Compare commits

...

3 Commits

Author SHA1 Message Date
bcd4c4a269
betanin: apply deadnix 2023-09-27 17:16:58 +10:00
5f261acb3b
modules/betanin: simplify configuration
Use secret settings configuration that a handful of other NixOS modules
do. Remove assertions. Remove beets config file setting.
2023-09-27 17:15:57 +10:00
55936a1641
betanin: format files 2023-09-27 16:32:01 +10:00
4 changed files with 164 additions and 249 deletions

View File

@ -1,47 +1,16 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
let let
inherit (lib) mkIf mkOption optionalAttrs optionalString types; inherit (builtins) hashString;
inherit (lib) mkIf mkOption optionalAttrs types;
cfg = config.services.betanin; cfg = config.services.betanin;
defaultUser = "betanin"; defaultUser = "betanin";
defaultGroup = "betanin"; defaultGroup = "betanin";
defaultSettings = {
notifications = {
services = { };
strings = {
title = "[betanin] torrent `$name` $status";
body = "@ $time. view/use the console at http://127.0.0.1:${toString cfg.port}/$console_path";
};
};
};
finalSettings =
let
base = lib.filterAttrsRecursive (n: _: !(lib.hasSuffix "_file" n)) cfg.settings;
clean = {
frontend.password =
if cfg.settings.frontend.password_file != null
then "@password@"
else cfg.settings.frontend.password;
clients.api_key =
if cfg.settings.clients.api_key_file != null
then "@api_key@"
else cfg.settings.clients.api_key;
};
in
lib.foldl' lib.recursiveUpdate defaultSettings [ base clean ];
settingsFormat = pkgs.formats.toml { }; settingsFormat = pkgs.formats.toml { };
settingsFile = settingsFormat.generate "betanin.toml" finalSettings;
beetsFormat = pkgs.formats.yaml { }; beetsFormat = pkgs.formats.yaml { };
beetsFile =
if (cfg.beetsFile != null)
then cfg.beetsFile
else if (cfg.beetsConfig != { })
then beetsFormat.generate "betanin-beets.yaml" cfg.beetsConfig
else null;
in in
{ {
options = { options = {
@ -85,106 +54,50 @@ in
}; };
settings = mkOption { settings = mkOption {
type = types.submodule { type = settingsFormat.type;
freeformType = settingsFormat.type; default = { };
options.frontend.username = mkOption {
type = types.str;
default = "";
description = "Username used to log into the frontend. Must be set.";
};
options.frontend.password = mkOption {
type = types.str;
default = "";
description = ''
Password used to log into the frontend. Either password or
password_file must be set.
'';
};
options.frontend.password_file = mkOption {
type = with types; nullOr (either str path);
default = null;
description = ''
File containing the password used to log into the frontend. The
file must be readable by the betanin user/group.
Using a password file keeps the password out of the Nix store, but
the password is still stored in plain text in the service data
directory.
'';
};
options.clients.api_key = mkOption {
type = types.nullOr types.str;
default = "";
description = ''
API key used to access Betanin (e.g., from other services).
'';
};
options.clients.api_key_file = mkOption {
type = with types; nullOr (either str path);
default = null;
description = ''
File containing the API key used to access Betanin (e.g., from
other services). The file must be readable by the betanin
user/group.
Using a API key file keeps the API key out of the Nix store, but
the API key is still stored in plain text in the service data
directory.
'';
};
};
default = defaultSettings;
example = lib.literalExpression '' example = lib.literalExpression ''
{ {
frontend = { frontend = {
username = "foo"; username = "foo";
password_file = "/run/secrets/betaninPasswordFile"; password { _secret = "/run/secrets/betaninPasswordFile"; };
}; };
clients = { clients = {
api_key_file = "/run/secrets/betaninApiKeyFile"; api_key = { _secret = "/run/secrets/betaninApiKeyFile"; };
}; };
server = { server = {
num_parallel_jobs = 1; num_parallel_jobs = 1;
}; };
} }
''; '';
description = "Configuration for betanin."; description = lib.mdDoc ''
Configuration for betanin.
