Compare commits
No commits in common. "main" and "web01" have entirely different histories.
35 changed files with 933 additions and 1064 deletions
|
|
@ -12,7 +12,7 @@ jobs:
|
||||||
- name: Check the validity of meta options
|
- name: Check the validity of meta options
|
||||||
run: nix-build meta/verify.nix -A meta
|
run: nix-build meta/verify.nix -A meta
|
||||||
name: Check meta
|
name: Check meta
|
||||||
on:
|
'on':
|
||||||
pull_request:
|
pull_request:
|
||||||
branches:
|
branches:
|
||||||
- main
|
- main
|
||||||
|
|
|
||||||
|
|
@ -7,7 +7,7 @@ jobs:
|
||||||
run: nix-shell -A check-workflows --run '[ $(git status --porcelain | wc -l)
|
run: nix-shell -A check-workflows --run '[ $(git status --porcelain | wc -l)
|
||||||
-eq 0 ]'
|
-eq 0 ]'
|
||||||
name: Check workflows
|
name: Check workflows
|
||||||
on:
|
'on':
|
||||||
pull_request:
|
pull_request:
|
||||||
branches:
|
branches:
|
||||||
- main
|
- main
|
||||||
|
|
|
||||||
|
|
@ -110,7 +110,7 @@ jobs:
|
||||||
name: Build and cache web03
|
name: Build and cache web03
|
||||||
run: nix-shell -A eval-nodes --run cache-node
|
run: nix-shell -A eval-nodes --run cache-node
|
||||||
name: Build all the nodes
|
name: Build all the nodes
|
||||||
on:
|
'on':
|
||||||
pull_request:
|
pull_request:
|
||||||
branches:
|
branches:
|
||||||
- main
|
- main
|
||||||
|
|
|
||||||
|
|
@ -7,19 +7,19 @@ jobs:
|
||||||
depth: 0
|
depth: 0
|
||||||
token: ${{ secrets.TEA_DGNUM_CHORES_TOKEN }}
|
token: ${{ secrets.TEA_DGNUM_CHORES_TOKEN }}
|
||||||
- name: Update dependencies and open PR if necessary
|
- name: Update dependencies and open PR if necessary
|
||||||
run: "npins update\n\nif [ ! -z \"$(git diff --name-only)\" ]; then\n echo
|
run: "npins update\n\nif [ ! -z \"$(git diff --name-only)\" ]; then\n echo\
|
||||||
\"[+] Changes detected, pushing updates.\"\n\n git switch -C npins-update\n\
|
\ \"[+] Changes detected, pushing updates.\"\n\n git switch -C npins-update\n\
|
||||||
\n git add npins\n\n git config user.name \"DGNum Chores\"\n git config
|
\n git add npins\n\n git config user.name \"DGNum Chores\"\n git config\
|
||||||
user.email \"tech@dgnum.eu\"\n\n git commit --message \"chore(npins): Update\"\
|
\ user.email \"tech@dgnum.eu\"\n\n git commit --message \"chore(npins): Update\"\
|
||||||
\n git push --set-upstream origin npins-update --force\n\n # Connect to
|
\n git push --set-upstream origin npins-update --force\n\n # Connect to\
|
||||||
the server with the cli\n tea login add \\\n -n dgnum-chores \\\n -t
|
\ the server with the cli\n tea login add \\\n -n dgnum-chores \\\n \
|
||||||
\"${{ secrets.TEA_DGNUM_CHORES_TOKEN }}\" \\\n -u https://git.dgnum.eu\n\
|
\ -t \"${{ secrets.TEA_DGNUM_CHORES_TOKEN }}\" \\\n -u https://git.dgnum.eu\n\
|
||||||
\n # Create a pull request if needed\n # i.e. no PR with the same title
|
\n # Create a pull request if needed\n # i.e. no PR with the same title\
|
||||||
exists\n if [ -z \"$(tea pr ls -f='title,author' -o simple | grep 'chore(npins):
|
\ exists\n if [ -z \"$(tea pr ls -f='title,author' -o simple | grep 'chore(npins):\
|
||||||
Update dgnum-chores')\" ]; then\n tea pr create \\\n --description
|
\ Update dgnum-chores')\" ]; then\n tea pr create \\\n --description\
|
||||||
\"Automatic npins update\" \\\n --title \"chore(npins): Update\" \\\n\
|
\ \"Automatic npins update\" \\\n --title \"chore(npins): Update\" \\\
|
||||||
\ --head npins-update\n fi\nfi\n"
|
\n --head npins-update\n fi\nfi\n"
|
||||||
name: npins update
|
name: npins update
|
||||||
on:
|
'on':
|
||||||
schedule:
|
schedule:
|
||||||
- cron: 25 15 * * *
|
- cron: 25 15 * * *
|
||||||
|
|
|
||||||
|
|
@ -7,6 +7,6 @@ jobs:
|
||||||
run: nix-shell -A pre-commit --run 'pre-commit run --all-files --hook-stage
|
run: nix-shell -A pre-commit --run 'pre-commit run --all-files --hook-stage
|
||||||
pre-push --show-diff-on-failure'
|
pre-push --show-diff-on-failure'
|
||||||
name: Run pre-commit on all files
|
name: Run pre-commit on all files
|
||||||
on:
|
'on':
|
||||||
- push
|
- push
|
||||||
- pull_request
|
- pull_request
|
||||||
|
|
|
||||||
15
hive.nix
15
hive.nix
|
|
@ -64,12 +64,23 @@ in
|
||||||
};
|
};
|
||||||
|
|
||||||
defaults =
|
defaults =
|
||||||
{ name, nodeMeta, ... }:
|
{
|
||||||
|
pkgs,
|
||||||
|
name,
|
||||||
|
nodeMeta,
|
||||||
|
...
|
||||||
|
}:
|
||||||
{
|
{
|
||||||
# Import the default modules
|
# Import the default modules
|
||||||
imports = [
|
imports = [
|
||||||
./modules
|
./modules
|
||||||
(import "${sources.lix-module}/module.nix" { inherit (sources) lix; })
|
(import "${sources.lix-module}/module.nix" {
|
||||||
|
lix = pkgs.applyPatches {
|
||||||
|
name = "lix-2.90.patched";
|
||||||
|
src = sources.lix;
|
||||||
|
patches = [ ./patches/00-disable-installChecks-lix.patch ];
|
||||||
|
};
|
||||||
|
})
|
||||||
];
|
];
|
||||||
|
|
||||||
# Include default secrets
|
# Include default secrets
|
||||||
|
|
|
||||||
|
|
@ -1,14 +1,7 @@
|
||||||
{
|
{ config, ... }:
|
||||||
config,
|
|
||||||
pkgs,
|
|
||||||
sources,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
|
|
||||||
let
|
let
|
||||||
host = "demarches.dgnum.eu";
|
host = "demarches.dgnum.eu";
|
||||||
|
|
||||||
dgn-id = "fca8f72cd60c00e74d7735ec13e4e3a22e8e1244";
|
|
||||||
in
|
in
|
||||||
{
|
{
|
||||||
imports = [ ./module.nix ];
|
imports = [ ./module.nix ];
|
||||||
|
|
@ -18,18 +11,6 @@ in
|
||||||
services.demarches-simplifiees = {
|
services.demarches-simplifiees = {
|
||||||
enable = true;
|
enable = true;
|
||||||
|
|
||||||
package =
|
|
||||||
((import sources.nix-pkgs { inherit pkgs; }).demarches-simplifiees.override {
|
|
||||||
initialDeploymentDate = "20230923";
|
|
||||||
}).overrideAttrs
|
|
||||||
(old: {
|
|
||||||
dsModules = old.dsModules.overrideAttrs {
|
|
||||||
prePatch = ''
|
|
||||||
${pkgs.lib.getExe pkgs.git} apply -p1 < ${builtins.fetchurl "https://git.dgnum.eu/DGNum/demarches-normaliennes/commit/${dgn-id}.patch"}
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
});
|
|
||||||
|
|
||||||
secretFile = config.age.secrets."ds-fr-secret_file".path;
|
secretFile = config.age.secrets."ds-fr-secret_file".path;
|
||||||
|
|
||||||
initialDeploymentDate = "20230923";
|
initialDeploymentDate = "20230923";
|
||||||
|
|
|
||||||
|
|
@ -2,6 +2,7 @@
|
||||||
config,
|
config,
|
||||||
lib,
|
lib,
|
||||||
meta,
|
meta,
|
||||||
|
nixpkgs,
|
||||||
...
|
...
|
||||||
}:
|
}:
|
||||||
|
|
||||||
|
|
@ -42,7 +43,7 @@ in
|
||||||
services.kanidm = {
|
services.kanidm = {
|
||||||
enableServer = true;
|
enableServer = true;
|
||||||
|
|
||||||
# package = nixpkgs.unstable.kanidm;
|
package = nixpkgs.unstable.kanidm;
|
||||||
|
|
||||||
serverSettings = {
|
serverSettings = {
|
||||||
inherit domain;
|
inherit domain;
|
||||||
|
|
|
||||||
|
|
@ -31,7 +31,7 @@ in
|
||||||
|
|
||||||
inherit url;
|
inherit url;
|
||||||
|
|
||||||
storePath = "/data/slow";
|
storePath = "/data/slow/nix";
|
||||||
tokenFile = config.age.secrets."forgejo_runners-token_file".path;
|
tokenFile = config.age.secrets."forgejo_runners-token_file".path;
|
||||||
|
|
||||||
dependencies = [
|
dependencies = [
|
||||||
|
|
|
||||||
|
|
@ -1,9 +1,4 @@
|
||||||
{
|
{ pkgs, sources, ... }:
|
||||||
pkgs,
|
|
||||||
sources,
|
|
||||||
config,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
|
|
||||||
let
|
let
|
||||||
nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
|
nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
|
||||||
|
|
@ -20,7 +15,7 @@ in
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
webHookSecret = config.age.secrets."webhook-annuaire_token".path;
|
webHookSecret = builtins.toFile "insecure-secret" "T5hNeDraMivRZLUkrekv&QeM";
|
||||||
|
|
||||||
python = pkgs.python3.override {
|
python = pkgs.python3.override {
|
||||||
packageOverrides = _: _: { inherit (nix-pkgs) authens loadcredential; };
|
packageOverrides = _: _: { inherit (nix-pkgs) authens loadcredential; };
|
||||||
|
|
@ -35,7 +30,7 @@ in
|
||||||
];
|
];
|
||||||
|
|
||||||
credentials = {
|
credentials = {
|
||||||
SECRET_KEY = config.age.secrets."dj_annuaire-secret_key_file".path;
|
SECRET_KEY = builtins.toFile "insecure-key" "insecure-key";
|
||||||
};
|
};
|
||||||
|
|
||||||
environment = {
|
environment = {
|
||||||
|
|
|
||||||
|
|
@ -1,9 +1,4 @@
|
||||||
{
|
{ pkgs, sources, ... }:
|
||||||
pkgs,
|
|
||||||
sources,
|
|
||||||
config,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
|
|
||||||
let
|
let
|
||||||
nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
|
nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
|
||||||
|
|
@ -20,7 +15,7 @@ in
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
webHookSecret = config.age.secrets."webhook-bocal_token".path;
|
webHookSecret = builtins.toFile "insecure-secret" "T5hNeDraMivRZLUkrekv&QeM";
|
||||||
|
|
||||||
python = pkgs.python3.override {
|
python = pkgs.python3.override {
|
||||||
packageOverrides = _: _: { inherit (nix-pkgs) django-cas-ng django-solo loadcredential; };
|
packageOverrides = _: _: { inherit (nix-pkgs) django-cas-ng django-solo loadcredential; };
|
||||||
|
|
@ -37,7 +32,7 @@ in
|
||||||
];
|
];
|
||||||
|
|
||||||
credentials = {
|
credentials = {
|
||||||
SECRET_KEY = config.age.secrets."dj_bocal-secret_key_file".path;
|
SECRET_KEY = builtins.toFile "insecure-key" "insecure-key";
|
||||||
};
|
};
|
||||||
|
|
||||||
environment = {
|
environment = {
|
||||||
|
|
|
||||||
|
|
@ -1,9 +1,4 @@
|
||||||
{
|
{ pkgs, sources, ... }:
|
||||||
pkgs,
|
|
||||||
sources,
|
|
||||||
config,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
|
|
||||||
let
|
let
|
||||||
nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
|
nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
|
||||||
|
|
@ -20,7 +15,7 @@ in
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
webHookSecret = config.age.secrets."webhook-gestiojeux_token".path;
|
webHookSecret = builtins.toFile "insecure-secret" "T5hNeDraMivRZLUkrekv&QeM";
|
||||||
|
|
||||||
application = {
|
application = {
|
||||||
type = "wsgi";
|
type = "wsgi";
|
||||||
|
|
@ -59,7 +54,7 @@ in
|
||||||
mediaDirectory = "source/public/media";
|
mediaDirectory = "source/public/media";
|
||||||
|
|
||||||
credentials = {
|
credentials = {
|
||||||
SECRET_KEY = config.age.secrets."dj_gestiojeux-secret_key_file".path;
|
SECRET_KEY = builtins.toFile "insecure-key" "insecure-key";
|
||||||
};
|
};
|
||||||
|
|
||||||
environment = {
|
environment = {
|
||||||
|
|
|
||||||
|
|
@ -1,9 +1,4 @@
|
||||||
{
|
{ pkgs, sources, ... }:
|
||||||
pkgs,
|
|
||||||
sources,
|
|
||||||
config,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
|
|
||||||
let
|
let
|
||||||
nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
|
nix-pkgs = import sources.nix-pkgs { inherit pkgs; };
|
||||||
|
|
@ -13,43 +8,33 @@ in
|
||||||
services.django-apps.sites.wikiens = {
|
services.django-apps.sites.wikiens = {
|
||||||
source = "https://git.dgnum.eu/DGNum/wiki-eleves";
|
source = "https://git.dgnum.eu/DGNum/wiki-eleves";
|
||||||
branch = "main";
|
branch = "main";
|
||||||
domain = "wiki.eleves.ens.fr";
|
domain = "wiki.webapps.dgnum.eu";
|
||||||
|
|
||||||
nginx = {
|
nginx = {
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
};
|
};
|
||||||
|
|
||||||
webHookSecret = config.age.secrets."webhook-wikiens_token".path;
|
webHookSecret = builtins.toFile "insecure-secret" "T5hNeDraMivRZLUkrekv&QeM";
|
||||||
|
|
||||||
python = pkgs.python3.override {
|
python = pkgs.python3.override {
|
||||||
packageOverrides = _: _: {
|
packageOverrides = _: _: { inherit (nix-pkgs) django-allauth-ens django-wiki loadcredential; };
|
||||||
inherit (nix-pkgs)
|
|
||||||
django-allauth
|
|
||||||
django-allauth-ens
|
|
||||||
django-wiki
|
|
||||||
loadcredential
|
|
||||||
;
|
|
||||||
};
|
|
||||||
};
|
};
|
||||||
|
|
||||||
dependencies =
|
dependencies = ps: [
|
||||||
ps:
|
|
||||||
[
|
|
||||||
ps.django
|
ps.django
|
||||||
ps.django-allauth-ens
|
ps.django-allauth-ens
|
||||||
ps.django-wiki
|
ps.django-wiki
|
||||||
ps.loadcredential
|
ps.loadcredential
|
||||||
ps.tinycss2
|
ps.tinycss2
|
||||||
]
|
];
|
||||||
++ ps.django-allauth.optional-dependencies.socialaccount;
|
|
||||||
|
|
||||||
credentials = {
|
credentials = {
|
||||||
SECRET_KEY = config.age.secrets."dj_wikiens-secret_key_file".path;
|
SECRET_KEY = builtins.toFile "insecure-key" "insecure-key";
|
||||||
};
|
};
|
||||||
|
|
||||||
environment = {
|
environment = {
|
||||||
WIKIENS_ALLOWED_HOSTS = [ "wiki.eleves.ens.fr" ];
|
WIKIENS_ALLOWED_HOSTS = [ "wiki.webapps.dgnum.eu" ];
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Binary file not shown.
