blob: 026d4643edb5f4f406f694e8bfa9b6067a49cf0c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
|
{ config, ... }:
{
config = {
services.postgresql = {
ensureDatabases = [ "firefly-iii" ];
ensureUsers = [
{ name = "firefly-iii";
ensureDBOwnership = true;
}
];
};
services.firefly-iii = {
enable = true;
enableNginx = true;
group = "firefly-iii";
virtualHost = "firefly.yggdrasil.li";
settings = {
DB_CONNECTION = "pgsql";
DB_DATABASE = "firefly-iii";
APP_KEY_FILE = config.sops.secrets."firefly-iii_app_key".path;
APP_URL = "https://${config.services.firefly-iii.virtualHost}";
};
};
services.nginx = {
commonHttpConfig = ''
map $http_x_forwarded_proto $fastcgi_param_https_variable {
default ''';
https 'on';
}
'';
virtualHosts.${config.services.firefly-iii.virtualHost} = {
listen = [
{ addr = "[2a03:4000:52:ada:4:1::]"; port = 9000; }
];
extraConfig = ''
set_real_ip_from 2a03:4000:52:ada:4::;
'';
locations."~ \\.php$" = {
extraConfig = ''
fastcgi_param HTTPS $fastcgi_param_https_variable;
'';
};
};
};
sops.secrets."firefly-iii_app_key" = {
format = "binary";
sopsFile = ./app_key;
group = config.services.firefly-iii.group;
mode = "0440";
restartUnits = [ "firefly-iii-setup.service" "firefly-iii-cron.service" "phpfpm-firefly-iii.service" ];
};
users.groups.${config.services.firefly-iii.group} = {};
systemd.services = {
nginx.serviceConfig.SupplementaryGroups = [ config.services.firefly-iii.group ];
"firefly-iii-setup".serviceConfig.ReadWritePaths = [ "/run/postgresql" ];
"firefly-iii-cron".serviceConfig.ReadWritePaths = [ "/run/postgresql" ];
};
};
}
|