Options containing secret data should be set to an attribute set
containing the attribute `_secret` - a string pointing to a file
containing the value the option should be set to.
'';
}; };
beetsConfig = mkOption { beets.settings = mkOption {
description = "beets configuration.";
type = beetsFormat.type; type = beetsFormat.type;
default = { }; default = { };
}; description = lib.mdDoc "Configuration for beets used by betanin.";
beetsFile = mkOption {
description = "beets configuration file.";
type = with types; nullOr (either str path);
default = null;
}; };
}; };
}; };
config = mkIf cfg.enable { config = mkIf cfg.enable {
assertions = [ services.betanin.settings = {
{ notifications = {
assertion = cfg.settings.frontend.username != ""; # Required to exist.
message = "services.betanin.settings.frontend.username is required"; services = { };
} strings = {
{ title = lib.mkDefault "[betanin] torrent `$name` $status";
assertion = (cfg.settings.frontend.password == "") != (cfg.settings.frontend.password_file == null); body = lib.mkDefault "@ $time. view/use the console at http://127.0.0.1:${toString cfg.port}/$console_path";
message = "services.betanin.settings.frontend.password or services.betanin.settings.frontend.password_file is required"; };
} };
{ };
assertion = (cfg.settings.clients.api_key == "") != (cfg.settings.clients.api_key_file == null);
message = "services.betanin.settings.clients.api_key or services.betanin.settings.clients.api_key_file is required";
}
];
networking.firewall = mkIf cfg.openFirewall { networking.firewall = mkIf cfg.openFirewall {
allowedTCPPorts = [ cfg.port ]; allowedTCPPorts = [ cfg.port ];
@ -192,12 +105,20 @@ in
systemd.services.betanin = systemd.services.betanin =
let let
replaceSecret = secretFile: placeholder: targetFile: isSecret = v: lib.isAttrs v && v ? _secret && lib.isString v._secret;
optionalString (secretFile != null) '' sanitisedConfig = lib.mapAttrsRecursiveCond
${pkgs.replace-secret}/bin/replace-secret ${placeholder} ${secretFile} ${targetFile} (as: !isSecret as)
(_: v: if isSecret v then hashString "sha256" v._secret else v)
cfg.settings;
settingsFile = settingsFormat.generate "betanin.toml" sanitisedConfig;
secretPaths = lib.catAttrs "_secret" (lib.collect isSecret cfg.settings);
mkSecretReplacement = file: ''
replace-secret ${hashString "sha256" file} ${file} "${cfg.dataDir}/.config/betanin/config.toml"
''; '';
replaceConfigSecret = secretFile: placeholder: secretReplacements = lib.concatMapStrings mkSecretReplacement secretPaths;
replaceSecret secretFile placeholder "${cfg.dataDir}/.config/betanin/config.toml";
beetsFile = beetsFormat.generate "betanin-beets.yaml" cfg.beets.settings;
in in
{ {
description = "Betanin service"; description = "Betanin service";
@ -210,15 +131,12 @@ in
script = '' script = ''
mkdir -p ${cfg.dataDir}/.config/betanin \ mkdir -p ${cfg.dataDir}/.config/betanin \
${cfg.dataDir}/.config/beets \ ${cfg.dataDir}/.local/share/betanin \
${cfg.dataDir}/.local/share/betanin ${cfg.dataDir}/.config/beets
cat ${settingsFile} > ${cfg.dataDir}/.config/betanin/config.toml
${optionalString (beetsFile != null) ''
ln -sf ${beetsFile} ${cfg.dataDir}/.config/betanin/config.toml ln -sf ${beetsFile} ${cfg.dataDir}/.config/betanin/config.toml
''} cat ${settingsFile} > ${cfg.dataDir}/.config/betanin/config.toml
${replaceConfigSecret cfg.settings.frontend.password_file "@password@"} ${secretReplacements}
${replaceConfigSecret cfg.settings.clients.api_key_file "@api_key@"}
${cfg.package}/bin/betanin --port ${toString cfg.port} ${cfg.package}/bin/betanin --port ${toString cfg.port}
''; '';

View File

@ -2,7 +2,10 @@
{ pkgs ? import <nixpkgs> { { pkgs ? import <nixpkgs> {
inherit system; inherit system;
}, system ? builtins.currentSystem, nodejs ? pkgs."nodejs_18"}: }
, system ? builtins.currentSystem
, nodejs ? pkgs."nodejs_18"
}:
let let
nodeEnv = import ./node-env.nix { nodeEnv = import ./node-env.nix {

