2023-01-17 17:02:34 +00:00
|
|
|
{ config, pkgs, lib, ... }:
|
|
|
|
let
|
|
|
|
secrets = import ./secrets.nix;
|
|
|
|
|
2024-08-12 13:33:29 +00:00
|
|
|
image = "chocobozzz/peertube:production-bookworm";
|
2023-01-17 17:02:34 +00:00
|
|
|
|
2023-01-17 17:20:56 +00:00
|
|
|
s3cmd = pkgs.writeShellScript "s3cmd" ''
|
|
|
|
${pkgs.s3cmd}/bin/s3cmd \
|
|
|
|
--access_key='${secrets.backup.accessKey}' \
|
|
|
|
--secret_key='${secrets.backup.secretKey}' \
|
|
|
|
--host='${secrets.backup.host}' \
|
|
|
|
--host-bucket='${secrets.backup.hostBucket}' \
|
|
|
|
$@
|
|
|
|
'';
|
|
|
|
|
|
|
|
bucket = secrets.backup.bucket;
|
|
|
|
|
2023-01-17 17:02:34 +00:00
|
|
|
domainName = "v.lor.sh";
|
|
|
|
hostName = builtins.replaceStrings [ "." ] [ "-" ] "${domainName}";
|
|
|
|
in {
|
|
|
|
imports = [ ./hardware-configuration.nix ];
|
|
|
|
|
|
|
|
boot.loader = {
|
|
|
|
efi.canTouchEfiVariables = true;
|
|
|
|
grub = {
|
|
|
|
enable = true;
|
|
|
|
efiSupport = true;
|
|
|
|
device = "nodev";
|
|
|
|
mirroredBoots = [{
|
|
|
|
devices = [ "nodev" ];
|
|
|
|
path = "/boot-fallback";
|
|
|
|
}];
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
networking = {
|
|
|
|
hostName = hostName;
|
|
|
|
hostId = (builtins.substring 0 8 (builtins.readFile "/etc/machine-id"));
|
|
|
|
|
|
|
|
useDHCP = false;
|
|
|
|
|
|
|
|
interfaces.eno1 = {
|
|
|
|
ipv4 = secrets.ipv4;
|
|
|
|
ipv6 = secrets.ipv6;
|
|
|
|
};
|
|
|
|
|
|
|
|
nameservers = [ "1.1.1.1" ];
|
|
|
|
|
|
|
|
firewall = {
|
|
|
|
enable = true;
|
2023-01-17 18:37:13 +00:00
|
|
|
allowedTCPPorts = [ 80 443 1935 ];
|
2023-01-17 17:02:34 +00:00
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
users.extraUsers.root.openssh.authorizedKeys.keys = secrets.pubkeys;
|
|
|
|
|
|
|
|
services.openssh.enable = true;
|
|
|
|
|
2024-08-12 13:33:40 +00:00
|
|
|
environment.systemPackages = with pkgs; [ vim htop git tmux jq ];
|
2023-01-17 17:02:34 +00:00
|
|
|
|
|
|
|
services.caddy = {
|
|
|
|
enable = true;
|
|
|
|
virtualHosts."${domainName}".extraConfig = ''
|
|
|
|
encode gzip
|
|
|
|
|
|
|
|
root * /dev/null
|
|
|
|
reverse_proxy localhost:9000
|
|
|
|
|
|
|
|
header {
|
|
|
|
Strict-Transport-Security "max-age=31536000;"
|
|
|
|
}
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
system.activationScripts.peertube = ''
|
|
|
|
mkdir -p /var/lib/peertube/{storage,config}
|
|
|
|
cat > /var/lib/peertube/config/local.yml <<EOF
|
2023-01-17 18:45:40 +00:00
|
|
|
instance:
|
|
|
|
name: 'v.lor.sh'
|
2023-01-17 22:10:33 +00:00
|
|
|
terms: 'See [lor.sh/about](https://lor.sh/about). Only original content is allowed.'