|
|
@ -1,30 +0,0 @@
|
||||||
age-encryption.org/v1
|
|
||||||
-> ssh-ed25519 jIXfPA HF+w4Kuk7Wo2s94SeNxAB3zFZhKNn1fPabJhUK/xGH0
|
|
||||||
KY5tknNrICYq0HTfNRX760OPyWPJ8B4Sasq8BjN9a6k
|
|
||||||
-> ssh-ed25519 QlRB9Q OGcCe/S1aIQckJGzt4Wz+DFebTZpNV+YCevnVOPDMXQ
|
|
||||||
keDckjD4Vjhj3gmQnW0V8nJ1Soubkhb9WP28fsanhMA
|
|
||||||
-> ssh-ed25519 r+nK/Q lO6xwuhfQ6gMlJzFBF5J9c2elEg1J3leAt5x1uTYGSk
|
|
||||||
HQG0VQXvn72CIOqe6FRGrSX8TIa7sBB3cOZZQzXBl8w
|
|
||||||
-> ssh-rsa krWCLQ
|
|
||||||
pvF18GVS3dHr2jiss4sn00UqVVM2f/6BmkpYMgAVQ3FNpgnimQGsgCssuBo3Hjrc
|
|
||||||
BTO4v2U6cQ28LTUsruWdPhRChT0zfGRtx1QIn0tPzy3XKUxjt2XkBeblxtLhCHmI
|
|
||||||
muQ0yA15bP+aQfZn0dE1Eb4krw1unKWE4f82L/BQ5Y/i1P2rubhyBhBoQRb6atHv
|
|
||||||
S2EWBafaNr3orbFl9FPMjhWW3WZX/zKJxlu0saN88I6ZU2967mdR4PogMpL9iqST
|
|
||||||
atraraA1jG6mR9Ojloyrf8FG6wTlplDlZk8Sgtg88FD1iHMN1q0DQv1LwRoD3QUa
|
|
||||||
ywIn9MABMufNXQ+jm/DQpw
|
|
||||||
-> ssh-ed25519 /vwQcQ 83MxgOJhIBBGU6IRcTQPtxtyR4MapAxhdKT634w/em4
|
|
||||||
scNxodN5j1HXOIPCB3glvc08Gb4wW9gmZ5gkWMCbm4E
|
|
||||||
-> ssh-ed25519 0R97PA LBFUS7zx26+rjiWqVwQ4UBqRxr+3Sx+j+GGrRaBbz08
|
|
||||||
fnFwvJz36SiKnEoJr+0+enNVcT7wduZUrYe7bWhyxfE
|
|
||||||
-> ssh-ed25519 JGx7Ng iXjAn4Y7+yHASx4ZbIrvFffLzgX52DbQy9hIcTScHAs
|
|
||||||
6AJZoV33mBryiCaquKTAkw8yB1NQs38QlG2p4LIcoMc
|
|
||||||
-> ssh-ed25519 bUjjig 0cqMXUVHqhyYhygR7meIyWRr/c7H8ZGB5eO7tTHhRUk
|
|
||||||
GYKKGB02ElJXpObmBJKF4Bvoswd3o83vvVYIHIpDprg
|
|
||||||
-> ssh-ed25519 VQSaNw xHhzKnYeKxrN2MJz84v7Mjg3Nh69UJ6Q/eAyVAvC3V0
|
|
||||||
/bvauGesQw9/tl4DhCNFY9Rq+qWv12O4TcqzdxTCWzk
|
|
||||||
-> T:){{-grease NuQ <}vLGT%
|
|
||||||
0JSFYPMWs6LXpWacfiHNdwqvs/eHecFwj6cg0eLZEQe96shxy8/WSUBMpgasKufB
|
|
||||||
Nc4tpfiOVWVRGm4arhunwJ+1sgg37X35PWde89Qpg5g
|
|
||||||
--- Y6N6GuCpRLdD25EWW+05qbUAadrT3z2Pzc5golCBHJw
|
|
||||||
ßNê ¯3'8ú³€@/¨0,zWêS¦‘ï;ßñì)§e<C2A7>ßÉïèÞí
|
|
||||||
qMj’ÏŒrçHB–ÇR2šš –E2H+d% ¶Ò–®
|
|
||||||
|
|
@ -1,30 +0,0 @@
|
||||||
age-encryption.org/v1
|
|
||||||
-> ssh-ed25519 jIXfPA tuq63SvMOBnLOZNkIA5RenFt0DTg6bwCX4zJ8ISYRxc
|
|
||||||
B1K+kEO/JC0t2EL+2od+UiVNlzBbpRg29lsp2L1DhHw
|
|
||||||
-> ssh-ed25519 QlRB9Q r3M3DQi3xJiP+3nTpwm+2PQipnAaRyaWSH+mb0es6kE
|
|
||||||
codqvk7AgptYBRyz2BFVH0FcQ7ebZGGdJ6PJmoWWXTk
|
|
||||||
-> ssh-ed25519 r+nK/Q Ah4Oim/N0Tdkz1KPbQiHJQaqx614/jjlMqCxtYqjBy0
|
|
||||||
aTrlmm3TbWN6pyDEHf9uGy9H9CyyChXGKL0RZr7U3W4
|
|
||||||
-> ssh-rsa krWCLQ
|
|
||||||
ZbbBqvj7L2XFfJBCQrn799m7FQDrFDg96Moev+Uab/U5caQoJIljMldkfD7VphEt
|
|
||||||
56dyeJ7IdKdnwyt07213ua2gZ8Cmjyffi4b0mYhHkvRI5aSmfUtfiomXU0HkgZvK
|
|
||||||
rk4+AVQYXTLZKlGaq5KkTt4i0ltwzjA9ECNirciqi5JmORkUD1T41xBKCSb+7N5b
|
|
||||||
34Z/uka+oacxt7q27GnSonyFQIm7/owS4bTWV7vxoWLoOYTJcg4Oki/Op4gE9GkK
|
|
||||||
1y4RDpdVsHcRZbi7ewB9UKbvMzH44TN5VJARUf0mFQ/OHUo5IJcm/glS898fSLu/
|
|
||||||
mrjVT6XGAmPELB8uaVhSkg
|
|
||||||
-> ssh-ed25519 /vwQcQ 2mD6dstuZmOkYlBajNevQkeCYAGWshp0h0F1TzdcJSY
|
|
||||||
pzjxW+RZDSqPAHm+c5cMJZOdIfkwTmSLw2BktGh/kHk
|
|
||||||
-> ssh-ed25519 0R97PA /vOiTSDwQVYTX+tFuJD0M8Enk+4b0ViZUnrZ/WhUKiI
|
|
||||||
83r35uyZ/XELwTXZXzlU1yq+xzsNTUYNwK9aGGlOSAA
|
|
||||||
-> ssh-ed25519 JGx7Ng V6Xnn5q1hSvWHjiWtWJAD7as5N2fdtWNKWi3JwhfYgQ
|
|
||||||
aL3fX67spVrgguVtNNrfJ20fy3LRaDgMZldw5D1fKuE
|
|
||||||
-> ssh-ed25519 bUjjig RdTpxQYpmEtG2Cn1EACf85/ZynfPbZhGfoSF+sfw1AA
|
|
||||||
YovrKYRtwRPco3luRBVA0IA1qAq1jKxoS1UdoouhLGE
|
|
||||||
-> ssh-ed25519 VQSaNw F4hYo2UaLzV8leVHx/oY9aIcZkZ9Fap5HiuTvZy+Hko
|
|
||||||
Qwf9JDKqLXmIzId7gAtG5ERirfwZlQWCV6YiKgbexS4
|
|
||||||
-> v>[->`-grease O {|u& 2o9 {w&!Ev
|
|
||||||
jZPBNd6e20KQYli80kXK9D+qfmIVbOw9Y0aKXB3uvyNJPWDOoYTbzanjeXLuJdN+
|
|
||||||
pB/fgMX7znIg+VP87n2qMR5jFVj/x4g4vNgKTUtglw
|
|
||||||
--- j4kt4DFy3r3y6IMvNakNkmlkeb6iHYI5xAK8CZtbPD4
|
|
||||||
EWS¦|p^/<2F> Ž?„<7F>Np%‚åeFU/>Ží¸0bccývr(ˆ‰Œº
|
|
||||||
“.èýVŸdgðáADZ3"® ‡Ù(½\5Ó§q<
|
|
||||||
Binary file not shown.
|
|
@ -1,14 +1,6 @@
|
||||||
(import ../../../keys).mkSecrets [ "web03" ] [
|
(import ../../../keys).mkSecrets [ "web03" ] [
|
||||||
# List of secrets for web03
|
# List of secrets for web03
|
||||||
"dj_annuaire-secret_key_file"
|
|
||||||
"dj_bocal-secret_key_file"
|
|
||||||
"dj_gestiojeux-secret_key_file"
|
|
||||||
"dj_interludes-email_host_password_file"
|
"dj_interludes-email_host_password_file"
|
||||||
"dj_interludes-secret_key_file"
|
"dj_interludes-secret_key_file"
|
||||||
"dj_wikiens-secret_key_file"
|
|
||||||
"webhook-annuaire_token"
|
|
||||||
"webhook-bocal_token"
|
|
||||||
"webhook-gestiojeux_token"
|
|
||||||
"webhook-interludes_token"
|
"webhook-interludes_token"
|
||||||
"webhook-wikiens_token"
|
|
||||||
]
|
]
|
||||||
|
|
|
||||||
|
|
@ -1,29 +0,0 @@
|
||||||
age-encryption.org/v1
|
|
||||||
-> ssh-ed25519 jIXfPA NovhLzllQnEbnI7bno+zDoSRFJyZMfVVYPQMReUIymw
|
|
||||||
sefGtZ8fbYVqtKgMhrEj9AlwP70YM5MGkQ+o8Dmfb/Q
|
|
||||||
-> ssh-ed25519 QlRB9Q 9mh3vQVo5tPorLYBVCcZUJOlcEftQKA94PxNhh+pDwg
|
|
||||||
GXM67qitYqnxbFoHbsfa1lNNLIahPqshosIY7h0fDBA
|
|
||||||
-> ssh-ed25519 r+nK/Q BOXck7k9AH+KvmoicI/fmGzWcna0nwnJ+uyteUjIukE
|
|
||||||
Hyts1/6EAdruuBilhifl/HwPTWEBe+Kr1RL6SDjHaaM
|
|
||||||
-> ssh-rsa krWCLQ
|
|
||||||
1ROqUHCkbkEgRTQUha0cVJVAqLu0nvfKik9yI392sbEQYgmpuf7F0gzA97BXcoi3
|
|
||||||
2BdZWu/cJ6m6bfMvXdZ04cUjRcNrnpPHsoqie3G9s9p6aa9XIrLO5K6kH7S6f5DZ
|
|
||||||
pZdOqfSYldtJKRx7F8k0D/pscN5qB1Tb1x0CIULJVo7uKf9X1MnZwapOOCY2q40U
|
|
||||||
Ip2aefr40h3EO7jBlswx2/fB8aqW95BR4JQzJZ/uiIsBUQDqvn39GU7R0JaLdAPB
|
|
||||||
6kJXaJ3ORaDDtslcaAVZWLqFbOlINXYHr/mqYNTZMubE4BmNjvJL3aRozQQWraoJ
|
|
||||||
q5rDvgwUXVhpGpcaNf4/xw
|
|
||||||
-> ssh-ed25519 /vwQcQ FHYnfCad1imFiV5tRIfe9mtJ2ouiu2l19th2UD7j3gw
|
|
||||||
Xu+Sk9GEQ9Wyf7iU790yxv80vLYHp2StArPkfRqfRhI
|
|
||||||
-> ssh-ed25519 0R97PA etwCsiGmvzufJGMw8aDN+M931lPlE9fTUBQmk0X4DFk
|
|
||||||
o6xJbfNjQ3Lko1MSJ9JBu6FefZ8267dZ+vL1Gpd1eH8
|
|
||||||
-> ssh-ed25519 JGx7Ng h0XzejD/c5F2M7sWS4vTQL9OoRG73ACwlWCtK51Dcyo
|
|
||||||
diMDy201IpwL6Ec+Zb4pH5f1yyMOMHT3jg6yriopCRU
|
|
||||||
-> ssh-ed25519 bUjjig 2Oh5FhWfrbA9c5TisXuxasyYF41YOlNdurZR9QowETA
|
|
||||||
706/MLiPT9+9xHZPZQYtvKm8zbN5qS/9XJ+TK15etIs
|
|
||||||
-> ssh-ed25519 VQSaNw YbtnCoySon7jNBq7IFOl8UfxuJXRjzLrgXp238q4RRE
|
|
||||||
10au0QwFP9ntPMU4u2bMl3KLYBIPy09xVoKNLxWvpw0
|
|
||||||
-> Vu-grease !oqb p1-QmV
|
|
||||||
i1WmaOmxmdAX/se60fnUL41n57c8tN1gnUjjBjSV7GkQGzhKnxTplJTUpifP9Js3
|
|
||||||
8D+xe86sN2l2JQ5R9QFOAbsvSa5eXSo
|
|
||||||
--- JE+yvBRH9Jz6Sdz46AzWuhVI0kXWObODKSiNWz5L9As
|
|
||||||
_n´(I 6ÔÃPèCa\³U¼=é @ “†?6— P[Tò³ñˆjk<6A>0ãrÒ…°“ƒ¼-É(]/³a¿É
õ8¶=é¤i²<69>
|
|
||||||
|
|
@ -1,29 +0,0 @@
|
||||||
age-encryption.org/v1
|
|
||||||
-> ssh-ed25519 jIXfPA Ju7YL9wvvYr9VPLmYtYTniyuj9JTVqe2V8eRLISkIH8
|
|
||||||
EJjZPLOhspyyrx7a+fYlPPH+1pr93KzW7E2Ztkic0cY
|
|
||||||
-> ssh-ed25519 QlRB9Q X+TAfiEk1d67rkz6CgIO66bBrahY39ZTnmj0cBGGrSo
|
|
||||||
kBLFu6DnN7rIzP3mSlPEc+yBN+yU5toLeA069vuNW6g
|
|
||||||
-> ssh-ed25519 r+nK/Q wcXXCuAS9bOp3GM6c0pU7sxpylFEHFPmnibQTEwJ1x4
|
|
||||||
fR41b7fhZCzuNP1jst3vx3wUjIkBDsz54VzubwNX6+M
|
|
||||||
-> ssh-rsa krWCLQ
|
|
||||||
ySG+OgB3gMW/ijdWqlGr1LnkfqeFD53ChxkOUfAe4+Z1VsK0FkVaBmqvW38SFMw9
|
|
||||||
S4dcOkO6Km8umsaZBZi2QaItm+p8Rf/j7+W2WZPoyoKE1l1KW1ic/wGOY7uqeucn
|
|
||||||
YZRq7rWX+DaH2VLbkl12wUlVgYwJGcH6VrpRizbq2z0jcdTak6hgzcXo7WhcNAit
|
|
||||||
DY8W8X5Zv34mpj1VO7n2LJs5V7gzfSLq+KVMIi++QphVv2VkFpvaOqlEP2neVXnV
|
|
||||||
C3YNJTkVx+R6wANCao+9a5VHC261Bkm81dKgzceW2OCHkwOP6XTbDpj59sMRxRuU
|
|
||||||
B7jrvre5S1WZN9jc16Dv/Q
|
|
||||||
-> ssh-ed25519 /vwQcQ TW560PIrbJV3ZB55w+EvH2PEYOoYM93x3aaeeShYKE8
|
|
||||||
LC6pydBK3yCq/Vs7MUoa0xjDSn3WjRaZuqwvhX24YJQ
|
|
||||||
-> ssh-ed25519 0R97PA zyerO6EIwW90XVSBVP3Y/7Q8hK+7uPe6kKENGCdDJRw
|
|
||||||
WEpgo8Y64YXnat1OJU5qtpecf+Zu2P2LmB7DEtmUuAU
|
|
||||||
-> ssh-ed25519 JGx7Ng 7h4q8ztQ0BFJSfavV4l1pKjbNRZveOPIJG0KF98vh28
|
|
||||||
mYcUEL4n2+bkjpvJylIvzXSxoa71YZKMSgN21ONnvko
|
|
||||||
-> ssh-ed25519 bUjjig 9wKWtLWD+9LlAOO24iQiOdvpSDIWpL6Xo0Wt3QOLIQY
|
|
||||||
Kq2QLFB7E5tiqZQlsn5pZRM52v8XqUyYsvwNHXZspRs
|
|
||||||
-> ssh-ed25519 VQSaNw 3tJNtvi0WK9iAzx3Q7Q0Ogj1TGH0Zrm5v0ERhQILBVk
|
|
||||||
4232/j+xnbhQpId7ZS6+xAQBDxtumeOp4c1HVeMRqB4
|
|
||||||
-> Pug13&(-grease 'w0JG}JF .t`9lMF v)8}4qW
|
|
||||||
yRriwE//abKvQgu962F7URbOAiHDFMipnsq22itGkLDvmwIRY6Bi83xOzx72EV4y
|
|
||||||
27GNdxQOni+z8NPt0YTskqq4fHfZky/EMFUvXTfteB7izYxEliHLRKA
|
|
||||||
--- JNvexaDwzwOIUCxanJRLunfhBh1/PE8ssFCytr8nPjo
|
|
||||||
TX¹Þ‚xòšd˜~KS?ìIò…Ce þ—3ÑJõ ¹ŸýCíÓF6qœv~Dùq¢T<>©55€bjˆf›Õ5”ñëã"ø£ÅŽp
|
|
||||||
|
|
@ -1,29 +0,0 @@
|
||||||
