pterodactyl-nix/modules/pterodactyl.nix

{ flake }:
{ lib, config, pkgs, ... }:

let
  thisConfig = config.services.pterodactyl;

  defaultUser = "pterodactyl";
in {
  options.services.pterodactyl = {
    enable = lib.mkEnableOption "Enable the pterodacytl game server panel";

    pkg = lib.mkOption {
      type = lib.types.package;
      description = "The package in which to source the php files used by pterodactyl";
      default = flake.outputs.packages.${pkgs.system}.pterodactyl;
    };

    dataDir = lib.mkOption {
      type = lib.types.str;
      description = "The directory in which to store stateful data";
      default = "/var/lib/pterodactyl";
    };

    server = {
      enable = lib.mkEnableOption ''
        Automatically configure Nginx to serve the panel

        If you need more control over the nginx proxy, for now you must leave this option disabled
        and write your own nginx configuration. Feel free to copy ours as a starting point.
      '';

      name = lib.mkOption {
        type = lib.types.str;
        description = "The canonical domain name on which the panel will be hosted";
        default = "localhost";
        example = "pterodactyl.example.com";
      };

      listenAddresses = lib.mkOption {
        type = lib.types.listOf lib.types.str;
        description = "The addresses the nginx server should listen on";
        default = [ "127.0.0.1" "[::1]" ];
      };
    };

    php = {
      socket = lib.mkOption {
        type = lib.types.path;
        description = "The location of the unix socket used by php-fpm";
        default = config.services.phpfpm.pools.pterodactyl.socket;
      };

      user = lib.mkOption {
        type = lib.types.str;
        description = ''
          The user that the php-fpm processes will run under. See also the `group` option.

          If you change this, make sure the unix socket is accessible by your www user
          (probably "nginx").
        '';
        default = defaultUser;
      };

      group = lib.mkOption {
        type = lib.types.str;
        description = ''
          The group that the php-fpm processes will run under. See also the `user` option.

          If you change this, make sure the unix socket is accessible by your www user
          (probably "nginx").
        '';
        default = defaultUser;
      };

      home = lib.mkOption {
        type = lib.types.path;
        description = ''
          Where Pterodactyl stores its stateful data is hardcoded to be right next to its php
          scripts. But since we'd like to store the latter in the nix store and the nix store is
          immutable, we have to find a workaround.

          So, the directory pointed to by this option will be where we instruct php to find its
          scripts and data. And the actual files will be simlinked to from this directory, so we can
          actually store them in a different location.
        '';
        default = "/var/lib/pterodactyl";
      };

      manageHome = lib.mkOption {
        type = lib.types.bool;
        description = ''
          Whether or not to automatically create the symlinks

          See services.pterodactyl.php.home for details.
        '';
        default = true;
      };

      pkg = lib.mkOption {
        type = lib.types.package;
        description = "The php package to use";
        default = flake.outputs.packages.${pkgs.system}.php;
      };
    };

    redis = {
      configureLocally = lib.mkEnableOption "Configure a local redis server for pterodactyl";

      name = lib.mkOption {
        type = lib.types.str;
        description = "The Redis server name.";
        default = "redis-pterodactyl";
      };

      port = lib.mkOption {
        type = lib.types.port;
        description = "The port the redis server listens on";
        default = 6379;
      };
    };
  };

  config = lib.mkIf thisConfig.enable {
    users = {
      users = {
        ${thisConfig.php.user} = lib.mkIf (thisConfig.php.user == defaultUser) {
          isSystemUser = true;
          createHome = true;
          home = thisConfig.php.home;
          group = thisConfig.php.group;
        };

        ${config.services.nginx.user} = lib.mkIf (thisConfig.php.group == defaultUser) {
          extraGroups = [ thisConfig.php.group ];
        };
      };

      groups = {
        ${thisConfig.php.group} = lib.mkIf (thisConfig.php.group == defaultUser) {};
      };
    };

    services.redis.servers.${thisConfig.redis.name} = lib.mkIf thisConfig.redis.configureLocally {
      enable = true;
      port = thisConfig.redis.port;
    };

    services.nginx = lib.mkIf thisConfig.server.enable {
      enable = true;

      virtualHosts."pterodactyl" = {
        serverName = thisConfig.server.name;

        root = "${config.services.pterodactyl.pkg}/public";

        extraConfig = ''
          index index.html index.htm index.php;
        '';

        locations = {
          "~ \\.php$".extraConfig = ''
            include ${pkgs.nginx}/conf/fastcgi_params;