|
|
|
|
|
|
|
|
smtp:
|
|
|
|
transport: smtp
|
|
|
|
hostname: 'smtp.eu.mailgun.org'
|
|
|
|
port: 587
|
|
|
|
username: 'peertube@m.lor.sh'
|
|
|
|
password: '${secrets.smtpPassword}'
|
|
|
|
tls: false
|
|
|
|
disable_starttls: false
|
|
|
|
from_address: 'peertube@m.lor.sh'
|
2023-01-17 18:45:40 +00:00
|
|
|
|
2023-01-17 17:02:34 +00:00
|
|
|
redis:
|
|
|
|
hostname: '${hostName}'
|
|
|
|
|
|
|
|
object_storage:
|
|
|
|
enabled: true
|
|
|
|
endpoint: 'https://sos-ch-gva-2.exo.io'
|
|
|
|
region: 'ch-gva-2'
|
|
|
|
|
|
|
|
upload_acl:
|
|
|
|
public: 'public-read'
|
2023-04-09 11:41:39 +00:00
|
|
|
private: 'private'
|
2023-01-17 17:02:34 +00:00
|
|
|
|
|
|
|
proxy:
|
2023-04-09 11:41:39 +00:00
|
|
|
proxify_private_files: true
|
2023-01-17 17:02:34 +00:00
|
|
|
|
|
|
|
credentials:
|
|
|
|
access_key_id: '${secrets.peertube.s3.id}'
|
|
|
|
secret_access_key: '${secrets.peertube.s3.key}'
|
|
|
|
|
2023-01-19 08:35:39 +00:00
|
|
|
max_upload_part: 128MB
|
2023-01-17 17:02:34 +00:00
|
|
|
|
|
|
|
streaming_playlists:
|
|
|
|
bucket_name: 'v-lor-sh'
|
|
|
|
prefix: 'streaming-playlists/'
|
2023-04-09 11:35:01 +00:00
|
|
|
base_url: 'https://sos-ch-gva-2.exo.io/v-lor-sh'
|
2023-01-17 17:02:34 +00:00
|
|
|
|
|
|
|
videos:
|
|
|
|
bucket_name: 'v-lor-sh'
|
|
|
|
prefix: 'videos/'
|
2023-04-09 11:35:01 +00:00
|
|
|
base_url: 'https://sos-ch-gva-2.exo.io/v-lor-sh'
|
2023-01-17 18:37:13 +00:00
|
|
|
|
|
|
|
transcoding:
|
|
|
|
resolutions:
|
|
|
|
0p: true
|
|
|
|
144p: true
|
|
|
|
480p: true
|
|
|
|
720p: true
|
|
|
|
1080p: true
|
|
|
|
2160p: true
|
|
|
|
|
|
|
|
live:
|
2023-04-09 11:09:47 +00:00
|
|
|
enabled: true
|
2023-01-17 18:37:13 +00:00
|
|
|
transcoding:
|
2023-01-19 09:43:30 +00:00
|
|
|
threads: 4
|
2023-01-17 18:37:13 +00:00
|
|
|
resolutions:
|
|
|
|
480p: true
|
|
|
|
1080p: true
|
2024-09-19 08:52:32 +00:00
|
|
|
|
|
|
|
video_transcription:
|
|
|
|
enabled: true
|
|
|
|
engine: 'whisper-ctranslate2'
|
|
|
|
model: 'large-v3'
|
|
|
|
|
2023-01-17 17:02:34 +00:00
|
|
|
EOF
|
|
|
|
'';
|
|
|
|
|
|
|
|
users.users.peertube = {
|
|
|
|
isSystemUser = true;
|
|
|
|
group = "peertube";
|
|
|
|
};
|
|
|
|
|
|
|
|
users.groups.peertube = { };
|
|
|
|
|
|
|
|
systemd.services.peertube-init-db = {
|
|
|
|
description = "Initialization database for PeerTube daemon";
|
|
|
|
after = [ "network.target" "postgresql.service" ];
|
|
|
|
requires = [ "postgresql.service" ];
|
|
|
|
before = [ "docker-peertube.service" ];
|
|
|
|
wantedBy = [ "docker-peertube.service" ];
|
|
|
|
script = ''
|
|
|
|
${pkgs.postgresql}/bin/psql peertube -c '\q' && exit 0
|
|
|
|
${pkgs.postgresql}/bin/createuser -w peertube
|
|
|
|
${pkgs.postgresql}/bin/psql -c "ALTER USER peertube WITH PASSWORD '${secrets.peertube.db.password}'";
|
|
|
|
|
|
|
|
${pkgs.postgresql}/bin/createdb -O peertube -E UTF8 -T template0 peertube
|
|
|
|
