Ready for NixOS builds

2026-03-09 21:51:56 -05:00
parent cc51f40591
commit 0fd901b01f
9 changed files with 173 additions and 80 deletions
@@ -0,0 +1,81 @@
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.services.portal;
+in
+{
+  options.services.portal = {
+    enable = lib.mkEnableOption "RhemaWave Portal";
+
+    directory = lib.mkOption {
+      type = lib.types.path;
+      default = "/mnt/volume_nyc3_01/Portal.RhemaWaveTech.com";
+      description = "Path to the Portal git clone.";
+    };
+
+    envFile = lib.mkOption {
+      type = lib.types.path;
+      default = "${cfg.directory}/.env";
+      defaultText = lib.literalExpression ''"''${cfg.directory}/.env"'';
+      description = "Path to the .env file containing secrets.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 3001;
+      description = "Port the Portal listens on.";
+    };
+
+    host = lib.mkOption {
+      type = lib.types.str;
+      default = "0.0.0.0";
+      description = "Host address the Portal binds to.";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.portal = {
+      isSystemUser = true;
+      group = "portal";
+      home = cfg.directory;
+    };
+
+    users.groups.portal = { };
+
+    systemd.services.portal = {
+      description = "RhemaWave Portal";
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+
+      serviceConfig = {
+        Type = "simple";
+        User = "portal";
+        Group = "portal";
+        WorkingDirectory = cfg.directory;
+        EnvironmentFile = cfg.envFile;
+        ExecStart = "${pkgs.nodejs_22}/bin/node build";
+        Restart = "on-failure";
+        RestartSec = 5;
+      };
+
+      environment = {
+        HOST = cfg.host;
+        PORT = toString cfg.port;
+        DO_CA_CERTIFICATE = "/var/lib/portal/do-ca-certificate.crt";
+        NODE_ENV = "production";
+      };
+    };
+
+    security.sudo.extraRules = [
+      {
+        users = [ "forgejo-runner" ];
+        commands = [
+          {
+            command = "/run/current-system/sw/bin/systemctl restart portal";
+            options = [ "NOPASSWD" ];
+          }
+        ];
+      }
+    ];
+  };
+}