blob: 40bbe88710b2eb479f5dc420defb2f19abf5ab77 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
|
{
options,
lib,
config,
...
}: let
cfg = config.services.podcastitlater-web;
rootDomain = "bensima.com";
ports = import ../../Omni/Cloud/Ports.nix;
in {
options.services.podcastitlater-web = {
enable = lib.mkEnableOption "Enable the PodcastItLater web service";
port = lib.mkOption {
type = lib.types.int;
default = 8000;
description = ''
The port on which PodcastItLater web will listen for
incoming HTTP traffic.
'';
};
dataDir = lib.mkOption {
type = lib.types.path;
default = "/var/podcastitlater";
description = "Data directory for PodcastItLater (shared with worker)";
};
package = lib.mkOption {
type = lib.types.package;
description = "PodcastItLater web package to use";
};
};
config = lib.mkIf cfg.enable {
systemd.services.podcastitlater-web = {
path = [cfg.package];
wantedBy = ["multi-user.target"];
preStart = ''
# Create data directory if it doesn't exist
mkdir -p ${cfg.dataDir}
# Manual step: create this file with secrets
# SECRET_KEY=your-secret-key-for-sessions
# SESSION_SECRET=your-session-secret
# EMAIL_FROM=noreply@podcastitlater.bensima.com
# SMTP_SERVER=smtp.mailgun.org
# SMTP_PASSWORD=your-smtp-password
# STRIPE_SECRET_KEY=sk_live_your_stripe_secret_key
# STRIPE_WEBHOOK_SECRET=whsec_your_webhook_secret
# STRIPE_PRICE_ID_PERSONAL=price_your_personal_price_id
# STRIPE_PRICE_ID_PRO=price_your_pro_price_id
test -f /run/podcastitlater/env
'';
script = ''
${cfg.package}/bin/podcastitlater-web
'';
description = ''
PodcastItLater Web Service
'';
serviceConfig = {
Environment = [
"PORT=${toString cfg.port}"
"AREA=Live"
"DATA_DIR=${cfg.dataDir}"
"BASE_URL=https://podcastitlater.${rootDomain}"
];
EnvironmentFile = "/run/podcastitlater/env";
KillSignal = "INT";
Type = "simple";
Restart = "on-abort";
RestartSec = "1";
};
};
# Nginx configuration
services.nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
statusPage = true;
virtualHosts."podcastitlater.${rootDomain}" = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = "http://127.0.0.1:${toString cfg.port}";
proxyWebsockets = true;
};
};
};
# Ensure firewall allows web traffic
networking.firewall.allowedTCPPorts = [ports.ssh ports.http ports.https];
};
}
|
