blob: 33909cfef80b20e253d6c9a24e7c933bd1a70fb7 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
|
{
config,
lib,
pkgs,
...
}:
let
cfg = config.services.remark42;
siteList = lib.concatStringsSep "," cfg.sites;
in
{
options.services.remark42 = {
enable = lib.mkEnableOption "Remark42 commenting server";
package = lib.mkPackageOption pkgs "remark42" { };
remarkUrl = lib.mkOption {
type = lib.types.str;
example = "https://comments.example.com";
description = ''
Public URL of this Remark42 instance. This is passed to the backend as
`REMARK_URL` and should match the frontend embed config `host`.
'';
};
sites = lib.mkOption {
type = lib.types.listOf lib.types.str;
default = [ "remark" ];
example = [
"blog"
"docs"
];
description = ''
Site IDs served by this instance (passed as `SITE`, comma-separated).
The frontend embed config `site_id` must match one of these values.
'';
};
listenAddress = lib.mkOption {
type = lib.types.str;
default = "127.0.0.1";
example = "0.0.0.0";
description = "Bind address (`REMARK_ADDRESS`).";
};
port = lib.mkOption {
type = lib.types.port;
default = 8080;
description = "Listen port (`REMARK_PORT`).";
};
dataDir = lib.mkOption {
type = lib.types.path;
default = "/var/lib/remark42";
description = ''
Working directory for Remark42. Data files are stored here and
automatic backups will be created in this directory by default.
'';
};
environmentFile = lib.mkOption {
type = lib.types.nullOr lib.types.path;
default = null;
example = "/run/secrets/remark42.env";
description = ''
Optional environment file in systemd `EnvironmentFile=` format.
Use this for secrets to avoid storing them in the Nix store.
'';
};
settings = lib.mkOption {
type = lib.types.attrsOf lib.types.str;
default = { };
example = {
AUTH_ANON = "true";
};
description = "Extra environment variables passed to Remark42.";
};
openFirewall = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Whether to open the firewall for `port`.";
};
};
config = lib.mkIf cfg.enable {
assertions = [
{
assertion = cfg.sites != [ ];
message = "services.remark42.sites must contain at least one site ID.";
}
{
assertion = cfg.environmentFile != null || (cfg.settings ? SECRET);
message = ''
Remark42 requires SECRET.
Provide it via services.remark42.environmentFile (recommended),
or via services.remark42.settings.SECRET (not recommended).
'';
}
];
users.groups.remark42 = { };
users.users.remark42 = {
isSystemUser = true;
group = "remark42";
home = cfg.dataDir;
createHome = true;
description = "Remark42 service user";
};
systemd.services.remark42 = {
description = "Remark42 commenting server";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
environment = cfg.settings // {
REMARK_URL = cfg.remarkUrl;
SITE = siteList;
REMARK_ADDRESS = cfg.listenAddress;
REMARK_PORT = toString cfg.port;
};
serviceConfig = {
Type = "simple";
User = "remark42";
Group = "remark42";
WorkingDirectory = cfg.dataDir;
ExecStart = "${cfg.package}/bin/remark42 server";
Restart = "on-failure";
RestartSec = "2s";
}
// lib.optionalAttrs (cfg.environmentFile != null) {
EnvironmentFile = cfg.environmentFile;
};
};
networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
};
}
|
