Compare commits
6 Commits
1d5c375841
...
ce57ed6732
| Author | SHA1 | Date |
|---|---|---|
 Jill
|
ce57ed6732 | 4 months ago |
|
Jill
|
ce5607c49e | 4 months ago |
|
Jill
|
4e92a5eae8 | 4 months ago |
|
Jill
|
639d9a864d | 5 months ago |
|
Jill
|
213f11c31c | 5 months ago |
|
Jill
|
b16a1a7a19 | 5 months ago |
@ -0,0 +1,158 @@
|
||||
{ pkgs, lib, config, options, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
cfg = config.modules.services.ghost;
|
||||
# user used to run the Ghost service
|
||||
userName = builtins.replaceStrings [ "." ] [ "_" ] cfg.domain;
|
||||
in {
|
||||
options.modules.services.ghost = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = false;
|
||||
};
|
||||
package = mkOption {
|
||||
type = types.package;
|
||||
default = pkgs._.ghost;
|
||||
};
|
||||
domain = mkOption {
|
||||
type = types.str;
|
||||
default = "blog.oat.zone";
|
||||
};
|
||||
port = mkOption {
|
||||
type = types.int;
|
||||
default = 1357;
|
||||
};
|
||||
dataDir = mkOption {
|
||||
type = types.str;
|
||||
default = "/var/lib/${userName}";
|
||||
};
|
||||
};
|
||||
|
||||
config = let
|
||||
# directory used to save the blog content
|
||||
dataDir = cfg.dataDir;
|
||||
# script that sets up the Ghost content directory
|
||||
setupScript = pkgs.writeScript "${cfg.domain}-setup.sh" ''
|
||||
#! ${pkgs.stdenv.shell} -e
|
||||
chmod g+s "${dataDir}"
|
||||
[[ ! -d "${dataDir}/content" ]] && cp -r "${cfg.package}/content" "${dataDir}/content"
|
||||
chown -R "${userName}":"${userName}" "${dataDir}/content"
|
||||
chmod -R +w "${dataDir}/content"
|
||||
ln -f -s "/etc/${cfg.domain}.json" "${dataDir}/config.production.json"
|
||||
[[ -d "${dataDir}/current" ]] && rm "${dataDir}/current"
|
||||
ln -f -s "${cfg.package}/current" "${dataDir}/current"
|
||||
[[ -d "${dataDir}/content/themes/casper" ]] && rm "${dataDir}/content/themes/casper"
|
||||
ln -f -s "${cfg.package}/current/content/themes/casper" "${dataDir}/content/themes/casper"
|
||||
'';
|
||||
in lib.mkIf cfg.enable {
|
||||
# Creates the user and group
|
||||
users.users.${userName} = {
|
||||
isSystemUser = true;
|
||||
group = userName;
|
||||
createHome = true;
|
||||
home = dataDir;
|
||||
};
|
||||
users.groups.${userName} = { };
|
||||
|
||||
# Creates the Ghost config
|
||||
environment.etc."${cfg.domain}.json".text = ''
|
||||
{
|
||||
"url": "https://${cfg.domain}",
|
||||
"server": {
|
||||
"port": ${toString cfg.port},
|
||||
"host": "0.0.0.0"
|
||||
},
|
||||
"database": {
|
||||
"client": "mysql",
|
||||
"connection": {
|
||||
"host": "localhost",
|
||||
"user": "${userName}",
|
||||
"database": "${userName}",
|
||||
"password": "",
|
||||
"socketPath": "/run/mysqld/mysqld.sock"
|
||||
}
|
||||
},
|
||||
"mail": {
|
||||
"transport": "sendmail"
|
||||
},
|
||||
"logging": {
|
||||
"transports": ["stdout"]
|
||||
},
|
||||
"paths": {
|
||||
"contentPath": "${dataDir}/content"
|
||||
}
|
||||
}
|
||||
'';
|
||||
|
||||
# Sets up the Systemd service
|
||||
systemd.services."${cfg.domain}" = {
|
||||
enable = true;
|
||||
description = "${cfg.domain} ghost blog";
|
||||
restartIfChanged = true;
|
||||
restartTriggers =
|
||||
[ cfg.package config.environment.etc."${cfg.domain}.json".source ];
|
||||
requires = [ "mysql.service" ];
|
||||
after = [ "mysql.service" ];
|
||||
path = [ pkgs.nodejs pkgs.vips ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
serviceConfig = {
|
||||
User = userName;
|
||||
Group = userName;
|
||||
WorkingDirectory = dataDir;
|
||||
# Executes the setup script before start
|
||||
ExecStartPre = setupScript;
|
||||
# Runs Ghost with node
|
||||
ExecStart = "${pkgs.nodejs}/bin/node current/index.js";
|
||||
# Sandboxes the Systemd service
|
||||
AmbientCapabilities = [ ];
|
||||
CapabilityBoundingSet = [ ];
|
||||
KeyringMode = "private";
|
||||
LockPersonality = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateMounts = true;
|
||||
PrivateTmp = true;
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectSystem = "full";
|
||||
RemoveIPC = true;
|
||||
RestrictAddressFamilies = [ ];
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
};
|
||||
environment = { NODE_ENV = "production"; };
|
||||
};
|
||||
|
||||
# Sets up the blog virtual host on NGINX
|
||||
services.nginx.virtualHosts.${cfg.domain} = {
|
||||
# Sets up Lets Encrypt SSL certificates for the blog
|
||||
forceSSL = true;
|
||||
enableACME = true;
|
||||
locations."/" = { proxyPass = "http://127.0.0.1:${toString cfg.port}"; };
|
||||
extraConfig = ''
|
||||
charset UTF-8;
|
||||
|
||||
add_header Strict-Transport-Security "max-age=2592000; includeSubDomains" always;
|
||||
add_header Referrer-Policy "strict-origin-when-cross-origin";
|
||||
add_header X-Frame-Options "SAMEORIGIN";
|
||||
add_header X-XSS-Protection "1; mode=block";
|
||||
add_header X-Content-Type-Options nosniff;
|
||||
'';
|
||||
};
|
||||
|
||||
# Sets up MySQL database and user for Ghost
|
||||
services.mysql = {
|
||||
ensureDatabases = [ userName ];
|
||||
ensureUsers = [{
|
||||
name = userName;
|
||||
ensurePermissions = { "${userName}.*" = "ALL PRIVILEGES"; };
|
||||
}];
|
||||
};
|
||||
};
|
||||
}
|
||||
@ -0,0 +1,9 @@
|
||||
source "$stdenv"/setup
|
||||
|
||||
export HOME=$(mktemp -d)
|
||||
|
||||
npm install --loglevel=info --logs-max=0 "ghost-cli@$ghostCliVersion"
|
||||
|
||||
mkdir --parents "$out"/
|
||||
node_modules/ghost-cli/bin/ghost install "$version" --db=sqlite3 \
|
||||
--no-enable --no-prompt --no-stack --no-setup --no-start --dir "$out"
|
||||
@ -0,0 +1,11 @@
|
||||
{ pkgs }:
|
||||
|
||||
let
|
||||
pname = "ghost";
|
||||
version = "5.33.2";
|
||||
in pkgs.stdenv.mkDerivation {
|
||||
inherit pname version;
|
||||
buildInputs = with pkgs; [ nodejs yarn vips ];
|
||||
ghostCliVersion = "1.24.0";
|
||||
builder = ./builder.sh;
|
||||
}
|
||||
Loading…
Reference in New Issue