diff options
author | makefu <github@syntax-fehler.de> | 2015-10-22 15:26:54 +0200 |
---|---|---|
committer | makefu <github@syntax-fehler.de> | 2015-10-22 15:26:54 +0200 |
commit | 9be59a04001698e8e34ae4e2a49e2dea920765b1 (patch) | |
tree | 59b9efdb7399215140a958c7b2d89a5158ed5aad /krebs/3modules | |
parent | 6a425334c78fe6eb30f21f9757554905f09436fa (diff) |
krebs 3 modules: bepasty-server is a krebs module
Diffstat (limited to 'krebs/3modules')
-rw-r--r-- | krebs/3modules/bepasty-server.nix | 164 | ||||
-rw-r--r-- | krebs/3modules/default.nix | 1 |
2 files changed, 165 insertions, 0 deletions
diff --git a/krebs/3modules/bepasty-server.nix b/krebs/3modules/bepasty-server.nix new file mode 100644 index 000000000..ff32eea60 --- /dev/null +++ b/krebs/3modules/bepasty-server.nix @@ -0,0 +1,164 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + gunicorn = pkgs.pythonPackages.gunicorn; + bepasty = pkgs.pythonPackages.bepasty-server; + gevent = pkgs.pythonPackages.gevent; + python = pkgs.pythonPackages.python; + cfg = config.krebs.bepasty; + + out = { + options.krebs.bepasty = api; + config = mkIf cfg.enable (mkMerge [(mkIf cfg.serveNginx nginx-imp) imp ]) ; + }; + + api = { + enable = mkEnableOption "Bepasty Servers"; + serveNginx = mkEnableOption "Serve Bepasty Servers with Nginx"; + + servers = mkOption { + type = with types; attrsOf optionSet; + options = singleton { + nginx = mkOption { + # TODO use the correct type + type = with types; attrsOf unspecified; + description = '' + additional nginx configuration. see krebs.nginx for all options + '' ; + }; + + secretKey = mkOption { + type = types.str; + description = '' + server secret for safe session cookies, must be set. + ''; + default = ""; + }; + + # we create a wsgi socket in $workDir/gunicorn-${name}.wsgi + workDir = mkOption { + type = types.str; + description = '' + Path to the working directory (used for sockets and pidfile). + Defaults to the users home directory. Must be accessible to nginx, + permissions will be set to 755 + ''; + default = config.users.extraUsers.bepasty.home; + }; + + dataDir = mkOption { + type = types.str; + description = '' + Defaults to the new users home dir which defaults to + /var/lib/bepasty-server/data + ''; + default = "${config.users.extraUsers.bepasty.home}/data"; + }; + + extraConfig = mkOption { + type = types.str; + default = ""; + # TODO configure permissions in separate + example = '' + PERMISSIONS = { + 'myadminsecret': 'admin,list,create,read,delete', + } + MAX_ALLOWED_FILE_SIZE = 5 * 1000 * 1000 + ''; + }; + + defaultPermissions = mkOption { + # TODO: listOf str + type = types.str; + description = '' + default permissions for all unauthenticated users. + ''; + example = "read,create,delete"; + default = "read"; + }; + + }; + default = {}; + }; + + }; + + imp = { + # Configures systemd services for each configured server + # environment.systemPackages = [ bepasty gunicorn gevent ]; + systemd.services = mapAttrs' (name: server: + nameValuePair ("bepasty-server-${name}") + ({ + description = "Bepasty Server ${name}"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + restartIfChanged = true; + environment = { + BEPASTY_CONFIG = "${server.workDir}/bepasty-${name}.conf"; + PYTHONPATH= "${bepasty}/lib/${python.libPrefix}/site-packages:${gevent}/lib/${python.libPrefix}/site-packages"; + }; + serviceConfig = { + Type = "simple"; + PrivateTmp = true; + + ExecStartPre = assert server.secretKey != ""; pkgs.writeScript "bepasty-server.${name}-init" '' + #!/bin/sh + mkdir -p "${server.dataDir}" "${server.workDir}" + chown bepasty:bepasty "${server.workDir}" "${server.dataDir}" + cat > "${server.workDir}/bepasty-${name}.conf" <<EOF + SITENAME="${name}" + STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}" + SECRET_KEY="${server.secretKey}" + DEFAULT_PERMISSIONS="${server.defaultPermissions}" + ${server.extraConfig} + EOF + ''; + ExecStart = ''${gunicorn}/bin/gunicorn bepasty.wsgi --name ${name} \ + -u bepasty \ + -g bepasty \ + --workers 3 --log-level=info \ + --bind=unix:${server.workDir}/gunicorn-${name}.sock \ + --pid ${server.workDir}/gunicorn-${name}.pid \ + -k gevent + ''; + }; + }) + ) cfg.servers; + + users.extraUsers.bepasty = { + uid = 2796546855; #genid bepasty + group = "bepasty"; + home = "/var/lib/bepasty-server"; + }; + users.extraGroups.bepasty = { + gid = 2796546855; #genid bepasty + }; + }; + + nginx-imp = { + assertions = [ { assertion = config.krebs.nginx.enable; + message = "krebs.nginx.enable must be true"; }]; + + krebs.nginx.servers = mapAttrs' (name: server: + nameValuePair("bepasty-server-${name}") + (mkMerge [ server.nginx { + extraConfig = '' + client_max_body_size 32M; + ''; + locations = [ + (nameValuePair ("/") + ('' + proxy_set_header Host $http_host; + proxy_pass http://unix:${server.workDir}/gunicorn-${name}.sock; + '')) + (nameValuePair ("/static/") + ('' + alias ${bepasty}/lib/${python.libPrefix}/site-packages/bepasty/static/; + '')) + ]; + }]) + ) cfg.servers ; + }; +in +out diff --git a/krebs/3modules/default.nix b/krebs/3modules/default.nix index 756245c0b..1f34c8e68 100644 --- a/krebs/3modules/default.nix +++ b/krebs/3modules/default.nix @@ -6,6 +6,7 @@ let out = { imports = [ + ./bepasty-server.nix ./build.nix ./exim-retiolum.nix ./exim-smarthost.nix |