commit 855155083a653a97c4dd17099187d3c178a6083d · pyrox.dev/nixpkgs

+32 -4
nixos/modules/services/misc/bepasty.nix
···

       21
       21
        
               configure a number of bepasty servers which will be started with

     

       22
       22
        
               gunicorn.

     

       23
       23
        
               '';

     

       24
       24
       -
             type = with types ; attrsOf (submodule ({

     

       24
       24
       +
             type = with types ; attrsOf (submodule ({ config, ... } : {

     

       25
       25
        
       

     

       26
       26
        
               options = {

     

       27
       27
        
       

     
···

       33
       33
        
                   example = "0.0.0.0:8000";

     

       34
       34
        
                   default = "127.0.0.1:8000";

     

       35
       35
        
                 };

     

       36
       36
       -
       

     

       37
       36
        
       

     

       38
       37
        
                 dataDir = mkOption {

     

       39
       38
        
                   type = types.str;

     
···

       73
       72
        
                   type = types.str;

     

       74
       73
        
                   description = ''

     

       75
       74
        
                     server secret for safe session cookies, must be set.

     

       75
       75
       +
       

     

       76
       76
       +
                     Warning: this secret is stored in the WORLD-READABLE Nix store!

     

       77
       77
       +
       

     

       78
       78
       +
                     It's recommended to use <option>secretKeyFile</option>

     

       79
       79
       +
                     which takes precedence over <option>secretKey</option>.

     

       76
       80
        
                     '';

     

       77
       81
        
                   default = "";

     

       78
       82
        
                 };

     

       79
       83
        
       

     

       84
       84
       +
                 secretKeyFile = mkOption {

     

       85
       85
       +
                   type = types.nullOr types.str;

     

       86
       86
       +
                   default = null;

     

       87
       87
       +
                   description = ''

     

       88
       88
       +
                     A file that contains the server secret for safe session cookies, must be set.

     

       89
       89
       +
       

     

       90
       90
       +
                     <option>secretKeyFile</option> takes precedence over <option>secretKey</option>.

     

       91
       91
       +
       

     

       92
       92
       +
                     Warning: when <option>secretKey</option> is non-empty <option>secretKeyFile</option>

     

       93
       93
       +
                     defaults to a file in the WORLD-READABLE Nix store containing that secret.

     

       94
       94
       +
                     '';

     

       95
       95
       +
                 };

     

       96
       96
       +
       

     

       80
       97
        
                 workDir = mkOption {

     

       81
       98
        
                   type = types.str;

     

       82
       99
        
                   description = ''

     
···

       87
       104
        
                 };

     

       88
       105
        
       

     

       89
       106
        
               };

     

       107
       107
       +
               config = {

     

       108
       108
       +
                 secretKeyFile = mkDefault (

     

       109
       109
       +
                   if config.secretKey != ""

     

       110
       110
       +
                   then toString (pkgs.writeTextFile {

     

       111
       111
       +
                     name = "bepasty-secret-key";

     

       112
       112
       +
                     text = config.secretKey;

     

       113
       113
       +
                   })

     

       114
       114
       +
                   else null

     

       115
       115
       +
                 );

     

       116
       116
       +
               };

     

       90
       117
        
             }));

     

       91
       118
        
           };

     

       92
       119
        
         };

     

       93
       120
        
       

     

       94
       121
        
         config = mkIf cfg.enable {

     

       122
       122
       +
       

     

       95
       123
        
           environment.systemPackages = [ bepasty ];

     

       96
       124
        
       

     

       97
       125
        
           # creates gunicorn systemd service for each configured server

     
···

       115
       143
        
                 serviceConfig = {

     

       116
       144
        
                   Type = "simple";

     

       117
       145
        
                   PrivateTmp = true;

     

       118
       118
       -
                   ExecStartPre = assert server.secretKey != ""; pkgs.writeScript "bepasty-server.${name}-init" ''

     

       146
       146
       +
                   ExecStartPre = assert !isNull server.secretKeyFile; pkgs.writeScript "bepasty-server.${name}-init" ''

     

       119
       147
        
                     #!/bin/sh

     

       120
       148
        
                     mkdir -p "${server.workDir}"

     

       121
       149
        
                     mkdir -p "${server.dataDir}"

     
···

       123
       151
        
                     cat > ${server.workDir}/bepasty-${name}.conf <<EOF

     

       124
       152
        
                     SITENAME="${name}"

     

       125
       153
        
                     STORAGE_FILESYSTEM_DIRECTORY="${server.dataDir}"

     

       126
       126
       -
                     SECRET_KEY="${server.secretKey}"

     

       154
       154
       +
                     SECRET_KEY="$(cat "${server.secretKeyFile}")"

     

       127
       155
        
                     DEFAULT_PERMISSIONS="${server.defaultPermissions}"

     

       128
       156
        
                     ${server.extraConfig}

     

       129
       157
        
                     EOF