char/topaz-flake

git clone https://git.t4t.associates/char/topaz-flake

Charlotte Somrun serve-esm from its project directory9eccc17

main
branchesmainall refs →
2.4 KiB85 linesraw
1{ pkgs, unstable-pkgs, ... }:
2let
3  serve-esm = pkgs.fetchFromGitHub {
4    owner = "char";
5    repo = "serve-esm";
6    rev = "bcfd5aa20c4aa4619eaca06f8c917b21c204e129";
7    hash = "sha256-ZnVpgszRMg/v9ZtK+IyKyRMcG5C+rXRnp5BeA6hF9eg=";
8  };
9in
10{
11  users.users.serve-esm = {
12    isSystemUser = true;
13    group = "serve-esm";
14    home = "/var/lib/serve-esm";
15  };
16  users.groups.serve-esm = { };
17
18  systemd.services.serve-esm = {
19    description = "serve-esm";
20    after = [ "network.target" ];
21    wantedBy = [ "multi-user.target" ];
22    path = [ pkgs.git ];
23    unitConfig.ConditionPathIsDirectory = "/srv/apps/serve-esm/repositories/citrus/.git";
24
25    environment = {
26      HOME = "/var/lib/serve-esm";
27      TARGET_DIR = "/srv/apps/serve-esm/repositories";
28    };
29
30    serviceConfig = {
31      Type = "simple";
32      User = "serve-esm";
33      Group = "serve-esm";
34      StateDirectory = "serve-esm";
35      WorkingDirectory = "${serve-esm}";
36      ExecStart = "${unstable-pkgs.deno}/bin/deno serve --host 127.0.0.1 --port 8525 --allow-env=TARGET_DIR --allow-read --allow-run=git ${serve-esm}/src/main.ts";
37      Restart = "on-failure";
38      RestartSec = "5s";
39
40      NoNewPrivileges = true;
41      PrivateTmp = true;
42      ProtectSystem = "strict";
43      ProtectHome = true;
44    };
45  };
46
47  systemd.tmpfiles.rules = [
48    "d /srv/apps/serve-esm 0755 serve-esm serve-esm - -"
49    "d /srv/apps/serve-esm/repositories 0755 serve-esm serve-esm - -"
50    "d /var/cache/nginx/serve-esm 0750 nginx nginx - -"
51  ];
52
53  services.nginx = {
54    proxyCachePath.serve-esm = {
55      enable = true;
56      keysZoneName = "serve_esm";
57      keysZoneSize = "32m";
58      maxSize = "4g";
59      inactive = "30d";
60    };
61
62    virtualHosts."esm.char.lt" = {
63      forceSSL = true;
64      enableACME = true;
65
66      locations."/" = {
67        proxyPass = "http://127.0.0.1:8525";
68        extraConfig = ''
69          proxy_set_header Host $host;
70          proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
71          proxy_set_header X-Forwarded-Proto $scheme;
72
73          proxy_cache serve_esm;
74          proxy_cache_key $request_uri;
75          proxy_cache_valid 200 301 302 30d;
76          proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
77          proxy_cache_background_update on;
78          proxy_cache_lock on;
79          proxy_cache_revalidate on;
80          add_header X-Cache-Status $upstream_cache_status;
81        '';
82      };
83    };
84  };
85}