{ config, pkgs, lib, ... }: let inherit (builtins) head tail; inherit (lib) generators maintainers types; inherit (lib.attrsets) attrValues filterAttrs mapAttrs mapAttrsToList recursiveUpdate; inherit (lib.lists) flatten optional optionals; inherit (lib.options) literalExpression mkEnableOption mkOption mkPackageOption; inherit (lib.strings) concatMapStringsSep concatStringsSep optionalString versionOlder; inherit (lib.trivial) mapNullable; inherit (lib.modules) mkBefore mkDefault mkForce mkIf mkMerge mkRemovedOptionModule mkRenamedOptionModule; inherit (config.services) nginx postfix postgresql redis; inherit (config.users) users groups; cfg = config.services.sourcehut; domain = cfg.settings."sr.ht".global-domain; settingsFormat = pkgs.formats.ini { listToValue = concatMapStringsSep "," (generators.mkValueStringDefault {}); mkKeyValue = k: v: optionalString (v != null) (generators.mkKeyValueDefault { mkValueString = v: if v == true then "yes" else if v == false then "no" else generators.mkValueStringDefault {} v; } "=" k v); }; configIniOfService = srv: settingsFormat.generate "sourcehut-${srv}-config.ini" # Each service needs access to only a subset of sections (and secrets). (filterAttrs (k: v: v != null) (mapAttrs (section: v: let srvMatch = builtins.match "^([a-z]*)\\.sr\\.ht(::.*)?$" section; in if srvMatch == null # Include sections shared by all services || head srvMatch == srv # Include sections for the service being configured then v # Enable Web links and integrations between services. else if tail srvMatch == [ null ] && cfg.${head srvMatch}.enable then { inherit (v) origin; # mansrht crashes without it oauth-client-id = v.oauth-client-id or null; } # Drop sub-sections of other services else null) (recursiveUpdate cfg.settings { # Those paths are mounted using BindPaths= or BindReadOnlyPaths= # for services needing access to them. "builds.sr.ht::worker".buildlogs = "/var/log/sourcehut/buildsrht-worker"; "git.sr.ht".post-update-script = "/usr/bin/gitsrht-update-hook"; "git.sr.ht".repos = cfg.settings."git.sr.ht".repos; "hg.sr.ht".changegroup-script = "/usr/bin/hgsrht-hook-changegroup"; "hg.sr.ht".repos = cfg.settings."hg.sr.ht".repos; # Making this a per service option despite being in a global section, # so that it uses the redis-server used by the service. "sr.ht".redis-host = cfg.${srv}.redis.host; }))); commonServiceSettings = srv: { origin = mkOption { description = "URL ${srv}.sr.ht is being served at (protocol://domain)"; type = types.str; default = "https://${srv}.${domain}"; defaultText = "https://${srv}.example.com"; }; debug-host = mkOption { description = "Address to bind the debug server to."; type = with types; nullOr str; default = null; }; debug-port = mkOption { description = "Port to bind the debug server to."; type = with types; nullOr str; default = null; }; connection-string = mkOption { description = "SQLAlchemy connection string for the database."; type = types.str; default = "postgresql:///localhost?user=${srv}srht&host=/run/postgresql"; }; migrate-on-upgrade = mkEnableOption "automatic migrations on package upgrade" // { default = true; }; oauth-client-id = mkOption { description = "${srv}.sr.ht's OAuth client id for meta.sr.ht."; type = types.str; }; oauth-client-secret = mkOption { description = "${srv}.sr.ht's OAuth client secret for meta.sr.ht."; type = types.path; apply = s: "<" + toString s; }; api-origin = mkOption { description = "Origin URL for the API"; type = types.str; default = "http://${cfg.listenAddress}:${toString (cfg.${srv}.port + 100)}"; defaultText = lib.literalMD '' `"http://''${`[](#opt-services.sourcehut.listenAddress)`}:''${toString (`[](#opt-services.sourcehut.${srv}.port)` + 100)}"` ''; }; }; # Specialized python containing all the modules python = pkgs.sourcehut.python.withPackages (ps: with ps; [ gunicorn eventlet # For monitoring Celery: sudo -u listssrht celery --app listssrht.process -b redis+socket:///run/redis-sourcehut/redis.sock?virtual_host=1 flower flower # Sourcehut services srht buildsrht gitsrht hgsrht hubsrht listssrht mansrht metasrht # Not a python package #pagessrht pastesrht todosrht ]); mkOptionNullOrStr = description: mkOption { description = description; type = with types; nullOr str; default = null; }; in { options.services.sourcehut = { enable = mkEnableOption '' sourcehut - git hosting, continuous integration, mailing list, ticket tracking, wiki and account management services ''; listenAddress = mkOption { type = types.str; default = "localhost"; description = "Address to bind to."; }; python = mkOption { internal = true; type = types.package; default = python; description = '' The python package to use. It should contain references to the *srht modules and also gunicorn. ''; }; minio = { enable = mkEnableOption ''local minio integration''; }; nginx = { enable = mkEnableOption ''local nginx integration''; virtualHost = mkOption { type = types.attrs; default = {}; description = "Virtual-host configuration merged with all Sourcehut's virtual-hosts."; }; }; postfix = { enable = mkEnableOption ''local postfix integration''; }; postgresql = { enable = mkEnableOption ''local postgresql integration''; }; redis = { enable = mkEnableOption ''local redis integration in a dedicated redis-server''; }; settings = mkOption { type = lib.types.submodule { freeformType = settingsFormat.type; options."sr.ht" = { global-domain = mkOption { description = "Global domain name."; type = types.str; example = "example.com"; }; environment = mkOption { description = "Values other than \"production\" adds a banner to each page."; type = types.enum [ "development" "production" ]; default = "development"; }; network-key = mkOption { description = '' An absolute file path (which should be outside the Nix-store) to a secret key to encrypt internal messages with. Use `srht-keygen network` to generate this key. It must be consistent between all services and nodes. ''; type = types.path; apply = s: "<" + toString s; }; owner-email = mkOption { description = "Owner's email."; type = types.str; default = "contact@example.com"; }; owner-name = mkOption { description = "Owner's name."; type = types.str; default = "John Doe"; }; site-blurb = mkOption { description = "Blurb for your site."; type = types.str; default = "the hacker's forge"; }; site-info = mkOption { description = "The top-level info page for your site."; type = types.str; default = "https://sourcehut.org"; }; service-key = mkOption { description = '' An absolute file path (which should be outside the Nix-store) to a key used for encrypting session cookies. Use `srht-keygen service` to generate the service key. This must be shared between each node of the same service (e.g. git1.sr.ht and git2.sr.ht), but different services may use different keys. If you configure all of your services with the same config.ini, you may use the same service-key for all of them. ''; type = types.path; apply = s: "<" + toString s; }; site-name = mkOption { description = "The name of your network of sr.ht-based sites."; type = types.str; default = "sourcehut"; }; source-url = mkOption { description = "The source code for your fork of sr.ht."; type = types.str; default = "https://git.sr.ht/~sircmpwn/srht"; }; }; options.mail = { smtp-host = mkOptionNullOrStr "Outgoing SMTP host."; smtp-port = mkOption { description = "Outgoing SMTP port."; type = with types; nullOr port; default = null; }; smtp-user = mkOptionNullOrStr "Outgoing SMTP user."; smtp-password = mkOptionNullOrStr "Outgoing SMTP password."; smtp-from = mkOption { type = types.str; description = "Outgoing SMTP FROM."; }; error-to = mkOptionNullOrStr "Address receiving application exceptions"; error-from = mkOptionNullOrStr "Address sending application exceptions"; pgp-privkey = mkOption { type = types.str; description = '' An absolute file path (which should be outside the Nix-store) to an OpenPGP private key. Your PGP key information (DO NOT mix up pub and priv here) You must remove the password from your secret key, if present. You can do this with `gpg --edit-key [key-id]`, then use the `passwd` command and do not enter a new password. ''; }; pgp-pubkey = mkOption { type = with types; either path str; description = "OpenPGP public key."; }; pgp-key-id = mkOption { type = types.str; description = "OpenPGP key identifier."; }; }; options.objects = { s3-upstream = mkOption { description = "Configure the S3-compatible object storage service."; type = with types; nullOr str; default = null; }; s3-access-key = mkOption { description = "Access key to the S3-compatible object storage service"; type = with types; nullOr str; default = null; }; s3-secret-key = mkOption { description = '' An absolute file path (which should be outside the Nix-store) to the secret key of the S3-compatible object storage service. ''; type = with types; nullOr path; default = null; apply = mapNullable (s: "<" + toString s); }; }; options.webhooks = { private-key = mkOption { description = '' An absolute file path (which should be outside the Nix-store) to a base64-encoded Ed25519 key for signing webhook payloads. This should be consistent for all *.sr.ht sites, as this key will be used to verify signatures from other sites in your network. Use the `srht-keygen webhook` command to generate a key. ''; type = types.path; apply = s: "<" + toString s; }; }; options."builds.sr.ht" = commonServiceSettings "builds" // { allow-free = mkEnableOption "nonpaying users to submit builds"; redis = mkOption { description = "The Redis connection used for the Celery worker."; type = types.str; default = "redis+socket:///run/redis-sourcehut-buildsrht/redis.sock?virtual_host=2"; }; shell = mkOption { description = '' Scripts used to launch on SSH connection. `/usr/bin/master-shell` on master, `/usr/bin/runner-shell` on runner. If master and worker are on the same system set to `/usr/bin/runner-shell`. ''; type = types.enum ["/usr/bin/master-shell" "/usr/bin/runner-shell"]; default = "/usr/bin/master-shell"; }; }; options."builds.sr.ht::worker" = { bind-address = mkOption { description = '' HTTP bind address for serving local build information/monitoring. ''; type = types.str; default = "localhost:8080"; }; buildlogs = mkOption { description = "Path to write build logs."; type = types.str; default = "/var/log/sourcehut/buildsrht-worker"; }; name = mkOption { description = '' Listening address and listening port of the build runner (with HTTP port if not 80). ''; type = types.str; default = "localhost:5020"; }; timeout = mkOption { description = '' Max