${pkgs.postgresql}/bin/psql -c "CREATE EXTENSION pg_trgm;" peertube
|
|
|
|
${pkgs.postgresql}/bin/psql -c "CREATE EXTENSION unaccent;" peertube
|
|
|
|
'';
|
|
|
|
serviceConfig = {
|
|
|
|
Type = "oneshot";
|
|
|
|
User = "postgres";
|
|
|
|
Group = "postgres";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
|
|
services.postgresql = {
|
|
|
|
enable = true;
|
|
|
|
enableTCPIP = true;
|
|
|
|
};
|
|
|
|
|
2023-01-17 17:20:56 +00:00
|
|
|
services.postgresqlBackup = {
|
|
|
|
enable = true;
|
|
|
|
databases = [ "peertube" ];
|
|
|
|
compression = "gzip";
|
|
|
|
};
|
|
|
|
|
|
|
|
systemd.services.postgresqlBackup-peertube.serviceConfig.ExecStartPost =
|
|
|
|
pkgs.writeShellScript "backup-to-s3" ''
|
|
|
|
cd /var/backup/postgresql
|
|
|
|
|
|
|
|
${pkgs.gnupg}/bin/gpg --batch --passphrase '${secrets.backup.password}' \
|
|
|
|
--symmetric peertube.sql.gz
|
|
|
|
|
|
|
|
${s3cmd} rm ${bucket}/peertube.prev.sql.gz.gpg
|
|
|
|
${s3cmd} mv ${bucket}/peertube.sql.gz.gpg ${bucket}/peertube.prev.sql.gz.gpg
|
|
|
|
${s3cmd} put peertube.sql.gz.gpg ${bucket}/
|
|
|
|
|
|
|
|
rm peertube.sql.gz.gpg
|
|
|
|
'';
|
|
|
|
|
2023-01-17 17:02:34 +00:00
|
|
|
services.redis.servers.peertube = {
|
|
|
|
enable = true;
|
|
|
|
bind = "127.0.0.1";
|
|
|
|
port = 6379;
|
|
|
|
};
|
|
|
|
|
|
|
|
virtualisation.oci-containers.backend = "docker";
|
2023-01-17 18:36:51 +00:00
|
|
|
virtualisation.docker.liveRestore = false;
|
2023-01-17 17:02:34 +00:00
|
|
|
|
|
|
|
virtualisation.oci-containers.containers = {
|
|
|
|
peertube = {
|
|
|
|
image = image;
|
|
|
|
environment = {
|
|
|
|
PEERTUBE_SECRET = "${secrets.peertube.secret}";
|
|
|
|
PEERTUBE_WEBSERVER_HOSTNAME = domainName;
|
|
|
|
PEERTUBE_DB_USERNAME = "peertube";
|
|
|
|
PEERTUBE_DB_PASSWORD = secrets.peertube.db.password;
|
|
|
|
PEERTUBE_DB_HOSTNAME = hostName;
|
|
|
|
PEERTUBE_ADMIN_EMAIL = secrets.peertube.admin.email;
|
|
|
|
};
|
|
|
|
volumes = [
|
|
|
|
"/var/lib/peertube/storage:/data"
|
|
|
|
"/var/lib/peertube/config:/config"
|
|
|
|
];
|
2023-01-19 07:59:33 +00:00
|
|
|
extraOptions = [ "--network=host" "--pull=always" ];
|
2023-01-17 17:02:34 +00:00
|
|
|
};
|
|
|
|
};
|
|
|
|
|
2023-01-19 07:48:09 +00:00
|
|
|
systemd.services.docker-peertube.serviceConfig.TimeoutStopSec = lib.mkForce 4;
|
2023-01-21 08:50:14 +00:00
|
|
|
systemd.services.docker-peertube.serviceConfig.RestartSec = lib.mkForce 16;
|
2023-01-19 07:48:09 +00:00
|
|
|
|
2023-01-17 17:02:34 +00:00
|
|
|
services.zfs = {
|
|
|
|
autoScrub.enable = true;
|
|
|
|
trim.enable = true;
|
|
|
|
};
|
|
|
|
|
|
|
|
time.timeZone = "UTC";
|
|
|
|
|
|
|
|
system.autoUpgrade = {
|
|
|
|
enable = true;
|
|
|
|
allowReboot = true;
|
|
|
|
};
|
|
|
|
|
|
|
|
system.stateVersion = "22.11";
|
|
|
|
|
|
|
|
nix = {
|
|
|
|
optimise.automatic = true;
|
|
|
|
gc = {
|
|
|
|
automatic = true;
|
|
|
|
options = "--delete-older-than 7d";
|
|
|
|
};
|
|
|
|
};
|
|
|
|
}
|