commit 5241e5a193f009bc8b1235904a8bc15cbe0e2c00 · pyrox.dev/nixpkgs

+10

nixos/doc/manual/release-notes/rl-2009.xml

···

       86
        
       }</programlisting>

     

       87
        
           </para>

     

       88
        
          </listitem>

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       89
        
         </itemizedlist>

     

       90
        
        </section>

     

       91

···

       86
        
       }</programlisting>

     

       87
        
           </para>

     

       88
        
          </listitem>

     

       89
       +
          <listitem>

     

       90
       +
           <para>

     

       91
       +
             The <link linkend="opt-services.supybot.enable">supybot</link> module now uses <literal>/var/lib/supybot</literal>

     

       92
       +
             as its default <link linkend="opt-services.supybot.stateDir">stateDir</link> path if <literal>stateVersion</literal>

     

       93
       +
             is 20.09 or higher. It also enables number of

     

       94
       +
             <link xlink:href="https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Sandboxing">systemd sandboxing options</link>

     

       95
       +
             which may possibly interfere with some plugins. If this is the case you can disable the options through attributes in

     

       96
       +
             <option>systemd.services.supybot.serviceConfig</option>.

     

       97
       +
           </para>

     

       98
       +
          </listitem>

     

       99
        
         </itemizedlist>

     

       100
        
        </section>

     

       101

+92 -17

nixos/modules/services/networking/supybot.nix

···

       3
        
       with lib;

     

       4
        
       

     

       5
        
       let

     

       6
       -
       

     

       7
        
         cfg  = config.services.supybot;

     

       8
       -
       

     

       0
        
       
     

       0
        
       
     

       9
        
       in

     

       10
       -
       

     

       11
        
       {

     

       12
       -
       

     

       13
        
         options = {

     

       14
        
       

     

       15
        
           services.supybot = {

     

       16
        
       

     

       17
        
             enable = mkOption {

     

       0
        
       
     

       18
        
               default = false;

     

       19
       -
               description = "Enable Supybot, an IRC bot";

     

       20
        
             };

     

       21
        
       

     

       22
        
             stateDir = mkOption {

     

       23
       -
               # Setting this to /var/lib/supybot caused useradd to fail

     

       24
       -
               default = "/home/supybot";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       25
        
               description = "The root directory, logs and plugins are stored here";

     

       26
        
             };

     

       27
        
       

     

       28
        
             configFile = mkOption {

     

       29
        
               type = types.path;

     

       30
        
               description = ''

     

       31
       -
                 Path to a supybot config file. This can be generated by

     

       32
        
                 running supybot-wizard.

     

       33
        
       

     

       34
        
                 Note: all paths should include the full path to the stateDir

     
···

       36
        
               '';

     

       37
        
             };

     

       38
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       39
        
           };

     

       40
        
       

     

       41
        
         };

     

       42
        
       

     

       43
       -
       

     

       44
        
         config = mkIf cfg.enable {

     

       45
        
       

     

       46
       -
           environment.systemPackages = [ pkgs.pythonPackages.limnoria ];

     

       47
        
       

     

       48
        
           users.users.supybot = {

     

       49
        
             uid = config.ids.uids.supybot;

     

       50
        
             group = "supybot";

     

       51
        
             description = "Supybot IRC bot user";

     

       52
        
             home = cfg.stateDir;

     

       53
       -
             createHome = true;

     

       54
        
           };

     

       55
        
       

     

       56
        
           users.groups.supybot = {

     
···

       59
        
       

     

       60
        
           systemd.services.supybot = {

     

       61
        
             description = "Supybot, an IRC bot";

     

       0
        
       
     

       62
        
             after = [ "network.target" ];

     

       63
        
             wantedBy = [ "multi-user.target" ];

     

       64
       -
             path = [ pkgs.pythonPackages.limnoria ];

     

       65
        
             preStart = ''

     

       66
       -
               cd ${cfg.stateDir}

     

       67
       -
               mkdir -p backup conf data plugins logs/plugins tmp web

     

       68
       -
               ln -sf ${cfg.configFile} supybot.cfg

     

       69
        
               # This needs to be created afresh every time

     

       70
       -
               rm -f supybot.cfg.bak

     

       71
        
             '';

     

       72
        
       

     

       73
        
             serviceConfig = {

     

       74
       -
               ExecStart = "${pkgs.pythonPackages.limnoria}/bin/supybot ${cfg.stateDir}/supybot.cfg";

