commit 4a8b7bb45d90c84fbc3a38fe40bb5b0265e5c0fc · pyrox.dev/nixpkgs

nixos/doc/manual/release-notes/rl-2505.section.md

···

       119
        
       

     

       120
        
       - [cross-seed](https://www.cross-seed.org), a tool to set-up fully automatic cross-seeding of torrents. Available as [services.cross-seed](#opt-services.cross-seed.enable).

     

       121
        
       

     

       0
        
       
     

       0
        
       
     

       122
        
       - [agorakit](https://github.com/agorakit/agorakit), an organization tool for citizens' collectives. Available with [services.agorakit](options.html#opt-services.agorakit.enable).

     

       123
        
       

     

       124
        
       - [vivid](https://github.com/sharkdp/vivid), a generator for LS_COLOR. Available as [programs.vivid](#opt-programs.vivid.enable).

···

       119
        
       

     

       120
        
       - [cross-seed](https://www.cross-seed.org), a tool to set-up fully automatic cross-seeding of torrents. Available as [services.cross-seed](#opt-services.cross-seed.enable).

     

       121
        
       

     

       122
       +
       - [Froide-Govplan](https://github.com/okfde/froide-govplan), a web application government planer. Available as [services.froide-govplan](#opt-services.froide-govplan.enable).

     

       123
       +
       

     

       124
        
       - [agorakit](https://github.com/agorakit/agorakit), an organization tool for citizens' collectives. Available with [services.agorakit](options.html#opt-services.agorakit.enable).

     

       125
        
       

     

       126
        
       - [vivid](https://github.com/sharkdp/vivid), a generator for LS_COLOR. Available as [programs.vivid](#opt-programs.vivid.enable).

nixos/modules/module-list.nix

···

       1501
        
         ./services/web-apps/flarum.nix

     

       1502
        
         ./services/web-apps/fluidd.nix

     

       1503
        
         ./services/web-apps/freshrss.nix

     

       0
        
       
     

       1504
        
         ./services/web-apps/galene.nix

     

       1505
        
         ./services/web-apps/gancio.nix

     

       1506
        
         ./services/web-apps/gerrit.nix

···

       1501
        
         ./services/web-apps/flarum.nix

     

       1502
        
         ./services/web-apps/fluidd.nix

     

       1503
        
         ./services/web-apps/freshrss.nix

     

       1504
       +
         ./services/web-apps/froide-govplan.nix

     

       1505
        
         ./services/web-apps/galene.nix

     

       1506
        
         ./services/web-apps/gancio.nix

     

       1507
        
         ./services/web-apps/gerrit.nix

+237

nixos/modules/services/web-apps/froide-govplan.nix

···

       1
       +
       {

     

       2
       +
         config,

     

       3
       +
         lib,

     

       4
       +
         pkgs,

     

       5
       +
         ...

     

       6
       +
       }:

     

       7
       +
       let

     

       8
       +
       

     

       9
       +
         cfg = config.services.froide-govplan;

     

       10
       +
         pythonFmt = pkgs.formats.pythonVars { };

     

       11
       +
         settingsFile = pythonFmt.generate "extra_settings.py" cfg.settings;

     

       12
       +
       

     

       13
       +
         pkg = cfg.package.overridePythonAttrs (old: {

     

       14
       +
           postInstall =

     

       15
       +
             old.postInstall

     

       16
       +
             + ''

     

       17
       +
               ln -s ${settingsFile} $out/${pkg.python.sitePackages}/froide_govplan/project/extra_settings.py

     

       18
       +
             '';

     

       19
       +
         });

     

       20
       +
       

     

       21
       +
         froide-govplan = pkgs.writeShellApplication {

     

       22
       +
           name = "froide-govplan";

     

       23
       +
           runtimeInputs = [ pkgs.coreutils ];

     

       24
       +
           text = ''

     

       25
       +
             SUDO="exec"

     

       26
       +
             if [[ "$USER" != govplan ]]; then

     

       27
       +
               SUDO="exec /run/wrappers/bin/sudo -u govplan"

     

       28
       +
             fi

     

       29
       +
             $SUDO env ${lib.getExe pkg} "$@"

     

       30
       +
           '';

     

       31
       +
         };

     

       32
       +
       

     

       33
       +
         # Service hardening

     

       34
       +
         defaultServiceConfig = {

     

       35
       +
           # Secure the services

     

       36
       +
           ReadWritePaths = [ cfg.dataDir ];

     

       37
       +
           CacheDirectory = "froide-govplan";

     

       38
       +
           CapabilityBoundingSet = "";

     

       39
       +
           # ProtectClock adds DeviceAllow=char-rtc r

     

       40
       +
           DeviceAllow = "";

     

       41
       +
           LockPersonality = true;

     

       42
       +
           MemoryDenyWriteExecute = true;

     

       43
       +
           NoNewPrivileges = true;

