nixpkgs/nixos/modules/services/web-apps/peering-manager.nix

{ config, lib, pkgs, buildEnv, ... }:

let
  cfg = config.services.peering-manager;

  pythonFmt = pkgs.formats.pythonVars {};
  settingsFile = pythonFmt.generate "peering-manager-settings.py" cfg.settings;
  extraConfigFile = pkgs.writeTextFile {
    name = "peering-manager-extraConfig.py";
    text = cfg.extraConfig;
  };
  configFile = pkgs.concatText "configuration.py" [ settingsFile extraConfigFile ];

  pkg = (pkgs.peering-manager.overrideAttrs (old: {
    postInstall = ''
      ln -s ${configFile} $out/opt/peering-manager/peering_manager/configuration.py
    '' + lib.optionalString cfg.enableLdap ''
      ln -s ${cfg.ldapConfigPath} $out/opt/peering-manager/peering_manager/ldap_config.py
    '' + lib.optionalString cfg.enableOidc ''
      ln -s ${cfg.oidcConfigPath} $out/opt/peering-manager/peering_manager/oidc_config.py
    '';
  })).override {
    inherit (cfg) plugins;
  };
  peeringManagerManageScript = pkgs.writeScriptBin "peering-manager-manage" ''
    #!${pkgs.stdenv.shell}
    export PYTHONPATH=${pkg.pythonPath}
    sudo -u peering-manager ${pkg}/bin/peering-manager "$@"
  '';

in {
  options.services.peering-manager = with lib; {
    enable = mkOption {
      type = types.bool;
      default = false;
      description = ''
        Enable Peering Manager.

        This module requires a reverse proxy that serves `/static` separately.
        See this [example](https://github.com/peering-manager/contrib/blob/main/nginx.conf on how to configure this.
      '';
    };

    enableScheduledTasks = mkOption {
      type = types.bool;
      default = true;
      description = ''
        Set up [scheduled tasks](https://peering-manager.readthedocs.io/en/stable/setup/8-scheduled-tasks/)
      '';
    };

    listenAddress = mkOption {
      type = types.str;
      default = "[::1]";
      description = ''
        Address the server will listen on.
      '';
    };

    port = mkOption {
      type = types.port;
      default = 8001;
      description = ''
        Port the server will listen on.
      '';
    };

    plugins = mkOption {
      type = types.functionTo (types.listOf types.package);
      default = _: [];
      defaultText = literalExpression ''
        python3Packages: with python3Packages; [];
      '';
      description = ''
        List of plugin packages to install.
      '';
    };

    secretKeyFile = mkOption {
      type = types.path;
      description = ''
        Path to a file containing the secret key.
      '';
    };

    peeringdbApiKeyFile = mkOption {
      type = with types; nullOr path;
      default = null;
      description = ''
        Path to a file containing the PeeringDB API key.
      '';
    };

    settings = lib.mkOption {
      description = ''
        Configuration options to set in `configuration.py`.
        See the [documentation](https://peering-manager.readthedocs.io/en/stable/configuration/optional-settings/) for more possible options.
      '';

      default = { };

      type = lib.types.submodule {
        freeformType = pythonFmt.type;

        options = {
          ALLOWED_HOSTS = lib.mkOption {
            type = with lib.types; listOf str;
            default = ["*"];
            description = ''
              A list of valid fully-qualified domain names (FQDNs) and/or IP
              addresses that can be used to reach the peering manager service.
            '';
          };
        };
      };
    };

    extraConfig = mkOption {
      type = types.lines;
      default = "";
      description = ''
        Additional lines of configuration appended to the `configuration.py`.
        See the [documentation](https://peering-manager.readthedocs.io/en/stable/configuration/optional-settings/) for more possible options.
      '';
    };

    enableLdap = mkOption {
      type = types.bool;
      default = false;
      description = ''
        Enable LDAP-Authentication for Peering Manager.

