Vernissage

Vernissage is an application that enables users to share their photographs with others.

⚠︎

Warning: The packages and module(s) to run Vernissage are not published yet. When Swift v6 has reached master, a (draft) PR should have been opened.

Setup

The following configuration provides a minimal example to configure VernissageServer and VernissageWeb, with the default SQLite database, without Redis or S3 object store. The necessary configuration options for VernissageWeb are automatically derived from the base address, set on the API.

services.vernissage = {
  api = {
    enable = true;
    settings.baseAddress = "https://vernissage.example.com";
  };
  web.enable = true;
}

Configuration

Check the upstream example on how to configure the API server.

Here is an example, including secret configuration. As you can see, secrets are specified via a _secret sub-option.

services.vernissage.api.settings = {
  baseAddress = "https://vernissage.example.com";
  connectionString._secret = pkgs.writeText "vernissage-conn-string" ''
    postgres://vernissage:PASSWORD@127.0.0.1:5432/vernissage
  '';
  queueUrl = "redis://127.0.0.1:6379";
  s3Address = "https://s3.garage.example.com";
  s3Bucket = "vernissage";
  s3AccessKeyId._secret = pkgs.writeText "vernissage-s3-id" ''
    KEY-ID
  '';
  s3SecretAccessKey._secret = pkgs.writeText "vernissage-s3-secret" ''
    KEY-SECRET
  '';
}

Reverse Proxy (nginx)

The nginx configuration is adapted from VernissageProxy, which is is a preconfigured nginx server the upstream project provides as a Docker container.

services.nginx = {
  enable = true;

  appendHttpConfig = ''
    map "$http_content_type:$http_accept" $vernissage_machine {
      default "127.0.0.1:${config.services.vernissage.web.port}";
      ~*json  "127.0.0.1:${config.services.vernissage.api.port}";
    }
  '';

  virtualHosts."vernissage.example.com" = {
    locations."~ \/(api\/v1|storage|.well-known|rss|atom)\/".proxyPass = "http://127.0.0.1:${config.services.vernissage.api.port}";
    locations."/".proxyPass = "http://$vernissage_machine";

    extraConfig = ''
      client_max_body_size 10M;
    '';
  };

S3 Object Store

The project suggests to use Minio but since it has been abandoned, Garage is a nearly perfect replacement.

Garage

Configuration

services.garage = {
  enable = true;
  package = pkgs.garage_2;
  settings = {
    replication_factor = 1;
    rpc_bind_addr = "[::]:3901";
    rpc_secret = "687335124ab1c88816cb5fd7e8d77ffe164c04e6bba8ea9d6d8301a92cf96c01";
    s3_api = {
      api_bind_addr = "[::]:3900";
      s3_region = "us-east-1";
      root_domain = ".s3.garage.example.com";
    };
      s3_web = {
        bind_addr = "[::]:3902";
        root_domain = ".web.garage.example.com";
      };
      admin = {
        api_bind_addr = "[::]:3903";
        admin_token = "DDZcCyhTSJGKGN4ukojesKL9aO7zVxQFsWG8FpFW6fw=";
        # Effectively disables metrics because no metrics token is specified (besides the admin token)
        metrics_require_token = true;
      };
    };
  };

Setup

1. Follow the upstream Quick Start guide to setup your node(s), the S3 bucket and a keypair.
2. Enable exposition as a website with sudo garage -c /etc/garage.toml bucket website --allow vernissage
3. Optionally set a bucket quota through sudo garage -c /etc/garage.toml bucket set-quotas --max-size 25G vernissage

Reverse proxy configuration (until anonymous HTTP access is possible)

Until support for anonymous HTTP access is there (upstream PR) you need configure your reverse proxy to redirect unauthenticated file requests to Garage’s web backend.

services.nginx.virtualHosts."s3.garage.example.com".locations."~ \/vernissage\/(.*\.jpg)" = {
proxyPass = "http://127.0.0.1:3902/$1";
  extraConfig = ''
    proxy_set_header Host "vernissage.web.garage.example.com"
  '';
};