     

       44
       +
           PrivateDevices = true;

     

       45
       +
           PrivateMounts = true;

     

       46
       +
           PrivateTmp = true;

     

       47
       +
           PrivateUsers = true;

     

       48
       +
           ProtectClock = true;

     

       49
       +
           ProtectHome = true;

     

       50
       +
           ProtectHostname = true;

     

       51
       +
           ProtectSystem = "strict";

     

       52
       +
           ProtectControlGroups = true;

     

       53
       +
           ProtectKernelLogs = true;

     

       54
       +
           ProtectKernelModules = true;

     

       55
       +
           ProtectKernelTunables = true;

     

       56
       +
           ProtectProc = "invisible";

     

       57
       +
           ProcSubset = "pid";

     

       58
       +
           RestrictAddressFamilies = [

     

       59
       +
             "AF_UNIX"

     

       60
       +
             "AF_INET"

     

       61
       +
             "AF_INET6"

     

       62
       +
           ];

     

       63
       +
           RestrictNamespaces = true;

     

       64
       +
           RestrictRealtime = true;

     

       65
       +
           RestrictSUIDSGID = true;

     

       66
       +
           SystemCallArchitectures = "native";

     

       67
       +
           SystemCallFilter = [

     

       68
       +
             "@system-service"

     

       69
       +
             "~@privileged @setuid @keyring"

     

       70
       +
           ];

     

       71
       +
           UMask = "0066";

     

       72
       +
         };

     

       73
       +
       

     

       74
       +
       in

     

       75
       +
       {

     

       76
       +
         options.services.froide-govplan = {

     

       77
       +
       

     

       78
       +
           enable = lib.mkEnableOption "Gouvernment planer web app Govplan";

     

       79
       +
       

     

       80
       +
           package = lib.mkPackageOption pkgs "froide-govplan" { };

     

       81
       +
       

     

       82
       +
           hostName = lib.mkOption {

     

       83
       +
             type = lib.types.str;

     

       84
       +
             default = "localhost";

     

       85
       +
             description = "FQDN for the froide-govplan instance.";

     

       86
       +
           };

     

       87
       +
       

     

       88
       +
           dataDir = lib.mkOption {

     

       89
       +
             type = lib.types.str;

     

       90
       +
             default = "/var/lib/froide-govplan";

     

       91
       +
             description = "Directory to store the Froide-Govplan server data.";

     

       92
       +
           };

     

       93
       +
       

     

       94
       +
           secretKeyFile = lib.mkOption {

     

       95
       +
             type = lib.types.nullOr lib.types.path;

     

       96
       +
             default = null;

     

       97
       +
             description = ''

     

       98
       +
               Path to a file containing the secret key.

     

       99
       +
             '';

     

       100
       +
           };

     

       101
       +
       

     

       102
       +
           settings = lib.mkOption {

     

       103
       +
             description = ''

     

       104
       +
               Configuration options to set in `extra_settings.py`.

     

       105
       +
             '';

     

       106
       +
       

     

       107
       +
             default = { };

     

       108
       +
       

     

       109
       +
             type = lib.types.submodule {

     

       110
       +
               freeformType = pythonFmt.type;

     

       111
       +
       

     

       112
       +
               options = {

     

       113
       +
                 ALLOWED_HOSTS = lib.mkOption {

     

       114
       +
                   type = with lib.types; listOf str;

     

       115
       +
                   default = [ "*" ];

     

       116
       +
                   description = ''

     

       117
       +
                     A list of valid fully-qualified domain names (FQDNs) and/or IP

     

       118
       +
                     addresses that can be used to reach the Froide-Govplan service.

     

       119
       +
                   '';

     

       120
       +
                 };

     

       121
       +
               };

     

       122
       +
             };

     

       123
       +
           };

     

       124
       +
       

     

       125
       +
         };

     

       126
       +
       

     

       127
       +
         config = lib.mkIf cfg.enable {

     

       128
       +
       

     

       129
       +
           services.froide-govplan = {

     

       130
       +
             settings = {

     

       131
       +
               STATIC_ROOT = "${cfg.dataDir}/static";

     

       132
       +
               DEBUG = false;

     

       133
       +
               DATABASES.default = {

     

       134
       +
                 ENGINE = "django.contrib.gis.db.backends.postgis";

     

       135
       +
                 NAME = "govplan";

     

       136
       +
                 USER = "govplan";

     

       137
       +
                 HOST = "/run/postgresql";

     

       138
       +
               };

     

       139
       +
             };

     

       140
       +
           };

     

       141
       +
       

     

       142
       +
           services.postgresql = {

     

       143
       +
             enable = true;

     

       144
       +
             ensureDatabases = [ "govplan" ];

     

       145
       +
             ensureUsers = [

     

       146
       +
               {

     

       147
       +
                 name = "govplan";

     

