betanin: format files

modules/services/web-apps/betanin.nix

@@ -1,17 +1,47 @@
 { config, lib, pkgs, ... }:
 
 let
-  inherit (lib) mkIf mkOption optionalAttrs types;
+  inherit (lib) mkIf mkOption optionalAttrs optionalString types;
   cfg = config.services.betanin;
 
-  yaml = pkgs.formats.yaml { };
-  configFile =
-    if (cfg.beetsConfigFile != null)
-    then cfg.beetsConfigFile
-    else yaml.generate "beets-config.yaml" cfg.beetsConfig;
-
   defaultUser = "betanin";
   defaultGroup = "betanin";
+  defaultSettings = {
+    notifications = {
+      services = { };
+      strings = {
+        title = "[betanin] torrent `$name` $status";
+        body = "@ $time. view/use the console at http://127.0.0.1:${toString cfg.port}/$console_path";
+      };
+    };
+  };
+
+  finalSettings =
+    let
+      base = lib.filterAttrsRecursive (n: _: !(lib.hasSuffix "_file" n)) cfg.settings;
+      clean = {
+        frontend.password =
+          if cfg.settings.frontend.password_file != null
+          then "@password@"
+          else cfg.settings.frontend.password;
+        clients.api_key =
+          if cfg.settings.clients.api_key_file != null
+          then "@api_key@"
+          else cfg.settings.clients.api_key;
+      };
+    in
+    lib.foldl' lib.recursiveUpdate defaultSettings [ base clean ];
+
+  settingsFormat = pkgs.formats.toml { };
+  settingsFile = settingsFormat.generate "betanin.toml" finalSettings;
+
+  beetsFormat = pkgs.formats.yaml { };
+  beetsFile =
+    if (cfg.beetsFile != null)
+    then cfg.beetsFile
+    else if (cfg.beetsConfig != { })
+    then beetsFormat.generate "betanin-beets.yaml" cfg.beetsConfig
+    else null;
 in
 {
   options = {
@@ -54,42 +84,149 @@ in
         default = "/var/lib/betanin";
       };
 
+      settings = mkOption {
+        type = types.submodule {
+          freeformType = settingsFormat.type;
+
+          options.frontend.username = mkOption {
+            type = types.str;
+            default = "";
+            description = "Username used to log into the frontend. Must be set.";
+          };
+
+          options.frontend.password = mkOption {
+            type = types.str;
+            default = "";
+            description = ''
+              Password used to log into the frontend. Either password or
+              password_file must be set.
+            '';
+          };
+
+          options.frontend.password_file = mkOption {
+            type = with types; nullOr (either str path);
+            default = null;
+            description = ''
+              File containing the password used to log into the frontend. The
+              file must be readable by the betanin user/group.
+
+              Using a password file keeps the password out of the Nix store, but
+              the password is still stored in plain text in the service data
+              directory.
+            '';
+          };
+
+          options.clients.api_key = mkOption {
+            type = types.nullOr types.str;
+            default = "";
+            description = ''
+              API key used to access Betanin (e.g., from other services).
+            '';
+          };
+
+          options.clients.api_key_file = mkOption {
+            type = with types; nullOr (either str path);
+            default = null;
+            description = ''
+              File containing the API key used to access Betanin (e.g., from
+              other services). The file must be readable by the betanin
+              user/group.
+
+              Using a API key file keeps the API key out of the Nix store, but
+              the API key is still stored in plain text in the service data
+              directory.
+            '';
+          };
+        };
+        default = defaultSettings;
+        example = lib.literalExpression ''
+          {
+            frontend = {
+              username = "foo";
+              password_file = "/run/secrets/betaninPasswordFile";
+            };
+            clients = {
+              api_key_file = "/run/secrets/betaninApiKeyFile";
+            };
+            server = {
+              num_parallel_jobs = 1;
+            };
+          }
+        '';
+        description = "Configuration for betanin.";
+      };
+
       beetsConfig = mkOption {
         description = "beets configuration.";
-        type = yaml.type;
+        type = beetsFormat.type;
         default = { };
       };
 