build duration. See . ''; type = types.str; default = "3m"; }; }; options."git.sr.ht" = commonServiceSettings "git" // { outgoing-domain = mkOption { description = "Outgoing domain."; type = types.str; default = "https://git.localhost.localdomain"; }; post-update-script = mkOption { description = '' A post-update script which is installed in every git repo. This setting is propagated to newer and existing repositories. ''; type = types.path; default = "${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook"; defaultText = "\${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook"; }; repos = mkOption { description = '' Path to git repositories on disk. If changing the default, you must ensure that the gitsrht's user as read and write access to it. ''; type = types.str; default = "/var/lib/sourcehut/gitsrht/repos"; }; webhooks = mkOption { description = "The Redis connection used for the webhooks worker."; type = types.str; default = "redis+socket:///run/redis-sourcehut-gitsrht/redis.sock?virtual_host=1"; }; }; options."git.sr.ht::api" = { internal-ipnet = mkOption { description = '' Set of IP subnets which are permitted to utilize internal API authentication. This should be limited to the subnets from which your *.sr.ht services are running. See [](#opt-services.sourcehut.listenAddress). ''; type = with types; listOf str; default = [ "127.0.0.0/8" "::1/128" ]; }; }; options."hg.sr.ht" = commonServiceSettings "hg" // { changegroup-script = mkOption { description = '' A changegroup script which is installed in every mercurial repo. This setting is propagated to newer and existing repositories. ''; type = types.str; default = "${pkgs.sourcehut.hgsrht}/bin/hgsrht-hook-changegroup"; defaultText = "\${pkgs.sourcehut.hgsrht}/bin/hgsrht-hook-changegroup"; }; repos = mkOption { description = '' Path to mercurial repositories on disk. If changing the default, you must ensure that the hgsrht's user as read and write access to it. ''; type = types.str; default = "/var/lib/sourcehut/hgsrht/repos"; }; srhtext = mkOptionNullOrStr '' Path to the srht mercurial extension (defaults to where the hgsrht code is) ''; clone_bundle_threshold = mkOption { description = ".hg/store size (in MB) past which the nightly job generates clone bundles."; type = types.ints.unsigned; default = 50; }; hg_ssh = mkOption { description = "Path to hg-ssh (if not in $PATH)."; type = types.str; default = "${pkgs.mercurial}/bin/hg-ssh"; defaultText = "\${pkgs.mercurial}/bin/hg-ssh"; }; webhooks = mkOption { description = "The Redis connection used for the webhooks worker."; type = types.str; default = "redis+socket:///run/redis-sourcehut-hgsrht/redis.sock?virtual_host=1"; }; }; options."hub.sr.ht" = commonServiceSettings "hub" // { }; options."lists.sr.ht" = commonServiceSettings "lists" // { allow-new-lists = mkEnableOption "creation of new lists"; notify-from = mkOption { description = "Outgoing email for notifications generated by users."; type = types.str; default = "lists-notify@localhost.localdomain"; }; posting-domain = mkOption { description = "Posting domain."; type = types.str; default = "lists.localhost.localdomain"; }; redis = mkOption { description = "The Redis connection used for the Celery worker."; type = types.str; default = "redis+socket:///run/redis-sourcehut-listssrht/redis.sock?virtual_host=2"; }; webhooks = mkOption { description = "The Redis connection used for the webhooks worker."; type = types.str; default = "redis+socket:///run/redis-sourcehut-listssrht/redis.sock?virtual_host=1"; }; }; options."lists.sr.ht::worker" = { reject-mimetypes = mkOption { description = '' Comma-delimited list of Content-Types to reject. Messages with Content-Types included in this list are rejected. Multipart messages are always supported, and each part is checked against this list. Uses fnmatch for wildcard expansion. ''; type = with types; listOf str; default = ["text/html"]; }; reject-url = mkOption { description = "Reject URL."; type = types.str; default = "https://man.sr.ht/lists.sr.ht/etiquette.md"; }; sock = mkOption { description = '' Path for the lmtp daemon's unix socket. Direct incoming mail to this socket. Alternatively, specify IP:PORT and an SMTP server will be run instead. ''; type = types.str; default = "/tmp/lists.sr.ht-lmtp.sock"; }; sock-group = mkOption { description = '' The lmtp daemon will make the unix socket group-read/write for users in this group. ''; type = types.str; default = "postfix"; }; }; options."man.sr.ht" = commonServiceSettings "man" // { }; options."meta.sr.ht" = removeAttrs (commonServiceSettings "meta") ["oauth-client-id" "oauth-client-secret"] // { webhooks = mkOption { description = "The Redis connection used for the webhooks worker."; type = types.str; default = "redis+socket:///run/redis-sourcehut-metasrht/redis.sock?virtual_host=1"; }; welcome-emails = mkEnableOption "sending stock sourcehut welcome emails after signup"; }; options."meta.sr.ht::api" = { internal-ipnet = mkOption { description = '' Set of IP subnets which are permitted to utilize internal API authentication. This should be limited to the subnets from which your *.sr.ht services are running. See [](#opt-services.sourcehut.listenAddress). ''; type = with types; listOf str; default = [ "127.0.0.0/8" "::1/128" ]; }; }; options."meta.sr.ht::aliases" = mkOption { description = "Aliases for the client IDs of commonly used OAuth clients."; type = with types; attrsOf int; default = {}; example = { "git.sr.ht" = 12345; }; }; options."meta.sr.ht::billing" = { enabled = mkEnableOption "the billing system"; stripe-public-key = mkOptionNullOrStr "Public key for Stripe. Get your keys at https://dashboard.stripe.com/account/apikeys"; stripe-secret-key = mkOptionNullOrStr '' An absolute file path (which should be outside the Nix-store) to a secret key for Stripe. Get your keys at https://dashboard.stripe.com/account/apikeys '' // { apply = mapNullable (s: "<" + toString s); }; }; options."meta.sr.ht::settings" = { registration = mkEnableOption "public registration"; onboarding-redirect = mkOption { description = "Where to redirect new users upon registration."; type = types.str; default = "https://meta.localhost.localdomain"; }; user-invites = mkOption { description = '' How many invites each user is issued upon registration (only applicable if open registration is disabled). ''; type = types.ints.unsigned; default = 5; }; }; options."pages.sr.ht" = commonServiceSettings "pages" // { gemini-certs = mkOption { description = '' An absolute file path (which should be outside the Nix-store) to Gemini certificates. ''; type = with types; nullOr path; default = null; }; max-site-size = mkOption { description = "Maximum size of any given site (post-gunzip), in MiB."; type = types.int; default = 1024; }; user-domain = mkOption { description = '' Configures the user domain, if enabled. All users are given \.this.domain. ''; type = with types; nullOr str; default = null; }; }; options."pages.sr.ht::api" = { internal-ipnet = mkOption { description = '' Set of IP subnets which are permitted to utilize internal API authentication. This should be limited to the subnets from which your *.sr.ht services are running. See [](#opt-services.sourcehut.listenAddress). ''; type = with types; listOf str; default = [ "127.0.0.0/8" "::1/128" ]; }; }; options."paste.sr.ht" = commonServiceSettings "paste" // { }; options."todo.sr.ht" = commonServiceSettings "todo" // { notify-from = mkOption { description = "Outgoing email for notifications generated by users."; type = types.str; default = "todo-notify@localhost.localdomain"; }; webhooks = mkOption { description = "The Redis connection used for the webhooks worker."; type = types.str; default = "redis+socket:///run/redis-sourcehut-todosrht/redis.sock?virtual_host=1"; }; }; options."todo.sr.ht::mail" = { posting-domain = mkOption { description = "Posting domain."; type = types.str; default = "todo.localhost.localdomain"; }; sock = mkOption { description = '' Path for the lmtp daemon's unix socket. Direct incoming mail to this socket. Alternatively, specify IP:PORT and an SMTP server will be run instead. ''; type = types.str; default = "/tmp/todo.sr.ht-lmtp.sock"; }; sock-group = mkOption { description = '' The lmtp daemon will make the unix socket group-read/write for users in this group. ''; type = types.str; default = "postfix"; }; }; }; default = { }; description = '' The configuration for the sourcehut network. ''; }; builds = { enableWorker = mkEnableOption '' worker for builds.sr.ht ::: {.warning} For smaller deployments, job runners can be installed alongside the master server but even if you only build your own software, integration with other services may cause you to run untrusted builds (e.g. automatic testing of patches via listssrht). See . ::: ''; images = mkOption { type = with types; attrsOf (attrsOf (attrsOf package)); default = { }; example = lib.literalExpression ''(let # Pinning unstable to allow usage with flakes and limit rebuilds. pkgs_unstable = builtins.fetchGit { url = "https://github.com/NixOS/nixpkgs"; rev = "ff96a0fa5635770390b184ae74debea75c3fd534"; ref = "nixos-unstable"; }; image_from_nixpkgs = (import ("''${pkgs.sourcehut.buildsrht}/lib/images/nixos/image.nix") { pkgs = (import pkgs_unstable {}); }); in { nixos.unstable.x86_64 = image_from_nixpkgs; } )''; description = '' Images for builds.sr.ht. Each package should be distro.release.arch and point to a /nix/store/package/root.img.qcow2. ''; }; }; git = { package = mkPackageOption pkgs "git" { example = "gitFull"; }; fcgiwrap.preforkProcess = mkOption { description = "Number of fcgiwrap processes to prefork."; type = types.int; default = 4; }; }; hg = { package = mkPackageOption pkgs "mercurial" { }; cloneBundles = mkOption { type = types.bool; default = false; description = '' Generate clonebundles (which require more disk space but dramatically speed up cloning large repositories). ''; }; }; lists = { process = { extraArgs = mkOption { type = with types; listOf str; default = [ "--loglevel DEBUG" "--pool eventlet" "--without-heartbeat" ]; description = "Extra arguments passed to the Celery responsible for processing mails."; }; celeryConfig = mkOption { type = types.lines; default = ""; description = "Content of the `celeryconfig.py` used by the Celery of `listssrht-process`."; }; }; }; }; config = mkIf cfg.enable (mkMerge [ { environment.systemPackages = [ pkgs.sourcehut.coresrht ]; services.sourcehut.settings = { "git.sr.ht".outgoing-domain = mkDefault "https://git.