282 lines
9.8 KiB
Nix
282 lines
9.8 KiB
Nix
{ config, pkgs, lib, ...}:
|
|
with lib;
|
|
let
|
|
cfg = config.services.seafile-server;
|
|
# fix permissions at start
|
|
in
|
|
{
|
|
options.services.seafile-server = {
|
|
enable = mkEnableOption "Seafile server";
|
|
storagePath = mkOption {
|
|
type = types.path;
|
|
default = "/srv/seafile";
|
|
description = "where to store uploaded file data";
|
|
};
|
|
autorun = mkOption {
|
|
type = types.bool;
|
|
default = true;
|
|
description = "enable the seafile-server service to get started automatically";
|
|
};
|
|
db = {
|
|
type = mkOption {
|
|
type = types.enum ["sqlite" "mysql"];
|
|
default = "sqlite";
|
|
description = "database backend type";
|
|
};
|
|
user = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = "seafile";
|
|
description = "Database user name. Not required for sqlite.";
|
|
};
|
|
dbname = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = "seafile";
|
|
description = "Database name. Not required for sqlite.";
|
|
};
|
|
password = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = ''
|
|
Database password. Use <literal>passwordFile</literal> to avoid this
|
|
being world-readable in the <literal>/nix/store</literal>.
|
|
|
|
Not required for sqlite.'';
|
|
};
|
|
passwordFile = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = ''
|
|
The full path to a file that contains the database password.
|
|
'';
|
|
};
|
|
host = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = "localhost";
|
|
description = "Database host.";
|
|
};
|
|
dbport = mkOption {
|
|
type = with types; nullOr (either int str);
|
|
default = 3306;
|
|
description = "Database port. Not required for sqlite.";
|
|
};
|
|
};
|
|
|
|
user = mkOption {
|
|
type = types.str;
|
|
default = "seafile";
|
|
description = "User account under which the Seafile server runs.";
|
|
};
|
|
|
|
group = mkOption {
|
|
type = types.str;
|
|
default = "seafile";
|
|
description = "Group account under which the Seafile server runs.";
|
|
};
|
|
|
|
# name = mkOption {
|
|
# type = types.str;
|
|
# default = "Seafile";
|
|
# description = "name of the Seafile instance, will show up in client and web interface";
|
|
# };
|
|
|
|
domainName = mkOption {
|
|
type = types.str;
|
|
description = "full domain name of the seafile instance";
|
|
};
|
|
|
|
# ccnetPort = mkOption {
|
|
# type = types.int;
|
|
# default = 10001;
|
|
# description = "listening port for ccnet server";
|
|
# };
|
|
|
|
seafilePort = mkOption {
|
|
type = types.int;
|
|
default = 12001;
|
|
description = "listening port for Seafile server";
|
|
};
|
|
|
|
fileserverPort = mkOption {
|
|
type = types.int;
|
|
default = 8082;
|
|
description = "listening port for Seafile's fileserver component";
|
|
};
|
|
|
|
seahubPort = mkOption {
|
|
type = types.int;
|
|
default = 443;
|
|
description = "listening http port for Seahub web interface";
|
|
};
|
|
|
|
externalPort = mkOption {
|
|
type = types.int;
|
|
default = 443;
|
|
description = "external port under which Seahub is reachable from the outside. Possibly the external port of a reverse proxy like nginx.";
|
|
};
|
|
|
|
enableTLS = mkEnableOption {
|
|
default = true;
|
|
description = "whether to use TLS and HTTPS for communication";
|
|
};
|
|
|
|
openFirewall = mkEnableOption {
|
|
default = true;
|
|
description = "whether to open up the firewall ports for ccnet, seafile-server and seahub";
|
|
};
|
|
|
|
defaultQuota = mkOption {
|
|
type = types.nullOr types.int;
|
|
default = null;
|
|
description = "default quota to be set per user, in GB";
|
|
};
|
|
|
|
trashExpirationTime = mkOption {
|
|
type = types.int;
|
|
default = 30;
|
|
description = "default time for automatic library trash cleanup";
|
|
};
|
|
|
|
fileRevisionHistoryDays = mkOption {
|
|
type = types.nullOr types.int;
|
|
default = null;
|
|
description = "default history length of file revisions to keep in days. <literal>null</literal> means keeping all revisions.";
|
|
};
|
|
|
|
fileserverBindAddress = mkOption {
|
|
type = types.str;
|
|
default = "0.0.0.0";
|
|
description = "bind address for fileserver, binds to all addresses by default";
|
|
};
|
|
|
|
fileserverWorkers = mkOption {
|
|
type = types.int;
|
|
