Skip to content

Commit ee333bd

Browse files
epattersepatters
committed
BUILD: Copy nix config for staging deployment to prod deployment.
Modulo changes to the hostnames.
1 parent dc24844 commit ee333bd

File tree

2 files changed

+207
-76
lines changed

2 files changed

+207
-76
lines changed

‎infrastructure/hosts/catcolab/backend.nix

Lines changed: 166 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,103 @@
11
{ inputs, pkgs, config, ... }:
22

33
let
4-
port = "8000";
5-
startScript = pkgs.writeShellScript "catcolab.sh" ''
6-
rm -f instrument.mjs
7-
cp ${config.age.secrets."instrument.mjs".path} .
8-
${pkgs.nodejs}/bin/node dist/index.js
4+
automergePort = "8010";
5+
backendPort = "8000";
6+
7+
automergeScript = pkgs.writeShellScript "automerge.sh" ''
8+
ln -sf ${config.age.secrets."instrument.mjs".path} /var/lib/catcolab/packages/automerge-doc-server/
9+
${pkgs.nodejs}/bin/node dist/automerge-doc-server/src/main.js
10+
'';
11+
12+
backendScript = pkgs.writeShellScript "backend.sh" ''
13+
ln -sf ${config.age.secrets.".env".path} /var/lib/catcolab/packages/backend/
14+
../../target/debug/backend
15+
'';
16+
17+
initScript = pkgs.writeShellScriptBin "catcolab-init" ''
18+
echo -e "\n\n##### catcolab-init: cloning catcolab repo...\n\n"
19+
cd /var/lib
20+
if [ -z "$1" ]; then branch="main"; else branch="$1"; fi
21+
git clone -b $branch https://github.com/ToposInstitute/CatColab.git
22+
mv CatColab catcolab
23+
chown -R catcolab:catcolab catcolab
24+
25+
echo -e "\n\n##### catcolab-init: linking secrets...\n\n"
26+
ln -sf ${config.age.secrets."instrument.mjs".path} /var/lib/catcolab/packages/automerge-doc-server/
27+
ln -sf ${config.age.secrets.".env".path} /var/lib/catcolab/packages/backend/
28+
29+
echo -e "\n\n##### catcolab-init: installing nodejs dependencies...\n\n"
30+
su -l catcolab -c "cd /var/lib/catcolab/packages/backend; pnpm install"
31+
32+
echo -e "\n\n##### catcolab-init: installing rust and cargo...\n\n"
33+
su -l catcolab -c "rustup default stable"
34+
35+
echo -e "\n\n##### catcolab-init: installing sqlx-cli for migrations...\n\n"
36+
su -l catcolab -c "cargo install sqlx-cli"
37+
38+
echo -e "\n\n##### catcolab-init: setting up postgres user, database, permissions...\n\n"
39+
su -l postgres -- /var/lib/catcolab/infrastructure/scripts/initdb.sh $(cat ${config.age.secrets.".env".path})
40+
41+
echo -e "\n\n##### catcolab-init: stopping automerge, build services...\n\n"
42+
/var/lib/catcolab/infrastructure/scripts/stop.sh
43+
44+
echo -e "\n\n##### catcolab-init: migrating database...\n\n"
45+
su -l catcolab -- /var/lib/catcolab/infrastructure/scripts/migrate.sh
46+
47+
echo -e "\n\n##### catcolab-init: building binaries...\n\n"
48+
su -l catcolab -- /var/lib/catcolab/infrastructure/scripts/build.sh
49+
50+
echo -e "\n\n##### catcolab-init: start automerge, build services...\n\n"
51+
/var/lib/catcolab/infrastructure/scripts/start.sh
52+
'';
53+
54+
stopScript = pkgs.writeShellScriptBin "catcolab-stop" ''
55+
/var/lib/catcolab/infrastructure/scripts/stop.sh
56+
'';
57+
58+
startScript = pkgs.writeShellScriptBin "catcolab-start" ''
59+
/var/lib/catcolab/infrastructure/scripts/start.sh
60+
'';
61+
62+
restartScript = pkgs.writeShellScriptBin "catcolab-restart" ''
63+
/var/lib/catcolab/infrastructure/scripts/restart.sh
64+
'';
65+
66+
statusScript = pkgs.writeShellScriptBin "catcolab-status" ''
67+
/var/lib/catcolab/infrastructure/scripts/status.sh
68+
'';
69+
70+
migrateScript = pkgs.writeShellScriptBin "catcolab-migrate" ''
71+
/var/lib/catcolab/infrastructure/scripts/migrate.sh
972
'';
73+
74+
buildScript = pkgs.writeShellScriptBin "catcolab-build" ''
75+
/var/lib/catcolab/infrastructure/scripts/build.sh
76+
'';
77+
78+
packages = with pkgs; [
79+
rustup
80+
nodejs
81+
nodejs.pkgs.pnpm
82+
git
83+
stdenv.cc
84+
openssl.dev
85+
pkg-config
86+
];
87+
88+
scripts = [
89+
initScript
90+
stopScript
91+
startScript
92+
restartScript
93+
statusScript
94+
migrateScript
95+
buildScript
96+
];
97+
1098
in {
11-
age.secrets.DATABASE_URL = {
12-
file = "${inputs.self}/secrets/DATABASE_URL.age";
99+
age.secrets.".env" = {
100+
file = "${inputs.self}/secrets/.env.age";
13101
mode = "400";
14102
owner = "catcolab";
15103
};
@@ -23,61 +111,99 @@ in {
23111
services.postgresql.enable = true;
24112

