From 5e82618be293782610c5827eaf34527556563cc9 Mon Sep 17 00:00:00 2001
From: teidesu <alina@tei.su>
Date: Wed, 21 Aug 2024 17:27:45 +0300
Subject: [PATCH] chore(koi): bumped pds and moved to oci-containers

---
 hosts/koi/containers/pds/default.nix         |  54 ++++++++++++++-----
 hosts/koi/containers/pds/docker-compose.yaml |  31 -----------
 secrets/bluesky-pds-secrets.age              | Bin 511 -> 418 bytes
 3 files changed, 41 insertions(+), 44 deletions(-)
 delete mode 100644 hosts/koi/containers/pds/docker-compose.yaml

diff --git a/hosts/koi/containers/pds/default.nix b/hosts/koi/containers/pds/default.nix
index 11c7b00..bb72a55 100644
--- a/hosts/koi/containers/pds/default.nix
+++ b/hosts/koi/containers/pds/default.nix
@@ -3,23 +3,51 @@
 
 let 
   secrets = import (abs "lib/secrets.nix");
+
+  UID = 1106;
 in {
   imports = [
-    (secrets.declare [
-      "bluesky-pds-secrets"
-    ])
-    ((import (abs "lib/containers.nix") inputs).mkDockerComposeContainer {
-      directory = ./.;
-      envFiles = [
-        # PDS_JWT_SECRET, PDS_ADMIN_PASSWORD, PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX, PDS_EMAIL_SMTP_URL
-        (secrets.file config "bluesky-pds-secrets")
-      ];
-    })
+    (secrets.declare [{
+      name = "bluesky-pds-secrets";
+      owner = "bluesky-pds";
+    }])
   ];
 
+  users.groups.bluesky-pds = {};
+  users.users.bluesky-pds = {
+    isNormalUser = true;
+    uid = UID;
+  };
+
+  virtualisation.oci-containers.containers.bluesky-pds = {
+    image = "ghcr.io/bluesky-social/pds:sha-12da4359e5ff2eed69c4ab7d142364d561276a9d";
+    volumes = [
+      "/srv/bluesky-pds/data:/pds"
+      "/mnt/puffer/bluesky-pds:/blobstore"
+    ];
+    environment = {
+      PDS_HOSTNAME = "pds.stupid.fish";
+      PDS_DATA_DIRECTORY = "/pds";
+      PDS_BLOBSTORE_DISK_LOCATION = "/blobstore";
+      PDS_DID_PLC_URL = "https://plc.directory";
+      PDS_BSKY_APP_VIEW_URL = "https://api.bsky.app";
+      PDS_BSKY_APP_VIEW_DID = "did:web:api.bsky.app";
+      PDS_REPORT_SERVICE_URL = "https://mod.bsky.app";
+      PDS_REPORT_SERVICE_DID = "did:plc:ar7c4by46qjdydhdevvrndac";
+      PDS_CRAWLERS = "https://bsky.network";
+      LOG_ENABLED = "true";
+      PDS_INVITE_REQUIRED = "true";
+    };
+    environmentFiles = [
+      # PDS_JWT_SECRET, PDS_ADMIN_PASSWORD, PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX
+      (secrets.file config "bluesky-pds-secrets")
+    ];
+    user = builtins.toString UID;
+  };
+
   systemd.tmpfiles.rules = [
-    "d /mnt/puffer/bluesky-pds 0777 root root -"
-    "d /srv/bluesky-pds/data 0777 root root -"
+    "d /mnt/puffer/bluesky-pds 0700 ${builtins.toString UID} ${builtins.toString UID} -"
+    "d /srv/bluesky-pds/data 0700 ${builtins.toString UID} ${builtins.toString UID} -"
   ];
 
   services.nginx.virtualHosts."pds.stupid.fish" = {
@@ -32,7 +60,7 @@ in {
     '';
     
