Something went wrong. Try again.
An ATProto Powered Reputation Network
Something went wrong. Try again.
3.8 kB · 100 lines
Nix
at master
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101{ config, lib, pkgs, ...}:let cfg = config.services.provenance.ui; common = import ./common.nix { inherit lib; }; localAppview = config.services.provenance.appview.enable or false;in{ options.services.provenance.ui = { enable = lib.mkEnableOption "the Provenance UI";
package = lib.mkOption { type = lib.types.package; default = pkgs.callPackage ../package.nix { pname = "provenance-ui"; subPackages = [ "cmd/ui" ]; }; defaultText = lib.literalExpression "the Provenance UI package"; description = "Package that provides bin/ui."; };
listenAddress = lib.mkOption { type = lib.types.str; default = "127.0.0.1:8000"; description = "HTTP listen address in host:port form. Use brackets for IPv6 hosts."; };
stateDirectory = common.stateOption "provenance-ui"; dataDirectory = common.dataOption cfg.stateDirectory; externalWorkers = common.externalWorkersOption; logLevel = common.logLevelOption; databaseFile = common.databaseOption "ui.db"; serviceKeyFile = common.secretOption "Absolute runtime path to the appview service key. Keep the file outside the Nix store."; encryptionKeyFile = common.secretOption "Absolute runtime path to the base64-encoded 32-byte encryption key. Keep the file outside the Nix store.";
publicOrigin = lib.mkOption { type = lib.types.str; default = "http://127.0.0.1:8000"; example = "https://provenance.example.com"; description = "Browser origin and OAuth callback origin. Use HTTPS except for loopback development."; };
appviewURL = lib.mkOption { type = lib.types.str; default = "http://127.0.0.1:8001"; description = "Appview origin. Use HTTPS for remote appviews or HTTP on loopback."; }; };
config = lib.mkIf cfg.enable ( lib.mkMerge [ (common.dataConfig "ui" cfg.stateDirectory cfg.dataDirectory) { assertions = [ { assertion = common.validSecret cfg.serviceKeyFile; message = "services.provenance.ui.serviceKeyFile must name an absolute runtime file outside the Nix store."; } { assertion = common.validSecret cfg.encryptionKeyFile; message = "services.provenance.ui.encryptionKeyFile must name an absolute runtime file outside the Nix store."; } { assertion = !localAppview || cfg.stateDirectory != config.services.provenance.appview.stateDirectory; message = "The Provenance UI and appview require separate state directories."; } { assertion = !localAppview || cfg.dataDirectory != config.services.provenance.appview.dataDirectory; message = "The Provenance UI and appview require separate data directories."; } ];
systemd.services.provenance-ui = lib.mkMerge [ (common.unit { inherit (cfg) package stateDirectory dataDirectory; binary = "ui"; credentials = { PROVENANCE_SERVICE_KEY = cfg.serviceKeyFile; PROVENANCE_ENCRYPTION_KEY = cfg.encryptionKeyFile; }; environment = { PROVENANCE_UI_ADDR = cfg.listenAddress; PROVENANCE_UI_DB = "${cfg.dataDirectory}/${cfg.databaseFile}"; PROVENANCE_PUBLIC_ORIGIN = cfg.publicOrigin; PROVENANCE_APPVIEW_URL = cfg.appviewURL; PROVENANCE_EXTERNAL_WORKERS = toString cfg.externalWorkers; PROVENANCE_LOG_LEVEL = cfg.logLevel; }; }) (lib.mkIf localAppview { after = [ "provenance-appview.service" ]; }) ]; } ] );}