       148
       +
                 ensureDBOwnership = true;

     

       149
       +
               }

     

       150
       +
             ];

     

       151
       +
             extensions = ps: with ps; [ postgis ];

     

       152
       +
           };

     

       153
       +
       

     

       154
       +
           services.nginx = {

     

       155
       +
             enable = lib.mkDefault true;

     

       156
       +
             virtualHosts."${cfg.hostName}".locations = {

     

       157
       +
               "/".extraConfig = "proxy_pass http://unix:/run/froide-govplan/froide-govplan.socket;";

     

       158
       +
               "/static/".alias = "${cfg.dataDir}/static/";

     

       159
       +
             };

     

       160
       +
             proxyTimeout = lib.mkDefault "120s";

     

       161
       +
           };

     

       162
       +
       

     

       163
       +
           systemd = {

     

       164
       +
             services = {

     

       165
       +
       

     

       166
       +
               postgresql.serviceConfig.ExecStartPost =

     

       167
       +
                 let

     

       168
       +
                   sqlFile = pkgs.writeText "immich-pgvectors-setup.sql" ''

     

       169
       +
                     CREATE EXTENSION IF NOT EXISTS postgis;

     

       170
       +
                   '';

     

       171
       +
                 in

     

       172
       +
                 [

     

       173
       +
                   ''

     

       174
       +
                     ${lib.getExe' config.services.postgresql.package "psql"} -d govplan -f "${sqlFile}"

     

       175
       +
                   ''

     

       176
       +
                 ];

     

       177
       +
       

     

       178
       +
               froide-govplan = {

     

       179
       +
                 description = "Gouvernment planer Govplan";

     

       180
       +
                 serviceConfig = defaultServiceConfig // {

     

       181
       +
                   WorkingDirectory = cfg.dataDir;

     

       182
       +
                   StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/froide-govplan") "froide-govplan";

     

       183
       +
                   User = "govplan";

     

       184
       +
                   Group = "govplan";

     

       185
       +
                 };

     

       186
       +
                 after = [

     

       187
       +
                   "postgresql.service"

     

       188
       +
                   "network.target"

     

       189
       +
                   "systemd-tmpfiles-setup.service"

     

       190
       +
                 ];

     

       191
       +
                 wantedBy = [ "multi-user.target" ];

     

       192
       +
                 environment =

     

       193
       +
                   {

     

       194
       +
                     PYTHONPATH = pkg.pythonPath;

     

       195
       +
                     GDAL_LIBRARY_PATH = "${pkgs.gdal}/lib/libgdal.so";

     

       196
       +
                     GEOS_LIBRARY_PATH = "${pkgs.geos}/lib/libgeos_c.so";

     

       197
       +
                   }

     

       198
       +
                   // lib.optionalAttrs (cfg.secretKeyFile != null) {

     

       199
       +
                     SECRET_KEY_FILE = cfg.secretKeyFile;

     

       200
       +
                   };

     

       201
       +
                 preStart = ''

     

       202
       +
                   # Auto-migrate on first run or if the package has changed

     

       203
       +
                   versionFile="${cfg.dataDir}/src-version"

     

       204
       +
                   version=$(cat "$versionFile" 2>/dev/null || echo 0)

     

       205
       +
       

     

       206
       +
                   if [[ $version != ${pkg.version} ]]; then

     

       207
       +
                     ${lib.getExe pkg} migrate --no-input

     

       208
       +
                     ${lib.getExe pkg} collectstatic --no-input --clear

     

       209
       +
                     echo ${pkg.version} > "$versionFile"

     

       210
       +
                   fi

     

       211
       +
                 '';

     

       212
       +
                 script = ''

     

       213
       +
                   ${pkg.python.pkgs.uvicorn}/bin/uvicorn --uds /run/froide-govplan/froide-govplan.socket \

     

       214
       +
                     --app-dir ${pkg}/${pkg.python.sitePackages}/froide_govplan \

     

       215
       +
                     project.asgi:application

     

       216
       +
                 '';

     

       217
       +
               };

     

       218
       +
             };

     

       219
       +
       

     

       220
       +
           };

     

       221
       +
       

     

       222
       +
           systemd.tmpfiles.rules = [ "d /run/froide-govplan - govplan govplan - -" ];

     

       223
       +
       

     

       224
       +
           environment.systemPackages = [ froide-govplan ];

     

       225
       +
       

     

       226
       +
           users.users.govplan = {

     

       227
       +
             home = "${cfg.dataDir}";

     

       228
       +
             isSystemUser = true;

     

       229
       +
             group = "govplan";

     

       230
       +
           };

     

       231
       +
           users.groups.govplan = { };

     

       232
       +
       

     

       233
       +
         };

     

       234
       +
       

     

       235
       +
         meta.maintainers = with lib.maintainers; [ onny ];

     

       236
       +
       

     

       237
       +
       }