This repository has no description
neoprism: add docuseal.lassul.us for document signing
author
lassulus
date
(Mar 21, 2026, 7:12 PM CET)
commit
ea74e846
ea74e84683d19b7c9014f9c5f26f027acd8189ec
parent
b0393e9a
b0393e9adff1a99b8d2258d90e1ebe2be981d041
+46
+43
2configs/docuseal.nix
+43
2configs/docuseal.nix
···
1
+
{
2
+
config,
3
+
pkgs,
4
+
...
5
+
}:
6
+
{
7
+
services.docuseal = {
8
+
enable = true;
9
+
host = "127.0.0.1";
10
+
port = 3200;
11
+
};
12
+
13
+
clan.core.vars.generators.docuseal = {
14
+
files.secret-key-base = { };
15
+
runtimeInputs = [ pkgs.openssl ];
16
+
script = ''
17
+
openssl rand -hex 64 | tr -d '\n' > $out/secret-key-base
18
+
'';
19
+
};
20
+
21
+
services.docuseal.secretKeyBaseFile = "/run/credentials/docuseal.service/secret-key-base";
22
+
23
+
systemd.services.docuseal.serviceConfig = {
24
+
LoadCredential = "secret-key-base:${config.clan.core.vars.generators.docuseal.files.secret-key-base.path}";
25
+
# relax syscall filter — Rails/Ruby needs more syscalls than the default allows
26
+
SystemCallFilter = pkgs.lib.mkForce [ ];
27
+
SystemCallArchitectures = pkgs.lib.mkForce "";
28
+
};
29
+
30
+
services.nginx.virtualHosts."docuseal.lassul.us" = {
31
+
enableACME = true;
32
+
forceSSL = true;
33
+
locations."/" = {
34
+
proxyPass = "http://127.0.0.1:${toString config.services.docuseal.port}";
35
+
proxyWebsockets = true;
36
+
extraConfig = ''
37
+
proxy_set_header Host $host;
38
+
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
39
+
proxy_set_header X-Forwarded-Proto $scheme;
40
+
'';
41
+
};
42
+
};
43
+
}