115 lines
3.1 KiB
Nix
115 lines
3.1 KiB
Nix
let
|
|
snakeoil_key = {
|
|
id = "GK1f9feea9960f6f95ff404c9b";
|
|
secret = "7295c4201966a02c2c3d25b5cea4a5ff782966a2415e3a196f91924631191395";
|
|
};
|
|
in
|
|
{ config, lib, pkgs, ... }: {
|
|
networking.firewall.allowedTCPPorts = [ 80 9000 ];
|
|
|
|
services.garage = {
|
|
ensureBuckets = {
|
|
peertube-videos = {
|
|
website = true;
|
|
corsRules = {
|
|
enable = true;
|
|
allowedHeaders = [ "*" ];
|
|
allowedMethods = [ "GET" ];
|
|
allowedOrigins = [ "*" ];
|
|
};
|
|
};
|
|
peertube-playlists = {
|
|
website = true;
|
|
corsRules = {
|
|
enable = true;
|
|
allowedHeaders = [ "*" ];
|
|
allowedMethods = [ "GET" ];
|
|
allowedOrigins = [ "*" ];
|
|
};
|
|
};
|
|
};
|
|
ensureKeys = {
|
|
peertube = {
|
|
inherit (snakeoil_key) id secret;
|
|
ensureAccess = {
|
|
peertube-videos = {
|
|
read = true;
|
|
write = true;
|
|
owner = true;
|
|
};
|
|
peertube-playlists = {
|
|
read = true;
|
|
write = true;
|
|
owner = true;
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
services.peertube = {
|
|
settings = {
|
|
object_storage = {
|
|
enabled = true;
|
|
endpoint = "http://s3.garage.localhost:3900";
|
|
region = "garage";
|
|
|
|
# not supported by garage
|
|
# SEE: https://garagehq.deuxfleurs.fr/documentation/connect/apps/#peertube
|
|
proxy.proxyify_private_files = false;
|
|
|
|
web_videos = {
|
|
bucket_name = "peertube-videos";
|
|
prefix = "";
|
|
base_url = "http://peertube-videos.web.garage.localhost:3902";
|
|
};
|
|
videos = {
|
|
bucket_name = "peertube-videos";
|
|
prefix = "";
|
|
base_url = "http://peertube-videos.web.garage.localhost:3902";
|
|
};
|
|
streaming_playlists = {
|
|
bucket_name = "peertube-playlists";
|
|
prefix = "";
|
|
base_url = "http://peertube-playlists.web.garage.localhost:3902";
|
|
};
|
|
};
|
|
};
|
|
serviceEnvironmentFile = "/etc/peertube-env";
|
|
};
|
|
environment.etc.peertube-env.text = ''
|
|
AWS_ACCESS_KEY_ID=${snakeoil_key.id}
|
|
AWS_SECRET_ACCESS_KEY=${snakeoil_key.secret}
|
|
'';
|
|
# these configurations only apply when producing a VM (e.g. nixos-rebuild build-vm)
|
|
virtualisation.vmVariant = { config, ... }: {
|
|
services.peertube = {
|
|
enable = true;
|
|
# redirects to localhost, but allows it to have a proper domain name
|
|
localDomain = "peertube.localhost";
|
|
enableWebHttps = false;
|
|
settings = {
|
|
listen.hostname = "0.0.0.0";
|
|
instance.name = "PeerTube Test VM";
|
|
};
|
|
# TODO: use agenix
|
|
secrets.secretsFile = pkgs.writeText "secret" ''
|
|
574e093907d1157ac0f8e760a6deb1035402003af5763135bae9cbd6abe32b24
|
|
'';
|
|
|
|
# TODO: in most of nixpkgs, these are true by default. upstream that unless there's a good reason not to.
|
|
redis.createLocally = true;
|
|
database.createLocally = true;
|
|
configureNginx = true;
|
|
};
|
|
|
|
virtualisation.forwardPorts = [
|
|
{
|
|
from = "host";
|
|
host.port = 9000;
|
|
guest.port = 9000;
|
|
}
|
|
];
|
|
};
|
|
}
|