-      beetsConfigFile = mkOption {
+      beetsFile = mkOption {
         description = "beets configuration file.";
-        type = nullOr (either str path);
+        type = with types; nullOr (either str path);
         default = null;
       };
     };
   };
 
   config = mkIf cfg.enable {
-    assertions = [{
+    assertions = [
-      assertion = (cfg.beetsConfig == { }) != (cfg.beetsConfigFile == null);
+      {
-      message = "either services.betanin.beetsConfig or services.betanin.beetsConfigFile is required";
+        assertion = cfg.settings.frontend.username != "";
-    }];
+        message = "services.betanin.settings.frontend.username is required";
+      }
+      {
+        assertion = (cfg.settings.frontend.password == "") != (cfg.settings.frontend.password_file == null);
+        message = "services.betanin.settings.frontend.password or services.betanin.settings.frontend.password_file is required";
+      }
+      {
+        assertion = (cfg.settings.clients.api_key == "") != (cfg.settings.clients.api_key_file == null);
+        message = "services.betanin.settings.clients.api_key or services.betanin.settings.clients.api_key_file is required";
+      }
+    ];
 
     networking.firewall = mkIf cfg.openFirewall {
       allowedTCPPorts = [ cfg.port ];
     };
 
-    systemd.services.betanin = {
+    systemd.services.betanin =
+      let
+        replaceSecret = secretFile: placeholder: targetFile:
+          optionalString (secretFile != null) ''
+            ${pkgs.replace-secret}/bin/replace-secret ${placeholder} ${secretFile} ${targetFile}
+          '';
+        replaceConfigSecret = secretFile: placeholder:
+          replaceSecret secretFile placeholder "${cfg.dataDir}/.config/betanin/config.toml";
+      in
+      {
         description = "Betanin service";
         wantedBy = [ "multi-user.target" ];
         after = [ "networking.target" ];
         environment = {
           HOME = cfg.dataDir;
         };
+        path = [ pkgs.replace-secret ];
+
+        script = ''
+          mkdir -p ${cfg.dataDir}/.config/betanin \
+            ${cfg.dataDir}/.config/beets \
+            ${cfg.dataDir}/.local/share/betanin
+          cat ${settingsFile} > ${cfg.dataDir}/.config/betanin/config.toml
+
+          ${optionalString (beetsFile != null) ''
+            ln -sf ${beetsFile} ${cfg.dataDir}/.config/betanin/config.toml
+          ''}
+          ${replaceConfigSecret cfg.settings.frontend.password_file "@password@"}
+          ${replaceConfigSecret cfg.settings.frontend.api_key_file "@api_key@"}
+
+          ${cfg.package}/bin/betanin --port ${toString cfg.port}
+        '';
+
         serviceConfig = lib.mkMerge [
           {
             User = cfg.user;
             Group = cfg.group;
-          ExecStart = "${cfg.package}/bin/betanin --port ${cfg.port}";
             PrivateTmp = true;
             Restart = "always";
             WorkingDirectory = cfg.dataDir;

pkgs/by-name/be/betanin/client/composition.nix

@@ -1,8 +1,11 @@
 # This file has been generated by node2nix 1.11.1. Do not edit!
 
-{pkgs ? import <nixpkgs> {
+{ pkgs ? import <nixpkgs> {
     inherit system;
-  }, system ? builtins.currentSystem, nodejs ? pkgs."nodejs_18"}:
+  }
+, system ? builtins.currentSystem
+, nodejs ? pkgs."nodejs_18"
+}:
 
 let
   nodeEnv = import ./node-env.nix {

pkgs/by-name/be/betanin/client/node-env.nix

@@ -1,6 +1,6 @@
 # This file originates from node2nix
 
-{lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile, writeShellScript}:
+{ lib, stdenv, nodejs, python2, pkgs, libtool, runCommand, writeTextFile, writeShellScript }:
 
 let
   # Workaround to cope with utillinux in Nixpkgs 20.09 and util-linux in Nixpkgs master
@@ -9,7 +9,7 @@ let
   python = if nodejs ? python then nodejs.python else python2;
 
   # Create a tar wrapper that filters all the 'Ignoring unknown extended header keyword' noise
-  tarWrapper = runCommand "tarWrapper" {} ''
+  tarWrapper = runCommand "tarWrapper" { } ''
     mkdir -p $out/bin
 
     cat > $out/bin/tar <<EOF
@@ -90,26 +90,28 @@ let
   # Bundle the dependencies of the package
   #
   # Only include dependencies if they don't exist. They may also be bundled in the package.
-  includeDependencies = {dependencies}:
+  includeDependencies = { dependencies }:
-    lib.optionalString (dependencies != []) (
+    lib.optionalString (dependencies != [ ]) (
       ''
         mkdir -p node_modules
         cd node_modules
       ''
-      + (lib.concatMapStrings (dependency:
+      + (lib.concatMapStrings
+        (dependency:
           ''
             if [ ! -e "${dependency.packageName}" ]; then
                 ${composePackage dependency}
             fi
           ''
-      ) dependencies)
+        )
+        dependencies)
       + ''
         cd ..
       ''
     );
 
   # Recursively composes the dependencies of a package
-  composePackage = { name, packageName, src, dependencies ? [], ... }@args:
+  composePackage = { name, packageName, src, dependencies ? [ ], ... }@args:
     builtins.addErrorContext "while evaluating node package '${packageName}'" ''
       installPackage "${packageName}" "${src}"
       ${includeDependencies { inherit dependencies; }}
@@ -117,7 +119,7 @@ let
       ${lib.optionalString (builtins.substring 0 1 packageName == "@") "cd .."}
     '';
 
-  pinpointDependencies = {dependencies, production}:
+  pinpointDependencies = { dependencies, production }:
     let
       pinpointDependenciesFromPackageJSON = writeTextFile {
         name = "pinpointDependencies.js";
@@ -194,7 +196,7 @@ let
   # dependencies in the package.json file to the versions that are actually
   # being used.
 
-  pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args:
+  pinpointDependenciesOfPackage = { packageName, dependencies ? [ ], production ? true, ... }@args:
     ''
       if [ -d "${packageName}" ]
       then
@@ -207,7 +209,7 @@ let
 
   # Extract the Node.js source code which is used to compile packages with
   # native bindings
-  nodeSources = runCommand "node-sources" {} ''
+  nodeSources = runCommand "node-sources" { } ''
     tar --no-same-owner --no-same-permissions -xf ${nodejs.src}
     mv node-* $out
   '';
@@ -414,7 +416,7 @@ let
     '';
   };
 
-  prepareAndInvokeNPM = {packageName, bypassCache, reconstructLock, npmFlags, production}:
+  prepareAndInvokeNPM = { packageName, bypassCache, reconstructLock, npmFlags, production }:
     let
       forceOfflineFlag = if bypassCache then "--offline" else "--registry http://www.example.com";
     in
@@ -479,8 +481,8 @@ let
     { name
     , packageName
     , version ? null
-    , dependencies ? []
+    , dependencies ? [ ]
-    , buildInputs ? []
+    , buildInputs ? [ ]
     , production ? true
     , npmFlags ? ""
     , dontNpmInstall ? false
@@ -490,8 +492,9 @@ let
     , dontStrip ? true
     , unpackPhase ? "true"
     , buildPhase ? "true"
-    , meta ? {}
+    , meta ? { }
-    , ... }@args:
+    , ...
+    }@args:
 
     let
       extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ];
@@ -572,8 +575,8 @@ let
     , packageName
     , version ? null
     , src
-    , dependencies ? []
+    , dependencies ? [ ]
-    , buildInputs ? []
+    , buildInputs ? [ ]
     , production ? true
     , npmFlags ? ""
     , dontNpmInstall ? false
@@ -582,7 +585,8 @@ let
     , dontStrip ? true
     , unpackPhase ? "true"
     , buildPhase ? "true"
-    , ... }@args:
+    , ...
+    }@args:
 
     let
       extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ];
@@ -643,8 +647,8 @@ let
     , packageName
     , version ? null
     , src
-    , dependencies ? []
+    , dependencies ? [ ]
-    , buildInputs ? []
+    , buildInputs ? [ ]
     , production ? true
     , npmFlags ? ""
     , dontNpmInstall ? false
@@ -653,7 +657,8 @@ let
     , dontStrip ? true
     , unpackPhase ? "true"
     , buildPhase ? "true"
-    , ... }@args:
+    , ...
+    }@args:
 
     let
       nodeDependencies = buildNodeDependencies args;
@@ -675,7 +680,7 @@ let
 
       # Provide the dependencies in a development shell through the NODE_PATH environment variable
       inherit nodeDependencies;
-      shellHook = lib.optionalString (dependencies != []) ''
+      shellHook = lib.optionalString (dependencies != [ ]) ''
         export NODE_PATH=${nodeDependencies}/lib/node_modules
         export PATH="${nodeDependencies}/bin:$PATH"
       '';

pkgs/by-name/be/betanin/client/packages.nix

@@ -1,6 +1,6 @@
 # This file has been generated by node2nix 1.11.1. Do not edit!
 
-{nodeEnv, fetchurl, fetchgit, nix-gitignore, stdenv, lib, globalBuildInputs ? []}:
+{ nodeEnv, fetchurl, fetchgit, nix-gitignore, stdenv, lib, globalBuildInputs ? [ ] }:
 
 let
   sources = {
@@ -9196,8 +9196,7 @@ let
       })
     ];
     buildInputs = globalBuildInputs;
-    meta = {
+    meta = { };
-    };
     production = false;
     bypassCache = true;
     reconstructLock = false;
@@ -9216,7 +9215,8 @@ in
         "*"
         "!package.json"
         "!package-lock.json"
-      ] args.src;
+      ]
+        args.src;
       dontBuild = true;
       installPhase = "mkdir -p $out; cp -r ./* $out;";
     };