jen.nix

{ tld ? "com" }:
let
  # To deal with an unusable (for me) release and master, I'm editing
  # a checkout of nixpkgs.
  pkgs = import ~/code/nixpkgs-jen { system = "x86_64-linux"; };
  # hpkgs = pkgs.haskellPackages;
  hpkgs = pkgs.haskell.packages.ghc7102;
  jinja27 = pkgs.pythonPackages.buildPythonPackage rec {
    name = "Jinja2-2.7";

    src = pkgs.fetchurl {
      url = "http://pypi.python.org/packages/source/J/Jinja2/${name}.tar.gz";
      sha256 = "0kgsd7h27jl2jpqa1ks88h93z50bsg0yr7qkicqpxbl9s4c1aks7";
    };

    propagatedBuildInputs = with pkgs.pythonPackages; [ markupsafe ];
  };
  glue = pkgs.pythonPackages.buildPythonPackage rec {
    name = "glue-0.11.1";

    src = pkgs.fetchurl {
      url = "https://pypi.python.org/packages/source/g/glue/glue-0.11.1.tar.gz";
      md5 = "9b9c99a035339f1efbe40077e401d5f7";
    };

    propagatedBuildInputs = with pkgs.pythonPackages; [ pillow jinja27 ];

    doCheck = false;
  };
  vocabulinkDomain = "vocabulink." + tld;
  fsrest = hpkgs.callPackage ../fsrest { };
  jcoreutils = hpkgs.callPackage ../jcoreutils { };
  jigplate = hpkgs.callPackage ../jigplate { };
  jsonwrench = hpkgs.callPackage ../jsonwrench { };
  gressgraph = hpkgs.callPackage ../gressgraph { };
  jekor-com = pkgs.callPackage ../jekor.com { inherit jcoreutils jigplate jsonwrench gressgraph; pandoc = pkgs.haskellPackages.pandoc; };
  minjs-com = pkgs.callPackage ../minjs.com { pygments = pkgs.pythonPackages.pygments; uglify = pkgs.nodePackages.uglify-js; };
  vocabulink-files = pkgs.callPackage ../vocabulink { uglify = pkgs.nodePackages.uglify-js;
                                                      stylus = pkgs.nodePackages.stylus;
                                                      glue = glue;
                                                      domain = vocabulinkDomain; };
  vocabulink = hpkgs.callPackage ../vocabulink/hs { postgresql = pkgs.postgresql;
                                                    templatepg = hpkgs.callPackage ../templatepg { };
                                                    sscgi = hpkgs.callPackage ../sscgi { };
                                                    domain = vocabulinkDomain;
                                                    vocabulink-sql = ../vocabulink/vocabulink.sql;
                                                    static-manifest = "${vocabulink-files}/manifest"; };
  # Because of the way I designed my site (for fsrest), modifications happen
  # within the www directory. This is not possible with my site in the
  # Nix store (nor desirable), so for now I'm using a union mount to combine
  # static content (generated by Nix/Make) and user-generated content
  # (comments, etc.).
  #
  # I tried using a systemd.mount, but it didn't seem to like fuse.
  # systemd.mounts = [
  #   { description = "/www/jekor.com";
  #     what = "/var/jekor.com=rw:${jekor-com}=ro";
  #     where = /www/jekor.com;
  #     type = "unionfs-fuse";
  #     options = "cow";
  #     requiredBy = [ "fsrest.service" ];
  #   }
  # ];
  #
  # So here's a service instead.
  www-mount = domain: site: uid: {
    preStart = ''
      mkdir -p /var/${domain}
      chown wwwrun:wwwrun /var/${domain}
      umount /www/${domain} 2>/dev/null || true
      mkdir -p /www/${domain}
    '';
    requiredBy = [ "fsrest.service" ];
    wantedBy = [ "multi-user.target" ];
    serviceConfig = {
      Type = "oneshot";
      ExecStart = "${pkgs.unionfs-fuse}/bin/unionfs -o cow,allow_other,uid=${toString uid} /var/${domain}=rw:${site}=ro /www/${domain}";
      RemainAfterExit = true;
      ExecStop = "${pkgs.utillinux}/bin/umount /www/${domain}";
    };
  };
in
{
  network.description = "jen";

  www = {config, pkgs, ...}:
  {
    imports = [
      ./common.nix
      ../fsrest/module.nix
    ];

    system.fsPackages = [ pkgs.unionfs-fuse ];

    systemd.services.jekor-com-mount = www-mount "jekor.com" jekor-com config.ids.uids.wwwrun;

    networking.enableIPv6 = false;
    services.fsrest = {
      enable = true;
      package = fsrest;
      directory = "/www";
      address = "localhost";
      port = 8001;
    };

    services.nginx = {
      enable = true;
      httpConfig = ''
        gzip on;
        gzip_types text/html text/plain text/css application/json application/javascript application/rss+xml;

        server {
          server_name jekor.com;
          location / {
            proxy_pass http://localhost:8001/;
            proxy_set_header Host $host;
          }
        }

