char/topaz-flake

git clone https://git.t4t.associates/char/topaz-flake

Charlotte Somtemp: use age assurance nginx override for tranquil alsoe6f2612

main
branchesmainall refs →
3.2 KiB92 linesraw
1{ pkgs, lib, config, tranquil, ... }:
2{
3  services.bluesky-pds = {
4    enable = true;
5    settings = {
6      PDS_HOSTNAME = "pds2.bun.how";
7      PDS_PORT = 6280;
8
9      PDS_INVITE_REQUIRED = "true";
10      PDS_RATE_LIMITS_ENABLED = "false";
11
12      PDS_BLOB_UPLOAD_LIMIT = "1073741824";
13
14      PDS_DID_PLC_URL = "https://plc.directory";
15      PDS_BSKY_APP_VIEW_URL = "https://api.pop1.bsky.app";
16      PDS_BSKY_APP_VIEW_DID = "did:web:api.bsky.app";
17      PDS_REPORT_SERVICE_URL = "https://mod.bsky.app";
18      PDS_REPORT_SERVICE_DID = "did:plc:ar7c4by46qjdydhdevvrndac";
19      PDS_CRAWLERS = "https://bsky.network";
20
21    };
22    environmentFiles = [ "/srv/pds/.env" ];
23  };
24
25  services.nginx.virtualHosts.${config.services.bluesky-pds.settings.PDS_HOSTNAME} = {
26    forceSSL = true;
27    enableACME = true;
28
29    locations."/" = {
30      proxyPass = "http://127.0.0.1:${toString config.services.bluesky-pds.settings.PDS_PORT}";
31      proxyWebsockets = true;
32      extraConfig = ''
33        client_max_body_size 1G;
34        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
35      '';
36    };
37
38    locations."= /".extraConfig = ''
39      default_type text/plain;
40      return 200 "pds2.bun.how";
41    '';
42
43    locations."/xrpc/app.bsky.ageassurance.getState".extraConfig = ''
44      default_type application/json;
45      add_header access-control-allow-headers $http_access_control_request_headers always;
46      add_header access-control-allow-origin "*" always;
47      return 200 '{"state":{"lastInitiatedAt":"2025-07-25T01:40:38.406Z","status":"assured","access":"full"},"metadata":{"accountCreatedAt":"2024-10-17T13:55:48.833Z"}}';
48    '';
49  };
50
51  services.tranquil-pds = {
52    enable = true;
53
54    # `nix run nixpkgs#openssl -- rand -base64 48`
55    # for JWT_SECRET, DPOP_SECRET, MASTER_KEY
56    environmentFiles = [ "/srv/tranquil-pds/.env" ];
57    database.createLocally = true;
58    settings = {
59      server = {
60        host = "127.0.0.2";
61        port = 6281;
62        hostname = "pds3.bun.how";
63        age_assurance_override = true;
64      };
65    };
66  };
67
68  services.nginx.virtualHosts.${config.services.tranquil-pds.settings.server.hostname} = {
69    forceSSL = true;
70    enableACME = true;
71
72    locations."/" = {
73      proxyPass = "http://${config.services.tranquil-pds.settings.server.host}:${toString config.services.tranquil-pds.settings.server.port}";
74      proxyWebsockets = true;
75      extraConfig = ''
76        client_max_body_size 10G;
77        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
78        proxy_hide_header Access-Control-Allow-Headers;
79        proxy_hide_header Access-Control-Allow-Origin;
80        add_header access-control-allow-headers $http_access_control_request_headers always;
81        add_header access-control-allow-origin "*" always;
82      '';
83    };
84
85    locations."/xrpc/app.bsky.ageassurance.getState".extraConfig = ''
86      default_type application/json;
87      add_header access-control-allow-headers $http_access_control_request_headers always;
88      add_header access-control-allow-origin "*" always;
89      return 200 '{"state":{"lastInitiatedAt":"2025-07-25T01:40:38.406Z","status":"assured","access":"full"},"metadata":{"accountCreatedAt":"2024-10-17T13:55:48.833Z"}}';
90    '';
91  };
92}