aboutsummaryrefslogtreecommitdiffstats
path: root/modules/by-name
diff options
context:
space:
mode:
Diffstat (limited to 'modules/by-name')
-rw-r--r--modules/by-name/sh/sharkey/module.nix275
1 files changed, 62 insertions, 213 deletions
diff --git a/modules/by-name/sh/sharkey/module.nix b/modules/by-name/sh/sharkey/module.nix
index 2b50cf0..d019bd3 100644
--- a/modules/by-name/sh/sharkey/module.nix
+++ b/modules/by-name/sh/sharkey/module.nix
@@ -1,18 +1,18 @@
-# Source: https://github.com/sodiboo/system/blob/b63c7b27f49043e8701b3ff5e1441cd27d5a2fff/sharkey/module.nix
{
config,
lib,
pkgs,
- vhackPackages,
+ pkgsUnstable,
+ nixpkgs-unstable,
...
}: let
cfg = config.vhack.sharkey;
-
- createDB = cfg.database.host == "127.0.0.1" && cfg.database.createLocally;
-
- settingsFormat = pkgs.formats.yaml {};
- configFile = settingsFormat.generate "sharkey-config.yml" cfg.settings;
in {
+ imports = [
+ # TODO(@bpeetz): Remove this import once we update to NixOS 25.11 <2025-07-12>
+ "${nixpkgs-unstable}/nixos/modules/services/web-apps/sharkey.nix"
+ ];
+
options.vhack.sharkey = {
enable = lib.mkEnableOption "sharkey";
@@ -24,254 +24,103 @@ in {
package = lib.mkOption {
type = lib.types.package;
- default = vhackPackages.sharkey;
+ default = pkgsUnstable.sharkey;
defaultText = lib.literalExpression "vhackPackages.sharkey";
description = "Sharkey package to use.";
};
- dataDirectory = lib.mkOption {
+ mediaDirectory = lib.mkOption {
type = lib.types.path;
default = "/var/lib/sharkey";
description = "The directory where sharkey stores it's data.";
-
- # This is already set in the package.
- readOnly = true;
- };
-
- database = {
- createLocally = lib.mkOption {
- description = "Whether to enable local db creation.";
- type = lib.types.bool;
- default = true;
- };
-
- host = lib.mkOption {
- type = lib.types.str;
- default = "127.0.0.1";
- description = "The database host.";
- };
-
- port = lib.mkOption {
- type = lib.types.port;
- default = 5432;
- description = "The database port.";
- };
-
- name = lib.mkOption {
- type = lib.types.str;
- default = "sharkey";
- description = "The database name in postgresql.";
- };
};
settings = lib.mkOption {
- inherit (settingsFormat) type;
+ inherit (pkgs.formats.yaml {}) type;
default = {};
description = ''
- Configuration for Sharkey, see
+ Extra Configuration for Sharkey, see
<link xlink:href="https://activitypub.software/TransFem-org/Sharkey/-/blob/develop/.config/example.yml"/>
for supported settings.
+
+ Note, that this is applied on-top of the neccessary config.
'';
};
};
config = lib.mkIf cfg.enable {
- environment.systemPackages = [cfg.package];
-
- vhack = {
- nginx.enable = true;
+ services = {
+ sharkey = {
+ enable = true;
- sharkey.settings = {
- id = "aidx";
+ inherit (cfg) package;
+ openFirewall = false;
+ setupRedis = true;
+ setupPostgresql = true;
- url = "https://${cfg.fqdn}/";
- port = 5312;
+ settings =
+ cfg.settings
+ // {
+ url = "https://${cfg.fqdn}/";
+ port = 5312;
- db = {
- inherit (cfg.database) host port;
- db = cfg.database.name;
- user = cfg.database.name;
- pass = "sharkey-password";
- };
- redis = {
- path = config.services.redis.servers."sharkey".unixSocket;
- };
+ inherit (cfg) mediaDirectory;
+ fulltextSearch.provider = "sqlLike";
+ };
};
- persist.directories = [
- {
- directory = "${config.services.redis.servers."sharkey".settings.dir}";
- user = "sharkey";
- group = "redis-sharey";
- mode = "0770";
- }
- {
- directory = "${cfg.dataDirectory}";
- user = "sharkey";
- group = "sharkey";
- mode = "0770";
- }
- ];
- };
-
- services = {
nginx.virtualHosts."${cfg.fqdn}" = {
locations."/" = {
- proxyPass = "http://127.0.0.1:${toString cfg.settings.port}";
+ proxyPass = "http://127.0.0.1:${toString config.services.sharkey.settings.port}";
proxyWebsockets = true;
};
- # proxy_set_header Host $host;
- # proxy_http_version 1.1;
- # proxy_redirect off;
- #
- # # If it's behind another reverse proxy or CDN, remove the following.