age-encryption.org/v1
|
|
||||||
-> ssh-ed25519 jIXfPA dBBF9o4SBTHNv495PFZa6dszbs9nEARwg0EfOlfFwhc
|
|
||||||
GkqX8sjLqFHGm4UA+zyVRB7FGGgAxilFYHarEQB0YAk
|
|
||||||
-> ssh-ed25519 QlRB9Q DEu91DA+qho3Zs3gSQbWH/hOKUfgP5Qd90+9ZzYs1So
|
|
||||||
aIw1ygo/e0tpqW2N27Fl8WRe362ronzqy52vSzD35Tc
|
|
||||||
-> ssh-ed25519 r+nK/Q JUurf12UYuJKvKusUh/GOJryFbA8lWaS8v+/pRb0kys
|
|
||||||
VsgsBSwjBXTD+tmP3jxCPVeDY7AHVFx5o57y+ubEjts
|
|
||||||
-> ssh-rsa krWCLQ
|
|
||||||
o08ZnFZIj37p5hpWgl8FXwPwHKjoBD7Z0UxMRsF4CUF0sLOpwVHD4L57hAA8a80S
|
|
||||||
063e48OJ5OsrtueqqJwPT+wjXfmEarLUqC+rP0X+JDW8OLwSImBcYC5DQJZLUFSK
|
|
||||||
doF8S8Bo0MbuB4eKnXUAJlhdZOk/iqYK8TYuuSIwWQxHwF/fT43hrYIkj6lmqdmG
|
|
||||||
IqSXA04KpQFoL15INIAtsnj5xXJlI0gCPp0pxMNUmVyTTrNLfaEiKH191D+Elmjd
|
|
||||||
xcdvMX1yzIPI/mI/+/OjeYspijY0XpRHLJ9ljfEK7E2N8IgpyzBx2BzxYhRHoQmi
|
|
||||||
6SbZu9Tirw+yv5wv8oIaHA
|
|
||||||
-> ssh-ed25519 /vwQcQ M6QID8DMaFMnF97UWwbSYJ7Sh0wvj/fq7cszu82/oHI
|
|
||||||
T+aT4NCbVfGXnvPK7w8fbojAwDTE41h40q0tDwnGyhE
|
|
||||||
-> ssh-ed25519 0R97PA XyZvyy80nv2tGe1fBzM0LeiIAGuyV22CzBoCPFMMrw8
|
|
||||||
9VPiRV3GCWbH1So5LBrjBeRzEtErPM7BwOF/zaD/yGk
|
|
||||||
-> ssh-ed25519 JGx7Ng OPlQBKO+Wub+PPMNPoRGWTeSZfGF3kYCD8HLbLbPR0k
|
|
||||||
ZhBUT5ig0FnLCau+da9bfEkVjFxfZXG0mXW1o0yZ+JQ
|
|
||||||
-> ssh-ed25519 bUjjig T5/dZtIRaXmNg8pajSAM76cVANM7MvQ7f32fz2fEqx0
|
|
||||||
+6kRffMJX+8QAOf5jA5acGihgw4q8yJda0EzVGePD+I
|
|
||||||
-> ssh-ed25519 VQSaNw InflFPtAwYwQFWqd+KK+ILwMa0XTNkVB+xEMtUXW8Us
|
|
||||||
XZ6LVMCpvq+QBo0EHAlnC8uBhQssixTLVCpul6ov4Dk
|
|
||||||
-> YKmn+c&-grease EA5d$ ="1d }cP
|
|
||||||
3u46NE2SdfO9ugNN/41PeU/65CRgmDiO54B9ZQLNRQtVyyLlcmvaYHCQach+s+Rs
|
|
||||||
tE0Gc8MD23hPw5ZhWj0nq7xF8VHtRQSTLQ
|
|
||||||
--- UkbfAVgnLkeg6Zdb3bsdPtx9Wh6HOjdB+qmTvrAWFuE
|
|
||||||
5_E¼ñ/e)±žÑÊC×7Ú›ÈY<C388>wPŽöTášt6>l_0:[èP»ÎH5·¼j—<6A>€ P˸â=vèFýÉIÄ4¹ÿÏD쪘ýp£§
|
|
||||||
Binary file not shown.
|
|
@ -132,6 +132,8 @@
|
||||||
|
|
||||||
hashedPassword = "$y$j9T$Un/tcX5SPKNXG.sy/BcTa.$kyNHELjb1GAOWnauJfcjyVi5tacWcuEBKflZDCUC6x4";
|
hashedPassword = "$y$j9T$Un/tcX5SPKNXG.sy/BcTa.$kyNHELjb1GAOWnauJfcjyVi5tacWcuEBKflZDCUC6x4";
|
||||||
|
|
||||||
|
nix-modules = [ "services/django-apps" ];
|
||||||
|
|
||||||
stateVersion = "24.05";
|
stateVersion = "24.05";
|
||||||
nixpkgs = "unstable";
|
nixpkgs = "unstable";
|
||||||
vm-cluster = "Hyperviseur NPS";
|
vm-cluster = "Hyperviseur NPS";
|
||||||
|
|
|
||||||
|
|
@ -58,7 +58,6 @@
|
||||||
"dgn-ssh"
|
"dgn-ssh"
|
||||||
"dgn-vm-variant"
|
"dgn-vm-variant"
|
||||||
"dgn-web"
|
"dgn-web"
|
||||||
"django-apps"
|
|
||||||
])
|
])
|
||||||
++ [
|
++ [
|
||||||
"${sources.agenix}/modules/age.nix"
|
"${sources.agenix}/modules/age.nix"
|
||||||
|
|
|
||||||
|
|
@ -13,7 +13,7 @@ in
|
||||||
|
|
||||||
options.dgn-netbox-agent = {
|
options.dgn-netbox-agent = {
|
||||||
enable = lib.mkEnableOption "DGNum netbox agent setup." // {
|
enable = lib.mkEnableOption "DGNum netbox agent setup." // {
|
||||||
default = false;
|
default = true;
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -1,67 +0,0 @@
|
||||||
diff --git a/internal/hook/hook.go b/internal/hook/hook.go
|
|
||||||
index 0510095..0347f26 100644
|
|
||||||
--- a/internal/hook/hook.go
|
|
||||||
+++ b/internal/hook/hook.go
|
|
||||||
@@ -13,12 +13,12 @@ import (
|
|
||||||
"errors"
|
|
||||||
"fmt"
|
|
||||||
"hash"
|
|
||||||
- "io/ioutil"
|
|
||||||
"log"
|
|
||||||
"math"
|
|
||||||
"net"
|
|
||||||
"net/textproto"
|
|
||||||
"os"
|
|
||||||
+ "path"
|
|
||||||
"reflect"
|
|
||||||
"regexp"
|
|
||||||
"strconv"
|
|
||||||
@@ -750,14 +750,18 @@ func (h *Hooks) LoadFromFile(path string, asTemplate bool) error {
|
|
||||||
}
|
|
||||||
|
|
||||||
// parse hook file for hooks
|
|
||||||
- file, e := ioutil.ReadFile(path)
|
|
||||||
+ file, e := os.ReadFile(path)
|
|
||||||
|
|
||||||
if e != nil {
|
|
||||||
return e
|
|
||||||
}
|
|
||||||
|
|
||||||
if asTemplate {
|
|
||||||
- funcMap := template.FuncMap{"getenv": getenv}
|
|
||||||
+ funcMap := template.FuncMap{
|
|
||||||
+ "cat": cat,
|
|
||||||
+ "credential": credential,
|
|
||||||
+ "getenv": getenv,
|
|
||||||
+ }
|
|
||||||
|
|
||||||
tmpl, err := template.New("hooks").Funcs(funcMap).Parse(string(file))
|
|
||||||
if err != nil {
|
|
||||||
@@ -956,3 +960,27 @@ func compare(a, b string) bool {
|
|
||||||
func getenv(s string) string {
|
|
||||||
return os.Getenv(s)
|
|
||||||
}
|
|
||||||
+
|
|
||||||
+// cat provides a template function to retrieve content of files
|
|
||||||
+// Similarly to getenv, if no file is found, it returns the empty string
|
|
||||||
+func cat(s string) string {
|
|
||||||
+ data, e := os.ReadFile(s)
|
|
||||||
+
|
|
||||||
+ if e != nil {
|
|
||||||
+ return ""
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ return strings.TrimSuffix(string(data), "\n")
|
|
||||||
+}
|
|
||||||
+
|
|
||||||
+// credential provides a template function to retreive secrets using systemd's LoadCredential mechanism
|
|
||||||
+func credential(s string) string {
|
|
||||||
+ dir := getenv("CREDENTIALS_DIRECTORY")
|
|
||||||
+
|
|
||||||
+ // If no credential directory is found, fallback to the env variable
|
|
||||||
+ if dir == "" {
|
|
||||||
+ return getenv(s)
|
|
||||||
+ }
|
|
||||||
+
|
|
||||||
+ return cat(path.Join(dir, s))
|
|
||||||
+}
|
|
||||||
|
|
@ -1,710 +0,0 @@
|
||||||
{
|
|
||||||
config,
|
|
||||||
lib,
|
|
||||||
options,
|
|
||||||
pkgs,
|
|
||||||
utils,
|
|
||||||
...
|
|
||||||
}:
|
|
||||||
|
|
||||||
let
|
|
||||||
inherit (lib)
|
|
||||||
attrNames
|
|
||||||
concatLists
|
|
||||||
concatMapAttrs
|
|
||||||
filterAttrs
|
|
||||||
getExe
|
|
||||||
getExe'
|
|
||||||
literalExpression
|
|
||||||
mapAttrs
|
|
||||||
mapAttrs'
|
|
||||||
mapAttrsToList
|
|
||||||
mkEnableOption
|
|
||||||
mkIf
|
|
||||||
mkMerge
|
|
||||||
mkOption
|
|
||||||
mkPackageOption
|
|
||||||
nameValuePair
|
|
||||||
optional
|
|
||||||
optionals
|
|
||||||
recursiveUpdate
|
|
||||||
toUpper
|
|
||||||
;
|
|
||||||
|
|
||||||
inherit (lib.types)
|
|
||||||
attrs
|
|
||||||
attrsOf
|
|
||||||
enum
|
|
||||||
functionTo
|
|
||||||
ints
|
|
||||||
listOf
|
|
||||||
nullOr
|
|
||||||
package
|
|
||||||
path
|
|
||||||
str
|
|
||||||
submodule
|
|
||||||
;
|
|
||||||
|
|
||||||
inherit (utils) escapeSystemdExecArgs;
|
|
||||||
|
|
||||||
cfg = config.services.django-apps;
|
|
||||||
|
|
||||||
# Alias the global config to allow its use when the identifier is shadowed
|
|
||||||
config' = config;
|
|
||||||
systemctl = getExe' config.systemd.package "systemctl";
|
|
||||||
in
|
|
||||||
|
|
||||||
{
|
|
||||||
options.services.django-apps = {
|
|
||||||
enable = mkEnableOption "automatic django apps management";
|
|
||||||
|
|
||||||
webhook = {
|
|
||||||
domain = mkOption {
|
|
||||||
type = str;
|
|
||||||
description = ''
|
|
||||||
The domain where the webhook service will listen.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
nginx = mkOption {
|
|
||||||
type = nullOr options.services.nginx.virtualHosts.type.nestedTypes.elemType;
|
|
||||||
default = null;
|
|
||||||
description = ''
|
|
||||||
With this option, you can customize the nginx virtualHost settings.
|
|
||||||
'';
|
|
||||||
example = literalExpression ''
|
|
||||||
{
|
|
||||||
# To enable encryption and let Let's Encrypt take care of certificate
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
}
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
sites = mkOption {
|
|
||||||
type = attrsOf (
|
|
||||||
submodule (
|
|
||||||
{ name, config, ... }:
|
|
||||||
{
|
|
||||||
options = {
|
|
||||||
source = mkOption {
|
|
||||||
type = str;
|
|
||||||
description = ''
|
|
||||||
The URI where the source of the app can be publicly fetched via git.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
branch = mkOption {
|
|
||||||
type = str;
|
|
||||||
default = "production";
|
|
||||||
description = ''
|
|
||||||
Branch to follow for updates to the source.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
domain = mkOption {
|
|
||||||
type = str;
|
|
||||||
description = ''
|
|
||||||
The domain where the web app will be served.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
nginx = mkOption {
|
|
||||||
type = nullOr options.services.nginx.virtualHosts.type.nestedTypes.elemType;
|
|
||||||
default = null;
|
|
||||||
description = ''
|
|
||||||
With this option, you can customize the nginx virtualHost settings.
