aboutsummaryrefslogtreecommitdiffstats
path: root/modules/by-name/ma/mastodon/module.nix
diff options
context:
space:
mode:
Diffstat (limited to 'modules/by-name/ma/mastodon/module.nix')
-rw-r--r--modules/by-name/ma/mastodon/module.nix128
1 files changed, 0 insertions, 128 deletions
diff --git a/modules/by-name/ma/mastodon/module.nix b/modules/by-name/ma/mastodon/module.nix
deleted file mode 100644
index 84f3ec8..0000000
--- a/modules/by-name/ma/mastodon/module.nix
+++ /dev/null
@@ -1,128 +0,0 @@
-{
- config,
- pkgs,
- lib,
- ...
-}: let
- emailAddress = "mastodon@vhack.eu";
- applyPatches = pkg:
- pkg.overrideAttrs (attrs: {
- patches = (attrs.patches or []) ++ [./patches/0001-feat-treewide-Increase-character-limit-to-5000-in-me.patch];
- });
- cfg = config.vhack.mastodon;
-in {
- options.vhack.mastodon = {
- enable = lib.mkEnableOption "a mastodon instance";
- domain = lib.mkOption {
- type = lib.types.str;
- description = "The Domain mastodon should be served on";
- example = "mastodon.vhack.eu";
- };
- enableTLD = lib.mkEnableOption "using the tld as handle, configured via
- webfinger (note: this requires the tld to point to the same server as domain)";
- tld = lib.mkOption {
- type = lib.types.nullOr lib.types.str;
- default = null;
- example = "vhack.eu";
- };
- mailPwFile = lib.mkOption {
- type = lib.types.path;
- description = "The age encrypted mail password file passed to agenix";
- };
- };
- config = lib.mkIf cfg.enable {
- age.secrets.mastodonMail = {
- file = cfg.mailPwFile;
- mode = "700";
- owner = "mastodon";
- group = "mastodon";
- };
-
- vhack = {
- persist.directories = [
- {
- directory = "/var/lib/mastodon";
- user = "mastodon";
- group = "mastodon";
- mode = "0700";
- }
- ];
-
- postgresql.enable = true;
-
- nginx.enable = true;
- };
-
- services.mastodon = {
- enable = true;
-
- package = applyPatches pkgs.mastodon;
-
- # Unstable Mastodon package, used if
- # security updates aren't backported.
- #package = applyPatches pkgsUnstable.mastodon;
-
- localDomain =
- if cfg.enableTLD
- then cfg.tld
- else cfg.domain;
- smtp = {
- authenticate = true;
- createLocally = false;
- fromAddress = emailAddress;
- user = emailAddress;
- host = "mail.foss-syndicate.org";
- passwordFile = config.age.secrets.mastodonMail.path;
- };
- streamingProcesses = 3; # Number of Cores - 1
- extraConfig = {
- WEB_DOMAIN = cfg.domain;
- EMAIL_DOMAIN_ALLOWLIST = "vhack.eu|sils.li";
- };
- };
-
- services.nginx = {
- enable = true;
- recommendedProxySettings = true; # required for redirections to work
- virtualHosts = {
- "${cfg.domain}" = {
- root = "${config.services.mastodon.package}/public/";
- # mastodon only supports https, but you can override this if you offload tls elsewhere.
- forceSSL = true;
- enableACME = true;
-
- locations = {
- "/system/".alias = "/var/lib/mastodon/public-system/";
- "/".tryFiles = "$uri @proxy";
- "@proxy" = {
- proxyPass = "http://unix:/run/mastodon-web/web.socket";
- proxyWebsockets = true;
- };
- "/api/v1/streaming/" = {
- proxyPass = "http://unix:/run/mastodon-streaming/streaming.socket";
- proxyWebsockets = true;
- };
- };
- };
- "${cfg.tld}" =
- if cfg.enableTLD
- then {
- locations."/.well-known/webfinger".return = "301 https://${cfg.domain}$request_uri";
- }
- else {};
- };
- };
-
- users = {
- users.mastodon.uid = config.vhack.constants.ids.uids.mastodon;
- users.redis-mastodon.uid = config.vhack.constants.ids.uids.redis-mastodon;
- groups.redis-mastodon.gid = config.vhack.constants.ids.gids.redis-mastodon;
- groups.mastodon = {
- gid = config.vhack.constants.ids.gids.mastodon;
- members = [
- config.services.nginx.user
- ];
- };
- };
- };
-}