            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_pass unix:${thisConfig.php.socket};

            fastcgi_index index.php;

            fastcgi_param PHP_VALUE "upload_max_filesize = 100M \n post_max_size=100M";
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param HTTP_PROXY "";

            fastcgi_intercept_errors off;

            fastcgi_buffer_size 16k;
            fastcgi_buffers 4 16k;

            fastcgi_connect_timeout 300;
            fastcgi_send_timeout 300;
            fastcgi_read_timeout 300;
          '';

          "/" = {
            tryFiles = "$uri $uri/ /index.php?$query_string";
          };
        };
      };
    };

    services.phpfpm.pools.pterodactyl = {
      user = thisConfig.php.user;
      settings = {
        "listen.owner" = config.services.nginx.user;
        "pm" = "dynamic";
        "pm.start_servers" = 4;
        "pm.min_spare_servers" = 4;
        "pm.max_spare_servers" = 16;
        "pm.max_children" = 64;
        "pm.max_requests" = 256;

        "clear_env" = false;
        "catch_workers_output" = true;
        "decorate_workers_output" = false;
        "php_admin_value[error_log]" = "stderr";
        "php_admin_flag[daemonize]" = "false";
      };
    };


    systemd = {
      tmpfiles.settings."10-pterodactyl" = lib.mkIf thisConfig.php.manageHome (let
        home = thisConfig.php.home;
        src = "${thisConfig.pkg}/share/php/pterodactyl-panel";
        data = thisConfig.dataDir;

        user = thisConfig.php.user;
        group = thisConfig.php.group;
      in {
        "${data}/cache" = { "d" = { inherit group user; mode = "750"; }; };
        "${data}/storage" = { "d" = { inherit group user; mode = "750"; }; };
      });

      services = {
        pterodactyl-setup = lib.mkIf thisConfig.php.manageHome {
          description = "Setup the necessary files for the pterodactyl panel to work";

          before = [ "pteroq.service" ]
            ++ (if thisConfig.server.enable then [ "nginx.service" ] else []);
          wantedBy = [ "multi-user.target" "pteroq.service" ]
            ++ (if thisConfig.server.enable then [ "nginx.service" ] else []);

          serviceConfig = {
            Type = "oneshot";

            User = thisConfig.php.user;
            Group = thisConfig.php.group;

            ExecStart = pkgs.writeShellScript "pterodactyl-setup.sh" ''
              SRC="${thisConfig.pkg}/share/php/pterodactyl-panel/";
              HOME="${thisConfig.php.home}";

              USER="${thisConfig.php.user}";
              GROUP="${thisConfig.php.group}";

              rm $HOME/* -r;

              mkdir -p -m 0770 "$HOME";

              for file in app bootstrap config database public resources routes vendor artisan; do
                cp -r "$SRC/$file" "$HOME"
                chmod -R 0550 "$HOME/$file"
              done;

              mkdir -p -m 0750 "$HOME/bootstrap"
              cp "$SRC/bootstrap/app.php" "$HOME/bootstrap/app.php";
              chmod -R 0550 "$HOME/bootstrap/app.php";

              ln -s "${thisConfig.dataDir}/cache" "$HOME/bootstrap/cache";
              ln -s "${thisConfig.dataDir}/storage" "$HOME/storage";
            '';
          };
        };

        pteroq = {
          enable = true;
          description = "Pterodactyl Queue Worker";
          after = [ "redis-${thisConfig.redis.name}.service" ];
          unitConfig = { StartLimitInterval = 180; };
          serviceConfig = {
            User = thisConfig.php.user;
            Group = thisConfig.php.group;

            WorkingDirectory = thisConfig.php.home;

            ExecStart = "${thisConfig.php.pkg}/bin/php ${thisConfig.php.home}/artisan queue:work --queue=high,standard,low --sleep=3 --tries=3";

            Restart = "always";
            RestartSec = "5s";
            StartLimitBurst = 30;
          };
          wantedBy = [ "multi-user.target" ];
        };
      };
    };
  };
}