|
|
||||||
'';
|
|
||||||
example = literalExpression ''
|
|
||||||
{
|
|
||||||
# To enable encryption and let Let's Encrypt take care of certificate
|
|
||||||
forceSSL = true;
|
|
||||||
enableACME = true;
|
|
||||||
}
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
env_prefix = mkOption {
|
|
||||||
type = str;
|
|
||||||
default = toUpper name;
|
|
||||||
description = ''
|
|
||||||
The prefix to use for environment settings declaration.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
application = {
|
|
||||||
type = mkOption {
|
|
||||||
type = enum [
|
|
||||||
"asgi"
|
|
||||||
"wsgi"
|
|
||||||
"daphne"
|
|
||||||
];
|
|
||||||
default = "wsgi";
|
|
||||||
description = ''
|
|
||||||
Specification for the django application.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
module = mkOption {
|
|
||||||
type = str;
|
|
||||||
default = "app";
|
|
||||||
description = ''
|
|
||||||
Name of the module containing the application interface.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
settingsModule = mkOption {
|
|
||||||
type = str;
|
|
||||||
default = "${config.application.module}.settings";
|
|
||||||
description = ''
|
|
||||||
The django settings module, will be passed as an environment variable to the app.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
workers = mkOption {
|
|
||||||
type = ints.positive;
|
|
||||||
default = 4;
|
|
||||||
description = ''
|
|
||||||
Number of workers processes to use.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
channelLayer = mkOption {
|
|
||||||
type = str;
|
|
||||||
default = "channel_layer";
|
|
||||||
description = ''
|
|
||||||
Channel layer to use when running the application with daphne.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
python = mkPackageOption pkgs "python3" { };
|
|
||||||
|
|
||||||
django = mkOption {
|
|
||||||
type = functionTo package;
|
|
||||||
default = ps: ps.django;
|
|
||||||
defaultText = literalExpression "ps: ps.django";
|
|
||||||
description = ''
|
|
||||||
The django version to use to run the app.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
djangoEnv = mkOption {
|
|
||||||
type = package;
|
|
||||||
default = config.python.withPackages (
|
|
||||||
ps:
|
|
||||||
[ (config.django ps) ]
|
|
||||||
++ (optional (config.application.type != "daphne") ps.gunicorn)
|
|
||||||
++ (optional (config.application.type == "asgi") ps.uvicorn)
|
|
||||||
++ (optional (config.dbType == "postgresql") ps.psycopg)
|
|
||||||
++ (config.dependencies ps)
|
|
||||||
);
|
|
||||||
description = ''
|
|
||||||
The python version used to run the app, with the correct dependencies.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
dependencies = mkOption {
|
|
||||||
type = functionTo (listOf package);
|
|
||||||
default = _: [ ];
|
|
||||||
example = literalExpression "ps: [ ps.requests ]";
|
|
||||||
description = ''
|
|
||||||
Python dependencies of the app.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
extraPackages = mkOption {
|
|
||||||
type = listOf package;
|
|
||||||
default = [ ];
|
|
||||||
description = ''
|
|
||||||
Packages that will be added to the path of the app.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
credentials = mkOption {
|
|
||||||
type = attrsOf path;
|
|
||||||
default = { };
|
|
||||||
description = ''
|
|
||||||
The files containing credentials to pass through `LoadCredential` to the application.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
environment = mkOption {
|
|
||||||
type = attrsOf (pkgs.formats.json { }).type;
|
|
||||||
default = { };
|
|
||||||
description = ''
|
|
||||||
Environment variables to pass to the app.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
managePath = mkOption {
|
|
||||||
type = str;
|
|
||||||
default = "manage.py";
|
|
||||||
description = ''
|
|
||||||
Path to the manage.py file inside the source
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
extraServices = mkOption {
|
|
||||||
type = attrs;
|
|
||||||
default = { };
|
|
||||||
description = ''
|
|
||||||
Extra services to run in parallel of the application.
|
|
||||||
May be used to run background tasks and/or workers.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
manageScript = mkOption {
|
|
||||||
type = package;
|
|
||||||
default = pkgs.writeShellApplication {
|
|
||||||
name = "${name}-manage";
|
|
||||||
|
|
||||||
runtimeInputs = [
|
|
||||||
pkgs.util-linux
|
|
||||||
config'.systemd.package
|
|
||||||
|
|
||||||
config.djangoEnv
|
|
||||||
] ++ config.extraPackages;
|
|
||||||
text = ''
|
|
||||||
MainPID=$(systemctl show -p MainPID --value dj-${name}.service)
|
|
||||||
|
|
||||||
nsenter -e -a -t "$MainPID" -G follow -S follow python /var/lib/django-apps/${name}/source/${config.managePath} "$@"
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
description = ''
|
|
||||||
Script to run manage.py related tasks.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
updateScript = mkOption {
|
|
||||||
type = package;
|
|
||||||
default = pkgs.writeShellApplication {
|
|
||||||
name = "dj-${name}-update-source";
|
|
||||||
|
|
||||||
runtimeInputs = [
|
|
||||||
config.djangoEnv
|
|
||||||
|
|
||||||
pkgs.git
|
|
||||||
];
|
|
||||||
|
|
||||||
text = ''
|
|
||||||
git pull
|
|
||||||
python3 ${config.managePath} migrate
|
|
||||||
python3 ${config.managePath} collectstatic --no-input
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
description = ''
|
|
||||||
Script to run when updating the app source.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
webHookSecret = mkOption {
|
|
||||||
type = path;
|
|
||||||
description = ''
|
|
||||||
Path to the webhook secret.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
dbType = mkOption {
|
|
||||||
type = enum [
|
|
||||||
"manual"
|
|
||||||
"postgresql"
|
|
||||||
"sqlite"
|
|
||||||
];
|
|
||||||
default = "postgresql";
|
|
||||||
description = ''
|
|
||||||
Which database backend to use, set to `manual` for custom declaration.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
baseDirectory = mkOption {
|
|
||||||
type = str;
|
|
||||||
readOnly = true;
|
|
||||||
default = "/var/lib/django-apps/${name}";
|
|
||||||
};
|
|
||||||
|
|
||||||
sourceDirectory = mkOption {
|
|
||||||
type = str;
|
|
||||||
readOnly = true;
|
|
||||||
default = "${config.baseDirectory}/source";
|
|
||||||
};
|
|
||||||
|
|
||||||
staticDirectory = mkOption {
|
|
||||||
type = str;
|
|
||||||
default = "static";
|
|
||||||
description = ''
|
|
||||||
Path to the staticfiles directory.
|
|
||||||
This is relative to the base directory, e.g. the parent of the source directory.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
|
|
||||||
mediaDirectory = mkOption {
|
|
||||||
type = str;
|
|
||||||
default = "media";
|
|
||||||
description = ''
|
|
||||||
Path to the media files directory.
|
|
||||||
This is relative to the base directory, e.g. the parent of the source directory.
|
|
||||||
'';
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
)
|
|
||||||
);
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
config = mkIf cfg.enable {
|
|
||||||
security.sudo.extraRules = [
|
|
||||||
{
|
|
||||||
users = [ "webhook" ];
|
|
||||||
commands = builtins.map (name: {
|
|
||||||
command = "${systemctl} start dj-${name}-update.service";
|
|
||||||
options = [ "NOPASSWD" ];
|
|
||||||
}) (attrNames cfg.sites);
|
|
||||||
}
|
|
||||||
];
|
|
||||||
|
|
||||||
environment.systemPackages = mapAttrsToList (_: { manageScript, ... }: manageScript) cfg.sites;
|
|
||||||
|
|
||||||
services = {
|
|
||||||
webhook = {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
package = pkgs.webhook.overrideAttrs (old: {
|
|
||||||
patches = (old.patches or [ ]) ++ [ ./01-webhook.patch ];
|
|
||||||
});
|
|
||||||
|
|
||||||
# extraArgs = [ "-debug" ];
|
|
||||||
|
|
||||||
# Only listen on localhost
|
|
||||||
ip = "127.0.0.1";
|
|
||||||
|
|
||||||
hooksTemplated = mapAttrs' (
|
|
||||||
name:
|
|
||||||
{ branch, ... }:
|
|
||||||
nameValuePair "dj-${name}" (
|
|
||||||
# Avoid issues when quoting "dj-name" through builtins.toJSON
|
|
||||||
builtins.replaceStrings [ "\\" ] [ "" ] (
|
|
||||||
builtins.toJSON {
|
|
||||||
id = "dj-${name}";
|
|
||||||
execute-command = "/run/wrappers/bin/sudo";
|
|
||||||
pass-arguments-to-command =
|
|
||||||
builtins.map
|
|
||||||
(name: {
|
|
||||||
inherit name;
|
|
||||||
source = "string";
|
|
||||||
})
|
|
||||||
[
|
|
||||||
systemctl
|
|
||||||
"start"
|
|
||||||
"dj-${name}-update.service"
|
|
||||||
];
|
|
||||||
# command-working-directory = "/var/lib/django-apps/${name}";
|
|
||||||
trigger-rule = {
|
|
||||||
and = [
|
|
||||||
{
|
|
||||||
or = [
|
|
||||||
{
|
|
||||||
match = {
|
|
||||||
type = "payload-hmac-sha256";
|
|
||||||
secret = ''{{ credential "dj-${name}" | js }}'';
|
|
||||||
parameter = {
|
|
||||||
source = "header";
|
|
||||||
name = "X-Hub-Signature-256";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
{
|
|
||||||
match = {
|
|
||||||
type = "value";
|
|
||||||
value = ''{{ credential "dj-${name}" | js }}'';
|
|
||||||
parameter = {
|
|
||||||
source = "header";
|
|
||||||
name = "X-Gitlab-Token";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
}
|
|
||||||
{
|
|
||||||
match = {
|
|
||||||
type = "value";
|
|
||||||
value = "refs/heads/${branch}";
|
|
||||||
parameter = {
|
|
||||||
source = "payload";
|
|
||||||
name = "ref";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
];
|
|
||||||
};
|
|
||||||
}
|
|
||||||
)
|
|
||||||
)
|
|
||||||
) cfg.sites;
|
|
||||||
};
|
|
||||||
|
|
||||||
nginx = mkMerge [
|
|
||||||
(mkIf (cfg.webhook.nginx != null) {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
virtualHosts = {
|
|
||||||
${cfg.webhook.domain} = mkMerge [
|
|
||||||
{ locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.services.webhook.port}"; }
|
|
||||||
cfg.webhook.nginx
|
|
||||||
];
|
|
||||||
};
|
|
||||||
})
|
|
||||||
{
|
|
||||||
virtualHosts = mapAttrs' (
|
|
||||||
name:
|
|
||||||
{ domain, nginx, ... }:
|
|
||||||
nameValuePair domain (
|
|
||||||
recursiveUpdate {
|
|
||||||
locations = {
|
|
||||||
"/".proxyPass = "http://unix:/run/django-apps/${name}.sock";
|
|
||||||
"/static/".root = "/run/django-apps/${name}";
|
|
||||||
"/media/".root = "/run/django-apps/${name}";
|
|
||||||
};
|
|
||||||
} nginx
|
|
||||||
)
|
|
||||||
) cfg.sites;
|
|
||||||
}
|
|
||||||
];
|
|
||||||
|
|
||||||
postgresql =
|
|
||||||
let
|
|
||||||
apps = builtins.map (name: "dj-${name}") (
|
|
||||||
attrNames (filterAttrs (_: { dbType, ... }: dbType == "postgresql") cfg.sites)
|
|
||||||
);
|
|
||||||
in
|
|
||||||
mkIf (apps != [ ]) {
|
|
||||||
enable = true;
|
|
||||||
|
|
||||||
ensureDatabases = apps;
|
|
||||||
ensureUsers = builtins.map (name: {
|
|
||||||
inherit name;
|
|
||||||
ensureDBOwnership = true;
|
|
||||||
}) apps;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
users = {
|
|
||||||
users.nginx.extraGroups = [ "django-apps" ];
|
|
||||||
groups.django-apps = { };
|
|
||||||
};
|
|
||||||
|
|
||||||
systemd = {
|
|
||||||
sockets = mapAttrs' (
|
|
||||||
name: _:
|
|
||||||
nameValuePair "dj-${name}" {
|
|
||||||
description = "Socket for the ${name} Django Application";
|
|
||||||
wantedBy = [ "sockets.target" ];
|
|
||||||
|
|
||||||
socketConfig = {
|
|
||||||
ListenStream = "/run/django-apps/${name}.sock";
|
|
||||||
SocketMode = "600";
|
|
||||||
SocketUser = config'.services.nginx.user;
|
|
||||||
};
|
|
||||||
}
|
|
||||||
) cfg.sites;
|
|
||||||
|
|
||||||
mounts = concatLists (
|
|
||||||
mapAttrsToList (
|
|
||||||
name:
|
|
||||||
{ mediaDirectory, staticDirectory, ... }:
|
|
||||||
[
|
|
||||||
{
|
|
||||||
where = "/run/django-apps/${name}/static";
|
|
||||||
what = "/var/lib/django-apps/${name}/${staticDirectory}";
|
|
||||||
options = "bind";
|
|
||||||
|
|
||||||
after = [ "dj-${name}.service" ];
|
|
||||||
partOf = [ "dj-${name}.service" ];
|
|
||||||
upheldBy = [ "dj-${name}.service" ];
|
|
||||||
}
|
|
||||||
|
|
||||||
{
|
|
||||||
where = "/run/django-apps/${name}/media";
|
|
||||||
what = "/var/lib/django-apps/${name}/${mediaDirectory}";
|
|
||||||
options = "bind";
|
|
||||||
|
|
||||||
after = [ "dj-${name}.service" ];
|
|
||||||
partOf = [ "dj-${name}.service" ];
|
|
||||||
upheldBy = [ "dj-${name}.service" ];
|
|
||||||
}
|
|
||||||
]
|
|
||||||
) cfg.sites
|
|
||||||
);
|
|
||||||
|
|
||||||
services =
|
|
||||||
{
|
|
||||||
webhook.serviceConfig.LoadCredential = mapAttrsToList (
|
|
||||||
name: { webHookSecret, ... }: "dj-${name}:${webHookSecret}"
|
|
||||||
) cfg.sites;
|
|
||||||
}
|
|
||||||
// (concatMapAttrs (
|
|
||||||
name: config:
|
|
||||||
let
|
|
||||||
mkDatabase =
|
|
||||||
name: type:
|
|
||||||
if type == "postgresql" then
|
|
||||||
{
|
|
||||||
ENGINE = "django.db.backends.postgresql";
|
|
||||||
NAME = "dj-${name}";
|
|
||||||
}
|
|
||||||
else if type == "sqlite" then
|
|
||||||
{
|
|
||||||
ENGINE = "django.db.backends.sqlite3";
|
|
||||||
NAME = "/var/lib/django-apps/${name}/db.sqlite3";
|
|
||||||
}
|
|
||||||
else
|
|
||||||
throw "Invalid database type !";
|
|
||||||
|
|
||||||
# Systemd Service Configuration
|
|
||||||
Group = "django-apps";
|
|
||||||
LoadCredential = mapAttrsToList (credential: path: "${credential}:${path}") config.credentials;
|
|
||||||
RuntimeDirectory = "django-apps/${name}";
|
|
||||||
StateDirectory = "django-apps/${name}";
|
|
||||||
UMask = "0027";
|
|
||||||
User = "dj-${name}";
|
|
||||||
WorkingDirectory = "/var/lib/django-apps/${name}";
|
|
||||||
|
|
||||||
environment =
|
|
||||||
let
|
|
||||||
mkValue = v: if builtins.isString v then v else builtins.toJSON v;
|
|
||||||
in
|
|
||||||
(mapAttrs' (key: value: nameValuePair "${config.env_prefix}_${key}" (mkValue value)) {
|
|
||||||
DATABASES =
|
|
||||||
if (config.dbType != "manual") then { default = mkDatabase name config.dbType; } else null;
|
|
||||||
STATIC_ROOT = "/var/lib/django-apps/${name}/${config.staticDirectory}";
|
|
||||||
MEDIA_ROOT = "/var/lib/django-apps/${name}/${config.mediaDirectory}";
|
|
||||||
ALLOWED_HOSTS = [ config.domain ];
|
|
||||||
})
|
|
||||||
// {
|
|
||||||
DJANGO_SETTINGS_MODULE = config.application.settingsModule;
|
|
||||||
}
|
|
||||||
// (mapAttrs (_: mkValue) config.environment);
|
|
||||||
path = config.extraPackages ++ [ config.djangoEnv ];
