nixpkgs/patches/sourcehut.diff

   1 diff --git a/nixos/lib/make-options-doc/options-to-docbook.xsl b/nixos/lib/make-options-doc/options-to-docbook.xsl
   2 index 18d19fddaca..304698a51ad 100644
   3 --- a/nixos/lib/make-options-doc/options-to-docbook.xsl
   4 +++ b/nixos/lib/make-options-doc/options-to-docbook.xsl
   5 @@ -20,7 +20,7 @@
   6        <title>Configuration Options</title>
   7        <variablelist xml:id="configuration-variable-list">
   8          <xsl:for-each select="attrs">
   9 -          <xsl:variable name="id" select="concat('opt-', str:replace(str:replace(str:replace(attr[@name = 'name']/string/@value, '*', '_'), '&lt;', '_'), '>', '_'))" />
  10 +          <xsl:variable name="id" select="concat('opt-', str:replace(str:replace(str:replace(str:replace(attr[@name = 'name']/string/@value, '*', '_'), '&lt;', '_'), '>', '_'), ':', '_'))" />
  11            <varlistentry>
  12              <term xlink:href="#{$id}">
  13                <xsl:attribute name="xml:id"><xsl:value-of select="$id"/></xsl:attribute>
  14 diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
  15 index 1b9358c81a1..16159e62d9d 100644
  16 --- a/nixos/modules/services/databases/redis.nix
  17 +++ b/nixos/modules/services/databases/redis.nix
  18 @@ -5,17 +5,18 @@ with lib;
  19  let
  20    cfg = config.services.redis;
  21
  22 -  ulimitNofile = cfg.maxclients + 32;
  23 -
  24    mkValueString = value:
  25      if value == true then "yes"
  26      else if value == false then "no"
  27      else generators.mkValueStringDefault { } value;
  28
  29 -  redisConfig = pkgs.writeText "redis.conf" (generators.toKeyValue {
  30 +  redisConfig = settings: pkgs.writeText "redis.conf" (generators.toKeyValue {
  31      listsAsDuplicateKeys = true;
  32      mkKeyValue = generators.mkKeyValueDefault { inherit mkValueString; } " ";
  33 -  } cfg.settings);
  34 +  } settings);
  35 +
  36 +  redisName = name: "redis" + optionalString (name != "") ("-"+name);
  37 +  enabledServers = filterAttrs (name: conf: conf.enable) config.services.redis.servers;
  38
  39  in {
  40    imports = [
  41 @@ -25,6 +26,27 @@ in {
  42      (mkRemovedOptionModule [ "services" "redis" "appendOnlyFilename" ] "This option was never used.")
  43      (mkRemovedOptionModule [ "services" "redis" "pidFile" ] "This option was removed.")
  44      (mkRemovedOptionModule [ "services" "redis" "extraConfig" ] "Use services.redis.settings instead.")
