This repository has no description
1{
2 lib,
3 config,
4 pkgs,
5 ...
6}:
7{
8 options.clan.hedgedoc = {
9 domain = lib.mkOption {
10 type = lib.types.str;
11 description = "The domain of the hedgedoc instance.";
12 };
13 };
14 config = {
15
16 security.acme.certs.${config.clan.hedgedoc.domain}.group = "hedgecert";
17 users.groups.hedgecert.members = [
18 "hedgedoc"
19 "nginx"
20 ];
21
22 services.hedgedoc = {
23 enable = true;
24 # Adds the krebspaste upload type (images to p.krebsco.de/image, other
25 # files as pastes to p.krebsco.de, GCed after 30 days),
26 # allowedUploadMimeTypes = [ "*" ] for any file type, and links
27 # non-image uploads as [name](url) instead of embedding them.
28 package = pkgs.hedgedoc.overrideAttrs (old: {
29 patches = (old.patches or [ ]) ++ [ ./upload-any-file.patch ];
30 });
31 settings = {
32 allowOrigin = [
33 "localhost"
34 config.clan.hedgedoc.domain
35 ];
36 useCDN = true;
37 port = 3091;
38 domain = config.clan.hedgedoc.domain;
39 allowFreeURL = true;
40 defaultPermission = "freely";
41 # No "you are leaving HedgeDoc" interstitial on external links.
42 externalLinkWarning = false;
43 allowedUploadMimeTypes = [ "*" ];
44 imageUploadType = "krebspaste";
45 # debug = true;
46 # useSSL = true;
47 # hsts.enable = false;
48 # protocolUseSSL = true;
49
50 useSSL = true;
51 protocolUseSSL = true;
52 sslCAPath = [ "/etc/ssl/certs/ca-certificates.crt" ];
53 sslCertPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/cert.pem";
54 sslKeyPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/key.pem";
55 dhParamPath = "/var/lib/dhparams/hedgedoc.pem";
56 };
57 };
58
59 # security.dhparams was removed from nixpkgs (RFC 7919), but HedgeDoc's
60 # HTTPS listener unconditionally reads dhParamPath. Generate the params
61 # ourselves if missing so the service stays self-contained.
62 systemd.services.hedgedoc.serviceConfig.ExecStartPre = [
63 (
64 "+"
65 + pkgs.writeShellScript "hedgedoc-dhparam" ''
66 set -eu
67 if [ ! -s /var/lib/dhparams/hedgedoc.pem ]; then
68 mkdir -p /var/lib/dhparams
69 ${pkgs.openssl}/bin/openssl dhparam -out /var/lib/dhparams/hedgedoc.pem 2048
70 chmod 644 /var/lib/dhparams/hedgedoc.pem
71 fi
72 ''
73 )
74 ];
75
76 systemd.services.hedgedoc.serviceConfig.SystemCallFilter = [
77 "fchown"
78 ];
79 systemd.services.hedgedoc.serviceConfig.MemoryMax = "1G";
80 systemd.services.hedgedoc.serviceConfig.Restart = "always";
81 systemd.services.hedgedoc.environment.NODE_OPTIONS = "--max-old-space-size=512";
82
83 lass.backup.state.hedgedoc = {
84 folders = [ config.services.hedgedoc.settings.uploadsPath ];
85 # The database uses a rollback journal and is written often during the
86 # day, so the dump waits for its locks instead of failing.
87 preBackup = ''
88 ${pkgs.sqlite}/bin/sqlite3 -cmd ".timeout 60000" /var/lib/hedgedoc/db.sqlite ".backup /var/backup/hedgedoc.sqlite"
89 '';
90 readWritePaths = [ "/var/lib/hedgedoc" ];
91 };
92
93 systemd.services.hedgedoc.serviceConfig.EnvironmentFile = [
94 config.clan.core.vars.generators.hedgedoc.files."hedgedoc.env".path
95 ];
96 clan.core.vars.generators.hedgedoc = {
97 files."hedgedoc.env" = { };
98 runtimeInputs = [ pkgs.pwgen ];
99 script = ''
100 pwgen -s 64 1 > session_secret
101 cat >> "$out/hedgedoc.env" <<EOF
102 CMD_SESSION_SECRET=$(cat session_secret)
103 EOF
104 '';
105 };
106
107 services.nginx.virtualHosts.${config.clan.hedgedoc.domain} = {
108 enableACME = true;
109 forceSSL = true;
110 locations."/" = {
111 # proxyPass = "https://localhost:3091";
112 proxyPass = "https://localhost:${toString config.services.hedgedoc.settings.port}";
113 recommendedProxySettings = true;
114 # proxyWebsockets = true;
115 };
116 locations."/socket.io/" = {
117 # proxyPass = "https://localhost:3091";
118 proxyPass = "https://localhost:${toString config.services.hedgedoc.settings.port}";
119 recommendedProxySettings = true;
120 proxyWebsockets = true;
121 };
122 };
123
124 };
125}