nix

configuration files that power my machines
Log | Files | Refs | README | LICENSE

shaarli.nix (4563B)

      1 {
      2   config,
      3   lib,
      4   pkgs,
      5   haravara,
      6   ...
      7 }: let
      8   cfg = config.services.haravara.shaarli;
      9   stateDir = "/var/lib/shaarli";
     10   webRoot = "${stateDir}/www";
     11   user = "shaarli";
     12   group = "shaarli";
     13   pool = "shaarli";
     14   socket = "/run/phpfpm/${pool}.sock";
     15 
     16   phpWithExtensions = pkgs.php.withExtensions ({
     17     enabled,
     18     all,
     19   }:
     20     enabled
     21     ++ [
     22       all.curl
     23       all.gd
     24       all.gettext
     25       all.intl
     26       all.mbstring
     27       all.zlib
     28     ]);
     29 
     30   theme = pkgs.fetchFromGitHub {
     31     owner = "ManufacturaInd";
     32     repo = "shaarli-2004licious-theme";
     33     rev = "075833c547c6ca281e7ad31591f5ab0e9a99efcc";
     34     sha256 = "16qzzshlyhdrawa3g8jg22j2fb6acmd0smg0ca5ilhjxakip3h81";
     35   };
     36 in {
     37   options.services.haravara.shaarli = {
     38     enable = lib.mkEnableOption "Shaarli bookmark manager";
     39     domain = lib.mkOption {
     40       type = lib.types.str;
     41     };
     42     authLabel = haravara.authLabelOption;
     43   };
     44 
     45   config = lib.mkIf cfg.enable {
     46     users.users.${user} = {
     47       isSystemUser = true;
     48       inherit group;
     49       home = stateDir;
     50       createHome = false;
     51     };
     52     users.groups.${group} = {};
     53 
     54     systemd.tmpfiles.rules = [
     55       "d ${stateDir} 0755 ${user} ${group} -"
     56     ];
     57 
     58     systemd.services.shaarli-init = {
     59       description = "Initialize Shaarli webroot";
     60       after = ["systemd-tmpfiles-setup.service"];
     61       before = ["phpfpm-${pool}.service"];
     62       requiredBy = ["phpfpm-${pool}.service"];
     63       serviceConfig = {
     64         Type = "oneshot";
     65         RemainAfterExit = true;
     66         User = user;
     67         Group = group;
     68 
     69         CapabilityBoundingSet = "";
     70         LockPersonality = true;
     71         NoNewPrivileges = true;
     72         PrivateDevices = true;
     73         PrivateMounts = true;
     74         PrivateTmp = true;
     75         PrivateUsers = true;
     76         ProtectClock = true;
     77         ProtectControlGroups = true;
     78         ProtectHome = true;
     79         ProtectHostname = true;
     80         ProtectKernelLogs = true;
     81         ProtectKernelModules = true;
     82         ProtectKernelTunables = true;
     83         ProtectProc = "invisible";
     84         ProtectSystem = "strict";
     85         ReadWritePaths = [stateDir];
     86         RestrictAddressFamilies = "AF_UNIX";
     87         RestrictNamespaces = true;
     88         RestrictRealtime = true;
     89         RestrictSUIDSGID = true;
     90         SystemCallArchitectures = "native";
     91         SystemCallFilter = ["@system-service" "~@privileged"];
     92       };
     93       script = ''
     94         set -euo pipefail
     95 
     96         pkg="${pkgs.shaarli}"
     97         themeSrc="${theme}/2004licious"
     98         stamp="${stateDir}/.src"
     99         themeStamp="${stateDir}/.theme-src"
    100 
    101         rm -rf "${stateDir}/.www-new" "${stateDir}/.www-old"
    102 
    103         if [ ! -f "$stamp" ] || [ "$(cat "$stamp")" != "$pkg" ]; then
    104           cp -r "$pkg" "${stateDir}/.www-new"
    105           chmod -R u+w "${stateDir}/.www-new"
    106 
    107           for dir in data pagecache cache tmp; do
    108             rm -rf "${stateDir}/.www-new/$dir"
    109             if [ -d "${webRoot}/$dir" ]; then
    110               cp -r "${webRoot}/$dir" "${stateDir}/.www-new/$dir"
    111             fi
    112           done
    113 
    114           chmod -R a+rX "${stateDir}/.www-new"
    115 
    116           [ -d "${webRoot}" ] && mv "${webRoot}" "${stateDir}/.www-old"
    117           mv "${stateDir}/.www-new" "${webRoot}"
    118           rm -rf "${stateDir}/.www-old"
    119 
    120           printf '%s' "$pkg" > "$stamp"
    121           rm -f "$themeStamp"
    122         fi
    123 
    124         for dir in data pagecache tmp; do
    125           mkdir -p "${webRoot}/$dir"
    126           chmod 0750 "${webRoot}/$dir"
    127         done
    128         mkdir -p "${webRoot}/cache"
    129         chmod 0755 "${webRoot}/cache"
    130 
    131         if [ ! -f "$themeStamp" ] || [ "$(cat "$themeStamp")" != "$themeSrc" ]; then
    132           rm -rf "${webRoot}/tpl/2004licious"
    133           mkdir -p "${webRoot}/tpl"
    134           cp -r "$themeSrc" "${webRoot}/tpl/2004licious"
    135           chmod -R u+w,a+rX "${webRoot}/tpl/2004licious"
    136           printf '%s' "$themeSrc" > "$themeStamp"
    137         fi
    138       '';
    139     };
    140 
    141     services.phpfpm.pools.${pool} = {
    142       inherit user group;
    143       phpPackage = phpWithExtensions;
    144       phpEnv.SHAARLI_CONFIG = "${webRoot}/data/config";
    145       settings = {
    146         "listen" = socket;
    147         "listen.owner" = "caddy";
    148         "listen.group" = "caddy";
    149         "listen.mode" = "0660";
    150         "pm" = "dynamic";
    151         "pm.max_children" = 5;
    152         "pm.start_servers" = 2;
    153         "pm.min_spare_servers" = 1;
    154         "pm.max_spare_servers" = 3;
    155       };
    156     };
    157 
    158     services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
    159       ${haravara.mkAuthImport cfg.authLabel}
    160       root * ${webRoot}
    161       php_fastcgi unix/${socket}
    162       file_server
    163     '';
    164   };
    165 }