets = true;
94 };
95 locations."/socket.io/" = {
96 # proxyPass = "https://localhost:3091";
97 proxyPass = "https://localhost:${toString config.services.hedgedoc.settings.port}";
98 recommendedProxySettings = true;
99 proxyWebsockets = true;
100 };
101 };
102
103 };
104}