25113
services.nginx.enable = true;
26-
services.nginx.virtualHosts."backend.catcolab.org" = {
114+
115+
services.nginx.virtualHosts."automerge.catcolab.org" = {
27116
forceSSL = true;
28117
enableACME = true;
29118
locations."/" = {
30119
extraConfig = ''
31-
if ($request_method = OPTIONS) {
32-
return 204;
33-
}
34-
proxy_hide_header 'Access-Control-Allow-Origin';
35-
add_header 'Access-Control-Allow-Origin' '*' always;
36-
add_header 'Access-Control-Allow-Methods' 'GET, POST, DELETE, PUT, OPTIONS' always;
37-
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
38-
proxy_pass http://localhost:${port};
39-
error_log syslog:server=unix:/dev/log;
40-
access_log syslog:server=unix:/dev/log;
41-
proxy_http_version 1.1;
42-
proxy_set_header Upgrade $http_upgrade;
43-
proxy_set_header Connection "upgrade";
120+
if ($request_method = OPTIONS) {
121+
return 204;
122+
}
123+
proxy_hide_header 'Access-Control-Allow-Origin';
124+
add_header 'Access-Control-Allow-Origin' '*' always;
125+
add_header 'Access-Control-Allow-Methods' 'GET, POST, DELETE, PUT, OPTIONS' always;
126+
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
127+
proxy_pass http://localhost:${automergePort};
128+
error_log syslog:server=unix:/dev/log;
129+
access_log syslog:server=unix:/dev/log;
130+
proxy_http_version 1.1;
131+
proxy_set_header Upgrade $http_upgrade;
132+
proxy_set_header Connection "upgrade";
44133
'';
45134
};
135+
};
136+
137+
services.nginx.virtualHosts."backend.catcolab.org" = {
138+
forceSSL = true;
139+
enableACME = true;
140+
locations."/" = {
141+
extraConfig = ''
142+
if ($request_method = OPTIONS) {
143+
return 204;
144+
}
145+
proxy_hide_header 'Access-Control-Allow-Origin';
146+
add_header 'Access-Control-Allow-Origin' '*' always;
147+
add_header 'Access-Control-Allow-Methods' 'GET, POST, DELETE, PUT, OPTIONS' always;
148+
add_header 'Access-Control-Allow-Headers' 'DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization' always;
149+
proxy_pass http://localhost:${backendPort};
150+
error_log syslog:server=unix:/dev/log;
151+
access_log syslog:server=unix:/dev/log;
152+
proxy_http_version 1.1;
153+
proxy_set_header Upgrade $http_upgrade;
154+
proxy_set_header Connection "upgrade";
155+
'';
156+
};
157+
};
158+
159+
systemd.services.automerge = {
160+
enable = true;
161+
wantedBy = ["multi-user.target"];
162+
163+
environment = {
164+
PORT = automergePort;
165+
# NODE_OPTIONS = "--import ./instrument.mjs"; # sentry disabled - need Owen to fix
166+
};
167+
168+
serviceConfig = {
169+
User = "catcolab";
170+
ExecStart = automergeScript;
171+
Type = "simple";
172+
WorkingDirectory = "/var/lib/catcolab/packages/automerge-doc-server/";
173+
Restart = "on-failure";
174+
};
46175
};
47176

48-
systemd.services.catcolab = {
177+
systemd.services.backend = {
49178
enable = true;
50179
wantedBy = ["multi-user.target"];
51180

52181
environment = {
53-
PORT = port;
54-
DATABASE_URL_PATH = config.age.secrets.DATABASE_URL.path;
55-
NODE_OPTIONS = "--import ./instrument.mjs";
182+
PORT = backendPort;
56183
};
57184

58185
serviceConfig = {
59186
User = "catcolab";
60-
ExecStart = startScript;
187+
ExecStart = backendScript;
61188
Type="simple";
62189
WorkingDirectory = "/var/lib/catcolab/packages/backend/";
63190
Restart = "on-failure";
64191
};
65192
};
66193

67-
users.users.catcolab = {
68-
isNormalUser = true;
69-
group = "catcolab";
70-
};
71-
72-
environment.systemPackages = with pkgs; [
73-
rustup
74-
nodejs
75-
nodejs.pkgs.pnpm
76-
git
77-
stdenv.cc
78-
];
194+
security.sudo.extraRules = [{
195+
users = [ "catcolab" ];
196+
commands = [
197+
{ command = "/run/current-system/sw/bin/systemctl start automerge"; options = [ "NOPASSWD" ]; }
198+
{ command = "/run/current-system/sw/bin/systemctl stop automerge"; options = [ "NOPASSWD" ]; }
199+
{ command = "/run/current-system/sw/bin/systemctl restart automerge"; options = [ "NOPASSWD" ]; }
200+
{ command = "/run/current-system/sw/bin/systemctl start backend"; options = [ "NOPASSWD" ]; }
201+
{ command = "/run/current-system/sw/bin/systemctl stop backend"; options = [ "NOPASSWD" ]; }
202+
{ command = "/run/current-system/sw/bin/systemctl restart backend"; options = [ "NOPASSWD" ]; }
203+
];
204+
}];
79205

