| 1 | { config, ... }: |
| 2 | { |
| 3 | services.backup.includes = [ "/var/lib/docuseal" ]; |
| 4 | |
| 5 | services.docuseal = { |
| 6 | enable = true; |
| 7 | extraConfig = { |
| 8 | SMTP_ADDRESS = "umbriel.nixos.org"; |
| 9 | SMTP_PORT = "465"; |
| 10 | SMTP_ENABLE_STARTTLS = "false"; # We're using port 465, which uses implicit TLS. |
| 11 | SMTP_FROM = "docuseal-noreply@nixos.org"; |
| 12 | SMTP_USERNAME = "docuseal-noreply@nixos.org"; |
| 13 | SMTP_ENABLE_TLS = "true"; |
| 14 | }; |
| 15 | extraEnvFiles = [ config.sops.templates."docuseal.env".path ]; |
| 16 | }; |
| 17 | |
| 18 | # How to generate: |
| 19 | # |
| 20 | # $ cd non-critical-infra |
| 21 | # $ SECRET_PATH=secrets/docuseal-secret-key-base.caliban |
| 22 | # $ openssl rand -hex 64 | tr -d '\n' > "$SECRET_PATH" |
| 23 | # $ sops encrypt --in-place "$SECRET_PATH" |
| 24 | sops.secrets.docuseal-secret-key-base = { |
| 25 | sopsFile = ../secrets/docuseal-secret-key-base.caliban; |
| 26 | format = "binary"; |
| 27 | restartUnits = [ config.systemd.services.docuseal.name ]; |
| 28 | }; |
| 29 | |
| 30 | sops.secrets.docuseal-smtp-password = { |
| 31 | # Keep this in sync with <../secrets/docuseal-noreply-email-login.umbriel>. |
| 32 | sopsFile = ../secrets/docuseal-noreply-email-login.caliban; |
| 33 | format = "binary"; |
| 34 | restartUnits = [ config.systemd.services.docuseal.name ]; |
| 35 | }; |
| 36 | |
| 37 | sops.templates."docuseal.env".content = '' |
| 38 | SMTP_PASSWORD=${config.sops.placeholder.docuseal-smtp-password} |
| 39 | ''; |
| 40 | |
| 41 | services.docuseal.secretKeyBaseFile = "/run/credentials/${config.systemd.services.docuseal.name}/secret-key-base"; |
| 42 | |
| 43 | systemd.services.docuseal.serviceConfig = { |
| 44 | LoadCredential = "secret-key-base:${config.sops.secrets.docuseal-secret-key-base.path}"; |
| 45 | }; |
| 46 | |
| 47 | services.nginx.virtualHosts."docuseal.nixos.org" = { |
| 48 | forceSSL = true; |
| 49 | enableACME = true; |
| 50 | locations."/" = { |
| 51 | proxyPass = "http://127.0.0.1:${toString config.services.docuseal.port}"; |
| 52 | proxyWebsockets = true; |
| 53 | }; |
| 54 | }; |
| 55 | } |