randogoth/bucur
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add jirorian Nostr image upload service

Browse source 
Adds the jirorian NixOS module (systemd service, sops secrets, Caddy
fragment), wires it into the flake as a Codeberg input, fixes the Caddy
glob import path, and encrypts all five R2/Nostr secrets into bucur.yaml.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
randogoth 2026-06-08 10:09:30 +03:00
parent 3ae266293f
commit e8dcc49320
6 changed files with 88 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

2
modules/services/caddy.nix
View file

@ -72,6 +72,6 @@ relay.otherwhere.app {
reverse_proxy localhost:8880
}
import Caddyfile.d/*.caddyfile
import /etc/caddy/Caddyfile.d/*.caddyfile
'';
}

74
modules/services/jirorian.nix Normal file
View file

@ -0,0 +1,74 @@
{ pkgs, inputs, config, ... }:
let
# Public domain for this service — set before deploying.
domain = "upload.otherwhere.app";
# Non-secret runtime configuration.
port = 8390;
relayUrl = "wss://relay.otherwhere.app/";
cdnUrl = "https://cdn.otherwhere.app";
bucketName = "media";
pkg = inputs.jirorian.packages.${pkgs.system}.default;
# Writes an EnvironmentFile from sops-managed secret files at service start.
makeEnv = pkgs.writeShellScript "jirorian-make-env" ''
set -euo pipefail
install -m 0600 /dev/null /run/jirorian/env
{
echo "R2_ACCESS_KEY_ID=$(cat ${config.sops.secrets.jirorian_r2_access_key_id.path})"
echo "R2_SECRET_ACCESS_KEY=$(cat ${config.sops.secrets.jirorian_r2_secret_access_key.path})"
echo "R2_ENDPOINT=$(cat ${config.sops.secrets.jirorian_r2_endpoint.path})"
echo "SERVICE_NOSTR_PRIVKEY=$(cat ${config.sops.secrets.jirorian_nostr_privkey.path})"
echo "JIRORIAN_APP_SECRETS=$(cat ${config.sops.secrets.jirorian_app_secrets.path})"
} >> /run/jirorian/env
'';
in
{
# Secrets — add corresponding keys to secrets/bucur.yaml via sops.
sops.secrets.jirorian_r2_access_key_id = { owner = "jirorian"; };
sops.secrets.jirorian_r2_secret_access_key = { owner = "jirorian"; };
sops.secrets.jirorian_r2_endpoint = { owner = "jirorian"; };
sops.secrets.jirorian_nostr_privkey = { owner = "jirorian"; };
sops.secrets.jirorian_app_secrets = { owner = "jirorian"; };
users.users.jirorian = {
isSystemUser = true;
group = "jirorian";
home = "/var/lib/jirorian";
};
users.groups.jirorian = {};
systemd.services.jirorian = {
description = "Jirorian — Nostr-native R2 image upload API";
after = [ "network.target" "sops-nix.service" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
User = "jirorian";
Group = "jirorian";
StateDirectory = "jirorian";
RuntimeDirectory = "jirorian";
ExecStartPre = "+${makeEnv}";
ExecStart = "${pkg}/bin/jirorian";
EnvironmentFile = "/run/jirorian/env";
Environment = [
"JIRORIAN_BASE_URL=https://${domain}"
"JIRORIAN_PORT=${toString port}"
"JIRORIAN_DB=/var/lib/jirorian/jirorian.db"
"R2_BUCKET_NAME=${bucketName}"
"R2_CDN_URL=${cdnUrl}"
"SERVICE_RELAY_URL=${relayUrl}"
];
Restart = "on-failure";
RestartSec = 5;
};
};
# Caddy reverse proxy fragment — picked up via the glob import in caddy.nix.
environment.etc."caddy/Caddyfile.d/jirorian.caddyfile".text = ''
${domain} {
reverse_proxy localhost:${toString port}
}
'';
}