80-
environment.variables.DATABASE_URL_PATH = config.age.secrets.DATABASE_URL.path;
206+
environment.systemPackages = packages ++ scripts;
81207

82-
users.groups.catcolab = {};
208+
environment.variables.PKG_CONFIG_PATH = "/run/current-system/sw/lib/pkgconfig";
83209
}

‎infrastructure/hosts/catcolab/default.nix

Lines changed: 41 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,60 @@
11
{ inputs, ... }:
22

33
let
4-
owen = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF2sBTuqGoEXRWpBRqTBwZZPDdLGGJ0GQcuX5dfIZKb4 o@red-special";
5-
epatters = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKXx6wMJSeYKCHNmbyR803RQ72uto9uYsHhAPPWNl2D [email protected]";
6-
shaowei = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOV/7Vnjn7PwOC9VWyRAvsh5lUieIBHgdf4RRLkL8ZPa [email protected]";
4+
owen = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIF2sBTuqGoEXRWpBRqTBwZZPDdLGGJ0GQcuX5dfIZKb4 o@red-special";
5+
epatters = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAKXx6wMJSeYKCHNmbyR803RQ72uto9uYsHhAPPWNl2D [email protected]";
6+
shaowei = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOV/7Vnjn7PwOC9VWyRAvsh5lUieIBHgdf4RRLkL8ZPa [email protected]";
77
in
88
{
9-
imports = [
10-
./backend.nix
11-
"${inputs.nixpkgs}/nixos/modules/virtualisation/amazon-image.nix"
12-
];
9+
imports = [
10+
./backend.nix
11+
"${inputs.nixpkgs}/nixos/modules/virtualisation/amazon-image.nix"
12+
];
1313

14-
networking.hostName = "catcolab";
14+
networking.hostName = "catcolab";
15+
networking.firewall.allowedTCPPorts = [ 80 443 ];
1516

16-
security.sudo.wheelNeedsPassword = false;
17+
security.sudo.wheelNeedsPassword = false;
18+
security.acme.acceptTerms = true;
19+
security.acme.defaults.email = "[email protected]";
1720

18-
users.mutableUsers = false;
21+
users.mutableUsers = false;
1922

20-
users.users.owen = {
21-
isNormalUser = true;
22-
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
23-
openssh.authorizedKeys.keys = [ owen ];
24-
};
23+
users.groups.catcolab = {};
2524

26-
users.users.epatters = {
27-
isNormalUser = true;
28-
extraGroups = [ "wheel" ];
29-
openssh.authorizedKeys.keys = [ epatters ];
30-
};
25+
users.users.catcolab = {
26+
isNormalUser = true;
27+
group = "catcolab";
28+
openssh.authorizedKeys.keys = [ owen epatters shaowei ];
29+
};
3130

32-
users.users.shaowei = {
33-
isNormalUser = true;
34-
extraGroups = [ "wheel" ];
35-
openssh.authorizedKeys.keys = [ shaowei ];
36-
};
31+
users.users.owen = {
32+
isNormalUser = true;
33+
extraGroups = [ "wheel" ]; # Enable ‘sudo’ for the user.
34+
openssh.authorizedKeys.keys = [ owen ];
35+
};
3736

38-
users.users.root.openssh.authorizedKeys.keys = [ owen epatters shaowei ];
37+
users.users.epatters = {
38+
isNormalUser = true;
39+
extraGroups = [ "wheel" ];
40+
openssh.authorizedKeys.keys = [ epatters ];
41+
};
3942

40-
time.timeZone = "America/New_York";
43+
users.users.shaowei = {
44+
isNormalUser = true;
45+
extraGroups = [ "wheel" ];
46+
openssh.authorizedKeys.keys = [ shaowei ];
47+
};
4148

42-
# Enable the OpenSSH daemon.
43-
services.openssh.enable = true;
49+
users.users.root.openssh.authorizedKeys.keys = [ owen epatters shaowei ];
4450

45-
system.stateVersion = "24.05";
51+
time.timeZone = "America/New_York";
4652

47-
security.acme.acceptTerms = true;
48-
security.acme.defaults.email = "[email protected]";
53+
services.openssh.enable = true;
4954

50-
nix.extraOptions = ''
51-
experimental-features = nix-command flakes
52-
'';
55+
system.stateVersion = "24.05";
5356

54-
networking.firewall.allowedTCPPorts = [ 80 443 ];
57+
nix.extraOptions = ''
58+
experimental-features = nix-command flakes
59+
'';
5560
}

0 commit comments

Comments
 (0)