  45 +    (mkRenamedOptionModule [ "services" "redis" "enable"] [ "services" "redis" "servers" "" "enable" ])
  46 +    (mkRenamedOptionModule [ "services" "redis" "port"] [ "services" "redis" "servers" "" "port" ])
  47 +    (mkRenamedOptionModule [ "services" "redis" "openFirewall"] [ "services" "redis" "servers" "" "openFirewall" ])
  48 +    (mkRenamedOptionModule [ "services" "redis" "bind"] [ "services" "redis" "servers" "" "bind" ])
  49 +    (mkRenamedOptionModule [ "services" "redis" "unixSocket"] [ "services" "redis" "servers" "" "unixSocket" ])
  50 +    (mkRenamedOptionModule [ "services" "redis" "unixSocketPerm"] [ "services" "redis" "servers" "" "unixSocketPerm" ])
  51 +    (mkRenamedOptionModule [ "services" "redis" "logLevel"] [ "services" "redis" "servers" "" "logLevel" ])
  52 +    (mkRenamedOptionModule [ "services" "redis" "logfile"] [ "services" "redis" "servers" "" "logfile" ])
  53 +    (mkRenamedOptionModule [ "services" "redis" "syslog"] [ "services" "redis" "servers" "" "syslog" ])
  54 +    (mkRenamedOptionModule [ "services" "redis" "databases"] [ "services" "redis" "servers" "" "databases" ])
  55 +    (mkRenamedOptionModule [ "services" "redis" "maxclients"] [ "services" "redis" "servers" "" "maxclients" ])
  56 +    (mkRenamedOptionModule [ "services" "redis" "save"] [ "services" "redis" "servers" "" "save" ])
  57 +    (mkRenamedOptionModule [ "services" "redis" "slaveOf"] [ "services" "redis" "servers" "" "slaveOf" ])
  58 +    (mkRenamedOptionModule [ "services" "redis" "masterAuth"] [ "services" "redis" "servers" "" "masterAuth" ])
  59 +    (mkRenamedOptionModule [ "services" "redis" "requirePass"] [ "services" "redis" "servers" "" "requirePass" ])
  60 +    (mkRenamedOptionModule [ "services" "redis" "requirePassFile"] [ "services" "redis" "servers" "" "requirePassFile" ])
  61 +    (mkRenamedOptionModule [ "services" "redis" "appendOnly"] [ "services" "redis" "servers" "" "appendOnly" ])
  62 +    (mkRenamedOptionModule [ "services" "redis" "appendFsync"] [ "services" "redis" "servers" "" "appendFsync" ])
  63 +    (mkRenamedOptionModule [ "services" "redis" "slowLogLogSlowerThan"] [ "services" "redis" "servers" "" "slowLogLogSlowerThan" ])
  64 +    (mkRenamedOptionModule [ "services" "redis" "slowLogMaxLen"] [ "services" "redis" "servers" "" "slowLogMaxLen" ])
  65 +    (mkRenamedOptionModule [ "services" "redis" "settings"] [ "services" "redis" "servers" "" "settings" ])
  66    ];
  67
  68    ###### interface
  69 @@ -32,18 +54,6 @@ in {
  70    options = {
  71
  72      services.redis = {
  73 -
  74 -      enable = mkOption {
  75 -        type = types.bool;
  76 -        default = false;
  77 -        description = ''
  78 -          Whether to enable the Redis server. Note that the NixOS module for
  79 -          Redis disables kernel support for Transparent Huge Pages (THP),
  80 -          because this features causes major performance problems for Redis,
  81 -          e.g. (https://redis.io/topics/latency).
  82 -        '';
  83 -      };
  84 -
  85        package = mkOption {
  86          type = types.package;
  87          default = pkgs.redis;
  88 @@ -51,177 +61,227 @@ in {
  89          description = "Which Redis derivation to use.";
  90        };
  91
  92 -      port = mkOption {
  93 -        type = types.port;
  94 -        default = 6379;
  95 -        description = "The port for Redis to listen to.";
  96 -      };
  97 +      vmOverCommit = mkEnableOption ''
  98 +        setting of vm.overcommit_memory to 1
  99 +        (Suggested for Background Saving: http://redis.io/topics/faq)
 100 +      '';
 101
 102 -      vmOverCommit = mkOption {
 103 -        type = types.bool;
 104 -        default = false;
 105 -        description = ''
 106 -          Set vm.overcommit_memory to 1 (Suggested for Background Saving: http://redis.io/topics/faq)
 107 -        '';
 108 -      };
 109 -
 110 -      openFirewall = mkOption {
 111 -        type = types.bool;
 112 -        default = false;
 113 -        description = ''
 114 -          Whether to open ports in the firewall for the server.
 115 -        '';
 116 -      };
 117 -
 118 -      bind = mkOption {
 119 -        type = with types; nullOr str;
 120 -        default = "127.0.0.1";
 121 -        description = ''
 122 -          The IP interface to bind to.
 123 -          <literal>null</literal> means "all interfaces".
