tangled.org / core
this repo has no description
fork atom

flake.nix: tangled-knotserver module improvements

Added two additional options:
- stateDir: controls where the knotserver's state should be stored
(defaults to `/home/git` to maintain compatibility with previous configs)
- openFirewall: decides if we should open port 22 for ssh
(defaults to true to maintain compatibility with previous configs)

Made use of config options that weren't being used

Changed the `gitUser` to be a system user instead of a normal user.
This is purely cosmetic and pretty much just keeps the UID and GID
below 1000. If the user and group were already made, NixOS won't
change them so this shouldn't have the possibility of breaking any
existing setups but if the UID and GID are changing, the activation
script that creates the directories should update the owner of all the
state files.

Add short-hand for `config.services.tangled-knotserver`
Instead of typing `config.services.tangled-knotserver` we can now use
`cfg` to refer to the module's options.

authored by yemou.pink and committed by Tangled b5d175fa a4599698

options
unified split
Changed files
+46 -22
flake.nix
+46 -22
flake.nix
··· 230 pkgs, 231 lib, 232 ... 233 - }: 234 with lib; { 235 options = { 236 services.tangled-knotserver = { ··· 252 description = "User that hosts git repos and performs git operations"; 253 }; 254 255 repo = { 256 scanPath = mkOption { 257 type = types.path; 258 - default = "/home/git"; 259 description = "Path where repositories are scanned from"; 260 }; 261 ··· 287 288 dbPath = mkOption { 289 type = types.path; 290 - default = "knotserver.db"; 291 description = "Path to the database file"; 292 }; 293 ··· 306 }; 307 }; 308 309 - config = mkIf config.services.tangled-knotserver.enable { 310 environment.systemPackages = with pkgs; [git]; 311 312 system.activationScripts.gitConfig = '' 313 - mkdir -p /home/git/.config/git 314 - cat > /home/git/.config/git/config << EOF 315 [user] 316 name = Git User 317 email = git@example.com 318 EOF 319 - chown -R git:git /home/git/.config 320 ''; 321 322 - users.users.git = { 323 - isNormalUser = true; 324 - home = "/home/git"; 325 createHome = true; 326 - group = "git"; 327 }; 328 329 - users.groups.git = {}; 330 331 services.openssh = { 332 enable = true; 333 extraConfig = '' 334 - Match User git 335 AuthorizedKeysCommand /etc/ssh/keyfetch_wrapper 336 AuthorizedKeysCommandUser nobody 337 ''; ··· 343 #!${pkgs.stdenv.shell} 344 ${self.packages.${pkgs.system}.keyfetch}/bin/keyfetch \ 345 -repoguard-path ${self.packages.${pkgs.system}.repoguard}/bin/repoguard \ 346 -log-path /tmp/repoguard.log 347 ''; 348 }; ··· 352 after = ["network.target" "sshd.service"]; 353 wantedBy = ["multi-user.target"]; 354 serviceConfig = { 355 - User = "git"; 356 - WorkingDirectory = "/home/git"; 357 Environment = [ 358 - "KNOT_REPO_SCAN_PATH=${config.services.tangled-knotserver.repo.scanPath}" 359 - "APPVIEW_ENDPOINT=${config.services.tangled-knotserver.appviewEndpoint}" 360 - "KNOT_SERVER_INTERNAL_LISTEN_ADDR=${config.services.tangled-knotserver.server.internalListenAddr}" 361 - "KNOT_SERVER_LISTEN_ADDR=${config.services.tangled-knotserver.server.listenAddr}" 362 - "KNOT_SERVER_HOSTNAME=${config.services.tangled-knotserver.server.hostname}" 363 ]; 364 - EnvironmentFile = config.services.tangled-knotserver.server.secretFile; 365 ExecStart = "${self.packages.${pkgs.system}.knotserver}/bin/knotserver"; 366 Restart = "always"; 367 }; 368 }; 369 370 - networking.firewall.allowedTCPPorts = [22]; 371 }; 372 }; 373