     

       75
        
               PIDFile = "/run/supybot.pid";

     

       76
        
               User = "supybot";

     

       77
        
               Group = "supybot";

     
···

       79
        
               Restart = "on-abort";

     

       80
        
               StartLimitInterval = "5m";

     

       81
        
               StartLimitBurst = "1";

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       82
        
             };

     

       83
        
           };

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       84
        
       

     

       85
        
         };

     

       86
        
       }

···

       3
        
       with lib;

     

       4
        
       

     

       5
        
       let

     

       0
        
       
     

       6
        
         cfg  = config.services.supybot;

     

       7
       +
         isStateDirHome = hasPrefix "/home/" cfg.stateDir;

     

       8
       +
         isStateDirVar = cfg.stateDir == "/var/lib/supybot";

     

       9
       +
         pyEnv = pkgs.python3.withPackages (p: [ p.limnoria ] ++ (cfg.extraPackages p));

     

       10
        
       in

     

       0
        
       
     

       11
        
       {

     

       0
        
       
     

       12
        
         options = {

     

       13
        
       

     

       14
        
           services.supybot = {

     

       15
        
       

     

       16
        
             enable = mkOption {

     

       17
       +
               type = types.bool;

     

       18
        
               default = false;

     

       19
       +
               description = "Enable Supybot, an IRC bot (also known as Limnoria).";

     

       20
        
             };

     

       21
        
       

     

       22
        
             stateDir = mkOption {

     

       23
       +
               type = types.path;

     

       24
       +
               default = if versionAtLeast config.system.stateVersion "20.09"

     

       25
       +
                 then "/var/lib/supybot"

     

       26
       +
                 else "/home/supybot";

     

       27
       +
               defaultText = "/var/lib/supybot";

     

       28
        
               description = "The root directory, logs and plugins are stored here";

     

       29
        
             };

     

       30
        
       

     

       31
        
             configFile = mkOption {

     

       32
        
               type = types.path;

     

       33
        
               description = ''

     

       34
       +
                 Path to initial supybot config file. This can be generated by

     

       35
        
                 running supybot-wizard.

     

       36
        
       

     

       37
        
                 Note: all paths should include the full path to the stateDir

     
···

       39
        
               '';

     

       40
        
             };

     

       41
        
       

     

       42
       +
             plugins = mkOption {

     

       43
       +
               type = types.attrsOf types.path;

     

       44
       +
               default = {};

     

       45
       +
               description = ''

     

       46
       +
                 Attribute set of additional plugins that will be symlinked to the

     

       47
       +
                 <filename>plugin</filename> subdirectory.

     

       48
       +
       

     

       49
       +
                 Please note that you still need to add the plugins to the config

     

       50
       +
                 file (or with <literal>!load</literal>) using their attribute name.

     

       51
       +
               '';

     

       52
       +
               example = literalExample ''

     

       53
       +
                 let

     

       54
       +
                   plugins = pkgs.fetchzip {

     

       55
       +
                     url = "https://github.com/ProgVal/Supybot-plugins/archive/57c2450c.zip";

     

       56
       +
                     sha256 = "077snf84ibnva3sbpzdfpfma6hcdw7dflwnhg6pw7mgnf0nd84qd";

     

       57
       +
                   };

     

       58
       +
                 in

     

       59
       +
                 {

     

       60
       +
                   Wikipedia = "''${plugins}/Wikipedia";

     

       61
       +
                   Decide = ./supy-decide;

     

       62
       +
                 }

     

       63
       +
               '';

     

       64
       +
             };

     

       65
       +
       

     

       66
       +
             extraPackages = mkOption {

     

       67
       +
               default = p: [];

     

       68
       +
               description = ''

     

       69
       +
                 Extra Python packages available to supybot plugins. The

     

       70
       +
                 value must be a function which receives the attrset defined

     

       71
       +
                 in <varname>python3Packages</varname> as the sole argument.