 124 -        '';
 125 -        example = "192.0.2.1";
 126 -      };
 127 -
 128 -      unixSocket = mkOption {
 129 -        type = with types; nullOr path;
 130 -        default = null;
 131 -        description = "The path to the socket to bind to.";
 132 -        example = "/run/redis/redis.sock";
 133 -      };
 134 -
 135 -      unixSocketPerm = mkOption {
 136 -        type = types.int;
 137 -        default = 750;
 138 -        description = "Change permissions for the socket";
 139 -        example = 700;
 140 -      };
 141 -
 142 -      logLevel = mkOption {
 143 -        type = types.str;
 144 -        default = "notice"; # debug, verbose, notice, warning
 145 -        example = "debug";
 146 -        description = "Specify the server verbosity level, options: debug, verbose, notice, warning.";
 147 -      };
 148 -
 149 -      logfile = mkOption {
 150 -        type = types.str;
 151 -        default = "/dev/null";
 152 -        description = "Specify the log file name. Also 'stdout' can be used to force Redis to log on the standard output.";
 153 -        example = "/var/log/redis.log";
 154 -      };
 155 -
 156 -      syslog = mkOption {
 157 -        type = types.bool;
 158 -        default = true;
 159 -        description = "Enable logging to the system logger.";
 160 -      };
 161 -
 162 -      databases = mkOption {
 163 -        type = types.int;
 164 -        default = 16;
 165 -        description = "Set the number of databases.";
 166 -      };
 167 -
 168 -      maxclients = mkOption {
 169 -        type = types.int;
 170 -        default = 10000;
 171 -        description = "Set the max number of connected clients at the same time.";
 172 -      };
 173 -
 174 -      save = mkOption {
 175 -        type = with types; listOf (listOf int);
 176 -        default = [ [900 1] [300 10] [60 10000] ];
 177 -        description = "The schedule in which data is persisted to disk, represented as a list of lists where the first element represent the amount of seconds and the second the number of changes.";
 178 -        example = [ [900 1] [300 10] [60 10000] ];
 179 -      };
 180 -
 181 -      slaveOf = mkOption {
 182 -        type = with types; nullOr (submodule ({ ... }: {
 183 +      servers = mkOption {
 184 +        type = with types; attrsOf (submodule ({config, name, ...}@args: {
 185            options = {
 186 -            ip = mkOption {
 187 -              type = str;
 188 -              description = "IP of the Redis master";
 189 -              example = "192.168.1.100";
 190 +            enable = mkEnableOption ''
 191 +              Redis server.
 192 +
 193 +              Note that the NixOS module for Redis disables kernel support
 194 +              for Transparent Huge Pages (THP),
 195 +              because this features causes major performance problems for Redis,
 196 +              e.g. (https://redis.io/topics/latency).
 197 +            '';
 198 +
 199 +            user = mkOption {
 200 +              type = types.str;
 201 +              default = redisName name;
 202 +              defaultText = "\"redis\" or \"redis-\${name}\" if name != \"\"";
 203 +              description = "The username and groupname for redis-server.";
 204              };
 205
 206              port = mkOption {
 207 -              type = port;
 208 -              description = "port of the Redis master";
 209 +              type = types.port;
 210                default = 6379;
 211 +              description = "The port for Redis to listen to.";
 212 +            };
 213 +
 214 +            openFirewall = mkOption {
 215 +              type = types.bool;
 216 +              default = false;
 217 +              description = ''
 218 +                Whether to open ports in the firewall for the server.
 219 +              '';
 220 +            };
 221 +
 222 +            bind = mkOption {
 223 +              type = with types; nullOr str;
 224 +              default = if name == "" then "127.0.0.1" else null;
 225 +              defaultText = "127.0.0.1 or null if name != \"\"";
 226 +              description = ''
 227 +                The IP interface to bind to.
 228 +                <literal>null</literal> means "all interfaces".
