install wardrowbe on orion
This commit is contained in:
kiri committed
1 parent
bd287a324a
commit
71aad7fc55
8 files changed
+408
-3
No files matched your search
@@ -0,0 +1,234 @@
|
||||
{ config, ... }:
|
||||
let
|
||||
nixosModules = config.flake.modules.nixos;
|
||||
in
|
||||
{
|
||||
flake.modules.nixos.wardrowbe =
|
||||
{ config, lib, ... }:
|
||||
let
|
||||
service = config.facts.services.wardrowbe;
|
||||
auth = config.facts.services.wardrowbe-auth;
|
||||
podman = lib.getExe config.virtualisation.podman.package;
|
||||
# Multi-architecture manifest digests; updating a tag alone cannot change an image.
|
||||
images = {
|
||||
backend = "ghcr.io/anyesh/wardrowbe:backend-1.10.3@sha256:75fd6f85fb7b91ccbb227b52d616bab11b5130c4e22858579f45736419fb592d";
|
||||
frontend = "ghcr.io/anyesh/wardrowbe:frontend-1.10.3@sha256:730cf52bd8a03b94473b129e9a988b3dae9818e9377fd88917029156ee7a2e17";
|
||||
auth = "ghcr.io/tinyauthapp/tinyauth:v5.2.0@sha256:220aa235c76393a73fece831d7ba967b8698d3907fd8e3c4c952f699c7b142a5";
|
||||
postgres = "docker.io/library/postgres:15-alpine@sha256:f7d23353e1b15400d22ebe31189f4d314b87a4c129cc400c8c2d8d4ca127bf81";
|
||||
redis = "docker.io/library/redis:7-alpine@sha256:858f009f9709ce576febc734aa78b8f6d624b82571f9ddb6bda4377c833b3499";
|
||||
};
|
||||
healthOptions = [
|
||||
"--health-interval=10s"
|
||||
"--health-timeout=5s"
|
||||
"--health-start-period=30s"
|
||||
"--health-retries=6"
|
||||
"--health-on-failure=kill"
|
||||
];
|
||||
backendContainer = {
|
||||
image = images.backend;
|
||||
environment = {
|
||||
# Profile selection is available only behind the password gateway.
|
||||
DEBUG = "true";
|
||||
AI_INTERNAL_ENABLED = "false";
|
||||
AI_VISION_ENABLED = "false";
|
||||
AI_TEXT_ENABLED = "false";
|
||||
APP_URL = service.origin;
|
||||
CORS_ORIGINS = builtins.toJSON [ service.origin ];
|
||||
REDIS_URL = "redis://wardrowbe-redis:6379/0";
|
||||
STORAGE_PATH = "/data/uploads";
|
||||
LOG_LEVEL = "INFO";
|
||||
};
|
||||
environmentFiles = [ config.sops.templates."wardrowbe-backend.env".path ];
|
||||
volumes = [ "wardrowbe-uploads:/data/uploads" ];
|
||||
};
|
||||
backendUnits = [
|
||||
"podman-wardrowbe-backend.service"
|
||||
"podman-wardrowbe-worker.service"
|
||||
"podman-wardrowbe-image-worker.service"
|
||||
];
|
||||
containers = {
|
||||
wardrowbe-postgres = {
|
||||
image = images.postgres;
|
||||
environment = {
|
||||
POSTGRES_USER = "wardrobe";
|
||||
POSTGRES_DB = "wardrobe";
|
||||
};
|
||||
environmentFiles = [ config.sops.templates."wardrowbe-postgres.env".path ];
|
||||
volumes = [ "wardrowbe-postgres:/var/lib/postgresql/data" ];
|
||||
podman.sdnotify = "healthy";
|
||||
extraOptions = healthOptions ++ [
|
||||
"--health-cmd=pg_isready -h 127.0.0.1 -U wardrobe -d wardrobe"
|
||||
];
|
||||
};
|
||||
wardrowbe-redis = {
|
||||
image = images.redis;
|
||||
cmd = [
|
||||
"redis-server"
|
||||
"--appendonly"
|
||||
"yes"
|
||||
];
|
||||
volumes = [ "wardrowbe-redis:/data" ];
|
||||
podman.sdnotify = "healthy";
|
||||
extraOptions = healthOptions ++ [ "--health-cmd=redis-cli ping" ];
|
||||
};
|
||||
wardrowbe-backend = backendContainer // {
|
||||
dependsOn = [
|
||||
"wardrowbe-postgres"
|
||||
"wardrowbe-redis"
|
||||
];
|
||||
ports = [ "127.0.0.1:8002:8000" ];
|
||||
cmd = [
|
||||
"sh"
|
||||
"-c"
|
||||
"alembic upgrade head && exec uvicorn app.main:app --host 0.0.0.0 --port 8000"
|
||||
];
|
||||
podman.sdnotify = "healthy";
|
||||
extraOptions = healthOptions ++ [
|
||||
"--health-cmd=curl --fail --silent http://127.0.0.1:8000/api/v1/health"
|
||||
];
|
||||
};
|
||||
wardrowbe-worker = backendContainer // {
|
||||
dependsOn = [ "wardrowbe-backend" ];
|
||||
cmd = [
|
||||
"arq"
|
||||
"app.workers.worker.WorkerSettings"
|
||||
];
|
||||
};
|
||||
wardrowbe-image-worker = backendContainer // {
|
||||
dependsOn = [ "wardrowbe-backend" ];
|
||||
cmd = [
|
||||
"arq"
|
||||
"app.workers.image_worker.ImageWorkerSettings"
|
||||
];
|
||||
};
|
||||
wardrowbe-frontend = {
|
||||
image = images.frontend;