|
|
||||||
after = [ "network.target" ] ++ (optional (config.dbType == "postgresql") "postgresql.service");
|
|
||||||
in
|
|
||||||
{
|
|
||||||
"dj-${name}" = {
|
|
||||||
inherit after environment path;
|
|
||||||
|
|
||||||
preStart = ''
|
|
||||||
if [ ! -f .initialized ]; then
|
|
||||||
# The previous initialization might have failed, so restart from the beginning
|
|
||||||
rm -rf source
|
|
||||||
|
|
||||||
# We need to download the application source and run the migrations first
|
|
||||||
${lib.getExe pkgs.git} clone --single-branch --branch ${config.branch} ${config.source} source
|
|
||||||
(cd source && python ${config.managePath} migrate --no-input && python ${config.managePath} collectstatic --no-input)
|
|
||||||
touch .initialized
|
|
||||||
fi
|
|
||||||
|
|
||||||
# Create the necessary directory with the correct user/group
|
|
||||||
mkdir -p ${config.mediaDirectory} ${config.staticDirectory}
|
|
||||||
'';
|
|
||||||
|
|
||||||
requires = [ "dj-${name}.socket" ];
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
|
|
||||||
serviceConfig = {
|
|
||||||
inherit
|
|
||||||
Group
|
|
||||||
LoadCredential
|
|
||||||
RuntimeDirectory
|
|
||||||
StateDirectory
|
|
||||||
User
|
|
||||||
UMask
|
|
||||||
WorkingDirectory
|
|
||||||
;
|
|
||||||
|
|
||||||
DynamicUser = true;
|
|
||||||
ExecStart = escapeSystemdExecArgs (
|
|
||||||
if (config.application.type == "daphne") then
|
|
||||||
[
|
|
||||||
(getExe' config.djangoEnv "daphne")
|
|
||||||
"-u"
|
|
||||||
"/run/django-apps/${name}.sock"
|
|
||||||
"${config.application.module}.asgi:${config.application.channelLayer}"
|
|
||||||
]
|
|
||||||
else
|
|
||||||
(
|
|
||||||
[
|
|
||||||
(getExe' config.djangoEnv "gunicorn")
|
|
||||||
"--workers"
|
|
||||||
config.application.workers
|
|
||||||
"--bind"
|
|
||||||
"unix:/run/django-apps/${name}.sock"
|
|
||||||
"--pythonpath"
|
|
||||||
"source"
|
|
||||||
]
|
|
||||||
++ (optionals (config.application.type == "asgi") [
|
|
||||||
"--worker-class"
|
|
||||||
"uvicorn.workers.UvicornWorker"
|
|
||||||
])
|
|
||||||
++ [ "${config.application.module}.${config.application.type}" ]
|
|
||||||
)
|
|
||||||
);
|
|
||||||
ExecReload = "${getExe' pkgs.coreutils "kill"} -s HUP $MAINPID";
|
|
||||||
KillMode = "mixed";
|
|
||||||
Type = mkIf (config.application.type != "daphne") "notify";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
"dj-${name}-update" = {
|
|
||||||
inherit environment path;
|
|
||||||
|
|
||||||
serviceConfig = {
|
|
||||||
inherit
|
|
||||||
Group
|
|
||||||
LoadCredential
|
|
||||||
StateDirectory
|
|
||||||
UMask
|
|
||||||
User
|
|
||||||
;
|
|
||||||
|
|
||||||
DynamicUser = true;
|
|
||||||
ExecStart = "${getExe config.updateScript}";
|
|
||||||
Type = "oneshot";
|
|
||||||
WorkingDirectory = "/var/lib/django-apps/${name}/source";
|
|
||||||
};
|
|
||||||
|
|
||||||
unitConfig = {
|
|
||||||
After = "dj-${name}.service";
|
|
||||||
Conflicts = "dj-${name}.service";
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
// (mapAttrs' (
|
|
||||||
serviceName: serviceContent:
|
|
||||||
nameValuePair "dj-${name}_${serviceName}" (
|
|
||||||
recursiveUpdate {
|
|
||||||
inherit after environment path;
|
|
||||||
|
|
||||||
partOf = [ "dj-${name}.service" ];
|
|
||||||
wantedBy = [ "multi-user.target" ];
|
|
||||||
upheldBy = [ "dj-${name}.service" ];
|
|
||||||
|
|
||||||
serviceConfig = {
|
|
||||||
inherit
|
|
||||||
Group
|
|
||||||
LoadCredential
|
|
||||||
RuntimeDirectory
|
|
||||||
StateDirectory
|
|
||||||
UMask
|
|
||||||
User
|
|
||||||
;
|
|
||||||
|
|
||||||
DynamicUser = true;
|
|
||||||
};
|
|
||||||
} serviceContent
|
|
||||||
)
|
|
||||||
) config.extraServices)
|
|
||||||
) cfg.sites);
|
|
||||||
};
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
@ -87,9 +87,9 @@
|
||||||
"repo": "git-hooks.nix"
|
"repo": "git-hooks.nix"
|
||||||
},
|
},
|
||||||
"branch": "master",
|
"branch": "master",
|
||||||
"revision": "3308484d1a443fc5bc92012435d79e80458fe43c",
|
"revision": "cd1af27aa85026ac759d5d3fccf650abe7e1bbf0",
|
||||||
"url": "https://github.com/cachix/git-hooks.nix/archive/3308484d1a443fc5bc92012435d79e80458fe43c.tar.gz",
|
"url": "https://github.com/cachix/git-hooks.nix/archive/cd1af27aa85026ac759d5d3fccf650abe7e1bbf0.tar.gz",
|
||||||
"hash": "0qdhcqisil8zhnf600y0vpa1mayrca8z2bja79p4j5vajy7dnx4s"
|
"hash": "1icl4cz33lkr4bz7fvlf3jppmahgpzij81wfa5any3z7w7b5lnxw"
|
||||||
},
|
},
|
||||||
"kadenios": {
|
"kadenios": {
|
||||||
"type": "Git",
|
"type": "Git",
|
||||||
|
|
@ -144,9 +144,9 @@
|
||||||
"url": "https://git.lix.systems/lix-project/lix.git"
|
"url": "https://git.lix.systems/lix-project/lix.git"
|
||||||
},
|
},
|
||||||
"branch": "main",
|
"branch": "main",
|
||||||
"revision": "66f6dbda32959dd5cf3a9aaba15af72d037ab7ff",
|
"revision": "c859d03013712b349d82ee6223948d6d03e63a8d",
|
||||||
"url": null,
|
"url": null,
|
||||||
"hash": "10mfry8k0jab4ngnhvx9d7ia8m7qf4va4395ylwg3qlsxziqvc8z"
|
"hash": "14bn1c3azvnkp1wl28x7y288vpd2gp96nswlnfzrcp13a4ivbbbf"
|
||||||
},
|
},
|
||||||
"lix-module": {
|
"lix-module": {
|
||||||
"type": "Git",
|
"type": "Git",
|
||||||
|
|
@ -155,9 +155,9 @@
|
||||||
"url": "https://git.lix.systems/lix-project/nixos-module.git"
|
"url": "https://git.lix.systems/lix-project/nixos-module.git"
|
||||||
},
|
},
|
||||||
"branch": "main",
|
"branch": "main",
|
||||||
"revision": "aa2846680fa9a2032939d720487942567fd9eb63",
|
"revision": "691193879d96bdfd1e6ab5ebcca2fadc7604cf34",
|
||||||
"url": null,
|
"url": null,
|
||||||
"hash": "0gb174800sgh6y6sir23nxsx85xrk478hbwqbzyd46ac34clz9wz"
|
"hash": "1h4f2p6x8vq7bfc20hxk6zz9i4imsjjkmf0m28bzmx6vinxqimj4"
|
||||||
},
|
},
|
||||||
"lon": {
|
"lon": {
|
||||||
"type": "Git",
|
"type": "Git",
|
||||||
|
|
@ -215,9 +215,9 @@
|
||||||
"url": "https://git.hubrecht.ovh/hubrecht/nix-modules.git"
|
"url": "https://git.hubrecht.ovh/hubrecht/nix-modules.git"
|
||||||
},
|
},
|
||||||
"branch": "main",
|
"branch": "main",
|
||||||
"revision": "75e8d70a051dd19d126b5248b62f61d6f8ce4361",
|
"revision": "695cf83c526dd3d78c8ed79b33f80019db4c8019",
|
||||||
"url": null,
|
"url": null,
|
||||||
"hash": "0yx5by3v2cshiidyh27n75lcqy9d1kk5zz5mchmfv63s9p0cjzqn"
|
"hash": "0xqv1rx0dnl3r1rhqdahcp8jqv8j9qc1v6xnmfiv0ddh81jd0szj"
|
||||||
},
|
},
|
||||||
"nix-patches": {
|
"nix-patches": {
|
||||||
"type": "GitRelease",
|
"type": "GitRelease",
|
||||||
|
|
@ -240,9 +240,9 @@
|
||||||
"url": "https://git.hubrecht.ovh/hubrecht/nix-pkgs"
|
"url": "https://git.hubrecht.ovh/hubrecht/nix-pkgs"
|
||||||
},
|
},
|
||||||
"branch": "main",
|
"branch": "main",
|
||||||
"revision": "fe54340f49449f01c2ee489abf7016d97706eb59",
|
"revision": "e27e07f9c03a3bc756f9447a2288ca6f14130ffc",
|
||||||
"url": null,
|
"url": null,
|
||||||
"hash": "1sv9nqhzcqn8anqfgf63i2j5qcqzyy4vl0a45rvllv7rhbhw9adq"
|
"hash": "06vydk09wniygpy04yjh07g9raswimhwwfj1cysigx2lxrg0997a"
|
||||||
},
|
},
|
||||||
"nixos-24.05": {
|
"nixos-24.05": {
|
||||||
"type": "Channel",
|
"type": "Channel",
|
||||||
|
|
@ -258,15 +258,15 @@
|
||||||
"repo": "nixos-generators"
|
"repo": "nixos-generators"
|
||||||
},
|
},
|
||||||
"branch": "master",
|
"branch": "master",
|
||||||
"revision": "3280fdde8c8f0276c9f5286ad5c0f433dfa5d56c",
|
"revision": "15a87ccb45e06d24a9fd5f99a49782efe11b23f0",
|
||||||
"url": "https://github.com/nix-community/nixos-generators/archive/3280fdde8c8f0276c9f5286ad5c0f433dfa5d56c.tar.gz",
|
"url": "https://github.com/nix-community/nixos-generators/archive/15a87ccb45e06d24a9fd5f99a49782efe11b23f0.tar.gz",
|
||||||
"hash": "12v6lxls3bfkj20rwxy62l8g6zlkhsp29m6wd7764j1wwfwjk274"
|
"hash": "0mwllbwinr6cira94347vhzq3jn3zgp28xg6w1ga0ncls7s476q4"
|
||||||
},
|
},
|
||||||
"nixos-unstable": {
|
"nixos-unstable": {
|
||||||
"type": "Channel",
|
"type": "Channel",
|
||||||
"name": "nixos-unstable",
|
"name": "nixos-unstable",
|
||||||
"url": "https://releases.nixos.org/nixos/unstable/nixos-25.05beta710087.23e89b7da85c/nixexprs.tar.xz",
|
"url": "https://releases.nixos.org/nixos/unstable/nixos-25.05beta708622.5e4fbfb6b3de/nixexprs.tar.xz",
|
||||||
"hash": "0b695yx17sarr7d3ypb9z6njd0qhiga1682wjxidl053lvx6g33b"
|
"hash": "18zd6qnn1zmz3pgq2q484lmdk486ncxyp8r5g9c71r9dc8jr5dnc"
|
||||||
},
|
},
|
||||||
"nixpkgs": {
|
"nixpkgs": {
|
||||||
"type": "Channel",
|
"type": "Channel",
|
||||||
|
|
@ -282,9 +282,9 @@
|
||||||
"repo": "proxmox-nixos"
|
"repo": "proxmox-nixos"
|
||||||
},
|
},
|
||||||
"branch": "main",
|
"branch": "main",
|
||||||
"revision": "c6a126238e8f8efc3660b523d314a0074e61fe44",
|
"revision": "93880e244b528deca89828bc1edf08e23ccc18c4",
|
||||||
"url": "https://github.com/SaumonNet/proxmox-nixos/archive/c6a126238e8f8efc3660b523d314a0074e61fe44.tar.gz",
|
"url": "https://github.com/SaumonNet/proxmox-nixos/archive/93880e244b528deca89828bc1edf08e23ccc18c4.tar.gz",
|
||||||
"hash": "0apinc8iiqsjazlj3nh75m4w5f93fd53xs4nj1s06qay4nq1h49w"
|
"hash": "0dyiv7mvvxc0zygfzfb6zhc0v3s7a9pv8xydprxgqhyy1sajp02h"
|
||||||
},
|
},
|
||||||
"signal-irc-bridge": {
|
"signal-irc-bridge": {
|
||||||
"type": "Git",
|
"type": "Git",
|
||||||
|
|
@ -316,9 +316,9 @@
|
||||||
"server": "https://git.helsinki.tools/"
|
"server": "https://git.helsinki.tools/"
|
||||||
},
|
},
|
||||||
"branch": "master",
|
"branch": "master",
|
||||||
"revision": "cce6f7961eb99fd56a039623c4d9e561d9a98928",
|
"revision": "10c3f658aecc0a54baf062137071b129f3897111",
|
||||||
"url": "https://git.helsinki.tools/api/v4/projects/helsinki-systems%2Fwp4nix/repository/archive.tar.gz?sha=cce6f7961eb99fd56a039623c4d9e561d9a98928",
|
"url": "https://git.helsinki.tools/api/v4/projects/helsinki-systems%2Fwp4nix/repository/archive.tar.gz?sha=10c3f658aecc0a54baf062137071b129f3897111",
|
||||||
"hash": "0ggqc92mh4xbsrrdv8j0jl6f3cagwizd93sdl8p8mqpxv9445xrf"
|
"hash": "13gbzfrz9vv9iz43bfl67hl11lsmrh524mw6kkjavfwpzw5shm1g"
|
||||||
}
|
}
|
||||||
},
|
},
|
||||||
"version": 3
|
"version": 3
|
||||||
|
|
|
||||||
808
patches/01-castopod.patch
Normal file
808
patches/01-castopod.patch
Normal file
|
|
@ -0,0 +1,808 @@
|
||||||
|
From 3b656cbdf40c6056983e95ac5c87839a68571096 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Alexander Tomokhov <alexoundos@gmail.com>
|
||||||
|
Date: Tue, 3 Oct 2023 22:20:59 +0400
|
||||||
|
Subject: [PATCH 1/8] castopod: 1.6.4 -> 1.6.5
|
||||||
|
|
||||||
|
---
|
||||||
|
pkgs/applications/audio/castopod/default.nix | 6 +++---
|
||||||
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/pkgs/applications/audio/castopod/default.nix b/pkgs/applications/audio/castopod/default.nix
|
||||||
|
index 9d9f83e2ecce40..83c70f9b36646d 100644
|
||||||
|
--- a/pkgs/applications/audio/castopod/default.nix
|
||||||
|
+++ b/pkgs/applications/audio/castopod/default.nix
|
||||||
|
@@ -7,11 +7,11 @@
|
||||||
|
}:
|
||||||
|
stdenv.mkDerivation {
|
||||||
|
pname = "castopod";
|
||||||
|
- version = "1.6.4";
|
||||||
|
+ version = "1.6.5";
|
||||||
|
|
||||||
|
src = fetchurl {
|
||||||
|
- url = "https://code.castopod.org/adaures/castopod/uploads/ce56d4f149242f12bedd20f9a2b0916d/castopod-1.6.4.tar.gz";
|
||||||
|
- sha256 = "080jj91yxbn3xsbs0sywzwa2f5in9bp9qi2zwqcfqpaxlq9ga62v";
|
||||||
|
+ url = "https://code.castopod.org/adaures/castopod/uploads/5aaaa6cf2edaed25bd7253449e5f8584/castopod-1.6.5.tar.gz";
|
||||||
|
+ sha256 = "04gcq2vmfy5aa2fmsm1qqv1k8g024nikmysdrhy33wj460d529b5";
|
||||||
|
};
|
||||||
|
|
||||||
|
dontBuild = true;
|
||||||
|
|
||||||
|
From 4cd096c27c52ff9948bc7d9ebc05490147ca9675 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Alexander Tomokhov <alexoundos@gmail.com>
|
||||||
|
Date: Tue, 3 Oct 2023 22:19:36 +0400
|
||||||
|
Subject: [PATCH 2/8] nixos/castopod: fix startup, displaying images, uploads
|
||||||
|
up to 500 MiB
|
||||||
|
|
||||||
|
- new maxUploadSize option
|
||||||
|
- new dataDir option (with ReadWritePaths systemd support)
|
||||||
|
- admin page reports correct free disk space (instead of /nix/store)
|
||||||
|
- fix example configuration in documentation
|
||||||
|
- now podcast creation and file upload are tested during NixOS test
|
||||||
|
- move castopod from audio to web-apps folder
|
||||||
|
- verbose logging from the browser test
|
||||||
|
---
|
||||||
|
nixos/modules/module-list.nix | 2 +-
|
||||||
|
.../services/{audio => web-apps}/castopod.md | 11 +-
|
||||||
|
.../services/{audio => web-apps}/castopod.nix | 60 ++--
|
||||||
|
nixos/tests/castopod.nix | 263 +++++++++++++-----
|
||||||
|
pkgs/applications/audio/castopod/default.nix | 13 +-
|
||||||
|
5 files changed, 256 insertions(+), 93 deletions(-)
|
||||||
|
rename nixos/modules/services/{audio => web-apps}/castopod.md (72%)
|
||||||
|
rename nixos/modules/services/{audio => web-apps}/castopod.nix (80%)
|
||||||
|
|
||||||
|
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
|
||||||
|
index 627427262da632..97043c965400c5 100644
|
||||||
|
--- a/nixos/modules/module-list.nix
|
||||||
|
+++ b/nixos/modules/module-list.nix
|
||||||
|
@@ -337,7 +337,6 @@
|
||||||
|
./services/amqp/rabbitmq.nix
|
||||||
|
./services/audio/alsa.nix
|
||||||
|
./services/audio/botamusique.nix
|
||||||
|
- ./services/audio/castopod.nix
|
||||||
|
./services/audio/gmediarender.nix
|
||||||
|
./services/audio/gonic.nix
|
||||||
|
./services/audio/goxlr-utility.nix
|
||||||
|
@@ -1282,6 +1281,7 @@
|
||||||
|
./services/web-apps/bookstack.nix
|
||||||
|
./services/web-apps/c2fmzq-server.nix
|
||||||
|
./services/web-apps/calibre-web.nix
|
||||||
|
+ ./services/web-apps/castopod.nix
|
||||||
|
./services/web-apps/coder.nix
|
||||||
|
./services/web-apps/changedetection-io.nix
|
||||||
|
./services/web-apps/chatgpt-retrieval-plugin.nix
|
||||||
|
diff --git a/nixos/modules/services/audio/castopod.md b/nixos/modules/services/web-apps/castopod.md
|
||||||
|
similarity index 72%
|
||||||
|
rename from nixos/modules/services/audio/castopod.md
|
||||||
|
rename to nixos/modules/services/web-apps/castopod.md
|
||||||
|
index ee8590737a7c73..f61bf1166a4d24 100644
|
||||||
|
--- a/nixos/modules/services/audio/castopod.md
|
||||||
|
+++ b/nixos/modules/services/web-apps/castopod.md
|
||||||
|
@@ -4,6 +4,7 @@ Castopod is an open-source hosting platform made for podcasters who want to enga
|
||||||
|
|
||||||
|
## Quickstart {#module-services-castopod-quickstart}
|
||||||
|
|
||||||
|
+Configure ACME (https://nixos.org/manual/nixos/unstable/#module-security-acme).