 229 +              '';
 230 +              example = "192.0.2.1";
 231 +            };
 232 +
 233 +            unixSocket = mkOption {
 234 +              type = with types; nullOr path;
 235 +              default = "/run/${redisName name}/redis.sock";
 236 +              defaultText = "\"/run/redis/redis.sock\" or \"/run/redis-\${name}/redis.sock\" if name != \"\"";
 237 +              description = "The path to the socket to bind to.";
 238 +            };
 239 +
 240 +            unixSocketPerm = mkOption {
 241 +              type = types.int;
 242 +              default = 660;
 243 +              description = "Change permissions for the socket";
 244 +              example = 600;
 245 +            };
 246 +
 247 +            logLevel = mkOption {
 248 +              type = types.str;
 249 +              default = "notice"; # debug, verbose, notice, warning
 250 +              example = "debug";
 251 +              description = "Specify the server verbosity level, options: debug, verbose, notice, warning.";
 252 +            };
 253 +
 254 +            logfile = mkOption {
 255 +              type = types.str;
 256 +              default = "/dev/null";
 257 +              description = "Specify the log file name. Also 'stdout' can be used to force Redis to log on the standard output.";
 258 +              example = "/var/log/redis.log";
 259 +            };
 260 +
 261 +            syslog = mkOption {
 262 +              type = types.bool;
 263 +              default = true;
 264 +              description = "Enable logging to the system logger.";
 265 +            };
 266 +
 267 +            databases = mkOption {
 268 +              type = types.int;
 269 +              default = 16;
 270 +              description = "Set the number of databases.";
 271 +            };
 272 +
 273 +            maxclients = mkOption {
 274 +              type = types.int;
 275 +              default = 10000;
 276 +              description = "Set the max number of connected clients at the same time.";
 277 +            };
 278 +
 279 +            save = mkOption {
 280 +              type = with types; listOf (listOf int);
 281 +              default = [ [900 1] [300 10] [60 10000] ];
 282 +              description = "The schedule in which data is persisted to disk, represented as a list of lists where the first element represent the amount of seconds and the second the number of changes.";
 283 +              example = [ [900 1] [300 10] [60 10000] ];
 284 +            };
 285 +
 286 +            slaveOf = mkOption {
 287 +              type = with types; nullOr (submodule ({ ... }: {
 288 +                options = {
 289 +                  ip = mkOption {
 290 +                    type = str;
 291 +                    description = "IP of the Redis master";
 292 +                    example = "192.168.1.100";
 293 +                  };
 294 +
 295 +                  port = mkOption {
 296 +                    type = port;
 297 +                    description = "port of the Redis master";
 298 +                    default = 6379;
 299 +                  };
 300 +                };
 301 +              }));
 302 +
 303 +              default = null;
 304 +              description = "IP and port to which this redis instance acts as a slave.";
 305 +              example = { ip = "192.168.1.100"; port = 6379; };
 306 +            };
 307 +
 308 +            masterAuth = mkOption {
 309 +              type = with types; nullOr str;
 310 +              default = null;
 311 +              description = ''If the master is password protected (using the requirePass configuration)
 312 +              it is possible to tell the slave to authenticate before starting the replication synchronization
 313 +              process, otherwise the master will refuse the slave request.
 314 +              (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';
 315 +            };
 316 +
 317 +            requirePass = mkOption {
 318 +              type = with types; nullOr str;
 319 +              default = null;
 320 +              description = ''
 321 +                Password for database (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE).
 322 +                Use requirePassFile to store it outside of the nix store in a dedicated file.
