Upgrade to 22.05 (and much else)

2022-06-01 13:57:58 -07:00
parent e9e61e24d4
commit a4ba216d71
16 changed files with 548 additions and 368 deletions
@@ -0,0 +1,149 @@
+{ config, lib, pkgs, ... }@toplevel:
+
+with lib;
+let
+  cfg = config.fudo.services.chat;
+
+  hostname = config.instance.hostname;
+  domain-name = config.instance.local-domain;
+  domain = config.fudo.domains.${domain-name};
+  chat-server = domain.chat-server;
+  isChatServer = hostname == chat-server;
+  chat-fqdn = "${cfg.host-alias}.${domain-name}";
+  mail-server = "mail.${domain-name}";
+
+  host-ip = "192.168.19.1";
+  container-ip = "192.168.19.2";
+
+  host-secrets = config.fudo.secrets.host-secrets.${hostname};
+
+  seed = config.instance.build-seed;
+
+  mattermost-mail-passwd-file =
+    pkgs.lib.passwd.stablerandom-passwd-file "mattermost-email" seed;
+
+in {
+  options.fudo.services.chat = with types; {
+    host-alias = mkOption {
+      type = str;
+      description = "CNAME to use for the chat server.";
+      default = "chat";
+    };
+
+    site-name = mkOption {
+      type = str;
+      description = "Name of the chat site.";
+      default = "Fudo Chat";
+    };
+
+    state-directory = mkOption {
+      type = str;
+      description =
+        "Path at which to store chat server state. Must be persistent.";
+    };
+
+    external-interface = mkOption {
+      type = str;
+      description = "Public-facing external interface, for outgoing traffic.";
+    };
+  };
+
+  config = mkIf (chat-server != null) {
+    networking.nat = mkIf isChatServer {
+      enable = true;
+      internalInterfaces = [ "ve-fudo-chat" ];
+      externalInterface = cfg.external-interface;
+    };
+
+    fudo = {
+      users.chat = {
+        uid = 20001;
+        primary-group = "fudo";
+        common-name = cfg.site-name;
+        ldap-hashed-passwd = pkgs.lib.passwd.hash-ldap-passwd "mattermost-chat"
+          mattermost-mail-passwd-file;
+      };
+
+      zones.${domain.zone}.aliases.chat =
+        pkgs.lib.network.host-fqdn config chat-server;
+    };
+
+    systemd.tmpfiles.rules = mkIf isChatServer [
+      "d ${cfg.state-directory}/mattermost 0700 - - - -"
+      "d ${cfg.state-directory}/postgresql 0700 - - - -"
+    ];
+
+    services.nginx = mkIf isChatServer {
+      enable = true;
+      recommendedProxySettings = true;
+      virtualHosts."${chat-fqdn}" = {
+        enableACME = true;
+        forceSSL = true;
+        locations."/" = {
+          proxyPass = "http://${container-ip}:1234";
+          proxyWebsockets = true;
+        };
+      };
+    };
+
+    containers.fudo-chat = mkIf isChatServer {
+      ephemeral = true;
+      privateNetwork = true;
+      hostAddress = host-ip;
+      localAddress = container-ip;
+      autoStart = true;
+
+      bindMounts = {
+        "/var/lib/mattermost" = {
+          hostPath = "${cfg.state-directory}/mattermost";
+          isReadOnly = false;
+        };
+        "/var/lib/postgresql" = {
+          hostPath = "${cfg.state-directory}/postgresql";
+          isReadOnly = false;
+        };
+      };
+
+      config = { config, lib, ... }: {
+        networking = {
+          defaultGateway = host-ip;
+          firewall.enable = false;
+        };
+
+        systemd.tmpfiles.rules = [
+          "d /var/lib/mattermost 700 ${config.services.mattermost.user} - - -"
+          "d /var/lib/postgresql 700 ${config.systemd.services.postgresql.serviceConfig.User} - - -"
+        ];
+
+        services = {
+          postgresql.dataDir = "/var/lib/postgresql";
+
+          mattermost = {
+            enable = true;
+            siteUrl = "https://${chat-fqdn}";
+            siteName = cfg.site-name;
+            statePath = "/var/lib/mattermost";
+            listenAddress = "${container-ip}:1234";
+            localDatabaseCreate = true;
+            extraConfig = {
+              EmailSettings = {
+                RequireEmailVerification = true;
+                SMTPServer = mail-server;
+                SMTPPort = "587";
+                ConnectionSecurity = "STARTTLS";
+                EnableSMTPAuth = true;
+                SMTPUsername = "chat";
+                # TODO: Ugh
+                SMTPPassword = readFile mattermost-mail-passwd-file;
+                SendEmailNotifications = true;
+                FeedbackEmail = "chat@${domain-name}";
+                FeedbackName = cfg.site-name;
+              };
+              EnableEmailNotifications = true;
+            };
+          };
+        };
+      };
+    };
+  };
+}