|
||||||
|
Use the following configuration to start a public instance of Castopod on `castopod.example.com` domain:
|
||||||
|
|
||||||
|
```nix
|
||||||
|
@@ -11,11 +12,11 @@ networking.firewall.allowedTCPPorts = [ 80 443 ];
|
||||||
|
services.castopod = {
|
||||||
|
enable = true;
|
||||||
|
database.createLocally = true;
|
||||||
|
- nginx.virtualHost = {
|
||||||
|
- serverName = "castopod.example.com";
|
||||||
|
- enableACME = true;
|
||||||
|
- forceSSL = true;
|
||||||
|
- };
|
||||||
|
+ localDomain = "castopod.example.com";
|
||||||
|
+};
|
||||||
|
+services.nginx.virtualHosts."castopod.example.com" = {
|
||||||
|
+ enableACME = true;
|
||||||
|
+ forceSSL = true;
|
||||||
|
};
|
||||||
|
```
|
||||||
|
|
||||||
|
diff --git a/nixos/modules/services/audio/castopod.nix b/nixos/modules/services/web-apps/castopod.nix
|
||||||
|
similarity index 80%
|
||||||
|
rename from nixos/modules/services/audio/castopod.nix
|
||||||
|
rename to nixos/modules/services/web-apps/castopod.nix
|
||||||
|
index b782b548914795..7c99551c83183f 100644
|
||||||
|
--- a/nixos/modules/services/audio/castopod.nix
|
||||||
|
+++ b/nixos/modules/services/web-apps/castopod.nix
|
||||||
|
@@ -4,7 +4,6 @@ let
|
||||||
|
fpm = config.services.phpfpm.pools.castopod;
|
||||||
|
|
||||||
|
user = "castopod";
|
||||||
|
- stateDirectory = "/var/lib/castopod";
|
||||||
|
|
||||||
|
# https://docs.castopod.org/getting-started/install.html#requirements
|
||||||
|
phpPackage = pkgs.php.withExtensions ({ enabled, all }: with all; [
|
||||||
|
@@ -29,6 +28,15 @@ in
|
||||||
|
defaultText = lib.literalMD "pkgs.castopod";
|
||||||
|
description = lib.mdDoc "Which Castopod package to use.";
|
||||||
|
};
|
||||||
|
+ dataDir = lib.mkOption {
|
||||||
|
+ type = lib.types.path;
|
||||||
|
+ default = "/var/lib/castopod";
|
||||||
|
+ description = lib.mdDoc ''
|
||||||
|
+ The path where castopod stores all data. This path must be in sync
|
||||||
|
+ with the castopod package (where it is hardcoded during the build in
|
||||||
|
+ accordance with its own `dataDir` argument).
|
||||||
|
+ '';
|
||||||
|
+ };
|
||||||
|
database = {
|
||||||
|
createLocally = lib.mkOption {
|
||||||
|
type = lib.types.bool;
|
||||||
|
@@ -111,6 +119,18 @@ in
|
||||||
|
Options for Castopod's PHP pool. See the documentation on `php-fpm.conf` for details on configuration directives.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
+ maxUploadSize = lib.mkOption {
|
||||||
|
+ type = lib.types.int;
|
||||||
|
+ default = 512;
|
||||||
|
+ description = lib.mdDoc ''
|
||||||
|
+ Maximum supported size for a file upload in MiB. Maximum HTTP body
|
||||||
|
+ size is set to this value for nginx and PHP (because castopod doesn't
|
||||||
|
+ support chunked uploads yet:
|
||||||
|
+ https://code.castopod.org/adaures/castopod/-/issues/330). Note, that
|
||||||
|
+ practical upload size limit is smaller. For example, with 512 MiB
|
||||||
|
+ setting - around 500 MiB is possible.
|
||||||
|
+ '';
|
||||||
|
+ };
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
@@ -120,13 +140,13 @@ in
|
||||||
|
sslEnabled = with config.services.nginx.virtualHosts.${cfg.localDomain}; addSSL || forceSSL || onlySSL || enableACME || useACMEHost != null;
|
||||||
|
baseURL = "http${lib.optionalString sslEnabled "s"}://${cfg.localDomain}";
|
||||||
|
in
|
||||||
|
- lib.mapAttrs (name: lib.mkDefault) {
|
||||||
|
+ lib.mapAttrs (_name: lib.mkDefault) {
|
||||||
|
"app.forceGlobalSecureRequests" = sslEnabled;
|
||||||
|
"app.baseURL" = baseURL;
|
||||||
|
|
||||||
|
- "media.baseURL" = "/";
|
||||||
|
+ "media.baseURL" = baseURL;
|
||||||
|
"media.root" = "media";
|
||||||
|
- "media.storage" = stateDirectory;
|
||||||
|
+ "media.storage" = cfg.dataDir;
|
||||||
|
|
||||||
|
"admin.gateway" = "admin";
|
||||||
|
"auth.gateway" = "auth";
|
||||||
|
@@ -142,13 +162,13 @@ in
|
||||||
|
services.phpfpm.pools.castopod = {
|
||||||
|
inherit user;
|
||||||
|
group = config.services.nginx.group;
|
||||||
|
- phpPackage = phpPackage;
|
||||||
|
+ inherit phpPackage;
|
||||||
|
phpOptions = ''
|
||||||
|
- # https://code.castopod.org/adaures/castopod/-/blob/main/docker/production/app/uploads.ini
|
||||||
|
+ # https://code.castopod.org/adaures/castopod/-/blob/develop/docker/production/common/uploads.template.ini
|
||||||
|
file_uploads = On
|
||||||
|
memory_limit = 512M
|
||||||
|
- upload_max_filesize = 500M
|
||||||
|
- post_max_size = 512M
|
||||||
|
+ upload_max_filesize = ${toString cfg.maxUploadSize}M
|
||||||
|
+ post_max_size = ${toString cfg.maxUploadSize}M
|
||||||
|
max_execution_time = 300
|
||||||
|
max_input_time = 300
|
||||||
|
'';
|
||||||
|
@@ -165,25 +185,25 @@ in
|
||||||
|
path = [ pkgs.openssl phpPackage ];
|
||||||
|
script =
|
||||||
|
let
|
||||||
|
- envFile = "${stateDirectory}/.env";
|
||||||
|
+ envFile = "${cfg.dataDir}/.env";
|
||||||
|
media = "${cfg.settings."media.storage"}/${cfg.settings."media.root"}";
|
||||||
|
in
|
||||||
|
''
|
||||||
|
- mkdir -p ${stateDirectory}/writable/{cache,logs,session,temp,uploads}
|
||||||
|
+ mkdir -p ${cfg.dataDir}/writable/{cache,logs,session,temp,uploads}
|
||||||
|
|
||||||
|
if [ ! -d ${lib.escapeShellArg media} ]; then
|
||||||
|
cp --no-preserve=mode,ownership -r ${cfg.package}/share/castopod/public/media ${lib.escapeShellArg media}
|
||||||
|
fi
|
||||||
|
|
||||||
|
- if [ ! -f ${stateDirectory}/salt ]; then
|
||||||
|
- openssl rand -base64 33 > ${stateDirectory}/salt
|
||||||
|
+ if [ ! -f ${cfg.dataDir}/salt ]; then
|
||||||
|
+ openssl rand -base64 33 > ${cfg.dataDir}/salt
|
||||||
|
fi
|
||||||
|
|
||||||
|
cat <<'EOF' > ${envFile}
|
||||||
|
${lib.generators.toKeyValue { } cfg.settings}
|
||||||
|
EOF
|
||||||
|
|
||||||
|
- echo "analytics.salt=$(cat ${stateDirectory}/salt)" >> ${envFile}
|
||||||
|
+ echo "analytics.salt=$(cat ${cfg.dataDir}/salt)" >> ${envFile}
|
||||||
|
|
||||||
|
${if (cfg.database.passwordFile != null) then ''
|
||||||
|
echo "database.default.password=$(cat ${lib.escapeShellArg cfg.database.passwordFile})" >> ${envFile}
|
||||||
|
@@ -192,10 +212,10 @@ in
|
||||||
|
''}
|
||||||
|
|
||||||
|
${lib.optionalString (cfg.environmentFile != null) ''
|
||||||
|
- cat ${lib.escapeShellArg cfg.environmentFile}) >> ${envFile}
|
||||||
|
+ cat ${lib.escapeShellArg cfg.environmentFile} >> ${envFile}
|
||||||
|
''}
|
||||||
|
|
||||||
|
- php spark castopod:database-update
|
||||||
|
+ php ${cfg.package}/share/castopod/spark castopod:database-update
|
||||||
|
'';
|
||||||
|
serviceConfig = {
|
||||||
|
StateDirectory = "castopod";
|
||||||
|
@@ -204,6 +224,7 @@ in
|
||||||
|
RemainAfterExit = true;
|
||||||
|
User = user;
|
||||||
|
Group = config.services.nginx.group;
|
||||||
|
+ ReadWritePaths = cfg.dataDir;
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
@@ -212,9 +233,7 @@ in
|
||||||
|
wantedBy = [ "multi-user.target" ];
|
||||||
|
path = [ phpPackage ];
|
||||||
|
script = ''
|
||||||
|
- php public/index.php scheduled-activities
|
||||||
|
- php public/index.php scheduled-websub-publish
|
||||||
|
- php public/index.php scheduled-video-clips
|
||||||
|
+ php ${cfg.package}/share/castopod/spark tasks:run
|
||||||
|
'';
|
||||||
|
serviceConfig = {
|
||||||
|
StateDirectory = "castopod";
|
||||||
|
@@ -222,6 +241,8 @@ in
|
||||||
|
Type = "oneshot";
|
||||||
|
User = user;
|
||||||
|
Group = config.services.nginx.group;
|
||||||
|
+ ReadWritePaths = cfg.dataDir;
|
||||||
|
+ LogLevelMax = "notice"; # otherwise periodic tasks flood the journal
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
@@ -251,6 +272,7 @@ in
|
||||||
|
extraConfig = ''
|
||||||
|
try_files $uri $uri/ /index.php?$args;
|
||||||
|
index index.php index.html;
|
||||||
|
+ client_max_body_size ${toString cfg.maxUploadSize}M;
|
||||||
|
'';
|
||||||
|
|
||||||
|
locations."^~ /${cfg.settings."media.root"}/" = {
|
||||||
|
@@ -278,7 +300,7 @@ in
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
- users.users.${user} = lib.mapAttrs (name: lib.mkDefault) {
|
||||||
|
+ users.users.${user} = lib.mapAttrs (_name: lib.mkDefault) {
|
||||||
|
description = "Castopod user";
|
||||||
|
isSystemUser = true;
|
||||||
|
group = config.services.nginx.group;
|
||||||
|
diff --git a/nixos/tests/castopod.nix b/nixos/tests/castopod.nix
|
||||||
|
index 4435ec617d4e67..2db7aa0bda6507 100644
|
||||||
|
--- a/nixos/tests/castopod.nix
|
||||||
|
+++ b/nixos/tests/castopod.nix
|
||||||
|
@@ -4,74 +4,211 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
|
||||||
|
meta = with lib.maintainers; {
|
||||||
|
maintainers = [ alexoundos misuzu ];
|
||||||
|
};
|
||||||
|
+
|
||||||
|
nodes.castopod = { nodes, ... }: {
|
||||||
|
+ # otherwise 500 MiB file upload fails!