 323 +              '';
 324 +              example = "letmein!";
 325 +            };
 326 +
 327 +            requirePassFile = mkOption {
 328 +              type = with types; nullOr path;
 329 +              default = null;
 330 +              description = "File with password for the database.";
 331 +              example = "/run/keys/redis-password";
 332 +            };
 333 +
 334 +            appendOnly = mkOption {
 335 +              type = types.bool;
 336 +              default = false;
 337 +              description = "By default data is only periodically persisted to disk, enable this option to use an append-only file for improved persistence.";
 338 +            };
 339 +
 340 +            appendFsync = mkOption {
 341 +              type = types.str;
 342 +              default = "everysec"; # no, always, everysec
 343 +              description = "How often to fsync the append-only log, options: no, always, everysec.";
 344 +            };
 345 +
 346 +            slowLogLogSlowerThan = mkOption {
 347 +              type = types.int;
 348 +              default = 10000;
 349 +              description = "Log queries whose execution take longer than X in milliseconds.";
 350 +              example = 1000;
 351 +            };
 352 +
 353 +            slowLogMaxLen = mkOption {
 354 +              type = types.int;
 355 +              default = 128;
 356 +              description = "Maximum number of items to keep in slow log.";
 357 +            };
 358 +
 359 +            settings = mkOption {
 360 +              # TODO: this should be converted to freeformType
 361 +              type = with types; attrsOf (oneOf [ bool int str (listOf str) ]);
 362 +              default = {};
 363 +              description = ''
 364 +                Redis configuration. Refer to
 365 +                <link xlink:href="https://redis.io/topics/config"/>
 366 +                for details on supported values.
 367 +              '';
 368 +              example = literalExample ''
 369 +                {
 370 +                  loadmodule = [ "/path/to/my_module.so" "/path/to/other_module.so" ];
 371 +                }
 372 +              '';
 373              };
 374            };
 375 +          config.settings = mkMerge [
 376 +            {
 377 +              port = if config.bind == null then 0 else config.port;
 378 +              daemonize = false;
 379 +              supervised = "systemd";
 380 +              loglevel = config.logLevel;
 381 +              logfile = config.logfile;
 382 +              syslog-enabled = config.syslog;
 383 +              databases = config.databases;
 384 +              maxclients = config.maxclients;
 385 +              save = map (d: "${toString (builtins.elemAt d 0)} ${toString (builtins.elemAt d 1)}") config.save;
 386 +              dbfilename = "dump.rdb";
 387 +              dir = "/var/lib/${redisName name}";
 388 +              appendOnly = config.appendOnly;
 389 +              appendfsync = config.appendFsync;
 390 +              slowlog-log-slower-than = config.slowLogLogSlowerThan;
 391 +              slowlog-max-len = config.slowLogMaxLen;
 392 +            }
 393 +            (mkIf (config.bind != null) { bind = config.bind; })
 394 +            (mkIf (config.unixSocket != null) {
 395 +              unixsocket = config.unixSocket;
 396 +              unixsocketperm = toString config.unixSocketPerm;
 397 +            })
 398 +            (mkIf (config.slaveOf != null) { slaveof = "${config.slaveOf.ip} ${toString config.slaveOf.port}"; })
 399 +            (mkIf (config.masterAuth != null) { masterauth = config.masterAuth; })
 400 +            (mkIf (config.requirePass != null) { requirepass = config.requirePass; })
 401 +          ];
 402          }));
 403 -
 404 -        default = null;
 405 -        description = "IP and port to which this redis instance acts as a slave.";
 406 -        example = { ip = "192.168.1.100"; port = 6379; };
 407 -      };
 408 -
 409 -      masterAuth = mkOption {
 410 -        type = with types; nullOr str;
 411 -        default = null;
 412 -        description = ''If the master is password protected (using the requirePass configuration)
 413 -        it is possible to tell the slave to authenticate before starting the replication synchronization
 414 -        process, otherwise the master will refuse the slave request.
 415 -        (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';
 416 -      };
 417 -
 418 -      requirePass = mkOption {
 419 -        type = with types; nullOr str;
 420 -        default = null;
 421 -        description = ''
 422 -          Password for database (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE).
 423 -          Use requirePassFile to store it outside of the nix store in a dedicated file.
