infrastructure

Unnamed repository; edit this file 'description' to name the repository.
Log | Files | Refs | README

mediawiki.nix (2264B)

      1 {
      2   config,
      3   lib,
      4   ...
      5 }:
      6 
      7 let
      8   cfg = config.services.local.mediawiki;
      9 in
     10 {
     11   options.services.local.mediawiki = {
     12     enable = lib.mkEnableOption "MediaWiki";
     13 
     14     name = lib.mkOption {
     15       type = lib.types.str;
     16       default = "My Wiki";
     17       description = "Wiki name";
     18     };
     19 
     20     domain = lib.mkOption {
     21       type = lib.types.str;
     22       description = "Domain for MediaWiki";
     23     };
     24 
     25     passwordSecretName = lib.mkOption {
     26       type = lib.types.str;
     27       description = "Name of the sops secret containing the admin password";
     28     };
     29 
     30     uploadsDir = lib.mkOption {
     31       type = lib.types.str;
     32       default = "/var/lib/mediawiki/uploads";
     33       description = "Directory for uploads";
     34     };
     35 
     36     privateWiki = lib.mkOption {
     37       type = lib.types.bool;
     38       default = true;
     39       description = "Restrict reading/editing to logged-in users";
     40     };
     41 
     42     allowedFileExtensions = lib.mkOption {
     43       type = lib.types.listOf lib.types.str;
     44       default = [ "png" "gif" "jpg" "jpeg" "webp" "pdf" ];
     45       description = "Allowed upload file extensions";
     46     };
     47   };
     48 
     49   config = lib.mkIf cfg.enable {
     50     sops.secrets.${cfg.passwordSecretName} = {
     51       owner = "mediawiki";
     52       mode = "0400";
     53     };
     54 
     55     services.mediawiki = {
     56       enable = true;
     57       name = cfg.name;
     58       webserver = "nginx";
     59       passwordFile = config.sops.secrets.${cfg.passwordSecretName}.path;
     60       database = {
     61         type = "postgres";
     62         createLocally = true;
     63       };
     64       nginx.hostName = cfg.domain;
     65       uploadsDir = cfg.uploadsDir;
     66       extensions = {
     67         ParserFunctions = null;
     68       };
     69       extraConfig = ''
     70         $wgEnableUploads = true;
     71         $wgUseImageMagick = true;
     72       '' + lib.optionalString cfg.privateWiki ''
     73         $wgGroupPermissions['*']['read'] = false;
     74         $wgGroupPermissions['*']['edit'] = false;
     75         $wgGroupPermissions['*']['createpage'] = false;
     76         $wgGroupPermissions['*']['createtalk'] = false;
     77         $wgGroupPermissions['*']['createaccount'] = false;
     78       '' + ''
     79         $wgFileExtensions = [${lib.concatMapStringsSep ", " (ext: "'${ext}'") cfg.allowedFileExtensions}];
     80       '';
     81     };
     82 
     83     services.nginx.virtualHosts.${cfg.domain} = {
     84       enableACME = true;
     85       forceSSL = true;
     86     };
     87   };
     88 }