|
||||||
|
+ virtualisation.diskSize = 512 + 3 * 512;
|
||||||
|
+
|
||||||
|
networking.firewall.allowedTCPPorts = [ 80 ];
|
||||||
|
- networking.extraHosts = ''
|
||||||
|
- 127.0.0.1 castopod.example.com
|
||||||
|
- '';
|
||||||
|
+ networking.extraHosts =
|
||||||
|
+ lib.strings.concatStringsSep "\n"
|
||||||
|
+ (lib.attrsets.mapAttrsToList
|
||||||
|
+ (name: _: "127.0.0.1 ${name}")
|
||||||
|
+ nodes.castopod.services.nginx.virtualHosts);
|
||||||
|
+
|
||||||
|
services.castopod = {
|
||||||
|
enable = true;
|
||||||
|
database.createLocally = true;
|
||||||
|
localDomain = "castopod.example.com";
|
||||||
|
+ maxUploadSize = 512;
|
||||||
|
};
|
||||||
|
- environment.systemPackages =
|
||||||
|
- let
|
||||||
|
- username = "admin";
|
||||||
|
- email = "admin@castood.example.com";
|
||||||
|
- password = "v82HmEp5";
|
||||||
|
- testRunner = pkgs.writers.writePython3Bin "test-runner"
|
||||||
|
- {
|
||||||
|
- libraries = [ pkgs.python3Packages.selenium ];
|
||||||
|
- flakeIgnore = [
|
||||||
|
- "E501"
|
||||||
|
- ];
|
||||||
|
- } ''
|
||||||
|
- from selenium.webdriver.common.by import By
|
||||||
|
- from selenium.webdriver import Firefox
|
||||||
|
- from selenium.webdriver.firefox.options import Options
|
||||||
|
- from selenium.webdriver.support.ui import WebDriverWait
|
||||||
|
- from selenium.webdriver.support import expected_conditions as EC
|
||||||
|
-
|
||||||
|
- options = Options()
|
||||||
|
- options.add_argument('--headless')
|
||||||
|
- driver = Firefox(options=options)
|
||||||
|
- try:
|
||||||
|
- driver.implicitly_wait(20)
|
||||||
|
- driver.get('http://castopod.example.com/cp-install')
|
||||||
|
-
|
||||||
|
- wait = WebDriverWait(driver, 10)
|
||||||
|
-
|
||||||
|
- wait.until(EC.title_contains("installer"))
|
||||||
|
-
|
||||||
|
- driver.find_element(By.CSS_SELECTOR, '#username').send_keys(
|
||||||
|
- '${username}'
|
||||||
|
- )
|
||||||
|
- driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
|
||||||
|
- '${email}'
|
||||||
|
- )
|
||||||
|
- driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
|
||||||
|
- '${password}'
|
||||||
|
- )
|
||||||
|
- driver.find_element(By.XPATH, "//button[contains(., 'Finish install')]").click()
|
||||||
|
-
|
||||||
|
- wait.until(EC.title_contains("Auth"))
|
||||||
|
-
|
||||||
|
- driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
|
||||||
|
- '${email}'
|
||||||
|
- )
|
||||||
|
- driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
|
||||||
|
- '${password}'
|
||||||
|
- )
|
||||||
|
- driver.find_element(By.XPATH, "//button[contains(., 'Login')]").click()
|
||||||
|
-
|
||||||
|
- wait.until(EC.title_contains("Admin dashboard"))
|
||||||
|
- finally:
|
||||||
|
- driver.close()
|
||||||
|
- driver.quit()
|
||||||
|
- '';
|
||||||
|
- in
|
||||||
|
- [ pkgs.firefox-unwrapped pkgs.geckodriver testRunner ];
|
||||||
|
};
|
||||||
|
+
|
||||||
|
+ nodes.client = { nodes, pkgs, lib, ... }:
|
||||||
|
+ let
|
||||||
|
+ domain = nodes.castopod.services.castopod.localDomain;
|
||||||
|
+
|
||||||
|
+ getIP = node:
|
||||||
|
+ (builtins.head node.networking.interfaces.eth1.ipv4.addresses).address;
|
||||||
|
+
|
||||||
|
+ targetPodcastSize = 500 * 1024 * 1024;
|
||||||
|
+ lameMp3Bitrate = 348300;
|
||||||
|
+ lameMp3FileAdjust = -800;
|
||||||
|
+ targetPodcastDuration = toString
|
||||||
|
+ ((targetPodcastSize + lameMp3FileAdjust) / (lameMp3Bitrate / 8));
|
||||||
|
+ mp3file = with pkgs;
|
||||||
|
+ runCommand "gen-castopod.mp3" { nativeBuildInputs = [ sox lame ]; } ''
|
||||||
|
+ sox -n -r 48000 -t wav - synth ${targetPodcastDuration} sine 440 `
|
||||||
|
+ `| lame --noreplaygain -cbr -q 9 -b 320 - $out
|
||||||
|
+ FILESIZE="$(stat -c%s $out)"
|
||||||
|
+ [ "$FILESIZE" -gt 0 ]
|
||||||
|
+ [ "$FILESIZE" -le "${toString targetPodcastSize}" ]
|
||||||
|
+ '';
|
||||||
|
+
|
||||||
|
+ bannerWidth = 3000;
|
||||||
|
+ banner = pkgs.runCommand "gen-castopod-cover.jpg" { } ''
|
||||||
|
+ ${pkgs.imagemagick}/bin/magick `
|
||||||
|
+ `-background green -bordercolor white -gravity northwest xc:black `
|
||||||
|
+ `-duplicate 99 `
|
||||||
|
+ `-seed 1 -resize "%[fx:rand()*72+24]" `
|
||||||
|
+ `-seed 0 -rotate "%[fx:rand()*360]" -border 6x6 -splice 16x36 `
|
||||||
|
+ `-seed 0 -rotate "%[fx:floor(rand()*4)*90]" -resize "150x50!" `
|
||||||
|
+ `+append -crop 10x1@ +repage -roll "+%[fx:(t%2)*72]+0" -append `
|
||||||
|
+ `-resize ${toString bannerWidth} -quality 1 $out
|
||||||
|
+ '';
|
||||||
|
+
|
||||||
|
+ coverWidth = toString 3000;
|
||||||
|
+ cover = pkgs.runCommand "gen-castopod-banner.jpg" { } ''
|
||||||
|
+ ${pkgs.imagemagick}/bin/magick `
|
||||||
|
+ `-background white -bordercolor white -gravity northwest xc:black `
|
||||||
|
+ `-duplicate 99 `
|
||||||
|
+ `-seed 1 -resize "%[fx:rand()*72+24]" `
|
||||||
|
+ `-seed 0 -rotate "%[fx:rand()*360]" -border 6x6 -splice 36x36 `
|
||||||
|
+ `-seed 0 -rotate "%[fx:floor(rand()*4)*90]" -resize "144x144!" `
|
||||||
|
+ `+append -crop 10x1@ +repage -roll "+%[fx:(t%2)*72]+0" -append `
|
||||||
|
+ `-resize ${coverWidth} -quality 1 $out
|
||||||
|
+ '';
|
||||||
|
+ in
|
||||||
|
+ {
|
||||||
|
+ networking.extraHosts =
|
||||||
|
+ lib.strings.concatStringsSep "\n"
|
||||||
|
+ (lib.attrsets.mapAttrsToList
|
||||||
|
+ (name: _: "${getIP nodes.castopod} ${name}")
|
||||||
|
+ nodes.castopod.services.nginx.virtualHosts);
|
||||||
|
+
|
||||||
|
+ environment.systemPackages =
|
||||||
|
+ let
|
||||||
|
+ username = "admin";
|
||||||
|
+ email = "admin@${domain}";
|
||||||
|
+ password = "Abcd1234";
|
||||||
|
+ podcastTitle = "Some Title";
|
||||||
|
+ episodeTitle = "Episode Title";
|
||||||
|
+ browser-test = pkgs.writers.writePython3Bin "browser-test"
|
||||||
|
+ {
|
||||||
|
+ libraries = [ pkgs.python3Packages.selenium ];
|
||||||
|
+ flakeIgnore = [ "E124" "E501" ];
|
||||||
|
+ } ''
|
||||||
|
+ from selenium.webdriver.common.by import By
|
||||||
|
+ from selenium.webdriver import Firefox
|
||||||
|
+ from selenium.webdriver.firefox.options import Options
|
||||||
|
+ from selenium.webdriver.firefox.service import Service
|
||||||
|
+ from selenium.webdriver.support.ui import WebDriverWait
|
||||||
|
+ from selenium.webdriver.support import expected_conditions as EC
|
||||||
|
+ from subprocess import STDOUT
|
||||||
|
+ import logging
|
||||||
|
+
|
||||||
|
+ selenium_logger = logging.getLogger("selenium")
|
||||||
|
+ selenium_logger.setLevel(logging.DEBUG)
|
||||||
|
+ selenium_logger.addHandler(logging.StreamHandler())
|
||||||
|
+
|
||||||
|
+ options = Options()
|
||||||
|
+ options.add_argument('--headless')
|
||||||
|
+ service = Service(log_output=STDOUT)
|
||||||
|
+ driver = Firefox(options=options, service=service)
|
||||||
|
+ driver = Firefox(options=options)
|
||||||
|
+ driver.implicitly_wait(20)
|
||||||
|
+
|
||||||
|
+ # install ##########################################################
|
||||||
|
+
|
||||||
|
+ driver.get('http://${domain}/cp-install')
|
||||||
|
+
|
||||||
|
+ wait = WebDriverWait(driver, 10)
|
||||||
|
+
|
||||||
|
+ wait.until(EC.title_contains("installer"))
|
||||||
|
+
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#username').send_keys(
|
||||||
|
+ '${username}'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
|
||||||
|
+ '${email}'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
|
||||||
|
+ '${password}'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.XPATH,
|
||||||
|
+ "//button[contains(., 'Finish install')]"
|
||||||
|
+ ).click()
|
||||||
|
+
|
||||||
|
+ wait.until(EC.title_contains("Auth"))
|
||||||
|
+
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#email').send_keys(
|
||||||
|
+ '${email}'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#password').send_keys(
|
||||||
|
+ '${password}'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.XPATH,
|
||||||
|
+ "//button[contains(., 'Login')]"
|
||||||
|
+ ).click()
|
||||||
|
+
|
||||||
|
+ wait.until(EC.title_contains("Admin dashboard"))
|
||||||
|
+
|
||||||
|
+ # create podcast ###################################################
|
||||||
|
+
|
||||||
|
+ driver.get('http://${domain}/admin/podcasts/new')
|
||||||
|
+
|
||||||
|
+ wait.until(EC.title_contains("Create podcast"))
|
||||||
|
+
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#cover').send_keys(
|
||||||
|
+ '${cover}'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#banner').send_keys(
|
||||||
|
+ '${banner}'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#title').send_keys(
|
||||||
|
+ '${podcastTitle}'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#handle').send_keys(
|
||||||
|
+ 'some_handle'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#description').send_keys(
|
||||||
|
+ 'Some description'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#owner_name').send_keys(
|
||||||
|
+ 'Owner Name'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#owner_email').send_keys(
|
||||||
|
+ 'owner@email.xyz'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.XPATH,
|
||||||
|
+ "//button[contains(., 'Create podcast')]"
|
||||||
|
+ ).click()
|
||||||
|
+
|
||||||
|
+ wait.until(EC.title_contains("${podcastTitle}"))
|
||||||
|
+
|
||||||
|
+ driver.find_element(By.XPATH,
|
||||||
|
+ "//span[contains(., 'Add an episode')]"
|
||||||
|
+ ).click()
|
||||||
|
+
|
||||||
|
+ wait.until(EC.title_contains("Add an episode"))
|
||||||
|
+
|
||||||
|
+ # upload podcast ###################################################
|
||||||
|
+
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#audio_file').send_keys(
|
||||||
|
+ '${mp3file}'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#cover').send_keys(
|
||||||
|
+ '${cover}'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#description').send_keys(
|
||||||
|
+ 'Episode description'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.CSS_SELECTOR, '#title').send_keys(
|
||||||
|
+ '${episodeTitle}'
|
||||||
|
+ )
|
||||||
|
+ driver.find_element(By.XPATH,
|
||||||
|
+ "//button[contains(., 'Create episode')]"
|
||||||
|
+ ).click()
|
||||||
|
+
|
||||||
|
+ wait.until(EC.title_contains("${episodeTitle}"))
|
||||||
|
+
|
||||||
|
+ driver.close()
|
||||||
|
+ driver.quit()
|
||||||
|
+ '';
|
||||||
|
+ in
|
||||||
|
+ [ pkgs.firefox-unwrapped pkgs.geckodriver browser-test ];
|
||||||
|
+ };
|
||||||
|
+
|
||||||
|
testScript = ''
|
||||||
|
start_all()
|
||||||
|
castopod.wait_for_unit("castopod-setup.service")
|
||||||
|
@@ -79,9 +216,9 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
|
||||||
|
castopod.wait_for_unit("nginx.service")
|
||||||
|
castopod.wait_for_open_port(80)
|
||||||
|
castopod.wait_until_succeeds("curl -sS -f http://castopod.example.com")
|
||||||
|
- castopod.succeed("curl -s http://localhost/cp-install | grep 'Create your Super Admin account' > /dev/null")
|
||||||
|
|
||||||
|
- with subtest("Create superadmin and log in"):
|
||||||
|
- castopod.succeed("PYTHONUNBUFFERED=1 systemd-cat -t test-runner test-runner")
|
||||||
|
+ with subtest("Create superadmin, log in, create and upload a podcast"):
|
||||||
|
+ client.succeed(\
|
||||||
|
+ "PYTHONUNBUFFERED=1 systemd-cat -t browser-test browser-test")
|
||||||
|
'';
|
||||||
|
})
|
||||||
|
diff --git a/pkgs/applications/audio/castopod/default.nix b/pkgs/applications/audio/castopod/default.nix
|
||||||
|
index 83c70f9b36646d..badace09587d2b 100644
|
||||||
|
--- a/pkgs/applications/audio/castopod/default.nix
|
||||||
|
+++ b/pkgs/applications/audio/castopod/default.nix
|
||||||
|
@@ -3,7 +3,7 @@
|
||||||
|
, ffmpeg-headless
|
||||||
|
, lib
|
||||||
|
, nixosTests
|
||||||
|
-, stateDirectory ? "/var/lib/castopod"
|
||||||
|
+, dataDir ? "/var/lib/castopod"
|
||||||
|
}:
|
||||||
|
stdenv.mkDerivation {
|
||||||
|
pname = "castopod";
|
||||||
|
@@ -20,13 +20,16 @@ stdenv.mkDerivation {
|
||||||
|
postPatch = ''
|
||||||
|
# not configurable at runtime unfortunately:
|
||||||
|
substituteInPlace app/Config/Paths.php \
|
||||||
|
- --replace "__DIR__ . '/../../writable'" "'${stateDirectory}/writable'"
|
||||||
|
+ --replace "__DIR__ . '/../../writable'" "'${dataDir}/writable'"
|
||||||
|
|
||||||
|
- # configuration file must be writable, place it to ${stateDirectory}
|
||||||
|
+ substituteInPlace modules/Admin/Controllers/DashboardController.php \
|
||||||
|
+ --replace "disk_total_space('./')" "disk_total_space('${dataDir}')"
|
||||||
|
+
|
||||||
|
+ # configuration file must be writable, place it to ${dataDir}
|
||||||
|
substituteInPlace modules/Install/Controllers/InstallController.php \
|
||||||
|
- --replace "ROOTPATH" "'${stateDirectory}/'"
|
||||||
|
+ --replace "ROOTPATH" "'${dataDir}/'"
|
||||||
|
substituteInPlace public/index.php spark \
|
||||||
|
- --replace "DotEnv(ROOTPATH)" "DotEnv('${stateDirectory}')"
|
||||||
|
+ --replace "DotEnv(ROOTPATH)" "DotEnv('${dataDir}')"
|
||||||
|
|
||||||
|
# ffmpeg is required for Video Clips feature
|
||||||
|
substituteInPlace modules/MediaClipper/VideoClipper.php \
|
||||||
|
|
||||||
|
From 45d43fe39fa3167d5cf7ba9a2cb9fcd6fbe2c5c3 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Alexander Tomokhov <alexoundos@gmail.com>
|
||||||
|
Date: Mon, 11 Dec 2023 09:00:26 +0400
|
||||||
|
Subject: [PATCH 3/8] nixos/castopod: little documentation fix
|
||||||
|
|
||||||
|
---
|
||||||
|
nixos/modules/services/web-apps/castopod.nix | 7 ++++---
|
||||||
|
1 file changed, 4 insertions(+), 3 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/nixos/modules/services/web-apps/castopod.nix b/nixos/modules/services/web-apps/castopod.nix
|
||||||
|
index 7c99551c83183f..11cf4b36aeb385 100644
|
||||||
|
--- a/nixos/modules/services/web-apps/castopod.nix
|
||||||
|
+++ b/nixos/modules/services/web-apps/castopod.nix
|
||||||
|
@@ -126,9 +126,10 @@ in
|
||||||
|
Maximum supported size for a file upload in MiB. Maximum HTTP body
|
||||||
|
size is set to this value for nginx and PHP (because castopod doesn't
|
||||||
|
support chunked uploads yet:
|
||||||
|
- https://code.castopod.org/adaures/castopod/-/issues/330). Note, that
|
||||||
|
- practical upload size limit is smaller. For example, with 512 MiB
|
||||||
|
- setting - around 500 MiB is possible.
