infrastructure

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README

daily-tracker.nix (3223B)

      1 {
      2   config,
      3   lib,
      4   pkgs,
      5   ...
      6 }:
      7 
      8 let
      9   cfg = config.services.local.daily-tracker;
     10 in
     11 {
     12   options.services.local.daily-tracker = {
     13     enable = lib.mkEnableOption "Daily Tracker";
     14 
     15     package = lib.mkOption {
     16       type = lib.types.package;
     17       description = "The daily_tracker release package";
     18     };
     19 
     20     domain = lib.mkOption {
     21       type = lib.types.str;
     22       description = "Domain for the daily tracker";
     23     };
     24 
     25     port = lib.mkOption {
     26       type = lib.types.int;
     27       default = 4000;
     28       description = "Port for the Phoenix server";
     29     };
     30 
     31     secretKeyBaseSecretName = lib.mkOption {
     32       type = lib.types.str;
     33       description = "Sops secret name for SECRET_KEY_BASE";
     34     };
     35 
     36     mailPasswordSecretName = lib.mkOption {
     37       type = lib.types.str;
     38       description = "Sops secret name for MAIL_PASSWORD";
     39     };
     40 
     41     databaseName = lib.mkOption {
     42       type = lib.types.str;
     43       default = "daily_tracker";
     44       description = "PostgreSQL database name";
     45     };
     46   };
     47 
     48   config = lib.mkIf cfg.enable {
     49     services.postgresql = {
     50       enable = true;
     51       ensureDatabases = [ cfg.databaseName ];
     52       ensureUsers = [
     53         {
     54           name = "daily_tracker";
     55           ensureDBOwnership = true;
     56         }
     57       ];
     58       authentication = ''
     59         local ${cfg.databaseName} daily_tracker trust
     60         host ${cfg.databaseName} daily_tracker 127.0.0.1/32 trust
     61       '';
     62     };
     63 
     64     systemd.services.daily-tracker = {
     65       wantedBy = [ "multi-user.target" ];
     66       description = "Daily Tracker Phoenix app";
     67       after = [ "network.target" "postgresql.service" ];
     68       requires = [ "postgresql.service" ];
     69       serviceConfig = {
     70         Type = "exec";
     71         ExecStartPre = "${cfg.package}/bin/daily_tracker eval 'DailyTracker.Release.migrate()'";
     72         ExecStart = "${cfg.package}/bin/daily_tracker start";
     73         Restart = "on-failure";
     74         User = "daily_tracker";
     75         Group = "daily_tracker";
     76         StateDirectory = "daily-tracker";
     77         WorkingDirectory = "/var/lib/daily-tracker";
     78       };
     79       environment = {
     80         PHX_SERVER = "true";
     81         PHX_HOST = cfg.domain;
     82         PORT = builtins.toString cfg.port;
     83         DATABASE_URL = "ecto://daily_tracker@127.0.0.1/${cfg.databaseName}";
     84         MAIL_HOST = "localhost";
     85         RELEASE_COOKIE = "daily-tracker-cookie";
     86       };
     87     };
     88 
     89     # Load secrets into the service environment
     90     systemd.services.daily-tracker.serviceConfig.EnvironmentFile = [
     91       config.sops.templates."daily-tracker-env".path
     92     ];
     93 
     94     sops.templates."daily-tracker-env" = {
     95       content = ''
     96         SECRET_KEY_BASE=${config.sops.placeholder.${cfg.secretKeyBaseSecretName}}
     97         MAIL_PASSWORD=${config.sops.placeholder.${cfg.mailPasswordSecretName}}
     98       '';
     99       owner = "daily_tracker";
    100     };
    101 
    102     users.users.daily_tracker = {
    103       isSystemUser = true;
    104       group = "daily_tracker";
    105     };
    106     users.groups.daily_tracker = { };
    107 
    108     services.nginx.virtualHosts.${cfg.domain} = {
    109       forceSSL = true;
    110       enableACME = true;
    111       locations."/" = {
    112         proxyPass = "http://127.0.0.1:${builtins.toString cfg.port}";
    113         recommendedProxySettings = true;
    114         proxyWebsockets = true;
    115       };
    116     };
    117   };
    118 }