1 files changed, 96 insertions, 0 deletions

diff --git a/hosts/surtr/http/webdav/default.nix b/hosts/surtr/http/webdav/default.nix
new file mode 100644
index 00000000..f0aec1e9
--- /dev/null
+++ b/hosts/surtr/http/webdav/default.nix
@@ -0,0 +1,96 @@
+{ config, libs, pkgs, flakeInputs, ... }:
+let
+  webdavSocket = config.services.uwsgi.runDir + "/webdav.sock";
+
+  webdavApp = flakeInputs.mach-nix.lib.${config.nixpkgs.system}.buildPythonPackage {
+    ignoreDataOutdated = true;
+    pname = "py-webdav";
+    version = builtins.readFile ./py-webdav/VERSION;
+    src = ./py-webdav;
+    python = "python3";
+    requirements = ''
+      PyNaCl ==1.5.*
+      psycopg ==3.0.*
+      WsgiDAV ==4.0.*
+    '';
+  };
+in {
+  config = {
+    security.pam.services."webdav".text = ''
+      auth requisite  pam_succeed_if.so user ingroup webdav quiet_success
+      auth required   pam_unix.so likeauth nullok nodelay quiet
+      account sufficient pam_unix.so quiet
+    '';
+    users.groups."webdav" = {};
+    
+    services.nginx = {
+      upstreams."py-webdav" = {
+        servers = {
+          "unix://${webdavSocket}" = {};
+        };
+      };
+      
+      virtualHosts."webdav.141.li" = {
+        forceSSL = true;
+        sslCertificate = "/run/credentials/nginx.service/webdav.141.li.pem";
+        sslCertificateKey = "/run/credentials/nginx.service/webdav.141.li.key.pem";
+        sslTrustedCertificate = "/run/credentials/nginx.service/webdav.141.li.chain.pem";
+        locations = {
+          "/".extraConfig = ''
+            root /srv/files/$remote_user;            
+
+            auth_pam "WebDAV";
+            auth_pam_service_name "webdav";
+          '';
+
+          "/py/".extraConfig = ''
+            rewrite ^/py(.*) $1 break;
+
+            include ${config.services.nginx.package}/conf/uwsgi_params;
+            uwsgi_param SCRIPT_NAME /py;
+            uwsgi_pass py-webdav;
+          '';
+        };
+        extraConfig = ''
+          dav_methods     PUT DELETE MKCOL COPY MOVE;
+          dav_ext_methods PROPFIND OPTIONS;
+          dav_access      user:rw;
+          autoindex on;
+
+          client_max_body_size    0;
+          create_full_put_path    on;
+
+          add_header Strict-Transport-Security "max-age=63072000" always;
+        '';
+      };
+    };
+    security.acme.domains."webdav.141.li" = {
+      certCfg = {
+        postRun = ''
+          ${pkgs.systemd}/bin/systemctl try-restart nginx.service
+        '';
+      };
+    };
+
+    systemd.services.nginx.serviceConfig.LoadCredential = [
+      "webdav.141.li.key.pem:${config.security.acme.certs."webdav.141.li".directory}/key.pem"
+      "webdav.141.li.pem:${config.security.acme.certs."webdav.141.li".directory}/fullchain.pem"
+      "webdav.141.li.chain.pem:${config.security.acme.certs."webdav.141.li".directory}/chain.pem"
+    ];
+
+
+    services.uwsgi.instance.vassals.webdav = {
+      type = "normal";
+      socket = webdavSocket;
+      listen = 1024;
+      master = true;
+      vacuum = true;
+      chown-socket = "${config.services.nginx.user}:${config.services.uwsgi.group}";
+      
+      plugins = ["python3"];
+      pythonPackages = self: [webdavApp];
+      module = "webdav";
+      callable = "app";
+    };
+  };
+}