char/topaz-flake

git clone https://git.t4t.associates/char/topaz-flake

Charlotte Sommerge staging and canonical watch partybe98809

main
branchesmainall refs →
1.6 KiB64 linesraw
1{ pkgs, unstable-pkgs, ... }:
2let
3  watch-party = pkgs.callPackage ../../packages/watch-party.nix { };
4
5  vhost = {
6    forceSSL = true;
7    enableACME = true;
8
9    locations."/" = {
10      proxyPass = "http://127.0.0.1:8524";
11      proxyWebsockets = true;
12      extraConfig = ''
13        proxy_set_header Host $host;
14        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
15        proxy_set_header X-Forwarded-Proto $scheme;
16      '';
17    };
18  };
19in
20{
21  users.users.watch-party = {
22    isSystemUser = true;
23    group = "watch-party";
24  };
25  users.groups.watch-party = { };
26
27  systemd.services.watch-party = {
28    description = "watch-party";
29    after = [ "network.target" ];
30    wantedBy = [ "multi-user.target" ];
31
32    environment = {
33      BIND_HOST = "127.0.0.1";
34      PORT = "8524";
35      HOME = "/var/lib/watch-party";
36    };
37
38    serviceConfig = {
39      Type = "simple";
40      User = "watch-party";
41      Group = "watch-party";
42      StateDirectory = "watch-party";
43      WorkingDirectory = "/var/lib/watch-party";
44      ExecStartPre = [
45        "${pkgs.coreutils}/bin/rm -rf app"
46        "${pkgs.coreutils}/bin/cp -r ${watch-party}/share/watch-party app"
47        "${pkgs.coreutils}/bin/chmod -R u+w app"
48      ];
49      ExecStart = "${unstable-pkgs.deno}/bin/deno task --cwd app start";
50      Restart = "on-failure";
51      RestartSec = "5s";
52
53      NoNewPrivileges = true;
54      PrivateTmp = true;
55      ProtectSystem = "strict";
56      ProtectHome = true;
57    };
58  };
59
60  services.nginx.virtualHosts = {
61    "watch.bun.how" = vhost;
62    "staging.watch.bun.how" = vhost;
63  };
64}