 424 -        '';
 425 -        example = "letmein!";
 426 -      };
 427 -
 428 -      requirePassFile = mkOption {
 429 -        type = with types; nullOr path;
 430 -        default = null;
 431 -        description = "File with password for the database.";
 432 -        example = "/run/keys/redis-password";
 433 -      };
 434 -
 435 -      appendOnly = mkOption {
 436 -        type = types.bool;
 437 -        default = false;
 438 -        description = "By default data is only periodically persisted to disk, enable this option to use an append-only file for improved persistence.";
 439 -      };
 440 -
 441 -      appendFsync = mkOption {
 442 -        type = types.str;
 443 -        default = "everysec"; # no, always, everysec
 444 -        description = "How often to fsync the append-only log, options: no, always, everysec.";
 445 -      };
 446 -
 447 -      slowLogLogSlowerThan = mkOption {
 448 -        type = types.int;
 449 -        default = 10000;
 450 -        description = "Log queries whose execution take longer than X in milliseconds.";
 451 -        example = 1000;
 452 -      };
 453 -
 454 -      slowLogMaxLen = mkOption {
 455 -        type = types.int;
 456 -        default = 128;
 457 -        description = "Maximum number of items to keep in slow log.";
 458 -      };
 459 -
 460 -      settings = mkOption {
 461 -        type = with types; attrsOf (oneOf [ bool int str (listOf str) ]);
 462 +        description = "Configuration of multiple <literal>redis-server</literal> instances.";
 463          default = {};
 464 -        description = ''
 465 -          Redis configuration. Refer to
 466 -          <link xlink:href="https://redis.io/topics/config"/>
 467 -          for details on supported values.
 468 -        '';
 469 -        example = literalExample ''
 470 -          {
 471 -            loadmodule = [ "/path/to/my_module.so" "/path/to/other_module.so" ];
 472 -          }
 473 -        '';
 474        };
 475      };
 476
 477 @@ -230,78 +290,61 @@ in {
 478
 479    ###### implementation
 480
 481 -  config = mkIf config.services.redis.enable {
 482 -    assertions = [{
 483 -      assertion = cfg.requirePass != null -> cfg.requirePassFile == null;
 484 -      message = "You can only set one services.redis.requirePass or services.redis.requirePassFile";
 485 -    }];
 486 -    boot.kernel.sysctl = (mkMerge [
 487 +  config = mkIf (enabledServers != {}) {
 488 +
 489 +    assertions = attrValues (mapAttrs (name: conf: {
 490 +      assertion = conf.requirePass != null -> conf.requirePassFile == null;
 491 +      message = ''
 492 +        You can only set one services.redis.servers.${name}.requirePass
 493 +        or services.redis.servers.${name}.requirePassFile
 494 +      '';
 495 +    }) enabledServers);
 496 +
 497 +    boot.kernel.sysctl = mkMerge [
 498        { "vm.nr_hugepages" = "0"; }
 499        ( mkIf cfg.vmOverCommit { "vm.overcommit_memory" = "1"; } )
 500 -    ]);
 501 +    ];
 502
 503 -    networking.firewall = mkIf cfg.openFirewall {
 504 -      allowedTCPPorts = [ cfg.port ];
 505 -    };
 506 -
 507 -    users.users.redis = {
 508 -      description = "Redis database user";
 509 -      group = "redis";
 510 -      isSystemUser = true;
 511 -    };
 512 -    users.groups.redis = {};
 513 +    networking.firewall.allowedTCPPorts = concatMap (conf:
 514 +      optional conf.openFirewall conf.port
 515 +    ) (attrValues enabledServers);
 516
 517      environment.systemPackages = [ cfg.package ];
 518
 519 -    services.redis.settings = mkMerge [
 520 -      {
 521 -        port = cfg.port;
 522 -        daemonize = false;
 523 -        supervised = "systemd";
 524 -        loglevel = cfg.logLevel;
