Fediversity/services/fediversity/peertube/default.nix

{ config, lib, ... }:

let
  inherit (lib) mkIf mkMerge readFile;

in
{
  _class = "nixos";

  imports = [ ./options.nix ];

  config = mkMerge [
    (mkIf
      (
        config.fediversity.garage.enable
        && config.fediversity.peertube.s3AccessKeyFile != null
        && config.fediversity.peertube.s3SecretKeyFile != null
      )
      {
        fediversity.garage = {
          ensureBuckets = {
            peertube-videos = {
              website = true;
              # TODO: these are too broad, after getting everything works narrow it down to the domain we actually want
              corsRules = {
                enable = true;
                allowedHeaders = [ "*" ];
                allowedMethods = [ "GET" ];
                allowedOrigins = [ "*" ];
              };
            };
            # TODO: these are too broad, after getting everything works narrow it down to the domain we actually want
            peertube-playlists = {
              website = true;
              corsRules = {
                enable = true;
                allowedHeaders = [ "*" ];
                allowedMethods = [ "GET" ];
                allowedOrigins = [ "*" ];
              };
            };
          };

          ensureKeys = {
            peertube = {
              inherit (config.fediversity.peertube) s3AccessKeyFile s3SecretKeyFile;
              ensureAccess = {
                peertube-videos = {
                  read = true;
                  write = true;
                  owner = true;
                };
                peertube-playlists = {
                  read = true;
                  write = true;
                  owner = true;
                };
              };
            };
          };
        };
      }
    )

    (mkIf config.fediversity.peertube.enable {
      networking.firewall.allowedTCPPorts = [
        80
        443

        ## For Live streaming and Live streaming when RTMPS is enabled.
        1935
        1936
      ];

      services.peertube = {
        enable = true;
        localDomain = config.fediversity.peertube.domain;

        # TODO: in most of nixpkgs, these are true by default. upstream that unless there's a good reason not to.
        redis.createLocally = true;
        database.createLocally = true;

        secrets.secretsFile = config.fediversity.peertube.secretsFile;

        settings = {
          object_storage = {
            enabled = true;
            endpoint = config.fediversity.garage.api.url;
            region = "garage";
            upload_acl.public = null; # Garage does not support ACL
            upload_acl.private = null; # Garage does not support ACL

            # not supported by garage
            # SEE: https://garagehq.deuxfleurs.fr/documentation/connect/apps/#peertube
            proxy.proxyify_private_files = false;

            web_videos = rec {
              bucket_name = "peertube-videos";
              prefix = "";
              base_url = config.fediversity.garage.web.urlForBucket bucket_name;
            };
            videos = rec {
              bucket_name = "peertube-videos";
              prefix = "";
              base_url = config.fediversity.garage.web.urlForBucket bucket_name;
            };
            streaming_playlists = rec {
              bucket_name = "peertube-playlists";
              prefix = "";
              base_url = config.fediversity.garage.web.urlForBucket bucket_name;
            };
          };
        };
        serviceEnvironmentFile = "/etc/peertube-env";
      };

      ## FIXME: secrets management; we should have a service that writes the
      ## `.env` files based on all the secrets that we need to put there.
      environment.etc.peertube-env.text = ''
        AWS_ACCESS_KEY_ID=${readFile config.fediversity.peertube.s3AccessKeyFile}
        AWS_SECRET_ACCESS_KEY=${readFile config.fediversity.peertube.s3SecretKeyFile}
      '';

      ## Proxying through Nginx

      services.peertube = {
        configureNginx = true;
        listenWeb = 443;
        enableWebHttps = true;
      };
      services.nginx.virtualHosts.${config.services.peertube.localDomain} = {
        forceSSL = true;
        enableACME = true;
      };
    })
  ];
}