|
||||
dependsOn = [ "wardrowbe-backend" ];
|
||||
environment = {
|
||||
BACKEND_URL = "http://wardrowbe-backend:8000";
|
||||
NEXTAUTH_URL = service.origin;
|
||||
DEV_MODE = "true";
|
||||
};
|
||||
environmentFiles = [ config.sops.templates."wardrowbe-frontend.env".path ];
|
||||
ports = [ "127.0.0.1:3002:3000" ];
|
||||
podman.sdnotify = "healthy";
|
||||
extraOptions = healthOptions ++ [
|
||||
"--health-cmd=node -e \"fetch('http://127.0.0.1:3000').then(r => process.exit(r.ok ? 0 : 1)).catch(() => process.exit(1))\""
|
||||
];
|
||||
};
|
||||
wardrowbe-auth = {
|
||||
image = images.auth;
|
||||
environment = {
|
||||
TINYAUTH_APPURL = auth.origin;
|
||||
TINYAUTH_AUTH_SECURECOOKIE = "true";
|
||||
TINYAUTH_AUTH_TRUSTEDPROXIES = "10.89.30.1";
|
||||
TINYAUTH_LABELPROVIDER = "none";
|
||||
TINYAUTH_ANALYTICS_ENABLED = "false";
|
||||
TINYAUTH_DATABASE_PATH = "/data/tinyauth.db";
|
||||
TINYAUTH_UI_TITLE = "Wardrobe login";
|
||||
};
|
||||
environmentFiles = [ config.sops.templates."wardrowbe-auth.env".path ];
|
||||
volumes = [ "wardrowbe-auth:/data" ];
|
||||
ports = [ "127.0.0.1:3003:3000" ];
|
||||
podman.sdnotify = "healthy";
|
||||
extraOptions = healthOptions ++ [ "--health-cmd=tinyauth healthcheck" ];
|
||||
};
|
||||
};
|
||||
in
|
||||
{
|
||||
imports = [
|
||||
nixosModules.caddy
|
||||
nixosModules.sops
|
||||
];
|
||||
|
||||
sops.secrets = {
|
||||
wardrowbe-postgres-password = { };
|
||||
wardrowbe-secret-key = { };
|
||||
wardrowbe-nextauth-secret = { };
|
||||
wardrowbe-auth-users = { };
|
||||
};
|
||||
sops.templates = {
|
||||
"wardrowbe-postgres.env" = {
|
||||
content = ''
|
||||
POSTGRES_PASSWORD=${config.sops.placeholder.wardrowbe-postgres-password}
|
||||
'';
|
||||
restartUnits = [ "podman-wardrowbe-postgres.service" ];
|
||||
};
|
||||
"wardrowbe-backend.env" = {
|
||||
content = ''
|
||||
DATABASE_URL=postgresql+asyncpg://wardrobe:${config.sops.placeholder.wardrowbe-postgres-password}@wardrowbe-postgres:5432/wardrobe
|
||||
SECRET_KEY=${config.sops.placeholder.wardrowbe-secret-key}
|
||||
'';
|
||||
restartUnits = backendUnits;
|
||||
};
|
||||
"wardrowbe-frontend.env" = {
|
||||
content = ''
|
||||
NEXTAUTH_SECRET=${config.sops.placeholder.wardrowbe-nextauth-secret}
|
||||
'';
|
||||
restartUnits = [ "podman-wardrowbe-frontend.service" ];
|
||||
};
|
||||
"wardrowbe-auth.env" = {
|
||||
content = ''
|
||||
TINYAUTH_AUTH_USERS=${config.sops.placeholder.wardrowbe-auth-users}
|
||||
'';
|
||||
restartUnits = [ "podman-wardrowbe-auth.service" ];
|
||||
};
|
||||
};
|
||||
|
||||
virtualisation.oci-containers = {
|
||||
backend = "podman";
|
||||
containers = lib.mapAttrs (
|
||||
_: container:
|
||||
{
|
||||
networks = [ "wardrowbe" ];
|
||||
}
|
||||
// container
|
||||
) containers;
|
||||
};
|
||||
|
||||
systemd.services = {
|
||||
wardrowbe-network = {
|
||||
description = "Wardrowbe container network";
|
||||
serviceConfig = {
|
||||
Type = "oneshot";
|
||||
RemainAfterExit = true;
|
||||
};
|
||||
script = ''
|
||||
${podman} network exists wardrowbe || \
|
||||
${podman} network create --subnet 10.89.30.0/24 --gateway 10.89.30.1 wardrowbe
|
||||
'';
|
||||
};
|
||||
}
|
||||
// lib.mapAttrs' (
|
||||
name: _:
|
||||
lib.nameValuePair "podman-${name}" {
|
||||
requires = [ "wardrowbe-network.service" ];
|
||||
after = [ "wardrowbe-network.service" ];
|
||||
serviceConfig.TimeoutStartSec = lib.mkForce 900;
|
||||
}
|
||||
) containers;
|
||||
|
||||
services.caddy.virtualHosts = {
|
||||
${auth.domain}.extraConfig = "reverse_proxy 127.0.0.1:3003";
|
||||
${service.domain}.extraConfig = ''
|
||||
request_body {
|
||||
max_size 50MB
|
||||
}
|
||||
route {
|
||||
forward_auth 127.0.0.1:3003 {
|
||||
uri /api/auth/caddy
|
||||
}
|
||||
handle /api/auth/* {
|
||||
reverse_proxy 127.0.0.1:3002
|
||||
}
|
||||
handle /api/* {
|
||||
reverse_proxy 127.0.0.1:8002
|
||||
}
|
||||
handle {
|
||||
reverse_proxy 127.0.0.1:3002
|
||||
}
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
}
|
||||
Reference in new issue
Block a user