 525 -        logfile = cfg.logfile;
 526 -        syslog-enabled = cfg.syslog;
 527 -        databases = cfg.databases;
 528 -        maxclients = cfg.maxclients;
 529 -        save = map (d: "${toString (builtins.elemAt d 0)} ${toString (builtins.elemAt d 1)}") cfg.save;
 530 -        dbfilename = "dump.rdb";
 531 -        dir = "/var/lib/redis";
 532 -        appendOnly = cfg.appendOnly;
 533 -        appendfsync = cfg.appendFsync;
 534 -        slowlog-log-slower-than = cfg.slowLogLogSlowerThan;
 535 -        slowlog-max-len = cfg.slowLogMaxLen;
 536 -      }
 537 -      (mkIf (cfg.bind != null) { bind = cfg.bind; })
 538 -      (mkIf (cfg.unixSocket != null) { unixsocket = cfg.unixSocket; unixsocketperm = "${toString cfg.unixSocketPerm}"; })
 539 -      (mkIf (cfg.slaveOf != null) { slaveof = "${cfg.slaveOf.ip} ${toString cfg.slaveOf.port}"; })
 540 -      (mkIf (cfg.masterAuth != null) { masterauth = cfg.masterAuth; })
 541 -      (mkIf (cfg.requirePass != null) { requirepass = cfg.requirePass; })
 542 -    ];
 543 +    users.users = mapAttrs' (name: conf: nameValuePair (redisName name) {
 544 +      description = "System user for the redis-server instance ${name}";
 545 +      isSystemUser = true;
 546 +      group = redisName name;
 547 +    }) enabledServers;
 548 +    users.groups = mapAttrs' (name: conf: nameValuePair (redisName name) {
 549 +    }) enabledServers;
 550
 551 -    systemd.services.redis = {
 552 -      description = "Redis Server";
 553 +    systemd.services = mapAttrs' (name: conf: nameValuePair (redisName name) {
 554 +      description = "Redis Server - ${redisName name}";
 555
 556        wantedBy = [ "multi-user.target" ];
 557        after = [ "network.target" ];
 558
 559 -      preStart = ''
 560 -        install -m 600 ${redisConfig} /run/redis/redis.conf
 561 -      '' + optionalString (cfg.requirePassFile != null) ''
 562 -        password=$(cat ${escapeShellArg cfg.requirePassFile})
 563 -        echo "requirePass $password" >> /run/redis/redis.conf
 564 -      '';
 565 -
 566        serviceConfig = {
 567 -        ExecStart = "${cfg.package}/bin/redis-server /run/redis/redis.conf";
 568 +        ExecStart = "${cfg.package}/bin/redis-server /run/${redisName name}/redis.conf";
 569 +        ExecStartPre = [("+"+pkgs.writeShellScript "${redisName name}-credentials" (''
 570 +            install -o '${conf.user}' -m 600 ${redisConfig conf.settings} /run/${redisName name}/redis.conf
 571 +          '' + optionalString (conf.requirePassFile != null) ''
 572 +            {
 573 +              printf requirePass' '
 574 +              cat ${escapeShellArg conf.requirePassFile}
 575 +            } >>/run/${redisName name}/redis.conf
 576 +          '')
 577 +        )];
 578          Type = "notify";
 579          # User and group
 580 -        User = "redis";
 581 -        Group = "redis";
 582 +        User = conf.user;
 583 +        Group = conf.user;
 584          # Runtime directory and mode
 585 -        RuntimeDirectory = "redis";
 586 +        RuntimeDirectory = redisName name;
 587          RuntimeDirectoryMode = "0750";
 588          # State directory and mode
 589 -        StateDirectory = "redis";
 590 +        StateDirectory = redisName name;
 591          StateDirectoryMode = "0700";
 592          # Access write directories
 593          UMask = "0077";
 594 @@ -310,7 +353,7 @@ in {
 595          # Security
 596          NoNewPrivileges = true;
 597          # Process Properties
 598 -        LimitNOFILE = "${toString ulimitNofile}";
 599 +        LimitNOFILE = mkDefault "${toString (conf.maxclients + 32)}";
 600          # Sandboxing
 601          ProtectSystem = "strict";
