Add static.nix, add wwwRedirect, simplify mkUsername

2025-12-12 11:24:04 +00:00 · 2025-08-28 17:16:08 +02:00 · 2025-08-28 17:16:08 +02:00 · 5495a4e309
commit 5495a4e309
parent 4bc7ebaf4c
3 changed files with 206 additions and 23 deletions
--- a/static.nix
+++ b/static.nix
@ -0,0 +1,130 @@
+{
+  name, # Name of the site, /srv/{name} will be based on this as well as the username if user = true
+  root, # The directory within /srv/{name} that should be served by nginx
+  user ? false, # Should a user be created. If false, static-generic is used
+  domains ? [], # e.g. [ "example.com" "acme.com" ]
+  ssl ? false, # Should SSL be used
+  wwwRedirect ? null, # The status code used for www-to-non-www redirects. Null means no redirect
+  cloudflareOnly ? false, # Should CF Authenticated Origin Pulls be used
+  extraNginxConfig ? null, # Extra nginx config string
+  sshKeys ? null, # SSH public keys used to log into the site's user for deployments
+  extraPackages ? [], # Any extra packages the user should have in $PATH (only used with user=true)
+  generateSshKey ? true, # Generate an SSH key for the user (used for GH deploy keys)
+  ...
+}:
+
+{ lib, pkgs, ... }:
+let
+  username = if user then "static-${name}" else "static-generic";
+in {
+  services.nginx.enable = true;
+  security.acme.acceptTerms = true;
+  networking.firewall.allowedTCPPorts = [ 80 ] ++ lib.optionals ssl [ 443 ];
+
+  services.nginx.virtualHosts = lib.genAttrs domains (domain: {
+    enableACME = ssl;
+    forceSSL = ssl;
+    root = "/srv/${name}/${root}";
+
+    extraConfig = ''
+      ${lib.optionalString cloudflareOnly ''
+      ssl_verify_client on;
+      ssl_client_certificate ${pkgs.fetchurl {
+        url = "https://developers.cloudflare.com/ssl/static/authenticated_origin_pull_ca.pem";
+        sha256 = "0hxqszqfzsbmgksfm6k0gp0hsx9k1gqx24gakxqv0391wl6fsky1";
+      }};
+      ''}
+      ${lib.optionalString (extraNginxConfig != null) extraNginxConfig}
+    '';
+
+    locations = {
+      "= /favicon.ico".extraConfig = ''
+        access_log off;
+        log_not_found off;
+      '';
+
+      "= /robots.txt".extraConfig = ''
+        access_log off;
+        log_not_found off;
+      '';
+    };
+  }) // lib.optionalAttrs (wwwRedirect != null) (lib.genAttrs (map (domain: "www.${domain}") domains) (wwwDomain: {
+    enableACME = ssl;
+    forceSSL = ssl;
+
+    locations."/" = {
+      return = "${toString wwwRedirect} ${if ssl then "https" else "http"}://${lib.removePrefix "www." wwwDomain}$request_uri";
+    };
+  }));
+
+  systemd.tmpfiles.rules = [
+    "d /srv 0751 root root - -"
+    "d /home 0751 root root - -"
+    "d /srv/${name} 0750 ${username} ${username} - -"
+  ] ++ lib.optional user
+    "C /home/${username}/.bashrc 0640 ${username} ${username} - /etc/static-${name}-bashrc";
+
+  # User and group settings
+  users.users.${username} = {
+    group = username;
+    isSystemUser = true;
+    createHome = true;
+    home = "/home/${username}";
+    homeMode = "750";
+    shell = pkgs.bashInteractive;
+    packages = [ pkgs.git pkgs.unzip ] ++ lib.optionals user extraPackages;
+  } // lib.optionalAttrs (sshKeys != null && user) {
+    openssh.authorizedKeys.keys = sshKeys;
+  };
+
+  users.groups.${username} = {};
+
+  # Add site group to nginx service
+  systemd.services.nginx.serviceConfig.SupplementaryGroups = [ username ];
+
+  # SSH key generation for git deployments
+  # Note: keep in sync with laravel.nix
+  systemd.services."generate-ssh-key-${username}" = lib.mkIf generateSshKey {
+    description = "Generate SSH key for ${username}";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "users.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      User = "root";
+    };
+    script = ''
+      USER_HOME="/home/${username}"
+      SSH_DIR="$USER_HOME/.ssh"
+      KEY_FILE="$SSH_DIR/id_ed25519"
+
+      if [[ ! -f "$KEY_FILE" ]]; then
+        echo "Generating SSH key for ${username}"
+        mkdir -p "$SSH_DIR"
+        ${pkgs.openssh}/bin/ssh-keygen -t ed25519 -f "$KEY_FILE" -N "" -C "${username}"
+        chown -R ${username}:${username} "$SSH_DIR"
+        chmod 700 "$SSH_DIR"
+        chmod 600 "$KEY_FILE"
+        chmod 640 "$KEY_FILE.pub"
+        echo "SSH key generated: $KEY_FILE.pub"
+        echo "Public key for deploy key:"
+        cat "$KEY_FILE.pub"
+      else
+        echo "SSH key already exists for ${username}"
+      fi
+    '';
+  };
+
+  # Create welcome message for user
+  # Note: keep in sync with laravel.nix (same block, minor changes here)
+  environment.etc."static-${name}-bashrc" = lib.mkIf user {
+    text = ''
+      echo "Welcome to ${name} static site!"
+      echo "Domains: ${lib.concatStringsSep ", " domains}"
+      echo "User home: /home/${username}"
+      echo "Site: /srv/${name}"
+        ${lib.optionalString generateSshKey ''echo "SSH public key: cat ~/.ssh/id_ed25519.pub"''}
+      echo "---"
+    '';
+  } ;
+}