93 lines
2.7 KiB
Nix
93 lines
2.7 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
dataDir = "/var/lib/focalboard";
|
|
ociBackend = config.virtualisation.oci-containers.backend;
|
|
port = 8003;
|
|
domain = "boards.felschr.com";
|
|
dbUser = "focalboard";
|
|
dbName = "focalboard";
|
|
dbPasswordFile = config.age.secrets.focalboard-db-password.path;
|
|
|
|
inherit (config.users.users.focalboard) uid;
|
|
inherit (config.users.groups.focalboard) gid;
|
|
|
|
pgSuperUser = config.services.postgresql.superUser;
|
|
in {
|
|
age.secrets.focalboard-env.file = ../secrets/focalboard/.env.age;
|
|
age.secrets.focalboard-db-password.file =
|
|
../secrets/focalboard/db-password.age;
|
|
|
|
services.postgresql = {
|
|
enable = true;
|
|
enableTCPIP = true;
|
|
ensureDatabases = [ dbName ];
|
|
ensureUsers = [{
|
|
name = dbUser;
|
|
ensurePermissions."DATABASE ${dbName}" = "ALL PRIVILEGES";
|
|
}];
|
|
};
|
|
|
|
systemd.services.focalboard-init = {
|
|
enable = true;
|
|
description = "Set up paths & database access for Focalboard";
|
|
requires = [ "postgresql.service" ];
|
|
after = [ "postgresql.service" ];
|
|
before = [ "${ociBackend}-focalboard.service" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
LoadCredential = [ "db_password:${dbPasswordFile}" ];
|
|
};
|
|
script = ''
|
|
mkdir -p ${dataDir}
|
|
echo "Set focalboard postgres user password"
|
|
db_password="$(<"$CREDENTIALS_DIRECTORY/db_password")"
|
|
${pkgs.sudo}/bin/sudo -u ${pgSuperUser} ${pkgs.postgresql}/bin/psql postgres \
|
|
-c "alter user ${dbUser} with password '$db_password'"
|
|
'';
|
|
};
|
|
|
|
virtualisation.oci-containers.containers.focalboard = {
|
|
image = "docker.io/mattermost/focalboard";
|
|
ports = [ "${toString port}:${toString port}" ];
|
|
volumes = [ "${dataDir}:/var/lib/focalboard" ];
|
|
environment = {
|
|
FOCALBOARD_PORT = toString port;
|
|
FOCALBOARD_DBTYPE = "postgres";
|
|
};
|
|
# only secrets need to be included, e.g. FOCALBOARD_DBCONFIG
|
|
environmentFiles = [ config.age.secrets.focalboard-env.path ];
|
|
extraOptions = [
|
|
"--uidmap=0:65534:1"
|
|
"--gidmap=0:65534:1"
|
|
"--uidmap=65534:${toString uid}:1"
|
|
"--gidmap=65534:${toString gid}:1"
|
|
"--network=host"
|
|
"--label=io.containers.autoupdate=registry"
|
|
];
|
|
};
|
|
|
|
systemd.services."${ociBackend}-focalboard" = {
|
|
requires = [ "postgresql.service" ];
|
|
after = [ "postgresql.service" ];
|
|
};
|
|
|
|
services.nginx.virtualHosts.${domain} = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:${toString port}";
|
|
proxyWebsockets = true;
|
|
};
|
|
};
|
|
|
|
users.users.focalboard = {
|
|
isSystemUser = true;
|
|
group = "focalboard";
|
|
uid = 981;
|
|
};
|
|
|
|
users.groups.focalboard = { gid = 978; };
|
|
}
|