devops/circlez.nix at master · rossprogram/devops · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
let
  awsKeyId = "AKIAI6QCDKDFAZFL5D5A"; # for fowler@rossprogram.org
  region = "us-west-1"; # to minimize latency for our users
  pkgs = import <nixpkgs> {};

  circlezPort = 7817;
  mumblePort = 64738;
  icePort = 6502;
in
{
  network.description = "circlez.rossprogram.org";

  resources.ec2KeyPairs.myKeyPair = {
    accessKeyId = awsKeyId;
    inherit region;
  };

  resources.ec2SecurityGroups.openCirclezPorts = { resources, lib, ... }: {
    accessKeyId = awsKeyId;
    inherit region;
    description = "Open ports for the Circle Z server";
    rules = [
      { toPort = 22; fromPort = 22; sourceIp = "0.0.0.0/0"; } # SSH
      { toPort = circlezPort; fromPort = circlezPort; sourceIp = "0.0.0.0/0"; }
    ];
  };

  circlez = { resources, config, nodes, ... }:
  let
    # build the backend node app
    app = pkgs.callPackage ../circle-z-server/default.nix { yarn2nix = pkgs.yarn2nix-moretea; };
  in {
    # Cloud provider settings; here for AWS
    deployment.targetEnv = "ec2";
    deployment.ec2.accessKeyId = awsKeyId;
    deployment.ec2.region = region;
    deployment.ec2.instanceType = "t2.micro"; # a cheap one
    deployment.ec2.ebsInitialRootDiskSize = 10; # GB
    deployment.ec2.keyPair = resources.ec2KeyPairs.myKeyPair;
    deployment.ec2.associatePublicIpAddress = true;
    deployment.ec2.securityGroups = [ resources.ec2SecurityGroups.openCirclezPorts.name ];

    environment.systemPackages = with pkgs; [
      pkgs.mongodb app
    ];

    services.mongodb.enable = true;

    systemd.services.node = {
      description = "node service";

      after = [ "network.target" ];
      wantedBy = [ "default.target" ];

      environment = {
        NODE_ENV = "production";

        # this is what is provided to clients, i.e., what a user would
        # enter into mumble
        MUMBLE_SERVER="mumble.rossprogram.org";
        MUMBLE_PORT=toString mumblePort;

        # murmur is the mumble server, i.e., the IP where we use ice
        # to control murmur
        MURMUR_HOST="127.0.0.1";
        MURMUR_PORT=toString icePort;
        MURMUR_ICE_SECRET=builtins.readFile ./ice.key;

        PORT = toString circlezPort;
        SECRET = builtins.readFile ./secret.key;

        MONGODB_DATABASE = "circlez";
        MONGODB_PORT = toString 27017;

        AWS_ACCESS_KEY_ID=awsKeyId;
        AWS_SECRET_ACCESS_KEY=builtins.readFile ./aws-secret.key;

        PRIVATE_KEY_PEM=builtins.readFile ./private-key.pem;
        PUBLIC_CERT_PEM=builtins.readFile ./public-cert.pem;
      };

      serviceConfig = {
        ExecStart = "${app}/bin/circle-z-server";
        User = "node";
        Restart = "always";
      };
    };

    # for "security" do not run the node app as root
    users.extraUsers = {
      node = { };
    };

    networking.firewall.allowedTCPPorts = [ circlezPort ];
  };
}