${domain}"; "lists.sr.ht".notify-from = mkDefault "lists-notify@${domain}"; "lists.sr.ht".posting-domain = mkDefault "lists.${domain}"; "meta.sr.ht::settings".onboarding-redirect = mkDefault "https://meta.${domain}"; "todo.sr.ht".notify-from = mkDefault "todo-notify@${domain}"; "todo.sr.ht::mail".posting-domain = mkDefault "todo.${domain}"; }; } (mkIf cfg.postgresql.enable { assertions = [ { assertion = postgresql.enable; message = "postgresql must be enabled and configured"; } ]; }) (mkIf cfg.postfix.enable { assertions = [ { assertion = postfix.enable; message = "postfix must be enabled and configured"; } ]; # Needed for sharing the LMTP sockets with JoinsNamespaceOf= systemd.services.postfix.serviceConfig.PrivateTmp = true; }) (mkIf cfg.redis.enable { services.redis.vmOverCommit = mkDefault true; }) (mkIf cfg.nginx.enable { assertions = [ { assertion = nginx.enable; message = "nginx must be enabled and configured"; } ]; # For proxyPass= in virtual-hosts for Sourcehut services. services.nginx.recommendedProxySettings = mkDefault true; }) (mkIf (cfg.builds.enable || cfg.git.enable || cfg.hg.enable) { services.openssh = { # Note that sshd will continue to honor AuthorizedKeysFile. # Note that you may want automatically rotate # or link to /dev/null the following log files: # - /var/log/gitsrht-dispatch # - /var/log/{build,git,hg}srht-keys # - /var/log/{git,hg}srht-shell # - /var/log/gitsrht-update-hook authorizedKeysCommand = ''/etc/ssh/sourcehut/subdir/srht-dispatch "%u" "%h" "%t" "%k"''; # srht-dispatch will setuid/setgid according to [git.sr.ht::dispatch] authorizedKeysCommandUser = "root"; extraConfig = '' PermitUserEnvironment SRHT_* ''; startWhenNeeded = false; }; environment.etc."ssh/sourcehut/config.ini".source = settingsFormat.generate "sourcehut-dispatch-config.ini" (filterAttrs (k: v: k == "git.sr.ht::dispatch") cfg.settings); environment.etc."ssh/sourcehut/subdir/srht-dispatch" = { # sshd_config(5): The program must be owned by root, not writable by group or others mode = "0755"; source = pkgs.writeShellScript "srht-dispatch-wrapper" '' set -e set -x cd /etc/ssh/sourcehut/subdir ${pkgs.sourcehut.gitsrht}/bin/gitsrht-dispatch "$@" ''; }; systemd.tmpfiles.settings."10-sourcehut-gitsrht" = mkIf cfg.git.enable ( mkMerge [ (builtins.listToAttrs (map (name: { name = "/var/log/sourcehut/gitsrht-${name}"; value.f = { inherit (cfg.git) user group; mode = "0644"; }; }) [ "keys" "shell" "update-hook" ])) { ${cfg.settings."git.sr.ht".repos}.d = { inherit (cfg.git) user group; mode = "0644"; }; } ] ); systemd.services.sshd = { preStart = mkIf cfg.hg.enable '' chown ${cfg.hg.user}:${cfg.hg.group} /var/log/sourcehut/hgsrht-keys ''; serviceConfig = { LogsDirectory = "sourcehut"; BindReadOnlyPaths = # Note that those /usr/bin/* paths are hardcoded in multiple places in *.sr.ht, # for instance to get the user from the [git.sr.ht::dispatch] settings. # *srht-keys needs to: # - access a redis-server in [sr.ht] redis-host, # - access the PostgreSQL server in [*.sr.ht] connection-string, # - query metasrht-api (through the HTTP API). # Using this has the side effect of creating empty files in /usr/bin/ optionals cfg.builds.enable [ "${pkgs.writeShellScript "buildsrht-keys-wrapper" '' set -e cd /run/sourcehut/buildsrht/subdir exec -a "$0" ${pkgs.sourcehut.buildsrht}/bin/buildsrht-keys "$@" ''}:/usr/bin/buildsrht-keys" "${pkgs.sourcehut.buildsrht}/bin/master-shell:/usr/bin/master-shell" "${pkgs.sourcehut.buildsrht}/bin/runner-shell:/usr/bin/runner-shell" ] ++ optionals cfg.git.enable [ # /path/to/gitsrht-keys calls /path/to/gitsrht-shell, # or [git.sr.ht] shell= if set. "${pkgs.writeShellScript "gitsrht-keys-wrapper" '' set -e cd /run/sourcehut/gitsrht/subdir exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-keys "$@" ''}:/usr/bin/gitsrht-keys" "${pkgs.writeShellScript "gitsrht-shell-wrapper" '' set -e cd /run/sourcehut/gitsrht/subdir export PATH="${cfg.git.package}/bin:$PATH" export SRHT_CONFIG=/run/sourcehut/gitsrht/config.ini exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-shell "$@" ''}:/usr/bin/gitsrht-shell" "${pkgs.writeShellScript "gitsrht-update-hook" '' set -e export SRHT_CONFIG=/run/sourcehut/gitsrht/config.ini # hooks/post-update calls /usr/bin/gitsrht-update-hook as hooks/stage-3 # but this wrapper being a bash script, it overrides $0 with /usr/bin/gitsrht-update-hook # hence this hack to put hooks/stage-3 back into gitsrht-update-hook's $0 if test "''${STAGE3:+set}" then exec -a hooks/stage-3 ${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook "$@" else export STAGE3=set exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook "$@" fi ''}:/usr/bin/gitsrht-update-hook" ] ++ optionals cfg.hg.enable [ # /path/to/hgsrht-keys calls /path/to/hgsrht-shell, # or [hg.sr.ht] shell= if set. "${pkgs.writeShellScript "hgsrht-keys-wrapper" '' set -e cd /run/sourcehut/hgsrht/subdir exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-keys "$@" ''}:/usr/bin/hgsrht-keys" "${pkgs.writeShellScript "hgsrht-shell-wrapper" '' set -e cd /run/sourcehut/hgsrht/subdir exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-shell "$@" ''}:/usr/bin/hgsrht-shell" # Mercurial's changegroup hooks are run relative to their repository's directory, # but hgsrht-hook-changegroup looks up ./config.ini "${pkgs.writeShellScript "hgsrht-hook-changegroup" '' set -e test -e "''$PWD"/config.ini || ln -s /run/sourcehut/hgsrht/config.ini "''$PWD"/config.ini exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-hook-changegroup "$@" ''}:/usr/bin/hgsrht-hook-changegroup" ]; }; }; }) ]); imports = [ (import ./service.nix "builds" { inherit configIniOfService; srvsrht = "buildsrht"; port = 5002; extraServices.buildsrht-api = { serviceConfig.Restart = "always"; serviceConfig.RestartSec = "5s"; serviceConfig.ExecStart = "${pkgs.sourcehut.buildsrht}/bin/buildsrht-api -b ${cfg.listenAddress}:${toString (cfg.builds.port + 100)}"; }; # TODO: a celery worker on the master and worker are apparently needed extraServices.buildsrht-worker = let qemuPackage = pkgs.qemu_kvm; serviceName = "buildsrht-worker"; statePath = "/var/lib/sourcehut/${serviceName}"; in mkIf cfg.builds.enableWorker { path = [ pkgs.openssh pkgs.docker ]; preStart = '' set -x if test -z "$(docker images -q qemu:latest 2>/dev/null)" \ || test "$(cat ${statePath}/docker-image-qemu)" != "${qemuPackage.version}" then # Create and import qemu:latest image for docker ${pkgs.dockerTools.streamLayeredImage { name = "qemu"; tag = "latest"; contents = [ qemuPackage ]; }} | docker load # Mark down current package version echo '${qemuPackage.version}' >${statePath}/docker-image-qemu fi ''; serviceConfig = { ExecStart = "${pkgs.sourcehut.buildsrht}/bin/buildsrht-worker"; BindPaths = [ cfg.settings."builds.sr.ht::worker".buildlogs ]; LogsDirectory = [ "sourcehut/${serviceName}" ]; RuntimeDirectory = [ "sourcehut/${serviceName}/subdir" ]; StateDirectory = [ "sourcehut/${serviceName}" ]; TimeoutStartSec = "1800s"; # buildsrht-worker looks up ../config.ini WorkingDirectory = "-"+"/run/sourcehut/${serviceName}/subdir"; }; }; extraConfig = let image_dirs = flatten ( mapAttrsToList (distro: revs: mapAttrsToList (rev: archs: mapAttrsToList (arch: image: pkgs.runCommand "buildsrht-images" { } '' mkdir -p $out/${distro}/${rev}/${arch} ln -s ${image}/*.qcow2 $out/${distro}/${rev}/${arch}/root.img.qcow2 '' ) archs ) revs ) cfg.builds.images ); image_dir_pre = pkgs.symlinkJoin { name = "buildsrht-worker-images-pre"; paths = image_dirs; # FIXME: not working, apparently because ubuntu/latest is a broken link # ++ [ "${pkgs.sourcehut.buildsrht}/lib/images" ]; }; image_dir = pkgs.runCommand "buildsrht-worker-images" { } '' mkdir -p $out/images cp -Lr ${image_dir_pre}/* $out/images ''; in mkMerge [ { users.users.${cfg.builds.user}.shell = pkgs.bash; virtualisation.docker.enable = true; services.sourcehut.settings = mkMerge [ { # Note that git.sr.ht::dispatch is not a typo, # gitsrht-dispatch always use this section "git.sr.ht::dispatch"."/usr/bin/buildsrht-keys" = mkDefault "${cfg.builds.user}:${cfg.builds.group}"; } (mkIf cfg.builds.enableWorker { "builds.sr.ht::worker".shell = "/usr/bin/runner-shell"; "builds.sr.ht::worker".images = mkDefault "${image_dir}/images"; "builds.sr.ht::worker".controlcmd = mkDefault "${image_dir}/images/control"; }) ]; } (mkIf cfg.builds.enableWorker { users.groups = { docker.members = [ cfg.builds.user ]; }; }) (mkIf (cfg.builds.enableWorker && cfg.nginx.enable) { # Allow nginx access to buildlogs users.users.${nginx.user}.extraGroups = [ cfg.builds.group ]; systemd.services.nginx = { serviceConfig.BindReadOnlyPaths = [ cfg.settings."builds.sr.ht::worker".buildlogs ]; }; services.nginx.virtualHosts."logs.${domain}" = mkMerge [ { /* FIXME: is a listen needed? listen = with builtins; # FIXME: not compatible with IPv6 let address = split ":" cfg.settings."builds.sr.ht::worker".name; in [{ addr = elemAt address 0; port = lib.toInt (elemAt address 2); }]; */ locations."/logs/".alias = cfg.settings."builds.sr.ht::worker".buildlogs + "/"; } cfg.nginx.virtualHost ]; }) ]; }) (import ./service.nix "git" (let baseService = { path = [ cfg.git.package ]; serviceConfig.BindPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/gitsrht/repos" ]; }; in { inherit configIniOfService; mainService = mkMerge [ baseService { serviceConfig.StateDirectory = [ "sourcehut/gitsrht" "sourcehut/gitsrht/repos" ]; preStart = mkIf (versionOlder config.system.stateVersion "22.05") (mkBefore '' # Fix Git hooks of repositories pre-dating https://github.com/NixOS/nixpkgs/pull/133984 ( set +f shopt -s nullglob for h in /var/lib/sourcehut/gitsrht/repos/~*/*/hooks/{pre-receive,update,post-update} do ln -fnsv /usr/bin/gitsrht-update-hook "$h"; done ) ''); } ]; port = 5001; webhooks = true; extraTimers.gitsrht-periodic = { service = baseService; timerConfig.OnCalendar = ["*:0/20"]; }; extraConfig = mkMerge [ { # https://stackoverflow.com/questions/22314298/git-push-results-in-fatal-protocol-error-bad-line-length-character-this # Probably could use gitsrht-shell if output is restricted to just parameters... users.users.${cfg.git.user}.shell = pkgs.bash; services.sourcehut.settings = { "git.sr.ht::dispatch"."/usr/bin/gitsrht-keys" = mkDefault "${cfg.git.user}:${cfg.git.group}"; }; systemd.services.sshd = baseService; } (mkIf cfg.nginx.enable { services.nginx.virtualHosts."git.${domain}" = { locations."/authorize" = { proxyPass = "http://${cfg.listenAddress}:${toString cfg.git.port}"; extraConfig = '' proxy_pass_request_body off; proxy_set_header Content-Length ""; proxy_set_header X-Original-URI $request_uri; ''; }; locations."