char/topaz-flake

git clone https://git.t4t.associates/char/topaz-flake

Charlotte Somset host on cerulea video233f0ea

main
branchesmainall refs →
1.3 KiB47 linesraw
1{ unstable-pkgs, ... }:
2{
3  users.users.cerulea-video = {
4    isSystemUser = true;
5    group = "cerulea-video";
6    home = "/srv/apps/cerulea-video";
7    createHome = false;
8  };
9  users.groups.cerulea-video = { };
10
11  systemd.services.cerulea-video = {
12    description = "cerulea video";
13    after = [ "network.target" ];
14    wantedBy = [ "multi-user.target" ];
15
16    serviceConfig = {
17      Type = "simple";
18      User = "cerulea-video";
19      Group = "cerulea-video";
20      WorkingDirectory = "/srv/apps/cerulea-video";
21      ExecStartPre = "${unstable-pkgs.deno}/bin/deno task client:build";
22      ExecStart = "${unstable-pkgs.deno}/bin/deno serve -A --host 127.0.0.16 --port 4080 ./appview/main.ts";
23      Restart = "on-failure";
24      RestartSec = "5s";
25
26      NoNewPrivileges = true;
27      PrivateTmp = true;
28      ProtectSystem = "strict";
29      ProtectHome = "read-only";
30      ReadWritePaths = [ "/srv/apps/cerulea-video" ];
31    };
32  };
33
34  services.nginx.virtualHosts."video.cerulea.blue" = {
35    forceSSL = true;
36    enableACME = true;
37
38    locations."/" = {
39      proxyPass = "http://127.0.0.16:4080";
40      proxyWebsockets = true;
41      extraConfig = ''
42        proxy_set_header Host $host;
43        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
44      '';
45    };
46  };
47}