        This requires a configuration file being pass through `ldapConfigPath`.
      '';
    };

    ldapConfigPath = mkOption {
      type = types.path;
      description = ''
        Path to the Configuration-File for LDAP-Authentication, will be loaded as `ldap_config.py`.
        See the [documentation](https://peering-manager.readthedocs.io/en/stable/setup/6-ldap/#configuration) for possible options.
      '';
    };

    enableOidc = mkOption {
      type = types.bool;
      default = false;
      description = ''
        Enable OIDC-Authentication for Peering Manager.

        This requires a configuration file being pass through `oidcConfigPath`.
      '';
    };

    oidcConfigPath = mkOption {
      type = types.path;
      description = ''
        Path to the Configuration-File for OIDC-Authentication, will be loaded as `oidc_config.py`.
        See the [documentation](https://peering-manager.readthedocs.io/en/stable/setup/6b-oidc/#configuration) for possible options.
      '';
    };
  };

  config = lib.mkIf cfg.enable {
    services.peering-manager = {
      settings = {
        DATABASE = {
          NAME = "peering-manager";
          USER = "peering-manager";
          HOST = "/run/postgresql";
        };

        # Redis database settings. Redis is used for caching and for queuing background tasks such as webhook events. A separate
        # configuration exists for each. Full connection details are required in both sections, and it is strongly recommended
        # to use two separate database IDs.
        REDIS = {
          tasks = {
            UNIX_SOCKET_PATH = config.services.redis.servers.peering-manager.unixSocket;
            DATABASE = 0;
          };
          caching = {
            UNIX_SOCKET_PATH = config.services.redis.servers.peering-manager.unixSocket;
            DATABASE = 1;
          };
        };
      };

      extraConfig = ''
        with open("${cfg.secretKeyFile}", "r") as file:
          SECRET_KEY = file.readline()
      '' + lib.optionalString (cfg.peeringdbApiKeyFile != null) ''
        with open("${cfg.peeringdbApiKeyFile}", "r") as file:
          PEERINGDB_API_KEY = file.readline()
      '';

      plugins = (ps:
        (lib.optionals cfg.enableLdap [ ps.django-auth-ldap ]) ++
        (lib.optionals cfg.enableOidc (with ps; [ mozilla-django-oidc pyopenssl josepy ]))
      );
    };

    system.build.peeringManagerPkg = pkg;

    services.redis.servers.peering-manager.enable = true;

    services.postgresql = {
      enable = true;
      ensureDatabases = [ "peering-manager" ];
      ensureUsers = [
        {
          name = "peering-manager";
          ensureDBOwnership = true;
        }
      ];
    };

    environment.systemPackages = [ peeringManagerManageScript ];

    systemd.targets.peering-manager = {
      description = "Target for all Peering Manager services";
      wantedBy = [ "multi-user.target" ];
      wants = [ "network-online.target" ];
      after = [ "network-online.target" "redis-peering-manager.service" ];
    };

    systemd.services = let
      defaults = {
        environment = {
          PYTHONPATH = pkg.pythonPath;
        };
        serviceConfig = {
          WorkingDirectory = "/var/lib/peering-manager";
          User = "peering-manager";
          Group = "peering-manager";
          StateDirectory = "peering-manager";
          StateDirectoryMode = "0750";
          Restart = "on-failure";
        };
      };
    in {
      peering-manager-migration = lib.recursiveUpdate defaults {
        description = "Peering Manager migrations";
        wantedBy = [ "peering-manager.target" ];
        serviceConfig = {
          Type = "oneshot";
          ExecStart = "${pkg}/bin/peering-manager migrate";
        };
      };

      peering-manager = lib.recursiveUpdate defaults {
        description = "Peering Manager WSGI Service";
        wantedBy = [ "peering-manager.target" ];
        after = [ "peering-manager-migration.service" ];

        preStart = ''
          ${pkg}/bin/peering-manager remove_stale_contenttypes --no-input
        '';