~ ^/([^/]+)/([^/]+)/(HEAD|info/refs|objects/info/.*|git-upload-pack).*$" = { root = "/var/lib/sourcehut/gitsrht/repos"; fastcgiParams = { GIT_HTTP_EXPORT_ALL = ""; GIT_PROJECT_ROOT = "$document_root"; PATH_INFO = "$uri"; SCRIPT_FILENAME = "${cfg.git.package}/bin/git-http-backend"; }; extraConfig = '' auth_request /authorize; fastcgi_read_timeout 500s; fastcgi_pass unix:/run/gitsrht-fcgiwrap.sock; gzip off; ''; }; }; systemd.sockets.gitsrht-fcgiwrap = { before = [ "nginx.service" ]; wantedBy = [ "sockets.target" "gitsrht.service" ]; # This path remains accessible to nginx.service, which has no RootDirectory= socketConfig.ListenStream = "/run/gitsrht-fcgiwrap.sock"; socketConfig.SocketUser = nginx.user; socketConfig.SocketMode = "600"; }; }) ]; extraServices.gitsrht-api.serviceConfig = { Restart = "always"; RestartSec = "5s"; ExecStart = "${pkgs.sourcehut.gitsrht}/bin/gitsrht-api -b ${cfg.listenAddress}:${toString (cfg.git.port + 100)}"; BindPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/gitsrht/repos" ]; }; extraServices.gitsrht-fcgiwrap = mkIf cfg.nginx.enable { serviceConfig = { # Socket is passed by gitsrht-fcgiwrap.socket ExecStart = "${pkgs.fcgiwrap}/sbin/fcgiwrap -c ${toString cfg.git.fcgiwrap.preforkProcess}"; # No need for config.ini ExecStartPre = mkForce []; User = null; DynamicUser = true; BindReadOnlyPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/gitsrht/repos" ]; IPAddressDeny = "any"; InaccessiblePaths = [ "-+/run/postgresql" "-+/run/redis-sourcehut" ]; PrivateNetwork = true; RestrictAddressFamilies = mkForce [ "none" ]; SystemCallFilter = mkForce [ "@system-service" "~@aio" "~@keyring" "~@memlock" "~@privileged" "~@resources" "~@setuid" # @timer is needed for alarm() ]; }; }; })) (import ./service.nix "hg" (let baseService = { path = [ cfg.hg.package ]; serviceConfig.BindPaths = [ "${cfg.settings."hg.sr.ht".repos}:/var/lib/sourcehut/hgsrht/repos" ]; }; in { inherit configIniOfService; mainService = mkMerge [ baseService { serviceConfig.StateDirectory = [ "sourcehut/hgsrht" "sourcehut/hgsrht/repos" ]; } ]; port = 5010; webhooks = true; extraTimers.hgsrht-periodic = { service = baseService; timerConfig.OnCalendar = ["*:0/20"]; }; extraTimers.hgsrht-clonebundles = mkIf cfg.hg.cloneBundles { service = baseService; timerConfig.OnCalendar = ["daily"]; timerConfig.AccuracySec = "1h"; }; extraServices.hgsrht-api = { serviceConfig.Restart = "always"; serviceConfig.RestartSec = "5s"; serviceConfig.ExecStart = "${pkgs.sourcehut.hgsrht}/bin/hgsrht-api -b ${cfg.listenAddress}:${toString (cfg.hg.port + 100)}"; }; extraConfig = mkMerge [ { users.users.${cfg.hg.user}.shell = pkgs.bash; services.sourcehut.settings = { # Note that git.sr.ht::dispatch is not a typo, # gitsrht-dispatch always uses this section. "git.sr.ht::dispatch"."/usr/bin/hgsrht-keys" = mkDefault "${cfg.hg.user}:${cfg.hg.group}"; }; systemd.services.sshd = baseService; } (mkIf cfg.nginx.enable { # Allow nginx access to repositories users.users.${nginx.user}.extraGroups = [ cfg.hg.group ]; services.nginx.virtualHosts."hg.${domain}" = { locations."/authorize" = { proxyPass = "http://${cfg.listenAddress}:${toString cfg.hg.port}"; extraConfig = '' proxy_pass_request_body off; proxy_set_header Content-Length ""; proxy_set_header X-Original-URI $request_uri; ''; }; # Let clients reach pull bundles. We don't really need to lock this down even for # private repos because the bundles are named after the revision hashes... # so someone would need to know or guess a SHA value to download anything. # TODO: proxyPass to an hg serve service? locations."~ ^/[~^][a-z0-9_]+/[a-zA-Z0-9_.-]+/\\.hg/bundles/.*$" = { root = "/var/lib/nginx/hgsrht/repos"; extraConfig = '' auth_request /authorize; gzip off; ''; }; }; systemd.services.nginx = { serviceConfig.BindReadOnlyPaths = [ "${cfg.settings."hg.sr.ht".repos}:/var/lib/nginx/hgsrht/repos" ]; }; }) ]; })) (import ./service.nix "hub" { inherit configIniOfService; port = 5014; extraConfig = { services.nginx = mkIf cfg.nginx.enable { virtualHosts."hub.${domain}" = mkMerge [ { serverAliases = [ domain ]; } cfg.nginx.virtualHost ]; }; }; }) (import ./service.nix "lists" (let srvsrht = "listssrht"; in { inherit configIniOfService; port = 5006; webhooks = true; extraServices.listssrht-api = { serviceConfig.Restart = "always"; serviceConfig.RestartSec = "5s"; serviceConfig.ExecStart = "${pkgs.sourcehut.listssrht}/bin/listssrht-api -b ${cfg.listenAddress}:${toString (cfg.lists.port + 100)}"; }; # Receive the mail from Postfix and enqueue them into Redis and PostgreSQL extraServices.listssrht-lmtp = { wants = [ "postfix.service" ]; unitConfig.JoinsNamespaceOf = optional cfg.postfix.enable "postfix.service"; serviceConfig.ExecStart = "${pkgs.sourcehut.listssrht}/bin/listssrht-lmtp"; # Avoid crashing: os.chown(sock, os.getuid(), sock_gid) serviceConfig.PrivateUsers = mkForce false; }; # Dequeue the mails from Redis and dispatch them extraServices.listssrht-process = { serviceConfig = { preStart = '' cp ${pkgs.writeText "${srvsrht}-webhooks-celeryconfig.py" cfg.lists.process.celeryConfig} \ /run/sourcehut/${srvsrht}-webhooks/celeryconfig.py ''; ExecStart = "${cfg.python}/bin/celery --app listssrht.process worker --hostname listssrht-process@%%h " + concatStringsSep " " cfg.lists.process.extraArgs; # Avoid crashing: os.getloadavg() ProcSubset = mkForce "all"; }; }; extraConfig = mkIf cfg.postfix.enable { users.groups.