81 lines
2.0 KiB
Nix
81 lines
2.0 KiB
Nix
{ pkgs, lib, config, ... }: let
|
|
cfg = config.services.hedgedoc;
|
|
in {
|
|
sops = {
|
|
secrets = {
|
|
"hedgedoc/env/cmd_session_secret" = { };
|
|
"hedgedoc/env/cmd_oauth2_client_secret" = { };
|
|
};
|
|
templates."hedgedoc.env" = {
|
|
restartUnits = [ "hedgedoc.service" ];
|
|
owner = "hedgedoc";
|
|
group = "hedgedoc";
|
|
content = let
|
|
inherit (config.sops) placeholder;
|
|
in ''
|
|
CMD_SESSION_SECRET=${placeholder."hedgedoc/env/cmd_session_secret"}
|
|
CMD_OAUTH2_CLIENT_SECRET=${placeholder."hedgedoc/env/cmd_oauth2_client_secret"}
|
|
'';
|
|
};
|
|
};
|
|
|
|
users.groups.hedgedoc.members = [ "nginx" ];
|
|
|
|
services.hedgedoc = {
|
|
enable = true;
|
|
environmentFile = config.sops.templates."hedgedoc.env".path;
|
|
settings = {
|
|
domain = "docs.nani.wtf";
|
|
email = false;
|
|
allowAnonymous = false;
|
|
allowAnonymousEdits = true;
|
|
protocolUseSSL = true;
|
|
|
|
path = "/run/hedgedoc/hedgedoc.sock";
|
|
|
|
db = {
|
|
username = "hedgedoc";
|
|
# TODO: set a password
|
|
database = "hedgedoc";
|
|
host = "/var/run/postgresql";
|
|
dialect = "postgres";
|
|
};
|
|
|
|
oauth2 = let
|
|
authServerUrl = config.services.kanidm.serverSettings.origin;
|
|
in rec {
|
|
baseURL = "${authServerUrl}/oauth2";
|
|
tokenURL = "${authServerUrl}/oauth2/token";
|
|
authorizationURL = "${authServerUrl}/ui/oauth2";
|
|
userProfileURL = "${authServerUrl}/oauth2/openid/${clientID}/userinfo";
|
|
|
|
clientID = "hedgedoc";
|
|
|
|
scope = "openid email profile";
|
|
userProfileUsernameAttr = "name";
|
|
userProfileEmailAttr = "email";
|
|
userProfileDisplayNameAttr = "displayname";
|
|
|
|
providerName = "KaniDM";
|
|
};
|
|
};
|
|
};
|
|
|
|
services.postgresql = {
|
|
ensureDatabases = [ "hedgedoc" ];
|
|
|
|
ensureUsers = [{
|
|
name = "hedgedoc";
|
|
ensureDBOwnership = true;
|
|
}];
|
|
};
|
|
|
|
systemd.services.hedgedoc = rec {
|
|
requires = [
|
|
"postgresql.service"
|
|
"kanidm.service"
|
|
];
|
|
after = requires;
|
|
};
|
|
}
|