117 lines
3.9 KiB
Nix
117 lines
3.9 KiB
Nix
{ config, pkgs, flake, inputs, ... }:
|
|
|
|
{
|
|
age.secrets."mastodon-secret-key-base" = {
|
|
file = "${flake.self}/secrets/mastodon-secret-key-base.age";
|
|
mode = "400";
|
|
owner = config.services.mastodon.user;
|
|
};
|
|
age.secrets."mastodon-otp-secret" = {
|
|
file = "${flake.self}/secrets/mastodon-otp-secret.age";
|
|
mode = "400";
|
|
owner = config.services.mastodon.user;
|
|
};
|
|
age.secrets."mastodon-vapid-private-key" = {
|
|
file = "${flake.self}/secrets/mastodon-vapid-private-key.age";
|
|
mode = "400";
|
|
owner = config.services.mastodon.user;
|
|
};
|
|
age.secrets."mastodon-vapid-public-key" = {
|
|
file = "${flake.self}/secrets/mastodon-vapid-public-key.age";
|
|
mode = "400";
|
|
owner = config.services.mastodon.user;
|
|
};
|
|
age.secrets."mastodon-smtp-password" = {
|
|
file = "${flake.self}/secrets/mastodon-smtp-password.age";
|
|
mode = "400";
|
|
owner = config.services.mastodon.user;
|
|
};
|
|
age.secrets."mastodon-extra-env-secrets" = {
|
|
file = "${flake.self}/secrets/mastodon-extra-env-secrets.age";
|
|
mode = "400";
|
|
owner = config.services.mastodon.user;
|
|
};
|
|
|
|
# Nginx user needs access to mastodon unix sockets
|
|
users.users.nginx.extraGroups = [ "mastodon" ];
|
|
|
|
services.mastodon = {
|
|
enable = true;
|
|
# Different from WEB_DOMAIN in our case
|
|
localDomain = "pub.solar";
|
|
enableUnixSocket = true;
|
|
# Processes used by the mastodon-streaming service. Defaults to the number
|
|
# of CPU cores minus one
|
|
# This is without affect until this comment is addressed
|
|
# https://github.com/NixOS/nixpkgs/pull/251950#issuecomment-1732568492
|
|
streamingProcesses = 5;
|
|
# Processes used by the mastodon-web service
|
|
webProcesses = 2;
|
|
# Threads per process used by the mastodon-web service
|
|
webThreads = 5;
|
|
secretKeyBaseFile = "/run/agenix/mastodon-secret-key-base";
|
|
otpSecretFile = "/run/agenix/mastodon-otp-secret";
|
|
vapidPrivateKeyFile = "/run/agenix/mastodon-vapid-private-key";
|
|
vapidPublicKeyFile = "/run/agenix/mastodon-vapid-public-key";
|
|
smtp = {
|
|
createLocally = false;
|
|
host = "mx2.greenbaum.cloud";
|
|
port = 587;
|
|
authenticate = true;
|
|
user = "admins@pub.solar";
|
|
passwordFile = "/run/agenix/mastodon-smtp-password";
|
|
fromAddress = "mastodon-notifications@pub.solar";
|
|
};
|
|
extraEnvFiles = [
|
|
"/run/agenix/mastodon-extra-env-secrets"
|
|
];
|
|
extraConfig = {
|
|
WEB_DOMAIN = "mastodon.pub.solar";
|
|
# Defined in ./opensearch.nix
|
|
ES_HOST = "127.0.0.1";
|
|
# S3 File storage (optional)
|
|
# -----------------------
|
|
S3_ENABLED = "true";
|
|
S3_BUCKET = "pub-solar-mastodon";
|
|
S3_REGION = "europe-west-1";
|
|
S3_ENDPOINT = "https://gateway.tardigradeshare.io";
|
|
S3_ALIAS_HOST = "files.pub.solar";
|
|
# Translation (optional)
|
|
# -----------------------
|
|
DEEPL_PLAN = "free";
|
|
# OpenID Connect
|
|
# --------------
|
|
OIDC_ENABLED = "true";
|
|
OIDC_DISPLAY_NAME = "pub.solar ID";
|
|
OIDC_ISSUER = "https://auth.pub.solar/realms/pub.solar";
|
|
OIDC_DISCOVERY = "true";
|
|
OIDC_SCOPE = "openid,profile,email";
|
|
OIDC_UID_FIELD = "preferred_username";
|
|
OIDC_REDIRECT_URI = "https://mastodon.pub.solar/auth/auth/openid_connect/callback";
|
|
OIDC_SECURITY_ASSUME_EMAIL_IS_VERIFIED = "true";
|
|
# only use OIDC for login / registration
|
|
OMNIAUTH_ONLY = "true";
|
|
};
|
|
};
|
|
|
|
services.restic.backups.mastodon = {
|
|
paths = [
|
|
"/tmp/mastodon-backup.sql"
|
|
];
|
|
timerConfig = {
|
|
OnCalendar = "*-*-* 02:00:00 Etc/UTC";
|
|
# droppie will be offline if nachtigall misses the timer
|
|
Persistent = false;
|
|
};
|
|
initialize = true;
|
|
passwordFile = config.age.secrets."restic-repo-droppie".path;
|
|
repository = "yule@droppie.b12f.io:/media/internal/backups-pub-solar";
|
|
backupPrepareCommand = ''
|
|
${pkgs.sudo}/bin/sudo -iu postgres ${pkgs.postgresql}/bin/pg_dump -d mastodon > /tmp/mastodon-backup.sql
|
|
'';
|
|
backupCleanupCommand = ''
|
|
rm /tmp/mastodon-backup.sql
|
|
'';
|
|
};
|
|
}
|