        serviceConfig = {
          ExecStart = ''
            ${pkg.python.pkgs.gunicorn}/bin/gunicorn peering_manager.wsgi \
              --bind ${cfg.listenAddress}:${toString cfg.port} \
              --pythonpath ${pkg}/opt/peering-manager
          '';
        };
      };

      peering-manager-rq = lib.recursiveUpdate defaults {
        description = "Peering Manager Request Queue Worker";
        wantedBy = [ "peering-manager.target" ];
        after = [ "peering-manager.service" ];
        serviceConfig.ExecStart = "${pkg}/bin/peering-manager rqworker high default low";
      };

      peering-manager-housekeeping = lib.recursiveUpdate defaults {
        description = "Peering Manager housekeeping job";
        after = [ "peering-manager.service" ];
        serviceConfig = {
          Type = "oneshot";
          ExecStart = "${pkg}/bin/peering-manager housekeeping";
        };
      };

      peering-manager-peeringdb-sync = lib.recursiveUpdate defaults {
        description = "PeeringDB sync";
        after = [ "peering-manager.service" ];
        serviceConfig = {
          Type = "oneshot";
          ExecStart = "${pkg}/bin/peering-manager peeringdb_sync";
        };
      };

      peering-manager-prefix-fetch = lib.recursiveUpdate defaults {
        description = "Fetch IRR AS-SET prefixes";
        after = [ "peering-manager.service" ];
        serviceConfig = {
          Type = "oneshot";
          ExecStart = "${pkg}/bin/peering-manager grab_prefixes";
        };
      };

      peering-manager-configuration-deployment = lib.recursiveUpdate defaults {
        description = "Push configuration to routers";
        after = [ "peering-manager.service" ];
        serviceConfig = {
          Type = "oneshot";
          ExecStart = "${pkg}/bin/peering-manager configure_routers";
        };
      };

      peering-manager-session-poll = lib.recursiveUpdate defaults {
        description = "Poll peering sessions from routers";
        after = [ "peering-manager.service" ];
        serviceConfig = {
          Type = "oneshot";
          ExecStart = "${pkg}/bin/peering-manager poll_bgp_sessions --all";
        };
      };
    };

    systemd.timers = {
      peering-manager-housekeeping = {
        description = "Run Peering Manager housekeeping job";
        wantedBy = [ "timers.target" ];
        timerConfig.OnCalendar = "daily";
      };

      peering-manager-peeringdb-sync = {
        enable = lib.mkDefault cfg.enableScheduledTasks;
        description = "Sync PeeringDB at 2:30";
        wantedBy = [ "timers.target" ];
        timerConfig.OnCalendar = "02:30:00";
      };

      peering-manager-prefix-fetch = {
        enable = lib.mkDefault cfg.enableScheduledTasks;
        description = "Fetch IRR AS-SET prefixes at 4:30";
        wantedBy = [ "timers.target" ];
        timerConfig.OnCalendar = "04:30:00";
      };

      peering-manager-configuration-deployment = {
        enable = lib.mkDefault cfg.enableScheduledTasks;
        description = "Push router configuration every hour 5 minutes before full hour";
        wantedBy = [ "timers.target" ];
        timerConfig.OnCalendar = "*:55:00";
      };

      peering-manager-session-poll = {
        enable = lib.mkDefault cfg.enableScheduledTasks;
        description = "Poll peering sessions from routers every hour";
        wantedBy = [ "timers.target" ];
        timerConfig.OnCalendar = "*:00:00";
      };
    };

    users.users.peering-manager = {
      home = "/var/lib/peering-manager";
      isSystemUser = true;
      group = "peering-manager";
    };
    users.groups.peering-manager = {};
    users.groups."${config.services.redis.servers.peering-manager.user}".members = [ "peering-manager" ];
  };

  meta.maintainers = with lib.maintainers; [ yuka ];
}