74 lines
2.3 KiB
Nix
74 lines
2.3 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
let
|
|
autodeploy = pkgs.buildGoModule {
|
|
name = "autodeploy";
|
|
src = ./autodeploy;
|
|
vendorHash = "sha256-H8Wa1GoXjU8mkaE0ofdA1mO+rNo3l4s0nxTVih9LuWs=";
|
|
};
|
|
|
|
buildScript = ''
|
|
rev=$(git ls-remote https://git.orga.cebula.camp/infra/site | grep refs/heads/nix | cut -f1)
|
|
pkg=$(nix-build -I nixpkgs=${pkgs.path} --no-out-link -E 'import (builtins.fetchGit { url = "https://git.orga.cebula.camp/infra/site"; rev="'$rev'"; })')
|
|
'';
|
|
in {
|
|
services.nginx.virtualHosts."cebula.camp" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:3000/";
|
|
proxyWebsockets = true;
|
|
};
|
|
locations."/.not-well-known/update" = {
|
|
proxyPass = "http://unix:/run/site-autodeploy.sock";
|
|
extraConfig = ''
|
|
proxy_http_version 1.0;
|
|
'';
|
|
};
|
|
};
|
|
systemd.sockets.site-autodeploy = {
|
|
wantedBy = [ "sockets.target" ];
|
|
socketConfig = {
|
|
ListenStream = "/run/site-autodeploy.sock";
|
|
SocketMode = "0600";
|
|
SocketUser = config.services.nginx.user;
|
|
Accept = true;
|
|
MaxConnections=1;
|
|
};
|
|
};
|
|
systemd.services."site-autodeploy@" = {
|
|
path = [ pkgs.git pkgs.nix pkgs.bash pkgs.systemd ];
|
|
script = ''
|
|
set -eu
|
|
rev=$(git ls-remote https://git.orga.cebula.camp/infra/site | grep refs/heads/nix | cut -f1)
|
|
if [ -n "$(nix-build --dry-run -I nixpkgs=${pkgs.path} -E 'import (builtins.fetchGit { url = "https://git.orga.cebula.camp/infra/site"; rev="'$rev'"; })' 2>&1)" ]; then
|
|
echo -e "HTTP/1.0 200 Ok\r\n\r\n\r\n"
|
|
${buildScript}
|
|
systemctl restart cebula-site
|
|
else
|
|
echo -e "HTTP/1.0 304 Not Modified\r\nContent-Length: 0\r\n\r\n"
|
|
fi
|
|
'';
|
|
unitConfig = {
|
|
CollectMode="inactive-or-failed";
|
|
};
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
# TODO: run as an unprivileged user:
|
|
# 1. figure out why rootless podman is broken, probaby something with
|
|
# subuid/subgid maps with LDAP.
|
|
# 2. let the unprivileged user sudo into a systemctl unit restart
|
|
User = "root";
|
|
StandardOutput = "socket";
|
|
};
|
|
};
|
|
systemd.services.cebula-site = {
|
|
wantedBy = [ "multi-user.target" ];
|
|
path = [ pkgs.git pkgs.nix pkgs.bash ];
|
|
script = ''
|
|
${buildScript}
|
|
exec $pkg/bin/cebula-site
|
|
'';
|
|
};
|
|
}
|