default = 10;
|
|
description = "number of worker threads to server http requests";
|
|
};
|
|
|
|
fileserverIndexers = mkOption {
|
|
type = types.int;
|
|
default = 1;
|
|
description = "number of threads used to sequentially divide uploaded files into blocks for storage";
|
|
};
|
|
|
|
fileserverBlockSize = mkOption {
|
|
type = types.int;
|
|
default = 1;
|
|
description = "size of blocks that uploaded files are divided into, in MB";
|
|
};
|
|
};
|
|
|
|
|
|
config = let
|
|
directoriesToManage = [ cfg.storagePath ];
|
|
in
|
|
mkIf cfg.enable {
|
|
systemd = {
|
|
# state directory permissions managed by systemd
|
|
tmpfiles.rules = [
|
|
"d ${cfg.storagePath} 0750 ${cfg.user} ${cfg.group} -"
|
|
"d ${cfg.storagePath}/conf 0750 ${cfg.user} ${cfg.group} -"
|
|
"d ${cfg.storagePath}/home 0710 ${cfg.user} ${cfg.group} -"
|
|
];
|
|
services.seafile-server = {
|
|
|
|
path = with pkgs; [ seafile-server.ccnet-server seafile-server.seafile-server-core ];
|
|
script = ''
|
|
./seafile-server/seafile-server-latest/bin/seafile-admin start
|
|
'';
|
|
serviceConfig = {
|
|
ExecStartPre = [
|
|
("+${pkgs.writeScript "seafile-server-preStart-privileged" ''
|
|
#!${pkgs.runtimeShell}
|
|
# stuff run as root
|
|
''}")
|
|
("${pkgs.writeShellScript "seafile-server-preStart-unprivileged" ''
|
|
# stuff run as seafile user
|
|
|
|
# ccnet-init must only be run once per installation, as it also generates stateful key and ID
|
|
# solution: invoke it once, use result as template
|
|
if [ ! -e ./ccnet/mykey.peer ]; then
|
|
${pkgs.seafile-server.ccnet-server}/bin/ccnet-init -c ./ccnet -H 'TEMPLATEHOST'
|
|
mv ./ccnet/ccnet.conf{,.template}
|
|
fi
|
|
|
|
# generate actual ccnet config file
|
|
echo "[General]" > ./conf/ccnet.conf
|
|
grep "^ID =" ./ccnet/ccnet.conf.template >> ./conf/ccnet.conf
|
|
# outside URL
|
|
SERVICE_URL = http${if cfg.enableTLS then "s" else ""}://${cfg.domainName}:${toString cfg.externalPort}
|
|
|
|
# seafile.conf generation
|
|
|
|
echo '[library_trash]
|
|
expire_days ${toString cfg.trashExpirationTime}
|
|
|
|
[fileserver]
|
|
host = ${cfg.fileserverBindAddress}
|
|
port = ${toString cfg.fileserverPort}
|
|
worker_threads = ${toString cfg.fileserverWorkers}
|
|
max_indexing_threads = ${toString cfg.fileserverIndexers}
|
|
fixed_block_size = ${toString cfg.fileserverIndexers}' > ./conf/seafile.conf
|
|
|
|
if [ ${toString (! isNull cfg.defaultQuota)} ]; then
|
|
echo '[quota]' >> ./conf/seafile.conf
|
|
echo 'default = ${toString cfg.defaultQuota}' >> ./conf/seafile.conf
|
|
fi
|
|
|
|
if [ ${toString (! isNull cfg.fileRevisionHistoryDays)} ]; then
|
|
echo '[history]' >> ./conf/seafile.conf
|
|
echo 'keep_days = ${toString cfg.defaultQuota}' >> ./conf/seafile.conf
|
|
fi
|
|
|
|
# seafile database settings
|
|
|
|
if [ ${cfg.db.type} = "mysql" ]; then
|
|
echo '[database]
|
|
type = mysql
|
|
host = ${cfg.db.host}
|
|
port = ${toString cfg.db.dbport}
|
|
user = ${cfg.db.user}
|
|
connection_charset = utf8
|
|
db_name = ${cfg.db.dbname}
|
|
max_connections = 100' >> ./conf/seafile.conf
|
|
|
|
if [ ${toString (! isNull cfg.db.password)}; then
|
|
echo 'password = ${toString cfg.db.password}' >> ./conf/seafile.conf
|
|
else
|
|
echo "password = $(cat ${toString cfg.db.passwordFile})" >> ./conf/seafile.conf
|
|
fi
|
|
else
|
|
echo '[database]
|
|
type = sqlite' >> ./conf/seafile.conf
|
|
fi
|
|
|
|
ln -s ${pkgs.seafile-server} seafile-server
|
|
./seafile-server/seafile-server-latest/bin/seafile-admin setup
|
|
''}")
|
|
];
|
|
User = cfg.user;
|
|
Group = cfg.group;
|
|
Type = "oneshot";
|
|
WorkingDirectory = cfg.storagePath;
|
|
};
|
|
enable = cfg.autorun;
|
|
wantedBy = [ "multi-user.target" ];
|
|
};
|
|
};
|
|
|
|
users.users.${cfg.user} = {
|
|
home = "${cfg.storagePath}/home";
|
|
group = cfg.group;
|
|
# don't make NixOS create the home directory as otherwise the permissions for /srv might be 0700,
|
|
# making it impossible to cd into the storagePath
|
|
createHome = false;
|
|
isNormalUser = false;
|
|
};
|
|
users.groups.${cfg.group}.members = [ cfg.user ];
|
|
|
|
# ToDo: make sure ccnet is reachable
|
|
networking.firewall.allowedTCPPorts = with cfg; if openFirewall then [ seafilePort fileserverPort ] else [];
|
|
};
|
|
}
|