citadel

My dotfiles, scripts and nix configs
git clone git://jb55.com/citadel
Log | Files | Refs | README | LICENSE

default.nix (7052B)

      1 extra:
      2 { config, lib, pkgs, ... }:
      3 let logDir = "/var/log/nginx";
      4 
      5     damus-api = (import (pkgs.fetchFromGitHub {
      6       owner  = "damus-io";
      7       repo   = "api";
      8       rev    = "68a4aafbf284ec2281e1a842177c8fd1386586c1";
      9       sha256 = "sha256-fxDrV2J8DtwVlU9hq2DRkQGLrarJMh3VxifouQeryEU=";
     10     }) {}).package;
     11 
     12     damus-api-port = 4000;
     13     damus-api-staging-port = 4001;
     14     damus-api-service = {env, port, db}: {
     15       description = "damus-api-${env}";
     16       wantedBy = [ "multi-user.target" ];
     17       serviceConfig.Type = "simple";
     18       serviceConfig.ExecStart = "${damus-api}/bin/damus-api";
     19 
     20       environment = {
     21         PORT="${toString port}";
     22         DEEPL_KEY=extra.private.deepl_key;
     23         LN_NODE_ID=extra.private.ln_node_id;
     24         LN_NODE_ADDRESS=extra.private.ln_node_address;
     25         LN_RUNE=extra.private.ln_rune;
     26         LN_WS_PROXY=extra.private.ln_ws_proxy;
     27         TEST_PRODUCTS=if env != "production" then "true" else "false";
     28         DB_PATH=db;
     29       };
     30     };
     31 in {
     32   systemd.services.damus-api-staging = damus-api-service {
     33     env = "staging";
     34     port = damus-api-staging-port;
     35     db = "/home/purple/api/staging";
     36   };
     37 
     38   systemd.services.damus-api = damus-api-service {
     39     env = "production";
     40     port = damus-api-port;
     41     db = "/home/purple/api/production";
     42   };
     43 
     44   services.nginx = {
     45     enable = true;
     46 
     47     config = ''
     48       worker_processes 2;
     49 
     50       events {
     51       	worker_connections 768;
     52         # multi_accept on;
     53       }
     54     '';
     55 
     56     httpConfig = ''
     57       port_in_redirect off;
     58       ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
     59       ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
     60       ssl_prefer_server_ciphers on;
     61 
     62       # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
     63       add_header Strict-Transport-Security max-age=15768000;
     64 
     65       sendfile on;
     66       tcp_nopush on;
     67       tcp_nodelay on;
     68       keepalive_timeout 65;
     69       # server_tokens off;
     70       proxy_buffering off;
     71       proxy_read_timeout 300s;
     72       expires off;
     73 
     74       access_log ${logDir}/access.log;
     75       error_log ${logDir}/error.log;
     76 
     77       gzip on;
     78       gzip_disable "msie6";
     79 
     80       server {
     81         listen      80 default_server;
     82         server_name "";
     83         return      444;
     84       }
     85 
     86       server {
     87         listen 80;
     88 
     89         server_name api.damus.io;
     90 
     91         location / {
     92           proxy_pass http://localhost:${toString damus-api-port};
     93           proxy_set_header Host $host;
     94           proxy_set_header X-Real-IP $remote_addr;
     95 
     96           add_header 'Access-Control-Allow-Origin' 'https://damus.io' always;
     97           add_header 'Access-Control-Expose-Headers' 'Content-Length' always;
     98         }
     99       }
    100 
    101       server {
    102         listen 80;
    103 
    104         server_name api-staging.damus.io;
    105 
    106         location / {
    107           proxy_pass http://localhost:${toString damus-api-staging-port};
    108           proxy_set_header Host $host;
    109           proxy_set_header X-Real-IP $remote_addr;
    110 
    111           add_header 'Access-Control-Allow-Origin' 'https://staging.damus.io' always;
    112           add_header 'Access-Control-Expose-Headers' 'Content-Length' always;
