76 lines
2.3 KiB
Nix
76 lines
2.3 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
...
|
|
}: let
|
|
serviceName = "baserow";
|
|
portUtils = import ../../../../lib/port-utils.nix {inherit lib;};
|
|
servicePort = portUtils.getPort serviceName "AZ-CLD-1";
|
|
in {
|
|
virtualisation.oci-containers.containers.${serviceName} = {
|
|
image = "docker.io/baserow/baserow:2.1.6";
|
|
environment = {
|
|
BASEROW_AMOUNT_OF_GUNICORN_WORKERS = "4";
|
|
BASEROW_AMOUNT_OF_WORKERS = "2";
|
|
DATABASE_CONN_MAX_AGE = "60";
|
|
# Proxy: tell Django the connection is HTTPS so cookies get Secure flag
|
|
BASEROW_ENABLE_SECURE_PROXY_SSL_HEADER = "yes";
|
|
# Published apps run on different origins — allow cross-origin cookie delivery
|
|
BASEROW_FRONTEND_SAME_SITE_COOKIE = "none";
|
|
# Valid base domain for published app subdomains
|
|
BASEROW_BUILDER_DOMAINS = "az-gruppe.com";
|
|
# Disable Caddy's on_demand TLS — Traefik handles TLS termination
|
|
BASEROW_CADDY_GLOBAL_CONF = "auto_https off";
|
|
};
|
|
environmentFiles = [config.age.secrets.baserow-env.path];
|
|
ports = ["127.0.0.1:${toString servicePort}:80"];
|
|
volumes = ["baserow_data:/baserow/data"];
|
|
extraOptions = ["--add-host=postgres:10.89.0.1" "--ip=10.89.0.10" "--network=web"];
|
|
};
|
|
|
|
# Traefik configuration
|
|
services.traefik.dynamicConfigOptions.http = {
|
|
services.${serviceName}.loadBalancer.servers = [
|
|
{
|
|
url = "http://localhost:${toString servicePort}/";
|
|
}
|
|
];
|
|
|
|
middlewares."${serviceName}-headers".headers = {
|
|
customRequestHeaders = {
|
|
X-Forwarded-Proto = "https";
|
|
X-Forwarded-Port = "443";
|
|
};
|
|
};
|
|
|
|
routers.${serviceName} = {
|
|
rule = "Host(`br.az-gruppe.com`)";
|
|
tls = {
|
|
certResolver = "ionos";
|
|
};
|
|
service = serviceName;
|
|
entrypoints = "websecure";
|
|
middlewares = ["${serviceName}-headers"];
|
|
};
|
|
|
|
routers.azubi = {
|
|
rule = "Host(`azubi.az-gruppe.com`)";
|
|
tls = {
|
|
certResolver = "ionos";
|
|
};
|
|
service = serviceName;
|
|
entrypoints = "websecure";
|
|
middlewares = ["${serviceName}-headers"];
|
|
};
|
|
routers.ausbilder = {
|
|
rule = "Host(`ausbilder.az-gruppe.com`)";
|
|
tls = {
|
|
certResolver = "ionos";
|
|
};
|
|
service = serviceName;
|
|
entrypoints = "websecure";
|
|
middlewares = ["${serviceName}-headers"];
|
|
};
|
|
};
|
|
}
|