138 lines
3.7 KiB
Nix
138 lines
3.7 KiB
Nix
{
|
|
inputs,
|
|
flake,
|
|
self,
|
|
domain,
|
|
sslOpts,
|
|
...
|
|
}: {
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}: let
|
|
system = pkgs.stdenv.hostPlatform.system;
|
|
|
|
mechDomain = "mechabellum.${domain}";
|
|
apiHost = "127.0.0.1";
|
|
apiPort = 8010;
|
|
|
|
mechPackages = inputs.mechabellum-replay-analysis.packages.${system};
|
|
|
|
mechabellumBackend = pkgs.python312.withPackages (_: [
|
|
mechPackages.backend
|
|
]);
|
|
|
|
mechabellumFrontend = mechPackages.frontend.overrideAttrs (_: {
|
|
VITE_API_BASE_URL = "https://${mechDomain}";
|
|
VITE_PUBLIC_APP_URL = "https://${mechDomain}";
|
|
});
|
|
|
|
stateDir = "/var/lib/mechabellum";
|
|
staticDir = "${stateDir}/static";
|
|
in {
|
|
systemd.tmpfiles.rules = [
|
|
"d ${stateDir} 0750 root root -"
|
|
"d ${stateDir}/replays 0750 root root -"
|
|
"d ${stateDir}/analysis_batches 0750 root root -"
|
|
"d ${stateDir}/analysis_reports 0750 root root -"
|
|
"d ${staticDir} 0755 root root -"
|
|
];
|
|
|
|
systemd.services.mechabellum-api = {
|
|
description = "Mechabellum Replay Analysis API";
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
unitConfig = {
|
|
ConditionPathExists = [
|
|
"${staticDir}/unit_id_to_name.json"
|
|
"${staticDir}/unit_footprints.json"
|
|
];
|
|
};
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
ExecStart = ''
|
|
${mechabellumBackend}/bin/uvicorn \
|
|
mechabellum_replay.backend.app:app \
|
|
--host ${apiHost} \
|
|
--port ${builtins.toString apiPort}
|
|
'';
|
|
WorkingDirectory = stateDir;
|
|
StateDirectory = "mechabellum";
|
|
Restart = "always";
|
|
RestartSec = "5s";
|
|
DynamicUser = true;
|
|
ProtectSystem = "strict";
|
|
ProtectHome = true;
|
|
NoNewPrivileges = true;
|
|
ReadWritePaths = [ stateDir ];
|
|
};
|
|
environment = {
|
|
DATA_DIR = stateDir;
|
|
STATIC_DATA_DIR = staticDir;
|
|
CORS_ALLOWED_ORIGINS = "https://${mechDomain}";
|
|
};
|
|
};
|
|
|
|
systemd.services.mechabellum-worker = {
|
|
description = "Mechabellum Replay Analysis worker";
|
|
after = [ "network-online.target" "mechabellum-api.service" ];
|
|
wants = [ "network-online.target" "mechabellum-api.service" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
unitConfig = {
|
|
ConditionPathExists = [
|
|
"${staticDir}/unit_id_to_name.json"
|
|
"${staticDir}/unit_footprints.json"
|
|
];
|
|
};
|
|
serviceConfig = {
|
|
Type = "simple";
|
|
ExecStart = ''
|
|
${mechabellumBackend}/bin/python -m mechabellum_replay.backend.worker
|
|
'';
|
|
WorkingDirectory = stateDir;
|
|
StateDirectory = "mechabellum";
|
|
Restart = "always";
|
|
RestartSec = "5s";
|
|
DynamicUser = true;
|
|
ProtectSystem = "strict";
|
|
ProtectHome = true;
|
|
NoNewPrivileges = true;
|
|
ReadWritePaths = [ stateDir ];
|
|
};
|
|
environment = {
|
|
DATA_DIR = stateDir;
|
|
STATIC_DATA_DIR = staticDir;
|
|
};
|
|
};
|
|
|
|
services.nginx.virtualHosts."${mechDomain}" = sslOpts // {
|
|
forceSSL = true;
|
|
root = mechabellumFrontend;
|
|
|
|
locations."/api/" = {
|
|
proxyPass = "http://${apiHost}:${builtins.toString apiPort}/api/";
|
|
extraConfig = ''
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
'';
|
|
};
|
|
|
|
locations."/" = {
|
|
tryFiles = "$uri $uri/ /index.html";
|
|
};
|
|
};
|
|
|
|
warnings = [
|
|
''
|
|
mechabellum.${domain} was enabled, but the upstream repo does not package
|
|
data/static/unit_id_to_name.json or data/static/unit_footprints.json.
|
|
Copy those files into ${staticDir} on the server before starting the API
|
|
and worker units.
|
|
''
|
|
];
|
|
}
|