- # proxy_set_header X-Real-IP $remote_addr;
- # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
- # proxy_set_header X-Forwarded-Proto https;
- #
- # # For WebSocket
- # proxy_set_header Upgrade $http_upgrade;
- # proxy_set_header Connection $connection_upgrade;
- #
- # # Cache settings
- # proxy_cache cache1;
- # proxy_cache_lock on;
- # proxy_cache_use_stale updating;
- # proxy_force_ranges on;
- # add_header X-Cache $upstream_cache_status;
-
enableACME = true;
forceSSL = true;
};
-
- postgresql = lib.mkIf createDB {
- enable = true;
- settings.port = cfg.database.port;
- ensureUsers = [
- {
- inherit (cfg.database) name;
- ensureDBOwnership = true;
- }
- ];
- ensureDatabases = [cfg.database.name];
- };
-
- redis = {
- servers."sharkey" = {
- enable = true;
-
- user = "sharkey";
-
- # Disable TCP listening. (We have a UNIX socket)
- port = 0;
- bind = null;
-
- settings = {
- protected-mode = true;
- enable-protected-configs = false;
- enable-debug-command = false;
- enable-module-command = false;
-
- supervised = "systemd";
- stop-writes-on-bgsave-error = true;
- sanitize-dump-payload = "clients";
- };
- };
- };
};
- systemd.services.postgresql.postStart = ''
- $PSQL -tAc "ALTER ROLE ${cfg.database.name} WITH ENCRYPTED PASSWORD 'sharkey-password';"
- '';
-
systemd.services.sharkey = {
- requires =
- [
- "redis-sharkey.service"
- "network-online.target"
- ]
- ++ lib.optionals createDB ["postgresql.service"];
-
- after =
- [
- "redis-sharkey.service"
- "network-online.target"
- ]
- ++ lib.optionals createDB ["postgresql.service"];
+ requires = ["network-online.target"];
- wantedBy = ["multi-user.target"];
-
- environment = {
- MISSKEY_CONFIG_YML = "${configFile}";
- NODE_ENV = "production";
- };
+ # TODO(@bpeetz): `postgresql.target` is only available in NixOS 25.11, as such we
+ # need to override this back to the postgresql.service. <2025-07-12>
+ after = lib.mkForce [
+ "network-online.target"
+ "postgresql.service"
+ "redis-sharkey.service"
+ ];
+ bindsTo = lib.mkForce [
+ "postgresql.service"
+ "redis-sharkey.service"
+ ];
serviceConfig = {
- Type = "simple";
-
- StateDirectory = "sharkey";
- StateDirectoryMode = "0700";
- CacheDirectory = "sharkey";
- RuntimeDirectory = "sharkey";
- RuntimeDirectoryMode = "0700";
- ExecStart = "${lib.getExe cfg.package} migrateandstart";
-
- TimeoutSec = 60;
- Restart = "no";
-
- StandardOutput = "journal";
- StandardError = "journal";
- SyslogIdentifier = "sharkey";
-
+ # The upstream service uses DynamicUsers, which currently poses issues to our
+ # directory persisting strategy.
User = "sharkey";
Group = "sharkey";
+ DynamicUser = lib.mkForce false;
+ };
+ };
- # Bind standard privileged ports
- AmbientCapabilities = [];
- CapabilityBoundingSet = [];
-
- ReadWritePaths = [
- "${cfg.dataDirectory}"
- ];
+ vhack = {
+ nginx.enable = true;
- # Hardening
- DeviceAllow = [""];
- LockPersonality = true;
- # Probably needed for v8's JIT (crashes with it on).
- MemoryDenyWriteExecute = false;
- PrivateDevices = true;
- PrivateUsers = true;
- # Sharkey needs access to the hosts CPUs
- ProcSubset = "all";
- PrivateTmp = true;
- ProtectClock = true;
- ProtectControlGroups = true;
- ProtectHome = true;
- ProtectHostname = true;
- ProtectKernelLogs = true;
- ProtectKernelModules = true;
- ProtectKernelTunables = true;
- ProtectProc = "invisible";
- ProtectSystem = "strict";
- RestrictAddressFamilies = [
- "AF_UNIX" # Local communication unix(7)
- "AF_INET" # IPv4 Internet protocols ip(7)
- "AF_INET6" # IPv6 Internet protocols ipv6(7)
- # Needed for nodes `os.networkInterfaces()` function.
- "AF_NETLINK" # Kernel user interface device netlink(7)
- ];
- RestrictNamespaces = true;
- RestrictRealtime = true;
- RestrictSUIDSGID = true;
- SystemCallArchitectures = "native";
- SystemCallFilter = [
- "@system-service"
- "@chown"
- "~@mount"
- ];
- UMask = "0077";
- };
+ persist.directories = [
+ {
+ directory = "${config.services.redis.servers."sharkey".settings.dir}";
+ user = "sharkey";
+ group = "redis-sharey";
+ mode = "0770";
+ }
+ {
+ directory = "${cfg.mediaDirectory}";
+ user = "sharkey";
+ group = "sharkey";
+ mode = "0700";
+ }
+ ];
};
users = {
generated by cgit v1.3.1 (git 2.54.0) at 2026-05-31 17:00:52 +0000