|
||||||
|
+ https://code.castopod.org/adaures/castopod/-/issues/330).
|
||||||
|
+
|
||||||
|
+ Note, that practical upload size limit is smaller. For example, with
|
||||||
|
+ 512 MiB setting - around 500 MiB is possible.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
|
||||||
|
From 4aafd48b7e76748eaf0ff7409b12b455d1db31ec Mon Sep 17 00:00:00 2001
|
||||||
|
From: sinavir <sinavir@sinavir.fr>
|
||||||
|
Date: Fri, 23 Feb 2024 22:02:10 +0100
|
||||||
|
Subject: [PATCH 4/8] castopod: 1.6.5 -> 1.10.3
|
||||||
|
|
||||||
|
---
|
||||||
|
pkgs/applications/audio/castopod/default.nix | 4 ++--
|
||||||
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/pkgs/applications/audio/castopod/default.nix b/pkgs/applications/audio/castopod/default.nix
|
||||||
|
index badace09587d2b..438f1d728f9624 100644
|
||||||
|
--- a/pkgs/applications/audio/castopod/default.nix
|
||||||
|
+++ b/pkgs/applications/audio/castopod/default.nix
|
||||||
|
@@ -10,8 +10,8 @@ stdenv.mkDerivation {
|
||||||
|
version = "1.6.5";
|
||||||
|
|
||||||
|
src = fetchurl {
|
||||||
|
- url = "https://code.castopod.org/adaures/castopod/uploads/5aaaa6cf2edaed25bd7253449e5f8584/castopod-1.6.5.tar.gz";
|
||||||
|
- sha256 = "04gcq2vmfy5aa2fmsm1qqv1k8g024nikmysdrhy33wj460d529b5";
|
||||||
|
+ url = "https://code.castopod.org/adaures/castopod/uploads/2bb52d4607a772ac8b397efa3559a3ae/castopod-1.10.3.tar.gz";
|
||||||
|
+ sha256 = "0w1yl14v3aajm089vwpq9wkiibv3w312y004ggdbf7xwzsrmjs51";
|
||||||
|
};
|
||||||
|
|
||||||
|
dontBuild = true;
|
||||||
|
|
||||||
|
From 6205595efbdcc2f3440022b4ff7258e2f50a6427 Mon Sep 17 00:00:00 2001
|
||||||
|
From: sinavir <sinavir@sinavir.fr>
|
||||||
|
Date: Fri, 23 Feb 2024 22:27:24 +0100
|
||||||
|
Subject: [PATCH 6/8] nixos/castopod: use LoadCredentials
|
||||||
|
|
||||||
|
---
|
||||||
|
nixos/modules/services/web-apps/castopod.nix | 12 ++++++++++--
|
||||||
|
1 file changed, 10 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/nixos/modules/services/web-apps/castopod.nix b/nixos/modules/services/web-apps/castopod.nix
|
||||||
|
index 11cf4b36aeb385..042fb3954d2b73 100644
|
||||||
|
--- a/nixos/modules/services/web-apps/castopod.nix
|
||||||
|
+++ b/nixos/modules/services/web-apps/castopod.nix
|
||||||
|
@@ -67,6 +67,8 @@ in
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
A file containing the password corresponding to
|
||||||
|
[](#opt-services.castopod.database.user).
|
||||||
|
+
|
||||||
|
+ This file is loaded using systemd LoadCredentials.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
};
|
||||||
|
@@ -93,6 +95,8 @@ in
|
||||||
|
Environment file to inject e.g. secrets into the configuration.
|
||||||
|
See [](https://code.castopod.org/adaures/castopod/-/blob/main/.env.example)
|
||||||
|
for available environment variables.
|
||||||
|
+
|
||||||
|
+ This file is loaded using systemd LoadCredentials.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
configureNginx = lib.mkOption {
|
||||||
|
@@ -207,19 +211,23 @@ in
|
||||||
|
echo "analytics.salt=$(cat ${cfg.dataDir}/salt)" >> ${envFile}
|
||||||
|
|
||||||
|
${if (cfg.database.passwordFile != null) then ''
|
||||||
|
- echo "database.default.password=$(cat ${lib.escapeShellArg cfg.database.passwordFile})" >> ${envFile}
|
||||||
|
+ echo "database.default.password=$(cat "$CREDENTIALS_DIRECTORY/dbpasswordfile)" >> ${envFile}
|
||||||
|
'' else ''
|
||||||
|
echo "database.default.password=" >> ${envFile}
|
||||||
|
''}
|
||||||
|
|
||||||
|
${lib.optionalString (cfg.environmentFile != null) ''
|
||||||
|
- cat ${lib.escapeShellArg cfg.environmentFile} >> ${envFile}
|
||||||
|
+ cat "$CREDENTIALS_DIRECTORY/envfile" >> ${envFile}
|
||||||
|
''}
|
||||||
|
|
||||||
|
php ${cfg.package}/share/castopod/spark castopod:database-update
|
||||||
|
'';
|
||||||
|
serviceConfig = {
|
||||||
|
StateDirectory = "castopod";
|
||||||
|
+ LoadCredential = lib.optional (cfg.environmentFile != null)
|
||||||
|
+ "envfile:${cfg.environmentFile}"
|
||||||
|
+ ++ (lib.optional (cfg.database.passwordFile != null)
|
||||||
|
+ "dbpasswordfile:${cfg.database.passwordFile}");
|
||||||
|
WorkingDirectory = "${cfg.package}/share/castopod";
|
||||||
|
Type = "oneshot";
|
||||||
|
RemainAfterExit = true;
|
||||||
|
|
||||||
|
From 9b03fc35a30671e5d4146bbcbe6b5536fa9baacc Mon Sep 17 00:00:00 2001
|
||||||
|
From: sinavir <sinavir@sinavir.fr>
|
||||||
|
Date: Sat, 2 Mar 2024 18:01:54 +0100
|
||||||
|
Subject: [PATCH 7/8] nixos/castopod: build mp3 in the test
|
||||||
|
|
||||||
|
---
|
||||||
|
nixos/tests/castopod.nix | 31 +++++++++++++++++++++----------
|
||||||
|
1 file changed, 21 insertions(+), 10 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/nixos/tests/castopod.nix b/nixos/tests/castopod.nix
|
||||||
|
index 2db7aa0bda6507..2bdc6941c23815 100644
|
||||||
|
--- a/nixos/tests/castopod.nix
|
||||||
|
+++ b/nixos/tests/castopod.nix
|
||||||
|
@@ -37,14 +37,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
|
||||||
|
targetPodcastDuration = toString
|
||||||
|
((targetPodcastSize + lameMp3FileAdjust) / (lameMp3Bitrate / 8));
|
||||||
|
mp3file = with pkgs;
|
||||||
|
- runCommand "gen-castopod.mp3" { nativeBuildInputs = [ sox lame ]; } ''
|
||||||
|
- sox -n -r 48000 -t wav - synth ${targetPodcastDuration} sine 440 `
|
||||||
|
- `| lame --noreplaygain -cbr -q 9 -b 320 - $out
|
||||||
|
- FILESIZE="$(stat -c%s $out)"
|
||||||
|
- [ "$FILESIZE" -gt 0 ]
|
||||||
|
- [ "$FILESIZE" -le "${toString targetPodcastSize}" ]
|
||||||
|
- '';
|
||||||
|
-
|
||||||
|
+ runCommand ;
|
||||||
|
bannerWidth = 3000;
|
||||||
|
banner = pkgs.runCommand "gen-castopod-cover.jpg" { } ''
|
||||||
|
${pkgs.imagemagick}/bin/magick `
|
||||||
|
@@ -185,7 +178,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
|
||||||
|
# upload podcast ###################################################
|
||||||
|
|
||||||
|
driver.find_element(By.CSS_SELECTOR, '#audio_file').send_keys(
|
||||||
|
- '${mp3file}'
|
||||||
|
+ '/tmp/podcast.mp3'
|
||||||
|
)
|
||||||
|
driver.find_element(By.CSS_SELECTOR, '#cover').send_keys(
|
||||||
|
'${cover}'
|
||||||
|
@@ -206,7 +199,23 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
|
||||||
|
driver.quit()
|
||||||
|
'';
|
||||||
|
in
|
||||||
|
- [ pkgs.firefox-unwrapped pkgs.geckodriver browser-test ];
|
||||||
|
+ [
|
||||||
|
+ pkgs.firefox-unwrapped
|
||||||
|
+ pkgs.geckodriver
|
||||||
|
+ browser-test
|
||||||
|
+ (pkgs.writeShellApplication {
|
||||||
|
+ name = "build-mp3";
|
||||||
|
+ runtimeInputs = with pkgs; [ sox lame ];
|
||||||
|
+ text = ''
|
||||||
|
+ out=/tmp/podcast.mp3
|
||||||
|
+ sox -n -r 48000 -t wav - synth ${targetPodcastDuration} sine 440 `
|
||||||
|
+ `| lame --noreplaygain -cbr -q 9 -b 320 - $out
|
||||||
|
+ FILESIZE="$(stat -c%s $out)"
|
||||||
|
+ [ "$FILESIZE" -gt 0 ]
|
||||||
|
+ [ "$FILESIZE" -le "${toString targetPodcastSize}" ]
|
||||||
|
+ '';
|
||||||
|
+ })
|
||||||
|
+ ];
|
||||||
|
};
|
||||||
|
|
||||||
|
testScript = ''
|
||||||
|
@@ -217,6 +226,8 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
|
||||||
|
castopod.wait_for_open_port(80)
|
||||||
|
castopod.wait_until_succeeds("curl -sS -f http://castopod.example.com")
|
||||||
|
|
||||||
|
+ client.succeed("build-mp3")
|
||||||
|
+
|
||||||
|
with subtest("Create superadmin, log in, create and upload a podcast"):
|
||||||
|
client.succeed(\
|
||||||
|
"PYTHONUNBUFFERED=1 systemd-cat -t browser-test browser-test")
|
||||||
|
|
||||||
|
From 538281e8be427f820371f4005e991e0281872e12 Mon Sep 17 00:00:00 2001
|
||||||
|
From: sinavir <sinavir@sinavir.fr>
|
||||||
|
Date: Sat, 2 Mar 2024 18:04:35 +0100
|
||||||
|
Subject: [PATCH 8/8] nixos/castopod: Increase test timeouts
|
||||||
|
|
||||||
|
---
|
||||||
|
nixos/tests/castopod.nix | 2 +-
|
||||||
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||||
|
|
||||||
|
diff --git a/nixos/tests/castopod.nix b/nixos/tests/castopod.nix
|
||||||
|
index 2bdc6941c23815..2c5c745f7da0df 100644
|
||||||
|
--- a/nixos/tests/castopod.nix
|
||||||
|
+++ b/nixos/tests/castopod.nix
|
||||||
|
@@ -105,7 +105,7 @@ import ./make-test-python.nix ({ pkgs, lib, ... }:
|
||||||
|
|
||||||
|
driver.get('http://${domain}/cp-install')
|
||||||
|
|
||||||
|
- wait = WebDriverWait(driver, 10)
|
||||||
|
+ wait = WebDriverWait(driver, 20)
|
||||||
|
|
||||||
|
wait.until(EC.title_contains("installer"))
|
||||||
|
|
||||||
28
patches/03-nextcloud.patch
Normal file
28
patches/03-nextcloud.patch
Normal file
|
|
@ -0,0 +1,28 @@
|
||||||
|
--- a/nixos/modules/services/web-apps/nextcloud.nix
|
||||||
|
+++ b/nixos/modules/services/web-apps/nextcloud.nix
|
||||||
|
@@ -131,6 +131,7 @@
|
||||||
|
(mkRemovedOptionModule [ "services" "nextcloud" "disableImagemagick" ] ''
|
||||||
|
Use services.nextcloud.enableImagemagick instead.
|
||||||
|
'')
|
||||||
|
+ (mkRenamedOptionModule [ "services" "nextcloud" "config" "objectstore" "s3" "autocreate" ] [ "services" "nextcloud" "config" "objectstore" "s3" "verify_bucket_exists" ])
|
||||||
|
];
|
||||||
|
|
||||||
|
options.services.nextcloud = {
|
||||||
|
@@ -487,7 +487,7 @@
|
||||||
|
The name of the S3 bucket.
|
||||||
|
'';
|
||||||
|
};
|
||||||
|
- autocreate = mkOption {
|
||||||
|
+ verify_bucket_exists = mkOption {
|
||||||
|
type = types.bool;
|
||||||
|
description = lib.mdDoc ''
|
||||||
|
Create the objectstore if it does not exist.
|
||||||
|
@@ -820,7 +820,7 @@
|
||||||
|
'class' => '\\OC\\Files\\ObjectStore\\S3',
|
||||||
|
'arguments' => [
|
||||||
|
'bucket' => '${s3.bucket}',
|
||||||
|
- 'autocreate' => ${boolToString s3.autocreate},
|
||||||
|
+ 'verify_bucket_exists' => ${boolToString s3.verify_bucket_exists},
|
||||||
|
'key' => '${s3.key}',
|
||||||
|
'secret' => nix_read_secret('${s3.secretFile}'),
|
||||||
|
${optionalString (s3.hostname != null) "'hostname' => '${s3.hostname}',"}
|
||||||
|
|
@ -1,17 +1,9 @@
|
||||||
let
|
|
||||||
local = path: {
|
|
||||||
_type = "static";
|
|
||||||
inherit path;
|
|
||||||
};
|
|
||||||
in
|
|
||||||
|
|
||||||
{
|
{
|
||||||
lix = [
|
|
||||||
(local ./lix/01-disable-installChecks.patch)
|
|
||||||
];
|
|
||||||
|
|
||||||
"nixos-24.05" = [
|
"nixos-24.05" = [
|
||||||
(local ./nixpkgs/06-netbox-qrcode.patch)
|
{
|
||||||
|
_type = "static";
|
||||||
|
path = ./06-netbox-qrcode.patch;
|
||||||
|
}
|
||||||
|
|
||||||
# nixos/nextcloud: Rename autocreate (a no-op) to verify_bucket_exists
|
# nixos/nextcloud: Rename autocreate (a no-op) to verify_bucket_exists
|
||||||
{
|
{
|
||||||
|
|
@ -27,7 +19,10 @@ in
|
||||||
}
|
}
|
||||||
|
|
||||||
# Crabfit: don't depend on all google-fonts
|
# Crabfit: don't depend on all google-fonts
|
||||||
(local ./nixpkgs/04-crabfit-karla.patch)
|
{
|
||||||
|
_type = "static";
|
||||||
|
path = ./04-crabfit-karla.patch;
|
||||||
|
}
|
||||||
|
|
||||||
# nixos/kanidm: add basic provisioning
|
# nixos/kanidm: add basic provisioning
|
||||||
{
|
{
|
||||||
|
|
@ -52,9 +47,15 @@ in
|
||||||
|
|
||||||
"nixos-unstable" = [
|
"nixos-unstable" = [
|
||||||
# netbox qrcode plugin
|
# netbox qrcode plugin
|
||||||
(local ./nixpkgs/06-netbox-qrcode.patch)
|
{
|
||||||
|
_type = "static";
|
||||||
|
path = ./06-netbox-qrcode.patch;
|
||||||
|
}
|
||||||
|
|
||||||
# Build netbird-relay
|
# Build netbird-relay
|
||||||
(local ./nixpkgs/05-netbird-relay.patch)
|
{
|
||||||
|
_type = "static";
|
||||||
|
path = ./05-netbird-relay.patch;
|
||||||
|
}
|
||||||
];
|
];
|
||||||
}
|
}
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue