tranquil.farm
Added a module and a test file to test it out! Tested locally on qemu
+1
default.nix
+1
default.nix
+8
docs/install-debian.md
+8
docs/install-debian.md
···
175
175
proxy_request_buffering off;
176
176
}
177
177
178
+
location = /oauth/client-metadata.json {
179
+
root /var/www/tranquil-pds;
180
+
default_type application/json;
181
+
sub_filter_once off;
182
+
sub_filter_types application/json;
183
+
sub_filter '__PDS_HOSTNAME__' $host;
184
+
}
185
+
178
186
location /oauth/ {
179
187
proxy_pass http://127.0.0.1:3000;
180
188
proxy_http_version 1.1;
+27
-6
flake.nix
+27
-6
flake.nix
···
7
7
# for now we important that PR as well purely for its fetchDenoDeps
8
8
nixpkgs-fetch-deno.url = "github:aMOPel/nixpkgs/feat/fetchDenoDeps";
9
9
};
10
-
11
-
outputs = { self, nixpkgs, ... } @ inputs : let
12
-
forAllSystems =
13
-
function:
10
+
11
+
outputs = {
12
+
self,
13
+
nixpkgs,
14
+
...
15
+
} @ inputs: let
16
+
forAllSystems = function:
14
17
nixpkgs.lib.genAttrs nixpkgs.lib.systems.flakeExposed (
15
18
system: (function system nixpkgs.legacyPackages.${system})
16
19
);
17
20
in {
18
21
packages = forAllSystems (system: pkgs: {
19
-
tranquil-pds = pkgs.callPackage ./default.nix { };
22
+
tranquil-pds = pkgs.callPackage ./default.nix {};
20
23
tranquil-frontend = pkgs.callPackage ./frontend.nix {
21
24
inherit (inputs.nixpkgs-fetch-deno.legacyPackages.${system}) fetchDenoDeps;
22
25
};
···
24
27
});
25
28
26
29
devShells = forAllSystems (system: pkgs: {
27
-
default = pkgs.callPackage ./shell.nix { };
30
+
default = pkgs.callPackage ./shell.nix {};
28
31
});
32
+
33
+
nixosModules = {
34
+
default = self.nixosModules.tranquil-pds;
35
+
tranquil-pds = {
36
+
_file = "${self.outPath}/flake.nix#nixosModules.tranquil-pds";
37
+
imports = [(import ./module.nix self)];
38
+
};
39
+
};
40
+
41
+
checks.x86_64-linux.integration = import ./test.nix {
42
+
pkgs = nixpkgs.legacyPackages.x86_64-linux;
43
+
inherit self;
44
+
};
45
+
46
+
checks.aarch64-linux.integration = import ./test.nix {
47
+
pkgs = nixpkgs.legacyPackages.aarch64-linux;
48
+
inherit self;
49
+
};
29
50
};
30
51
}
+388
module.nix
+388
module.nix
···
1
+
self:
2
+
{
3
+
lib,
4
+
pkgs,
5
+
config,
6
+
...
7
+
}:
8
+
let
9
+
cfg = config.services.tranquil-pds;
10
+
11
+
inherit (lib) types mkOption;
12
+
13
+
backendUrl = "http://127.0.0.1:${toString cfg.settings.SERVER_PORT}";
14
+
15
+
useACME = cfg.nginx.enableACME && cfg.nginx.useACMEHost == null;
16
+
hasSSL = useACME || cfg.nginx.useACMEHost != null;
17
+
in
18
+
{
19
+
_class = "nixos";
20
+
21
+
options.services.tranquil-pds = {
22
+
enable = lib.mkEnableOption "tranquil-pds AT Protocol personal data server";
23
+
24
+
package = mkOption {
25
+
type = types.package;
26
+
default = self.packages.${pkgs.stdenv.hostPlatform.system}.tranquil-pds;
27
+
defaultText = lib.literalExpression "self.packages.\${pkgs.stdenv.hostPlatform.system}.tranquil-pds";
28
+
description = "The tranquil-pds package to use";
29
+
};
30
+
31
+
user = mkOption {
32
+
type = types.str;
33
+
default = "tranquil-pds";
34
+
description = "User under which tranquil-pds runs";
35
+
};
36
+
37
+
group = mkOption {
38
+
type = types.str;
39
+
default = "tranquil-pds";
40
+
description = "Group under which tranquil-pds runs";
41
+
};
42
+
43
+
dataDir = mkOption {
44
+
type = types.str;
45
+
default = "/var/lib/tranquil-pds";
46
+
description = "Directory for tranquil-pds data (blobs, backups)";
47
+
};
48
+
49
+
environmentFiles = mkOption {
50
+
type = types.listOf types.path;
51
+
default = [ ];
52
+
description = ''
53
+
File to load environment variables from. Loaded variables override
54
+
values set in {option}`environment`.
55
+
56
+
Use it to set values of `JWT_SECRET`, `DPOP_SECRET` and `MASTER_KEY`.
57
+
58
+
Generate these with:
59
+
```
60
+
openssl rand --hex 32
61
+
```
62
+
'';
63
+
};
64
+
65
+
database.createLocally = mkOption {
66
+
type = types.bool;
67
+
default = false;
68
+
description = ''
69
+
Create the postgres database and user on the local host.
70
+
'';
71
+
};
72
+
73
+
frontend.package = mkOption {
74
+
type = types.nullOr types.package;
75
+
default = self.packages.${pkgs.stdenv.hostPlatform.system}.tranquil-frontend;
76
+
defaultText = lib.literalExpression "self.packages.\${pkgs.stdenv.hostPlatform.system}.tranquil-frontend";
77
+
description = "Frontend package to serve via nginx (set null to disable frontend)";
78
+
};
79
+
80
+
nginx = {
81
+
enable = lib.mkEnableOption "nginx reverse proxy for tranquil-pds";
82
+
83
+
enableACME = mkOption {
84
+
type = types.bool;
85
+
default = true;
86
+
description = "Enable ACME for the pds domain";
87
+
};
88
+
89
+
useACMEHost = mkOption {
90
+
type = types.nullOr types.str;
91
+
default = null;
92
+
description = ''
93
+
Use a pre-configured ACME certificate instead of generating one.
94
+
Set this to the cert name from security.acme.certs for wildcard setups.
95
+
96
+
REMEMBER: Handle subdomains (*.pds.example.com) require a wildcard cert via DNS-01.
97
+
'';
98
+
};
99
+
};
100
+
101
+
settings = mkOption {
102
+
type = types.submodule {
103
+
freeformType = types.attrsOf (
104
+
types.nullOr (
105
+
types.oneOf [
106
+
types.str
107
+
types.path
108
+
types.int
109
+
]
110
+
)
111
+
);
112
+
113
+
options = {
114
+
SERVER_HOST = mkOption {
115
+
type = types.str;
116
+
default = "127.0.0.1";
117
+
description = "Host for tranquil-pds to listen on";
118
+
};
119
+
120
+
SERVER_PORT = mkOption {
121
+
type = types.int;
122
+
default = 3000;
123
+
description = "Port for tranquil-pds to listen on";
124
+
};
125
+
126
+
PDS_HOSTNAME = mkOption {
127
+
type = types.nullOr types.str;
128
+
default = null;
129
+
example = "pds.example.com";
130
+
description = "The public-facing hostname of the PDS";
131
+
};
132
+
133
+
BLOB_STORAGE_PATH = mkOption {
134
+
type = types.path;
135
+
default = "/var/lib/tranquil-pds/blobs";
136
+
description = "Directory for storing blobs";
137
+
};
138
+
139
+
BACKUP_STORAGE_PATH = mkOption {
140
+
type = types.path;
141
+
default = "/var/lib/tranquil-pds/backups";
142
+
description = "Directory for storing backups";
143
+
};
144
+
145
+
MAIL_FROM_ADDRESS = mkOption {
146
+
type = types.nullOr types.str;
147
+
default = null;
148
+
description = "Email address to use in the From header when sending emails.";
149
+
};
150
+
151
+
SENDMAIL_PATH = mkOption {
152
+
type = types.path;
153
+
default = lib.getExe pkgs.system-sendmail;
154
+
description = "Path to the sendmail executable to use for sending emails.";
155
+
};
156
+
157
+
SIGNAL_SENDER_NUMBER = mkOption {
158
+
type = types.nullOr types.str;
159
+
default = null;
160
+
description = "Phone number (in international format) to use for sending Signal notifications.";
161
+
};
162
+
163
+
SIGNAL_CLI_PATH = mkOption {
164
+
type = types.path;
165
+
default = lib.getExe pkgs.signal-cli;
166
+
description = "Path to the signal-cli executable to use for sending Signal notifications.";
167
+
};
168
+
169
+
MAX_BLOB_SIZE = mkOption {
170
+
type = types.int;
171
+
default = 10737418240; # 10 GiB
172
+
description = "Maximum allowed blob size in bytes.";
173
+
};
174
+
};
175
+
};
176
+
177
+
description = ''
178
+
Environment variables to set for the service. Secrets should be
179
+
specified using {option}`environmentFile`.
180
+
181
+
Refer to <https://tangled.org/tranquil.farm/tranquil-pds/blob/main/.env.example>
182
+
available environment variables.
183
+
'';
184
+
};
185
+
};
186
+
187
+
config = lib.mkIf cfg.enable (
188
+
lib.mkMerge [
189
+
(lib.mkIf cfg.database.createLocally {
190
+
services.postgresql = {
191
+
enable = true;
192
+
ensureDatabases = [ cfg.user ];
193
+
ensureUsers = [
194
+
{
195
+
name = cfg.user;
196
+
ensureDBOwnership = true;
197
+
}
198
+
];
199
+
};
200
+
201
+
services.tranquil-pds.settings.DATABASE_URL = lib.mkDefault "postgresql:///${cfg.user}?host=/run/postgresql";
202
+
203
+
systemd.services.tranquil-pds = {
204
+
requires = [ "postgresql.service" ];
205
+
after = [ "postgresql.service" ];
206
+
};
207
+
})
208
+
209
+
(lib.mkIf cfg.nginx.enable {
210
+
services.nginx = {
211
+
enable = true;
212
+
213
+
virtualHosts.${cfg.settings.PDS_HOSTNAME} = {
214
+
serverAliases = [ "*.${cfg.settings.PDS_HOSTNAME}" ];
215
+
forceSSL = hasSSL;
216
+
enableACME = useACME;
217
+
useACMEHost = cfg.nginx.useACMEHost;
218
+
219
+
root = lib.mkIf (cfg.frontend.package != null) cfg.frontend.package;
220
+
221
+
extraConfig = "client_max_body_size ${toString cfg.settings.MAX_BLOB_SIZE};";
222
+
223
+
locations = lib.mkMerge [
224
+
{
225
+
"/xrpc/" = {
226
+
proxyPass = backendUrl;
227
+
proxyWebsockets = true;
228
+
extraConfig = ''
229
+
proxy_read_timeout 86400;
230
+
proxy_send_timeout 86400;
231
+
proxy_buffering off;
232
+
proxy_request_buffering off;
233
+
'';
234
+
};
235
+
236
+
"/oauth/" = {
237
+
proxyPass = backendUrl;
238
+
extraConfig = ''
239
+
proxy_read_timeout 300;
240
+
proxy_send_timeout 300;
241
+
'';
242
+
};
243
+
244
+
"/.well-known/" = {
245
+
proxyPass = backendUrl;
246
+
};
247
+
248
+
"/webhook/" = {
249
+
proxyPass = backendUrl;
250
+
};
251
+
252
+
"= /metrics" = {
253
+
proxyPass = backendUrl;
254
+
};
255
+
256
+
"= /health" = {
257
+
proxyPass = backendUrl;
258
+
};
259
+
260
+
"= /robots.txt" = {
261
+
proxyPass = backendUrl;
262
+
};
263
+
264
+
"= /logo" = {
265
+
proxyPass = backendUrl;
266
+
};
267
+
268
+
"~ ^/u/[^/]+/did\\.json$" = {
269
+
proxyPass = backendUrl;
270
+
};
271
+
}
272
+
273
+
(lib.optionalAttrs (cfg.frontend.package != null) {
274
+
"= /oauth/client-metadata.json" = {
275
+
root = "${cfg.frontend.package}";
276
+
extraConfig = ''
277
+
default_type application/json;
278
+
sub_filter_once off;
279
+
sub_filter_types application/json;
280
+
sub_filter '__PDS_HOSTNAME__' $host;
281
+
'';
282
+
};
283
+
284
+
"/assets/" = {
285
+
# TODO: use `add_header_inherit` when nixpkgs updates to nginx 1.29.3+
286
+
extraConfig = ''
287
+
expires 1y;
288
+
add_header Cache-Control "public, immutable";
289
+
'';
290
+
tryFiles = "$uri =404";
291
+
};
292
+
293
+
"/app/" = {
294
+
tryFiles = "$uri $uri/ /index.html";
295
+
};
296
+
297
+
"= /" = {
298
+
tryFiles = "/homepage.html /index.html";
299
+
};
300
+
301
+
"/" = {
302
+
tryFiles = "$uri $uri/ /index.html";
303
+
priority = 9999;
304
+
};
305
+
})
306
+
];
307
+
};
308
+
};
309
+
})
310
+
311
+
{
312
+
users.users.${cfg.user} = {
313
+
isSystemUser = true;
314
+
inherit (cfg) group;
315
+
home = cfg.dataDir;
316
+
};
317
+
318
+
users.groups.${cfg.group} = { };
319
+
320
+
systemd.tmpfiles.settings."tranquil-pds" =
321
+
lib.genAttrs
322
+
[
323
+
cfg.dataDir
324
+
cfg.settings.BLOB_STORAGE_PATH
325
+
cfg.settings.BACKUP_STORAGE_PATH
326
+
]
327
+
(_: {
328
+
d = {
329
+
mode = "0750";
330
+
inherit (cfg) user group;
331
+
};
332
+
});
333
+
334
+
systemd.services.tranquil-pds = {
335
+
description = "Tranquil PDS - AT Protocol Personal Data Server";
336
+
after = [ "network-online.target" ];
337
+
wants = [ "network-online.target" ];
338
+
wantedBy = [ "multi-user.target" ];
339
+
340
+
serviceConfig = {
341
+
User = cfg.user;
342
+
Group = cfg.group;
343
+
ExecStart = lib.getExe cfg.package;
344
+
Restart = "on-failure";
345
+
RestartSec = 5;
346
+
347
+
WorkingDirectory = cfg.dataDir;
348
+
StateDirectory = "tranquil-pds";
349
+
350
+
EnvironmentFile = cfg.environmentFiles;
351
+
Environment = lib.mapAttrsToList (k: v: "${k}=${if builtins.isInt v then toString v else v}") (
352
+
lib.filterAttrs (k: v:
353
+
if k == "SENDMAIL_PATH" then cfg.settings.MAIL_FROM_ADDRESS != null
354
+
else if k == "SIGNAL_CLI_PATH" then cfg.settings.SIGNAL_SENDER_NUMBER != null
355
+
else v != null
356
+
) cfg.settings
357
+
);
358
+
359
+
NoNewPrivileges = true;
360
+
ProtectSystem = "strict";
361
+
ProtectHome = true;
362
+
PrivateTmp = true;
363
+
PrivateDevices = true;
364
+
ProtectKernelTunables = true;
365
+
ProtectKernelModules = true;
366
+
ProtectControlGroups = true;
367
+
RestrictAddressFamilies = [
368
+
"AF_INET"
369
+
"AF_INET6"
370
+
"AF_UNIX"
371
+
];
372
+
RestrictNamespaces = true;
373
+
LockPersonality = true;
374
+
MemoryDenyWriteExecute = true;
375
+
RestrictRealtime = true;
376
+
RestrictSUIDSGID = true;
377
+
RemoveIPC = true;
378
+
379
+
ReadWritePaths = [
380
+
cfg.settings.BLOB_STORAGE_PATH
381
+
cfg.settings.BACKUP_STORAGE_PATH
382
+
];
383
+
};
384
+
};
385
+
}
386
+
]
387
+
);
388
+
}
+258
test.nix
+258
test.nix
···
1
+
{
2
+
pkgs,
3
+
self,
4
+
...
5
+
}:
6
+
pkgs.testers.nixosTest {
7
+
name = "tranquil-pds";
8
+
9
+
nodes.server = {
10
+
config,
11
+
pkgs,
12
+
...
13
+
}: {
14
+
imports = [self.nixosModules.default];
15
+
16
+
services.tranquil-pds = {
17
+
enable = true;
18
+
database.createLocally = true;
19
+
20
+
nginx = {
21
+
enable = true;
22
+
enableACME = false;
23
+
};
24
+
25
+
settings = {
26
+
PDS_HOSTNAME = "pds.test";
27
+
SERVER_HOST = "0.0.0.0";
28
+
29
+
DISABLE_RATE_LIMITING = 1;
30
+
TRANQUIL_PDS_ALLOW_INSECURE_SECRETS = 1;
31
+
32
+
JWT_SECRET="test-jwt-secret-must-be-32-chars-long";
33
+
DPOP_SECRET="test-dpop-secret-must-be-32-chars-long";
34
+
MASTER_KEY="test-master-key-must-be-32-chars-long";
35
+
};
36
+
};
37
+
};
38
+
39
+
testScript = ''
40
+
import json
41
+
42
+
server.wait_for_unit("postgresql.service")
43
+
server.wait_for_unit("tranquil-pds.service")
44
+
server.wait_for_unit("nginx.service")
45
+
server.wait_for_open_port(3000)
46
+
server.wait_for_open_port(80)
47
+
48
+
def xrpc(method, endpoint, *, headers=None, data=None, raw_body=None, via="nginx"):
49
+
host_header = "-H 'Host: pds.test'" if via == "nginx" else ""
50
+
base = "http://localhost" if via == "nginx" else "http://localhost:3000"
51
+
url = f"{base}/xrpc/{endpoint}"
52
+
53
+
parts = ["curl", "-sf", "-X", method, host_header]
54
+
if headers:
55
+
parts.extend(f"-H '{k}: {v}'" for k, v in headers.items())
56
+
if data is not None:
57
+
parts.append("-H 'Content-Type: application/json'")
58
+
parts.append(f"-d '{json.dumps(data)}'")
59
+
if raw_body:
60
+
parts.append(f"--data-binary @{raw_body}")
61
+
parts.append(f"'{url}'")
62
+
63
+
return server.succeed(" ".join(parts))
64
+
65
+
def xrpc_json(method, endpoint, **kwargs):
66
+
return json.loads(xrpc(method, endpoint, **kwargs))
67
+
68
+
def xrpc_status(endpoint, *, headers=None, via="nginx"):
69
+
host_header = "-H 'Host: pds.test'" if via == "nginx" else ""
70
+
base = "http://localhost" if via == "nginx" else "http://localhost:3000"
71
+
url = f"{base}/xrpc/{endpoint}"
72
+
73
+
parts = ["curl", "-s", "-o", "/dev/null", "-w", "'%{http_code}'", host_header]
74
+
if headers:
75
+
parts.extend(f"-H '{k}: {v}'" for k, v in headers.items())
76
+
parts.append(f"'{url}'")
77
+
78
+
return server.succeed(" ".join(parts)).strip()
79
+
80
+
def http_status(path, *, host="pds.test", via="nginx"):
81
+
base = "http://localhost" if via == "nginx" else "http://localhost:3000"
82
+
return server.succeed(
83
+
f"curl -s -o /dev/null -w '%{{http_code}}' -H 'Host: {host}' '{base}{path}'"
84
+
).strip()
85
+
86
+
def http_get(path, *, host="pds.test"):
87
+
return server.succeed(
88
+
f"curl -sf -H 'Host: {host}' 'http://localhost{path}'"
89
+
)
90
+
91
+
def http_header(path, header, *, host="pds.test"):
92
+
return server.succeed(
93
+
f"curl -sI -H 'Host: {host}' 'http://localhost{path}'"
94
+
f" | grep -i '^{header}:'"
95
+
).strip()
96
+
97
+
# --- testing that stuff is up in general ---
98
+
99
+
with subtest("service is running"):
100
+
status = server.succeed("systemctl is-active tranquil-pds")
101
+
assert "active" in status
102
+
103
+
with subtest("data directories exist"):
104
+
server.succeed("test -d /var/lib/tranquil-pds/blobs")
105
+
server.succeed("test -d /var/lib/tranquil-pds/backups")
106
+
107
+
with subtest("postgres database created"):
108
+
server.succeed("sudo -u tranquil-pds psql -d tranquil-pds -c 'SELECT 1'")
109
+
110
+
with subtest("healthcheck via backend"):
111
+
xrpc("GET", "_health", via="backend")
112
+
113
+
with subtest("healthcheck via nginx"):
114
+
xrpc("GET", "_health")
115
+
116
+
with subtest("describeServer"):
117
+
desc = xrpc_json("GET", "com.atproto.server.describeServer")
118
+
assert "availableUserDomains" in desc
119
+
assert "did" in desc
120
+
assert desc.get("inviteCodeRequired") == False
121
+
122
+
with subtest("nginx serves frontend"):
123
+
result = server.succeed("curl -sf -H 'Host: pds.test' http://localhost/")
124
+
assert "<html" in result.lower() or "<!" in result
125
+
126
+
with subtest("well-known proxied"):
127
+
code = http_status("/.well-known/atproto-did")
128
+
assert code != "502" and code != "504", f"well-known proxy broken: {code}"
129
+
130
+
with subtest("health endpoint proxied"):
131
+
code = http_status("/health")
132
+
assert code != "404" and code != "502", f"/health not proxied: {code}"
133
+
134
+
with subtest("robots.txt proxied"):
135
+
code = http_status("/robots.txt")
136
+
assert code != "404" and code != "502", f"/robots.txt not proxied: {code}"
137
+
138
+
with subtest("metrics endpoint proxied"):
139
+
code = http_status("/metrics")
140
+
assert code != "502", f"/metrics not proxied: {code}"
141
+
142
+
with subtest("oauth path proxied"):
143
+
code = http_status("/oauth/.well-known/openid-configuration")
144
+
assert code != "502" and code != "504", f"oauth proxy broken: {code}"
145
+
146
+
with subtest("subdomain routing works"):
147
+
code = http_status("/xrpc/_health", host="alice.pds.test")
148
+
assert code == "200", f"subdomain routing failed: {code}"
149
+
150
+
with subtest("client-metadata.json served with host substitution"):
151
+
meta_raw = http_get("/oauth/client-metadata.json")
152
+
meta = json.loads(meta_raw)
153
+
assert "client_id" in meta, f"no client_id in client-metadata: {meta}"
154
+
assert "pds.test" in meta_raw, "host substitution did not apply"
155
+
156
+
with subtest("static assets location exists"):
157
+
code = http_status("/assets/nonexistent.js")
158
+
assert code == "404", f"expected 404 for missing asset, got {code}"
159
+
160
+
with subtest("spa fallback works"):
161
+
code = http_status("/app/some/deep/route")
162
+
assert code == "200", f"SPA fallback broken: {code}"
163
+
164
+
with subtest("firewall ports open"):
165
+
server.succeed("ss -tlnp | grep ':80 '")
166
+
server.succeed("ss -tlnp | grep ':3000 '")
167
+
168
+
# --- test little bit of an account lifecycle ---
169
+
170
+
with subtest("create account"):
171
+
account = xrpc_json("POST", "com.atproto.server.createAccount", data={
172
+
"handle": "alice",
173
+
"password": "NixOS-Test-Pass-99!",
174
+
"email": "alice@pds.test",
175
+
"didType": "web",
176
+
})
177
+
assert "accessJwt" in account, f"no accessJwt: {account}"
178
+
assert "did" in account, f"no did: {account}"
179
+
access_token = account["accessJwt"]
180
+
did = account["did"]
181
+
assert did.startswith("did:web:"), f"expected did:web, got {did}"
182
+
183
+
with subtest("mark account verified"):
184
+
server.succeed(
185
+
f"sudo -u tranquil-pds psql -d tranquil-pds "
186
+
f"-c \"UPDATE users SET email_verified = true WHERE did = '{did}'\""
187
+
)
188
+
189
+
auth = {"Authorization": f"Bearer {access_token}"}
190
+
191
+
with subtest("get session"):
192
+
session = xrpc_json("GET", "com.atproto.server.getSession", headers=auth)
193
+
assert session["did"] == did
194
+
assert session["handle"] == "alice.pds.test", f"unexpected handle: {session['handle']}"
195
+
196
+
with subtest("create record"):
197
+
created = xrpc_json("POST", "com.atproto.repo.createRecord", headers=auth, data={
198
+
"repo": did,
199
+
"collection": "app.bsky.feed.post",
200
+
"record": {
201
+
"$type": "app.bsky.feed.post",
202
+
"text": "hello from lewis silly nix integration test",
203
+
"createdAt": "2025-01-01T00:00:00.000Z",
204
+
},
205
+
})
206
+
assert "uri" in created, f"no uri: {created}"
207
+
assert "cid" in created, f"no cid: {created}"
208
+
record_uri = created["uri"]
209
+
record_cid = created["cid"]
210
+
rkey = record_uri.split("/")[-1]
211
+
212
+
with subtest("read record back"):
213
+
fetched = xrpc_json(
214
+
"GET",
215
+
f"com.atproto.repo.getRecord?repo={did}&collection=app.bsky.feed.post&rkey={rkey}",
216
+
)
217
+
assert fetched["uri"] == record_uri
218
+
assert fetched["cid"] == record_cid
219
+
assert fetched["value"]["text"] == "hello from lewis silly nix integration test"
220
+
221
+
with subtest("upload blob"):
222
+
server.succeed("dd if=/dev/urandom bs=1024 count=4 of=/tmp/testblob.bin 2>/dev/null")
223
+
blob_resp = xrpc_json(
224
+
"POST",
225
+
"com.atproto.repo.uploadBlob",
226
+
headers={**auth, "Content-Type": "application/octet-stream"},
227
+
raw_body="/tmp/testblob.bin",
228
+
)
229
+
assert "blob" in blob_resp, f"no blob: {blob_resp}"
230
+
blob_ref = blob_resp["blob"]
231
+
assert blob_ref["size"] == 4096
232
+
233
+
with subtest("export repo as car"):
234
+
server.succeed(
235
+
f"curl -sf -H 'Host: pds.test' "
236
+
f"-o /tmp/repo.car "
237
+
f"'http://localhost/xrpc/com.atproto.sync.getRepo?did={did}'"
238
+
)
239
+
size = int(server.succeed("stat -c%s /tmp/repo.car").strip())
240
+
assert size > 0, "exported car is empty"
241
+
242
+
with subtest("delete record"):
243
+
xrpc_json("POST", "com.atproto.repo.deleteRecord", headers=auth, data={
244
+
"repo": did,
245
+
"collection": "app.bsky.feed.post",
246
+
"rkey": rkey,
247
+
})
248
+
249
+
with subtest("deleted record gone"):
250
+
code = xrpc_status(
251
+
f"com.atproto.repo.getRecord?repo={did}&collection=app.bsky.feed.post&rkey={rkey}",
252
+
)
253
+
assert code != "200", f"expected non-200 for deleted record, got {code}"
254
+
255
+
with subtest("service still healthy after lifecycle"):
256
+
xrpc("GET", "_health")
257
+
'';
258
+
}
History
8 rounds
13 comments
6 commits
expand
collapse
feat: nix module
fix: better defaults, add in pg & nginx
feat: actual good config from Isabel
fix: set env vars of paths for sendmail & signal from nix pkg not manual
refactor(nix): toml conf
fix: minor format cleanup and description fixing in the module
expand 0 comments
pull request successfully merged
6 commits
expand
collapse
feat: nix module
fix: better defaults, add in pg & nginx
feat: actual good config from Isabel
fix: set env vars of paths for sendmail & signal from nix pkg not manual
refactor(nix): toml conf
fix: minor format cleanup and description fixing in the module
expand 0 comments
expand 0 comments
expand 0 comments
expand 0 comments
expand 5 comments
https://search.nixos.org/packages?channel=25.11&show=system-sendmail&query=sendmail
^ You should probably also consider using system-sendmail which looks in a few places rather than your own best-guess sendmail path
The starred alias in nginx should really be tied to availableUserDomains rather than the hostname
I'm not a huge fan of some of the nginx stuff you're doing - recommendedProxySettings, etc. are good settings but you're leaking config outside the module which might change stuff for other modules. It might be better to enable recommendedProxySettings per-location and then setup whatever settings for the other categories you feel work best for tranquil in a lower scope...
...on a similar note, openFirewall tends to default to false to avoid unknowingly opening ports in firewalls that you didn't mean to
openFirewall tends to default to false
(I think there's one place in nixpkgs this isn't true - and it's with SSH to avoid making stuff unreachable unexpectedly)
7 commits
expand
collapse
feat: nix module
feat: fun handle resolution during migration
feat: initial in-house cache distribution
feat: cache locks less
fix: smaller docker img
fix: removed some bs
fix: better defaults, add in pg & nginx
expand 7 comments
Is there any reason the package doesn't seem to default to packages.tranquil-pds from this flake? I think it might be kinda nice if it did... (though I guess it would mean you have to have a reference to the flake in your module - that shouldn't really be much of a problem though)
What's the default for settings.storage.blobPath - is it actually null? what happens if I leave the blob backend as filesystem and then this as null? Could we default it in terms of dataDir (as I suspect it must really be) so that it's easier to introspect or could we put what this'll be in the description of the option
Why is backup.backend set in the test file - given it has the same value as the default and backups aren't enabled by default (or are they? they're set to null?) ... is this a mistake or something else? blobBackend is also set to its default but this is a little more understandable incase the default were to change/etc.
I also wonder if backup.enabled should be called backup.enable and should be a mkEnableOption rather than what you are doing here...... it seems quite unidiomatic
You're using optional types in a bunch of places. I'm going to assume that they are being set as overrides to some other config that is secretly elsewhere (e.g. plc.directoryUrl)... it would be much more idiomatic to have these required and have the true defaults in nix
Can you default sendmailPath (and signal CLI path) to whatever it should be from nixpkgs? I think that'd be nice :) - you need to make sure these options don't get evaluated unless mail or signal is enabled respectively
Thanks for all the comments! I am no nix connoisseur and i'll read through carefully and try to fix
Generally much better! I'll go through with a more fine-toothed comb at some point, but one immediate comment is that you should probably be using lib.mkEnableOption rather than lib.mkOption for your enable options - it's more idiomatic.
I'd also be interested in seeing your default paths for sendmail and signal moved up (and the options can be made no longer nullOr in that case too) - remember that in Nix nothing is evaluated unless you actually look at it, so as long as you check that email/signal are enabled when you place those options into the environment file (e.g. with mkIf) then this still needn't cause a dependency when it's not desirable...