     locations."/" = {
-      proxyPass = "http://pds.pds.docker:3000$request_uri";
+      proxyPass = "http://bluesky-pds.docker:3000$request_uri";
       proxyWebsockets = true;
     };
   };
diff --git a/hosts/koi/containers/pds/docker-compose.yaml b/hosts/koi/containers/pds/docker-compose.yaml
deleted file mode 100644
index 95fff33..0000000
--- a/hosts/koi/containers/pds/docker-compose.yaml
+++ /dev/null
@@ -1,31 +0,0 @@
-version: "3"
-
-services:
-  pds:
-    image: ghcr.io/bluesky-social/pds:sha-3f0cdfa8441c578eb42eb6e5eadbf909abe9ecfd
-    restart: unless-stopped
-    environment: 
-      - PDS_HOSTNAME=pds.stupid.fish
-      - PDS_DATA_DIRECTORY=/pds
-      - PDS_BLOBSTORE_DISK_LOCATION=/blobstore
-      - PDS_DID_PLC_URL=https://plc.directory
-      - PDS_BSKY_APP_VIEW_URL=https://api.bsky.app
-      - PDS_BSKY_APP_VIEW_DID=did:web:api.bsky.app
-      - PDS_REPORT_SERVICE_URL=https://mod.bsky.app
-      - PDS_REPORT_SERVICE_DID=did:plc:ar7c4by46qjdydhdevvrndac
-      - PDS_CRAWLERS=https://bsky.network
-      - LOG_ENABLED=true
-      - PDS_EMAIL_FROM_ADDRESS=alina@tei.su
-      - PDS_INVITE_REQUIRED=true
-      # forward secret variables
-      - PDS_JWT_SECRET=$PDS_JWT_SECRET
-      - PDS_ADMIN_PASSWORD=$PDS_ADMIN_PASSWORD
-      - PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX
-      - PDS_EMAIL_SMTP_URL=$PDS_EMAIL_SMTP_URL
-    volumes:
-      - type: bind
-        source: /srv/bluesky-pds/data
-        target: /pds
-      - type: bind
-        source: /mnt/puffer/bluesky-pds
-        target: /blobstore
diff --git a/secrets/bluesky-pds-secrets.age b/secrets/bluesky-pds-secrets.age
index 0a235c50d73ed5a83cf7df25c5cff089050288d8..ee2a0003448a085e6d0cdebd90b3ccdb0b529352 100644
GIT binary patch
delta 383
zcmV-_0f7Gh1EK?vEPq*Zd1GipRWE36W-x7aPc>s^M@?8Zb!jn5d2%sBcsP1#X=YVU
zYHDdmI0`{zT1|6RQ7}O=H%DqvOI31WQff|XXiH;aYB*<Sb1`>WVo7W{a4UL8Gzu*(
zEg)HBVO3dXM@=wyS!_i|QEX2yRY-YDPEkovcW+foM`cG#OMg;OYffoTaX|`kEM{<>
z(nrW|+1)kj>#sSpu34uq+{rL(L0){Kvrp<d54S|~`XpqMm<hQ(4u7|dMn|Namu~k@
z(H$9CeJx4`$8E64IyZYkj<}jc*^M$FVj@}jV5ynnffYStsD@xx${Mb18yy+aBA(KA
z4i_E2eE0ISrFbbf2r1&>dDttDbY>x*>=Z~w{EyK1`&8lg1>44xp)d0*F&r1PoTbP7
zaMz#b#d+kfUt;^mpzLQT1OGh9kgvTUQuSwEnA!G-dn(4&SqE(xK}E;&_DXw_3CJPd
dCbaV>AD940xG7Uck7`R97TJ9}BqO^)G}43-rUw83

delta 477
zcmV<30V4jQ1OEe%EPqf;bT)EyOhHOcOi(jMZbL#cdSOp^X-I1~Yf*7aWqE2&QB-m;
zH&$<GcM4B(T0?SLHdi=dSx-@RNKj5vS9x$+Qgvo-ZDe{=FjH)GIc7m*aWze5I0`K-
zEg&^acTGfUP*_n)NH9uSL1=AiLvBuVaAYe|FKtapRWxolRDX7PX>KxQPG<^M5g^BT
zhRD<Xe1Gx24<B5)J%nec*I|!^$vCLd7JDT;(!QscNQNu5sSug)&`SuDMzBC7NHHZM
zGe?h8$^xO+kdf&FATt<I8N+Vg*-L(|#q1Z8?WW2O-i1>d%uGFQi{d4qgytk;Uv*Oz
zynMgN5KV_eIDZy3Nmm3w`M+u_W^bm`Lqy>0)mW}WT#idNtj<^~Q*XYP2=Nu@EtM2B
z{JhR|L+k?VY`&wdMm^o>sqgDoh?l`Md8@q+Q5lrU{v4I3x+A;t-PX3NAoin(ab39O
zV1Y2FQi(7Rnr!KYmXw0o7RFoATJXhCOp(#fl-&NZDOS7kTettaFV0(y4&|vyAL4-h
z5z24|1~(cnKI`?{Y$pvlgLVPpKGL^gAaknGC&&CHK}BiqI+Rn-$BLM-4?`v?&$M3J
T$tVUcgVSAOn4nk}t@YevaoX03