View File

@ -96,20 +96,22 @@ let
mkdir -p node_modules mkdir -p node_modules
cd node_modules cd node_modules
'' ''
+ (lib.concatMapStrings (dependency: + (lib.concatMapStrings
(dependency:
'' ''
if [ ! -e "${dependency.packageName}" ]; then if [ ! -e "${dependency.packageName}" ]; then
${composePackage dependency} ${composePackage dependency}
fi fi
'' ''
) dependencies) )
dependencies)
+ '' + ''
cd .. cd ..
'' ''
); );
# Recursively composes the dependencies of a package # Recursively composes the dependencies of a package
composePackage = { name, packageName, src, dependencies ? [], ... }@args: composePackage = { packageName, src, dependencies ? [ ], ... }:
builtins.addErrorContext "while evaluating node package '${packageName}'" '' builtins.addErrorContext "while evaluating node package '${packageName}'" ''
installPackage "${packageName}" "${src}" installPackage "${packageName}" "${src}"
${includeDependencies { inherit dependencies; }} ${includeDependencies { inherit dependencies; }}
@ -194,7 +196,7 @@ let
# dependencies in the package.json file to the versions that are actually # dependencies in the package.json file to the versions that are actually
# being used. # being used.
pinpointDependenciesOfPackage = { packageName, dependencies ? [], production ? true, ... }@args: pinpointDependenciesOfPackage = { packageName, dependencies ? [ ], production ? true, ... }:
'' ''
if [ -d "${packageName}" ] if [ -d "${packageName}" ]
then then
@ -479,7 +481,6 @@ let
{ name { name
, packageName , packageName
, version ? null , version ? null
, dependencies ? []
, buildInputs ? [ ] , buildInputs ? [ ]
, production ? true , production ? true
, npmFlags ? "" , npmFlags ? ""
@ -491,7 +492,8 @@ let
, unpackPhase ? "true" , unpackPhase ? "true"
, buildPhase ? "true" , buildPhase ? "true"
, meta ? { } , meta ? { }
, ... }@args: , ...
}@args:
let let
extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ]; extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" "dontStrip" "dontNpmInstall" "preRebuild" "unpackPhase" "buildPhase" "meta" ];
@ -582,7 +584,8 @@ let
, dontStrip ? true , dontStrip ? true
, unpackPhase ? "true" , unpackPhase ? "true"
, buildPhase ? "true" , buildPhase ? "true"
, ... }@args: , ...
}@args:
let let
extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ]; extraArgs = removeAttrs args [ "name" "dependencies" "buildInputs" ];
@ -640,20 +643,11 @@ let
# Builds a development shell # Builds a development shell
buildNodeShell = buildNodeShell =
{ name { name
, packageName
, version ? null , version ? null
, src
, dependencies ? [ ] , dependencies ? [ ]
, buildInputs ? [ ] , buildInputs ? [ ]
, production ? true , ...
, npmFlags ? "" }@args:
, dontNpmInstall ? false
, bypassCache ? false
, reconstructLock ? false
, dontStrip ? true
, unpackPhase ? "true"
, buildPhase ? "true"
, ... }@args:
let let
nodeDependencies = buildNodeDependencies args; nodeDependencies = buildNodeDependencies args;

View File

@ -1,6 +1,6 @@
# This file has been generated by node2nix 1.11.1. Do not edit! # This file has been generated by node2nix 1.11.1. Do not edit!
{nodeEnv, fetchurl, fetchgit, nix-gitignore, stdenv, lib, globalBuildInputs ? []}: { nodeEnv, fetchurl, nix-gitignore, stdenv, lib, globalBuildInputs ? [ ] }:
let let
sources = { sources = {
@ -9196,8 +9196,7 @@ let
}) })
]; ];
buildInputs = globalBuildInputs; buildInputs = globalBuildInputs;
meta = { meta = { };
};
production = false; production = false;
bypassCache = true; bypassCache = true;
reconstructLock = false; reconstructLock = false;
@ -9216,7 +9215,8 @@ in
"*" "*"
"!package.json" "!package.json"
"!package-lock.json" "!package-lock.json"
] args.src; ]
args.src;
dontBuild = true; dontBuild = true;
installPhase = "mkdir -p $out; cp -r ./* $out;"; installPhase = "mkdir -p $out; cp -r ./* $out;";
}; };