rope/nixos
1
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

pelican: fix panel startup — BEHIND_PROXY, www-data dir ownership

Browse source 
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
rope 2026-08-09 12:05:53 +01:00
parent 475d394810
commit 82c02cab03
1 changed files with 19 additions and 30 deletions
Download patch file Download diff file Expand all files Collapse all files

49
services/pelican.nix
View file

@ -28,36 +28,18 @@
# 3. Node → Configuration tab → copy the generated YAML to
# /etc/pelican/config.yml on this host, then
# `systemctl restart docker-pelican-wings`.
{ config, pkgs, lib, ... }:
let
# Replaces the image's default Caddyfile, which would try to fetch its own
# Let's Encrypt cert. nginx already terminates TLS for us, so serve plain
# HTTP on :80 and trust the forwarded headers. private_ranges rather than a
# literal IP: requests arrive from the docker bridge gateway, not 127.0.0.1,
# and the published port is localhost-only anyway.
caddyfile = pkgs.writeText "pelican-Caddyfile" ''
{
admin off
servers {
trusted_proxies static private_ranges
}
}
:80 {
root * /var/www/html/public
encode gzip
php_fastcgi 127.0.0.1:9000
file_server
}
'';
in
{ config, lib, ... }:
{
config = lib.mkIf (config.networking.hostName == "FredOS-Mediaserver") {
systemd.tmpfiles.rules = [
"d /var/lib/pelican-panel 0755 root root -"
"d /var/lib/pelican-panel/logs 0755 root root -"
# Panel runs as www-data (uid/gid 82, alpine) and writes its .env,
# SQLite DB and storage into /pelican-data — root-owned host dirs make
# the entrypoint die on "touch: /pelican-data/.env: Permission denied".
# Numeric because no host user owns 82; nothing else on this box does.
"d /var/lib/pelican-panel 0750 82 82 -"
"d /var/lib/pelican-panel/logs 0750 82 82 -"
# wings runs as root (distroless image, no USER directive).
"d /etc/pelican 0755 root root -"
"d /var/lib/pelican 0755 root root -"
"d /var/log/pelican 0755 root root -"
@ -69,18 +51,25 @@ in
volumes = [
"/var/lib/pelican-panel:/pelican-data"
"/var/lib/pelican-panel/logs:/var/www/html/storage/logs"
"${caddyfile}:/etc/caddy/Caddyfile:ro"
];
# Localhost-only; nginx fronts it (see nginx.nix).
ports = [ "127.0.0.1:8092:80" ];
environment = {
XDG_DATA_HOME = "/pelican-data";
APP_URL = "https://panel.nordhammer.it";
ADMIN_EMAIL = "fredrik@nordhammer.it";
# Required: with an https APP_URL the entrypoint refuses to start
# unless either LE_EMAIL is set or it knows TLS is terminated
# upstream. This also switches the bundled Caddy to plain :80 with
# auto_https off, so no custom Caddyfile is needed.
BEHIND_PROXY = "true";
APP_ENV = "production";
APP_DEBUG = "false";
# Laravel otherwise renders http:// asset URLs behind the proxy.
TRUSTED_PROXIES = "*";
# Without this Laravel sees the container's own IP and renders http://
# asset URLs. Caddy reuses the same value for trusted_proxies, so it
# must be real CIDRs, not "*". nginx reaches us via the published
# localhost port, so the request arrives from the docker bridge
# gateway in 172.16/12 — not 127.0.0.1.
TRUSTED_PROXIES = "172.16.0.0/12,10.0.0.0/8,127.0.0.1/32";
TZ = "Europe/Stockholm";
};
extraOptions = [ "--add-host=host.docker.internal:host-gateway" ];