chaos-jetzt-nixfiles/services/pretix.nix at d767424a091fa7262af53347b84543b2ce79db19 · chaos-jetzt/chaos-jetzt-nixfiles · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
{ baseDomain
, isDev
, config
, lib
, pkgs
, ... }:

let
  domain = "pretix.${baseDomain}";
in {
  sops.secrets.pretix_env = {};

  services.pretix = {
    enable = true;
    environmentFile = config.sops.secrets.pretix_env.path;
    settings = {
      pretix = {
        instance_name = domain;
        url = "https://${domain}";
        currency = "EUR";
        loglevel = if isDev then "INFO" else "WARNING";
        plugins_default = "pretix.plugins.sendmail,pretix.plugins.statistics,pretix.plugins.ticketoutputpdf,pretix.plugins.dbvat";
        plugins_exclude = "pretix.plugins.paypal,pretix.plugins.paypal2,pretix.plugins.stripe,pretix.plugins.banktransfer";
        audit_comments = true;
        obligatory_2fa = true;
        trust_x_forwarded_for = true;
        trust_x_forwarded_proto = true;
        trust_x_forwarded_host = true;
      };
      metrics = {
        enabled = true;
        username = "metrics";
        # PRETIX_METRICS_PASSPHRASE contained in environment file
      };
      locale = {
        default = "de-informal";
        timezone = "Europe/Berlin";
      };
      database = {
        backend = "postgresql";
        name = "pretix";
        user = "pretix";
      };
      mail = {
        from = "pretix${lib.optionalString isDev "-dev"}@chaos.jetzt";
        # environmentFile contains user, password, host, port, tls and ssl options
        admins = "administration@chaos.jetzt";
      };
      django = {
        # PRETIX_DJANGO_SECRET contained in environmentFile
        debug = false;
      };
      languages = {
        enabled = "en,de-informal";
      };
    };

    plugins = [
      pkgs.pretix-dbvat
    ];

    database.createLocally = true;
    nginx = {
      inherit domain;
      enable = true;
    };
  };

  services.nginx = {
    enable = true;
    virtualHosts."${domain}" = {
      serverAliases = [ "tickets.${baseDomain}" ];
      enableACME = true;
      forceSSL = true;
      locations."/".recommendedProxySettings = true;
      locations."/jetzt5".return = "307 https://tickets.chaostreff-flensburg.de/chaos.jetzt/jetzt5";
    };
  };

  cj.monitoring = {
    blackbox.http = [ "${domain}/healthcheck" ] ++ map (d: "${d}/healthcheck") config.services.nginx.virtualHosts.${domain}.serverAliases;
    pretix = [ domain ];
  };
}