nix

etherpad.nix (5819B)

---

 {
   config,
   lib,
   pkgs,
   haravara,
   ...
 }: let
   cfg = config.services.haravara.etherpad;
   stateDir = "/var/lib/etherpad";
 in {
   options.services.haravara.etherpad = {
     enable = lib.mkEnableOption "Etherpad collaborative editor";
 
     domain = lib.mkOption {
       type = lib.types.str;
       description = "Public domain for the Etherpad instance";
     };
 
     port = lib.mkOption {
       type = lib.types.port;
       default = 9090;
       description = "Local TCP port for Etherpad to listen on";
     };
 
     image = lib.mkOption {
       type = lib.types.str;
       default = "etherpad/etherpad@sha256:044e5b58686f22e2c8b792ed0a7c35a83986458e1ee91f12119276c1e2572bce";
       description = "OCI image reference (pinned by digest) for Etherpad";
     };
 
     title = lib.mkOption {
       type = lib.types.str;
       default = "Etherpad";
       description = "Title shown in the Etherpad UI";
     };
 
     adminPasswordFile = lib.mkOption {
       type = lib.types.nullOr lib.types.path;
       default = null;
       description = "Path to a file containing the admin user password. If null, no admin user is created.";
     };
 
     userPasswordFile = lib.mkOption {
       type = lib.types.nullOr lib.types.path;
       default = null;
       description = "Path to a file containing the shared non-admin user password. If null, no user account is created.";
     };
 
     dbType = lib.mkOption {
       type = lib.types.str;
       default = "sqlite";
       description = "UeberDB database driver (e.g. dirty, sqlite, postgres, mysql)";
     };
 
     dbFilename = lib.mkOption {
       type = lib.types.str;
       default = "etherpad.sqlite3";
       description = "Database filename when dbType is sqlite or dirty, relative to the state directory";
     };
 
     extraEnvironment = lib.mkOption {
       type = lib.types.attrsOf lib.types.str;
       default = {};
       description = "Additional environment variables passed to the Etherpad container";
     };
 
     authLabel = haravara.authLabelOption;
   };
 
   config = lib.mkIf cfg.enable {
     # The Etherpad container image runs as UID 5001 (user "etherpad", group 0).
     # Match that ownership on the host bind-mount so the process can read/write.
     systemd = {
       tmpfiles.rules = [
         "d ${stateDir} 0750 5001 0 -"
       ];
 
       services.etherpad-init-state = {
         description = "Ensure Etherpad state directory ownership";
         before = ["podman-etherpad.service"];
         requiredBy = ["podman-etherpad.service"];
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
           User = "root";
           Group = "root";
           ExecStart = pkgs.writeShellScript "etherpad-init-state" ''
             set -euo pipefail
             install -d -m 0750 -o 5001 -g 0 ${stateDir}
           '';
         };
       };
     };
 
     virtualisation.oci-containers = {
       backend = "podman";
 
       containers.etherpad = {
         inherit (cfg) image;
         autoStart = true;
         ports = ["127.0.0.1:${toString cfg.port}:9001"];
         volumes = [
           "${stateDir}:/opt/etherpad-lite/var:Z"
         ];
         environment =
           {
             TITLE = cfg.title;
             PORT = "9001";
             IP = "0.0.0.0";
             TRUST_PROXY = "true";
             DB_TYPE = cfg.dbType;
             DB_FILENAME = "/opt/etherpad-lite/var/${cfg.dbFilename}";
             LOGLEVEL = "INFO";
             DISABLE_IP_LOGGING = "true";
             SHOW_SETTINGS_IN_ADMIN_PAGE = "false";
             SKIN_NAME = "colibris";
             SKIN_VARIANTS = "super-light-toolbar super-light-editor light-background";
             DEFAULT_PAD_TEXT = "Welcome to Etherpad!\n\nThis pad text is synchronized as you type, so that everyone viewing this page sees the same text. This allows you to collaborate seamlessly on documents!";
             SHOW_RECENT_PADS = "false";
             REQUIRE_AUTHENTICATION = "true";
             REQUIRE_AUTHORIZATION = "false";
             EDIT_ONLY = "true";
             AUTHENTICATION_METHOD = "apikey";
           }
           // cfg.extraEnvironment;
         environmentFiles = lib.optionals (cfg.adminPasswordFile != null || cfg.userPasswordFile != null) [
           "/run/etherpad-admin-password.env"
         ];
       };
     };
 
     systemd.services = {
       etherpad-init-password = lib.mkIf (cfg.adminPasswordFile != null || cfg.userPasswordFile != null) {
         description = "Prepare Etherpad password environment file";
         before = ["podman-etherpad.service"];
         requiredBy = ["podman-etherpad.service"];
         unitConfig = {};
         serviceConfig = {
           Type = "oneshot";
           RemainAfterExit = true;
           User = "root";
           Group = "root";
           PrivateTmp = true;
           UMask = "0077";
           ExecStart = pkgs.writeShellScript "etherpad-init-password" ''
             set -euo pipefail
             : > /run/etherpad-admin-password.env
             ${lib.optionalString (cfg.adminPasswordFile != null) ''
               pass="$(cat ${lib.escapeShellArg cfg.adminPasswordFile})"
               printf 'ADMIN_PASSWORD=%s\n' "$pass" >> /run/etherpad-admin-password.env
             ''}
             ${lib.optionalString (cfg.userPasswordFile != null) ''
               pass="$(cat ${lib.escapeShellArg cfg.userPasswordFile})"
               printf 'USER_PASSWORD=%s\n' "$pass" >> /run/etherpad-admin-password.env
             ''}
             chmod 600 /run/etherpad-admin-password.env
           '';
         };
       };
 
       podman-etherpad = {
         after = ["etherpad-init-state.service"];
         requires = ["etherpad-init-state.service"];
       };
     };
 
     services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
       ${haravara.mkAuthImport cfg.authLabel}
       reverse_proxy 127.0.0.1:${toString cfg.port}
     '';
   };
 }