d9262bd6c6
It appears this didn't even *work* without a password, so we've been forced into being more secure. Change-Id: I4ff9d04961a703a85299dafb79e8447b0a933fc1 Reviewed-on: https://cl.tvl.fyi/c/depot/+/1491 Tested-by: BuildkiteCI Reviewed-by: tazjin <mail@tazj.in>
86 lines
2.3 KiB
Nix
86 lines
2.3 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
cfg = config.services.depot.panettone;
|
|
depot = config.depot;
|
|
in {
|
|
options.services.depot.panettone = with lib; {
|
|
enable = mkEnableOption "Panettone issue tracker";
|
|
|
|
port = mkOption {
|
|
description = "Port on which Panettone should listen";
|
|
type = types.int;
|
|
default = 7268;
|
|
};
|
|
|
|
dbHost = mkOption {
|
|
description = "Postgresql host to connect to for Panettone";
|
|
type = types.str;
|
|
default = "localhost";
|
|
};
|
|
|
|
dbName = mkOption {
|
|
description = "Name of the database for Panettone";
|
|
type = types.str;
|
|
default = "panettone";
|
|
};
|
|
|
|
dbUser = mkOption {
|
|
description = "Name of the database user for Panettone";
|
|
type = types.str;
|
|
default = "panettone";
|
|
};
|
|
|
|
secretsFile = mkOption {
|
|
description = ''
|
|
Path to a file containing secrets, in the format accepted
|
|
by systemd's EnvironmentFile
|
|
'';
|
|
type = types.str;
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
assertions = [{
|
|
assertion =
|
|
cfg.dbHost != "localhost" || config.services.postgresql.enable;
|
|
message = "Panettone requires a postgresql database";
|
|
} {
|
|
assertion =
|
|
cfg.dbHost != "localhost" || config.services.postgresql.enableTCPIP;
|
|
message = "Panettone can only connect to the postgresql database over TCP";
|
|
} {
|
|
assertion =
|
|
cfg.dbHost != "localhost" || (lib.any
|
|
(user: user.name == cfg.dbUser)
|
|
config.services.postgresql.ensureUsers);
|
|
message = "Panettone requires a database user";
|
|
} {
|
|
assertion =
|
|
cfg.dbHost != "localhost" || (lib.any
|
|
(db: db == cfg.dbName)
|
|
config.services.postgresql.ensureDatabases);
|
|
message = "Panettone requires a database";
|
|
}];
|
|
|
|
systemd.services.panettone = {
|
|
wantedBy = [ "multi-user.target" ];
|
|
script = "${depot.web.panettone}/bin/panettone";
|
|
|
|
serviceConfig = {
|
|
DynamicUser = true;
|
|
Restart = "always";
|
|
StateDirectory = "panettone";
|
|
EnvironmentFile = cfg.secretsFile;
|
|
};
|
|
|
|
environment = {
|
|
PANETTONE_PORT = toString cfg.port;
|
|
PANETTONE_DATA_DIR = "/var/lib/panettone";
|
|
PGHOST = "localhost";
|
|
PGUSER = cfg.dbUser;
|
|
PGDATABASE = cfg.dbName;
|
|
};
|
|
};
|
|
};
|
|
}
|