    113         }
    114       }
    115 
    116       server {
    117         listen 80;
    118 
    119         server_name staging.damus.io;
    120 
    121         location / {
    122           root /www/staging.damus.io;
    123 
    124           add_header 'Access-Control-Allow-Origin' '*' always;
    125           add_header 'Access-Control-Expose-Headers' 'Content-Length' always;
    126         }
    127       }
    128 
    129       server {
    130         listen 80;
    131 
    132         server_name damus.io;
    133 
    134         location / {
    135           root /www/damus.io;
    136 
    137           add_header 'Access-Control-Allow-Origin' '*' always;
    138           add_header 'Access-Control-Expose-Headers' 'Content-Length' always;
    139         }
    140 
    141         location ~* "^/(?<note>note1[qpzry9x8gf2tvdw0s3jn54khce6mua7l]+)(?<end>.png)?/?$" {
    142           proxy_pass http://localhost:3000;
    143         }
    144 
    145         location ~* "^/(?<nevent>nevent1[qpzry9x8gf2tvdw0s3jn54khce6mua7l]+)(?<end>.png)?/?$" {
    146           proxy_pass http://localhost:3000;
    147         }
    148 
    149         location ~* "^/(?<pk>npub1[qpzry9x8gf2tvdw0s3jn54khce6mua7l]+)(?<end>.png)?/?$" {
    150           proxy_pass http://localhost:3000;
    151         }
    152 
    153         location ~* "^/(?<pk>nprofile1[qpzry9x8gf2tvdw0s3jn54khce6mua7l]+)(?<end>.png)?/?$" {
    154           proxy_pass http://localhost:3000;
    155         }
    156 
    157         location /github-hook {
    158           proxy_pass http://localhost:3111;
    159           proxy_set_header Host $host;
    160           proxy_set_header X-Real-IP $remote_addr;
    161         }
    162 
    163         location /appstore {
    164           return 301 https://apps.apple.com/us/app/damus/id1628663131;
    165         }
    166 
    167         location /devchat {
    168           return 301 https://t.me/+abMSAEO6ho8xYjdh;
    169         }
    170 
    171         location /testflight {
    172           return 301 https://testflight.apple.com/join/CLwjLxWl;
    173         }
    174 
    175         location /code {
    176           return 301 https://github.com/damus-io/damus/pulls;
    177         }
    178 
    179         location /list/patches {
    180           return 301 https://groups.google.com/a/damus.io/g/patches;
    181         }
    182 
    183         location /list/product {
    184           return 301 https://groups.google.com/a/damus.io/g/product;
    185         }
    186 
    187         location /list/design {
    188           return 301 https://groups.google.com/a/damus.io/g/design;
    189         }
    190 
    191         location /list/dev {
    192           return 301 https://groups.google.com/a/damus.io/g/dev;
    193         }
    194 
    195         location /figma {
    196           return 301 https://www.figma.com/file/ORaT1T0Ywfbm0sIjwy5Rgq/Damus-iOS?type=design&node-id=0-1&t=AGpDcKb6rHfpQ9CA-0;
    197         }
    198 
    199         location /merch/hat {
    200           return 302 http://lnlink.org/?d=ASED88EIzNU2uFJoQfClxYISu55lhKHrSTCA58HMNPgtrXECMjQuODQuMTUyLjE4Nzo4MzI0AANgB6Cj2QCeZAFOZ1nS6qGuRe4Vf6qzwJyQ5Qo3b0HRt_w9MTIwJm1ldGhvZD1pbnZvaWNlfG1ldGhvZD13YWl0aW52b2ljZSZwbmFtZWxhYmVsXmxubGluay0mcmF0ZT04BERhbXVzIEhhdAAFAALG8AZUaGFua3MgZm9yIHN1cHBvcnRpbmcgRGFtdXMhAA==;
    201         }
    202 
    203         location /merch {
    204           return 302 http://lnlink.org/?d=ASED88EIzNU2uFJoQfClxYISu55lhKHrSTCA58HMNPgtrXECMjQuODQuMTUyLjE4Nzo4MzI0AANgB6Cj2QCeZAFOZ1nS6qGuRe4Vf6qzwJyQ5Qo3b0HRt_w9MTIwJm1ldGhvZD1pbnZvaWNlfG1ldGhvZD13YWl0aW52b2ljZSZwbmFtZWxhYmVsXmxubGluay0mcmF0ZT04BERhbXVzIE1lcmNoAAUAAfvQBlRoYW5rcyBmb3Igc3VwcG9ydGluZyBkYW11cyEA;
    205         }
    206       }
    207 
    208       server {
    209         listen 80;
    210         listen [::]:80;
    211 
    212         server_name www.damus.io;
    213         return 301 https://damus.io$request_uri;
    214       }
    215     '';
    216   };
    217 }