     

       72
       +
               '';

     

       73
       +
               example = literalExample ''p: [ p.lxml p.requests ]'';

     

       74
       +
             };

     

       75
       +
       

     

       76
        
           };

     

       77
        
       

     

       78
        
         };

     

       79
        
       

     

       0
        
       
     

       80
        
         config = mkIf cfg.enable {

     

       81
        
       

     

       82
       +
           environment.systemPackages = [ pkgs.python3Packages.limnoria ];

     

       83
        
       

     

       84
        
           users.users.supybot = {

     

       85
        
             uid = config.ids.uids.supybot;

     

       86
        
             group = "supybot";

     

       87
        
             description = "Supybot IRC bot user";

     

       88
        
             home = cfg.stateDir;

     

       89
       +
             isSystemUser = true;

     

       90
        
           };

     

       91
        
       

     

       92
        
           users.groups.supybot = {

     
···

       95
        
       

     

       96
        
           systemd.services.supybot = {

     

       97
        
             description = "Supybot, an IRC bot";

     

       98
       +
             documentation = [ "https://limnoria.readthedocs.io/" ];

     

       99
        
             after = [ "network.target" ];

     

       100
        
             wantedBy = [ "multi-user.target" ];

     

       0
        
       
     

       101
        
             preStart = ''

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       102
        
               # This needs to be created afresh every time

     

       103
       +
               rm -f '${cfg.stateDir}/supybot.cfg.bak'

     

       104
        
             '';

     

       105
        
       

     

       106
        
             serviceConfig = {

     

       107
       +
               ExecStart = "${pyEnv}/bin/supybot ${cfg.stateDir}/supybot.cfg";

     

       108
        
               PIDFile = "/run/supybot.pid";

     

       109
        
               User = "supybot";

     

       110
        
               Group = "supybot";

     
···

       112
        
               Restart = "on-abort";

     

       113
        
               StartLimitInterval = "5m";

     

       114
        
               StartLimitBurst = "1";

     

       115
       +
       

     

       116
       +
               NoNewPrivileges = true;

     

       117
       +
               PrivateDevices = true;

     

       118
       +
               PrivateMounts = true;

     

       119
       +
               PrivateTmp = true;

     

       120
       +
               ProtectControlGroups = true;

     

       121
       +
               ProtectKernelModules = true;

     

       122
       +
               ProtectKernelTunables = true;

     

       123
       +
               RestrictAddressFamilies = [ "AF_INET" "AF_INET6" ];

     

       124
       +
               RestrictSUIDSGID = true;

     

       125
       +
               SystemCallArchitectures = "native";

     

       126
       +
               RestrictNamespaces = true;

     

       127
       +
               RestrictRealtime = true;

     

       128
       +
               LockPersonality = true;

     

       129
       +
               MemoryDenyWriteExecute = true;

     

       130
       +
               RemoveIPC = true;

     

       131
       +
               ProtectHostname = true;

     

       132
       +
               CapabilityBoundingSet = "";

     

       133
       +
               ProtectSystem = "full";

     

       134
       +
             }

     

       135
       +
             // optionalAttrs isStateDirVar {

     

       136
       +
               StateDirectory = "supybot";

     

       137
       +
               ProtectSystem = "strict";

     

       138
       +
             }

     

       139
       +
             // optionalAttrs (!isStateDirHome) {

     

       140
       +
               ProtectHome = true;

     

       141
        
             };

     

       142
        
           };

     

       143
       +
       

     

       144
       +
           systemd.tmpfiles.rules = [

     

       145
       +
             "d '${cfg.stateDir}'              0700 supybot supybot - -"

     

       146
       +
             "d '${cfg.stateDir}/backup'       0750 supybot supybot - -"

     

       147
       +
             "d '${cfg.stateDir}/conf'         0750 supybot supybot - -"

     

       148
       +
             "d '${cfg.stateDir}/data'         0750 supybot supybot - -"

     

       149
       +
             "d '${cfg.stateDir}/plugins'      0750 supybot supybot - -"

     

       150
       +
             "d '${cfg.stateDir}/logs'         0750 supybot supybot - -"

     

       151
       +
             "d '${cfg.stateDir}/logs/plugins' 0750 supybot supybot - -"

     

       152
       +
             "d '${cfg.stateDir}/tmp'          0750 supybot supybot - -"

     

       153
       +
             "d '${cfg.stateDir}/web'          0750 supybot supybot - -"

     

       154
       +
             "L '${cfg.stateDir}/supybot.cfg'  -    -       -       - ${cfg.configFile}"

     

       155
       +
           ]

     

       156
       +
           ++ (flip mapAttrsToList cfg.plugins (name: dest:

     

       157
       +
             "L+ '${cfg.stateDir}/plugins/${name}' - - - - ${dest}"

     

       158
       +
           ));

     

       159
        
       

     

       160
        
         };

     

       161
        
       }