diff options
author | Franck Cuny <franck@fcuny.net> | 2022-04-13 15:20:45 -0700 |
---|---|---|
committer | Franck Cuny <franck@fcuny.net> | 2022-04-13 15:20:45 -0700 |
commit | d95497cf3a7728f4a0d43bf4f54eb4a796ba0870 (patch) | |
tree | 3df15db490f3da6f83d15e2e732196bb48cb2525 /modules/services/drone/server | |
parent | nginx: configure correctly the dashboard (diff) | |
download | world-d95497cf3a7728f4a0d43bf4f54eb4a796ba0870.tar.gz |
drone: initial attempt at configuring it
Diffstat (limited to 'modules/services/drone/server')
-rw-r--r-- | modules/services/drone/server/default.nix | 45 |
1 files changed, 45 insertions, 0 deletions
diff --git a/modules/services/drone/server/default.nix b/modules/services/drone/server/default.nix new file mode 100644 index 0000000..199aa47 --- /dev/null +++ b/modules/services/drone/server/default.nix @@ -0,0 +1,45 @@ +{ config, lib, pkgs, ... }: +let cfg = config.my.services.drone; +in { + config = lib.mkIf cfg.enable { + systemd.services.drone-server = { + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + EnvironmentFile = [ cfg.sharedSecretFile ]; + Environment = [ + "DRONE_SERVER_HOST=${cfg.vhostName}" + "DRONE_SERVER_PROTO=https" + "DRONE_SERVER_PORT=:${toString cfg.port}" + "DRONE_USER_CREATE=username:${cfg.admin},admin:true" + "DRONE_JSONNET_ENABLED=true" + "DRONE_STARLARK_ENABLED=true" + ]; + ExecStart = "${pkgs.drone}/bin/drone-server"; + User = "drone"; + Group = "drone"; + }; + }; + + users.users.drone = { + isSystemUser = true; + createHome = true; + group = "drone"; + }; + + users.groups.drone = { }; + + services.nginx.virtualHosts."${cfg.vhostName}" = { + forceSSL = true; + useACMEHost = cfg.vhostName; + locations."/" = { + proxyPass = "http://127.0.0.1:${toString cfg.port}"; + proxyWebsockets = true; + }; + }; + + security.acme.certs."${cfg.vhostName}" = { + dnsProvider = "gcloud"; + credentialsFile = secrets."acme/credentials".path; + }; + }; +} |