1 files changed, 129 insertions, 0 deletions
diff --git a/modules/plausible.nix b/modules/plausible.nix
new file mode 100644
index 0000000..d63e3ab
--- /dev/null
+++ b/modules/plausible.nix
@@ -0,0 +1,129 @@
+{
+  config,
+  inputs,
+  lib,
+  ...
+}:
+with lib;
+let
+  cfg = config.nixfiles.modules.plausible;
+in
+{
+  options.nixfiles.modules.plausible = {
+    enable = mkEnableOption "Plausible Analytics";
+
+    port = mkOption {
+      description = "Port.";
+      type = with types; port;
+      default = 8000;
+    };
+
+    domain = mkOption {
+      description = "Domain name sans protocol scheme.";
+      type = with types; nullOr str;
+      default = "plausible.${config.networking.domain}";
+    };
+  };
+
+  config =
+    let
+      db = "plausible";
+    in
+    mkIf cfg.enable {
+      _module.args.libPlausible = {
+        htmlPlausibleScript =
+          {
+            domain ? "$host",
+            src ? "https://${cfg.domain}/js/script.js",
+          }:
+          ''<script defer data-domain="${domain}" src="${src}"></script>'';
+      };
+
+      secrets = {
+        plausible-key.file = "${inputs.self}/secrets/plausible-key";
+        plausible-admin-password.file = "${inputs.self}/secrets/plausible-admin-password";
+        plausible-smtp-password.file = "${inputs.self}/secrets/smtp-password";
+      };
+
+      nixfiles.modules = {
+        nginx = {
+          enable = true;
+          upstreams.plausible.servers."127.0.0.1:${toString cfg.port}" = { };
+          virtualHosts.${cfg.domain}.locations."/" = {
+            proxyPass = "http://plausible";
+            proxyWebsockets = true;
+          };
+        };
+        postgresql = {
+          enable = true;
+          extraPostStart = [
+            ''
+              $PSQL "${db}" -tAc 'GRANT ALL ON SCHEMA "public" TO "${db}"'
+              $PSQL "${db}" -tAc 'CREATE EXTENSION IF NOT EXISTS citext'
+            ''
+          ];
+        };
+        clickhouse.enable = true;
+      };
+
+      services.postgresql = {
+        ensureDatabases = [ db ];
+        ensureUsers = [
+          {
+            name = db;
+            ensureDBOwnership = true;
+          }
+        ];
+      };
+
+      services.plausible = {
+        enable = true;
+
+        adminUser = {
+          name = "admin";
+          email = "admin@${my.domain.shire}";
+          passwordFile = config.secrets.plausible-admin-password.path;
+          activate = false;
+        };
+
+        mail = {
+          email = "admin+plausible@${my.domain.shire}";
+          smtp = {
+            hostAddr = my.domain.shire;
+            hostPort = 465;
+            enableSSL = true;
+            user = "azahi@${my.domain.shire}";
+            passwordFile = config.secrets.plausible-smtp-password.path;
+          };
+        };
+
+        database = {
+          clickhouse = {
+            setup = false;
+            url = "http://127.0.0.1:8123/default";
+          };
+
+          postgres = {
+            setup = true;
+            dbname = db;
+          };
+        };
+
+        server = {
+          baseUrl = "https://${cfg.domain}";
+          disableRegistration = true;
+          listenAddress = "127.0.0.1";
+          inherit (cfg) port;
+          secretKeybaseFile = config.secrets.plausible-key.path;
+        };
+      };
+
+      systemd.services.plausible = rec {
+        after = [
+          "postgresql.service"
+          "clickhouse.service"
+        ];
+        requires = after;
+      };
+    };
+}