        # For historical reasons, my site lives at jekor.com instead of www.jekor.com.
        # www.jekor.com -> jekor.com
        server {
          server_name www.jekor.com;
          return 301 $scheme://jekor.com$request_uri;
        }

        server {
          server_name www.minjs.com;
          location / {
            root "${minjs-com}";
          }
        }

        # minjs.com -> www.minjs.com
        server {
          server_name minjs.com;
          return 301 $scheme://www.minjs.com$request_uri;
        }

        server {
          listen 80;
          listen 443 ssl;
          server_name www.${vocabulinkDomain};
          ssl_certificate ${./security + ("/www." + vocabulinkDomain + ".crt")};
          ssl_certificate_key ${./security + ("/www." + vocabulinkDomain + ".key")};
          location / {
            proxy_pass http://localhost:8002/;
            proxy_set_header Host $host;
          }
        }

        server {
          server_name s.${vocabulinkDomain};
          location / {
            proxy_pass http://localhost:8002/;
            proxy_set_header Host $host;
          }
        }

        # vocabulink.com -> www.vocabulink.com
        server {
          server_name ${vocabulinkDomain};
          return 301 $scheme://www.${vocabulinkDomain}$request_uri;
        }
      '';
    };

    services.lighttpd = {
      enable = true;
      configText = ''
        server.port = 8002
        server.username = "lighttpd"
        server.groupname = "lighttpd"
        server.modules = ("mod_scgi", "mod_redirect", "mod_accesslog", "mod_compress")
        server.document-root = "/dev/null"
        accesslog.use-syslog = "enable"
        server.errorlog-use-syslog = "enable"

        mimetype.assign = (
          ".html" => "text/html; charset=utf-8",
          ".css"  => "text/css; charset=utf-8",
          ".js"   => "application/javascript; charset=utf-8",
          ".gif"  => "image/gif",
          ".jpg"  => "image/jpeg",
          ".jpeg" => "image/jpeg",
          ".png"  => "image/png",
          ".mp3"  => "audio/mpeg",
          ".ogg"  => "application/ogg"
        )

        $HTTP["host"] == "www.${vocabulinkDomain}" {
          scgi.server = (
            "/" => ((
              "host" => "127.0.0.1",
              "port" => 10033,
              "check-local" => "disable"
            ))
          )
        }
        $HTTP["host"] == "s.${vocabulinkDomain}" {
          server.document-root = "${vocabulink-files}"
        }
      '';
    };

    users.extraUsers.vocabulink = {
      group = "nogroup";
    };

    services.postgresql = {
      enable = true;
      authentication = ''
        local  all  all                trust
        host   all  all  127.0.0.1/32  trust
        host   all  all       ::1/128  trust
      '';
      initialScript = ../vocabulink/vocabulink.sql;
    };

    systemd.services.vocabulink = {
      after = [ "fsrest.service" ];
      wantedBy = [ "lighttpd.service" ];
      serviceConfig = {
        ExecStart = ''${vocabulink}/bin/vocabulink.cgi ${vocabulink-files} ${pkgs.ssmtp}/bin/sendmail ${builtins.readFile (./security + ("/" + vocabulinkDomain + ".token.key"))}'';
        User = "vocabulink";
        Group = "nogroup";
      };
    };

    networking.defaultMailServer = {
      directDelivery = true;
      hostName = "email-smtp.us-east-1.amazonaws.com";
      useTLS = true;
      useSTARTTLS = true;
      root = "jekor@jekor.com";
      authUser = builtins.readFile ./security/ses-user;
      authPass = builtins.readFile ./security/ses-password;
    };

    networking.firewall.allowedTCPPorts = [22 80 443];
    networking.firewall.allowedUDPPorts = [53];

  networking.extraHosts = ''
127.0.0.1 localhost
  '';
  };
}