··· 230 pkgs, 231 lib, 232 ... 233 + }: let 234 + cfg = config.services.tangled-knotserver; 235 + in 236 with lib; { 237 options = { 238 services.tangled-knotserver = { ··· 254 description = "User that hosts git repos and performs git operations"; 255 }; 256 257 + openFirewall = mkOption { 258 + type = types.bool; 259 + default = true; 260 + description = "Open port 22 in the firewall for ssh"; 261 + }; 262 + 263 + stateDir = mkOption { 264 + type = types.path; 265 + default = "/home/${cfg.gitUser}"; 266 + description = "Tangled knot data directory"; 267 + }; 268 + 269 repo = { 270 scanPath = mkOption { 271 type = types.path; 272 + default = cfg.stateDir; 273 description = "Path where repositories are scanned from"; 274 }; 275 ··· 301 302 dbPath = mkOption { 303 type = types.path; 304 + default = "${cfg.stateDir}/knotserver.db"; 305 description = "Path to the database file"; 306 }; 307 ··· 320 }; 321 }; 322 323 + config = mkIf cfg.enable { 324 environment.systemPackages = with pkgs; [git]; 325 326 system.activationScripts.gitConfig = '' 327 + mkdir -p "${cfg.repo.scanPath}" 328 + chown -R ${cfg.gitUser}:${cfg.gitUser} \ 329 + "${cfg.repo.scanPath}" 330 + 331 + mkdir -p "${cfg.stateDir}/.config/git" 332 + cat > "${cfg.stateDir}/.config/git/config" << EOF 333 [user] 334 name = Git User 335 email = git@example.com 336 EOF 337 + chown -R ${cfg.gitUser}:${cfg.gitUser} \ 338 + "${cfg.stateDir}" 339 ''; 340 341 + users.users.${cfg.gitUser} = { 342 + isSystemUser = true; 343 + useDefaultShell = true; 344 + home = cfg.stateDir; 345 createHome = true; 346 + group = cfg.gitUser; 347 }; 348 349 + users.groups.${cfg.gitUser} = {}; 350 351 services.openssh = { 352 enable = true; 353 extraConfig = '' 354 + Match User ${cfg.gitUser} 355 AuthorizedKeysCommand /etc/ssh/keyfetch_wrapper 356 AuthorizedKeysCommandUser nobody 357 ''; ··· 363 #!${pkgs.stdenv.shell} 364 ${self.packages.${pkgs.system}.keyfetch}/bin/keyfetch \ 365 -repoguard-path ${self.packages.${pkgs.system}.repoguard}/bin/repoguard \ 366 + -internal-api "http://${cfg.server.internalListenAddr}" \ 367 + -git-dir "${cfg.repo.scanPath}" \ 368 -log-path /tmp/repoguard.log 369 ''; 370 }; ··· 374 after = ["network.target" "sshd.service"]; 375 wantedBy = ["multi-user.target"]; 376 serviceConfig = { 377 + User = cfg.gitUser; 378 + WorkingDirectory = cfg.stateDir; 379 Environment = [ 380 + "KNOT_REPO_SCAN_PATH=${cfg.repo.scanPath}" 381 + "KNOT_REPO_MAIN_BRANCH=${cfg.repo.mainBranch}" 382 + "APPVIEW_ENDPOINT=${cfg.appviewEndpoint}" 383 + "KNOT_SERVER_INTERNAL_LISTEN_ADDR=${cfg.server.internalListenAddr}" 384 + "KNOT_SERVER_LISTEN_ADDR=${cfg.server.listenAddr}" 385 + "KNOT_SERVER_DB_PATH=${cfg.server.dbPath}" 386 + "KNOT_SERVER_HOSTNAME=${cfg.server.hostname}" 387 ]; 388 + EnvironmentFile = cfg.server.secretFile; 389 ExecStart = "${self.packages.${pkgs.system}.knotserver}/bin/knotserver"; 390 Restart = "always"; 391 }; 392 }; 393 394 + networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [22]; 395 }; 396 }; 397