char/topaz-flake

git clone https://git.t4t.associates/char/topaz-flake

Charlotte Somrun stars.hackery.sitedf10a8e

main
branchesmainall refs →
3.1 KiB89 linesraw
1{ pkgs, unstable-pkgs, hydrant-src, ... }:
2let
3  hydrant = pkgs.callPackage (hydrant-src + "/default.nix") { };
4in
5{
6  users.groups.stars = { };
7  users.users.stars = {
8    isSystemUser = true;
9    group = "stars";
10  };
11  users.groups.stars-hydrant = { };
12  users.users.stars-hydrant = {
13    isSystemUser = true;
14    group = "stars-hydrant";
15  };
16
17  systemd.services.stars-hydrant = {
18    description = "Stars Hydrant indexer";
19    after = [ "network-online.target" ];
20    wants = [ "network-online.target" ];
21    wantedBy = [ "multi-user.target" ];
22    environment = {
23      HYDRANT_DATABASE_PATH = "/var/lib/stars-hydrant/db";
24      HYDRANT_API_BIND = "127.0.0.1:33991";
25      HYDRANT_PLC_URL = "https://plc.cerulea.blue,https://plc.directory";
26      HYDRANT_FULL_NETWORK = "false";
27      HYDRANT_EPHEMERAL = "false";
28      HYDRANT_ONLY_INDEX_LINKS = "false";
29      HYDRANT_FILTER_SIGNALS = "site.hackery.stars.star,site.hackery.stars.follow";
30      HYDRANT_FILTER_COLLECTIONS = "site.hackery.stars.star,site.hackery.stars.follow,app.bsky.actor.profile";
31      HYDRANT_VERIFY_SIGNATURES = "full";
32      HYDRANT_ENABLE_FIREHOSE = "true";
33      HYDRANT_ENABLE_CRAWLER = "true";
34      HYDRANT_RELAY_HOST = "wss://relay.fire.hose.cam/";
35      HYDRANT_CRAWLER_URLS = "by_collection::https://lightrail.microcosm.blue";
36      HYDRANT_BACKFILL_CONCURRENCY_LIMIT = "4";
37      HYDRANT_CACHE_SIZE = "128";
38      RUST_LOG = "warn";
39    };
40    serviceConfig = {
41      Type = "simple";
42      User = "stars-hydrant";
43      Group = "stars-hydrant";
44      StateDirectory = "stars-hydrant";
45      StateDirectoryMode = "0700";
46      WorkingDirectory = "/var/lib/stars-hydrant";
47      ExecStart = "${hydrant}/bin/hydrant";
48      Restart = "on-failure";
49      RestartSec = "5s";
50      NoNewPrivileges = true;
51      PrivateTmp = true;
52      ProtectSystem = "strict";
53      ProtectHome = true;
54    };
55  };
56
57  systemd.services.stars = {
58    description = "Stars server";
59    after = [ "network-online.target" "stars-hydrant.service" ];
60    wants = [ "network-online.target" "stars-hydrant.service" ];
61    wantedBy = [ "multi-user.target" ];
62    unitConfig.ConditionPathExists = "/srv/apps/stars/main.ts";
63    environment = {
64      PUBLIC_URL = "https://stars.hackery.site";
65      HYDRANT_URL = "http://127.0.0.1:33991";
66      DATABASE_PATH = "/var/lib/stars/stars.sqlite";
67      DENO_DIR = "/var/cache/stars/deno";
68      HOME = "/var/lib/stars";
69    };
70    serviceConfig = {
71      Type = "simple";
72      User = "stars";
73      Group = "stars";
74      StateDirectory = "stars";
75      StateDirectoryMode = "0700";
76      CacheDirectory = "stars";
77      CacheDirectoryMode = "0700";
78      WorkingDirectory = "/srv/apps/stars";
79      ExecStartPre = "${unstable-pkgs.deno}/bin/deno cache --lock=deno.lock main.ts";
80      ExecStart = "${unstable-pkgs.deno}/bin/deno run --cached-only --allow-net --allow-env --allow-read=/srv/apps/stars,/var/lib/stars,/var/cache/stars --allow-write=/var/lib/stars,/var/cache/stars main.ts";
81      Restart = "on-failure";
82      RestartSec = "5s";
83      NoNewPrivileges = true;
84      PrivateTmp = true;
85      ProtectSystem = "strict";
86      ProtectHome = true;
87    };
88  };
89}