${postfix.group}.members = [ cfg.lists.user ]; services.sourcehut.settings."lists.sr.ht::mail".sock-group = postfix.group; services.postfix = { destination = [ "lists.${domain}" ]; # FIXME: an accurate recipient list should be queried # from the lists.sr.ht PostgreSQL database to avoid backscattering. # But usernames are unfortunately not in that database but in meta.sr.ht. # Note that two syntaxes are allowed: # - ~username/list-name@lists.${domain} # - u.username.list-name@lists.${domain} localRecipients = [ "@lists.${domain}" ]; transport = '' lists.${domain} lmtp:unix:${cfg.settings."lists.sr.ht::worker".sock} ''; }; }; })) (import ./service.nix "man" { inherit configIniOfService; port = 5004; }) (import ./service.nix "meta" { inherit configIniOfService; port = 5000; webhooks = true; extraTimers.metasrht-daily.timerConfig = { OnCalendar = ["daily"]; AccuracySec = "1h"; }; extraServices.metasrht-api = { serviceConfig.Restart = "always"; serviceConfig.RestartSec = "5s"; preStart = "set -x\n" + concatStringsSep "\n\n" (attrValues (mapAttrs (k: s: let srvMatch = builtins.match "^([a-z]*)\\.sr\\.ht$" k; srv = head srvMatch; in # Configure client(s) as "preauthorized" optionalString (srvMatch != null && cfg.${srv}.enable && ((s.oauth-client-id or null) != null)) '' # Configure ${srv}'s OAuth client as "preauthorized" ${postgresql.package}/bin/psql '${cfg.settings."meta.sr.ht".connection-string}' \ -c "UPDATE oauthclient SET preauthorized = true WHERE client_id = '${s.oauth-client-id}'" '' ) cfg.settings)); serviceConfig.ExecStart = "${pkgs.sourcehut.metasrht}/bin/metasrht-api -b ${cfg.listenAddress}:${toString (cfg.meta.port + 100)}"; }; extraConfig = { assertions = [ { assertion = let s = cfg.settings."meta.sr.ht::billing"; in s.enabled == "yes" -> (s.stripe-public-key != null && s.stripe-secret-key != null); message = "If meta.sr.ht::billing is enabled, the keys must be defined."; } ]; environment.systemPackages = optional cfg.meta.enable (pkgs.writeShellScriptBin "metasrht-manageuser" '' set -eux if test "$(${pkgs.coreutils}/bin/id -n -u)" != '${cfg.meta.user}' then exec sudo -u '${cfg.meta.user}' "$0" "$@" else # In order to load config.ini if cd /run/sourcehut/metasrht then exec ${pkgs.sourcehut.metasrht}/bin/metasrht-manageuser "$@" else cat <${stateDir}/db fi ${optionalString cfg.settings.${iniKey}.migrate-on-upgrade '' # Just try all the migrations because they're not linked to the version for sql in ${pkgs.sourcehut.pagessrht}/share/sql/migrations/*.sql; do ${postgresql.package}/bin/psql '${cfg.settings.${iniKey}.connection-string}' -f "$sql" || true done ''} # Disable webhook touch ${stateDir}/webhook ''; serviceConfig = { ExecStart = mkForce "${pkgs.sourcehut.pagessrht}/bin/pages.sr.ht -b ${cfg.listenAddress}:${toString cfg.pages.port}"; }; }; }) (import ./service.nix "paste" { inherit configIniOfService; port = 5011; extraServices.pastesrht-api = { serviceConfig.Restart = "always"; serviceConfig.RestartSec = "5s"; serviceConfig.ExecStart = "${pkgs.sourcehut.pastesrht}/bin/pastesrht-api -b ${cfg.listenAddress}:${toString (cfg.paste.port + 100)}"; }; }) (import ./service.nix "todo" { inherit configIniOfService; port = 5003; webhooks = true; extraServices.todosrht-api = { serviceConfig.Restart = "always"; serviceConfig.RestartSec = "5s"; serviceConfig.ExecStart = "${pkgs.sourcehut.todosrht}/bin/todosrht-api -b ${cfg.listenAddress}:${toString (cfg.todo.port + 100)}"; }; extraServices.todosrht-lmtp = { wants = [ "postfix.service" ]; unitConfig.JoinsNamespaceOf = optional cfg.postfix.enable "postfix.service"; serviceConfig.ExecStart = "${pkgs.sourcehut.todosrht}/bin/todosrht-lmtp"; # Avoid crashing: os.chown(sock, os.getuid(), sock_gid) serviceConfig.PrivateUsers = mkForce false; }; extraConfig = mkIf cfg.postfix.enable { users.groups.${postfix.group}.members = [ cfg.todo.user ]; services.sourcehut.settings."todo.sr.ht::mail".sock-group = postfix.group; services.postfix = { destination = [ "todo.${domain}" ]; # FIXME: an accurate recipient list should be queried # from the todo.sr.ht PostgreSQL database to avoid backscattering. # But usernames are unfortunately not in that database but in meta.sr.ht. # Note that two syntaxes are allowed: # - ~username/tracker-name@todo.${domain} # - u.username.tracker-name@todo.${domain} localRecipients = [ "@todo.${domain}" ]; transport = '' todo.${domain} lmtp:unix:${cfg.settings."todo.sr.ht::mail".sock} ''; }; }; }) (mkRenamedOptionModule [ "services" "sourcehut" "originBase" ] [ "services" "sourcehut" "settings" "sr.ht" "global-domain" ]) (mkRenamedOptionModule [ "services" "sourcehut" "address" ] [ "services" "sourcehut" "listenAddress" ]) (mkRemovedOptionModule [ "services" "sourcehut" "dispatch" ] '' dispatch is deprecated. See https://sourcehut.org/blog/2022-08-01-dispatch-deprecation-plans/ for more information. '') (mkRemovedOptionModule [ "services" "sourcehut" "services"] '' This option was removed in favor of individual .enable flags. '') ]; meta.doc = ./default.md; meta.maintainers = with maintainers; [ tomberek nessdoor christoph-heiss ]; }