 602          ProtectHome = true;
 603 @@ -323,7 +366,9 @@ in {
 604          ProtectKernelModules = true;
 605          ProtectKernelTunables = true;
 606          ProtectControlGroups = true;
 607 -        RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
 608 +        RestrictAddressFamilies =
 609 +          optionals (conf.bind != null) ["AF_INET" "AF_INET6"] ++
 610 +          optional (conf.unixSocket != null) "AF_UNIX";
 611          RestrictNamespaces = true;
 612          LockPersonality = true;
 613          MemoryDenyWriteExecute = true;
 614 @@ -334,6 +379,7 @@ in {
 615          SystemCallArchitectures = "native";
 616          SystemCallFilter = "~@cpu-emulation @debug @keyring @memlock @mount @obsolete @privileged @resources @setuid";
 617        };
 618 -    };
 619 +    }) enabledServers;
 620 +
 621    };
 622  }
 623 diff --git a/nixos/modules/services/misc/sourcehut/builds.nix b/nixos/modules/services/misc/sourcehut/builds.nix
 624 deleted file mode 100644
 625 index e446f08284f..00000000000
 626 --- a/nixos/modules/services/misc/sourcehut/builds.nix
 627 +++ /dev/null
 628 @@ -1,234 +0,0 @@
 629 -{ config, lib, pkgs, ... }:
 630 -
 631 -with lib;
 632 -let
 633 -  cfg = config.services.sourcehut;
 634 -  scfg = cfg.builds;
 635 -  rcfg = config.services.redis;
 636 -  iniKey = "builds.sr.ht";
 637 -
 638 -  drv = pkgs.sourcehut.buildsrht;
 639 -in
 640 -{
 641 -  options.services.sourcehut.builds = {
 642 -    user = mkOption {
 643 -      type = types.str;
 644 -      default = "buildsrht";
 645 -      description = ''
 646 -        User for builds.sr.ht.
 647 -      '';
 648 -    };
 649 -
 650 -    port = mkOption {
 651 -      type = types.port;
 652 -      default = 5002;
 653 -      description = ''
 654 -        Port on which the "builds" module should listen.
 655 -      '';
 656 -    };
 657 -
 658 -    database = mkOption {
 659 -      type = types.str;
 660 -      default = "builds.sr.ht";
 661 -      description = ''
 662 -        PostgreSQL database name for builds.sr.ht.
 663 -      '';
 664 -    };
 665 -
 666 -    statePath = mkOption {
 667 -      type = types.path;
 668 -      default = "${cfg.statePath}/buildsrht";
 669 -      description = ''
 670 -        State path for builds.sr.ht.
 671 -      '';
 672 -    };
 673 -
 674 -    enableWorker = mkOption {
 675 -      type = types.bool;
 676 -      default = false;
 677 -      description = ''
 678 -        Run workers for builds.sr.ht.
 679 -      '';
 680 -    };
 681 -
 682 -    images = mkOption {
 683 -      type = types.attrsOf (types.attrsOf (types.attrsOf types.package));
 684 -      default = { };
 685 -      example = lib.literalExample ''(let
 686 -          # Pinning unstable to allow usage with flakes and limit rebuilds.
 687 -          pkgs_unstable = builtins.fetchGit {
 688 -              url = "https://github.com/NixOS/nixpkgs";
 689 -              rev = "ff96a0fa5635770390b184ae74debea75c3fd534";
 690 -              ref = "nixos-unstable";
 691 -          };
 692 -          image_from_nixpkgs = pkgs_unstable: (import ("${pkgs.sourcehut.buildsrht}/lib/images/nixos/image.nix") {
 693 -            pkgs = (import pkgs_unstable {});
 694 -          });
 695 -        in
 696 -        {
 697 -          nixos.unstable.x86_64 = image_from_nixpkgs pkgs_unstable;
 698 -        }
 699 -      )'';
 700 -      description = ''
 701 -        Images for builds.sr.ht. Each package should be distro.release.arch and point to a /nix/store/package/root.img.qcow2.
 702 -      '';
 703 -    };
 704 -
 705 -  };
 706 -
 707 -  config = with scfg; let
 708 -    image_dirs = lib.lists.flatten (
 709 -      lib.attrsets.mapAttrsToList
 710 -        (distro: revs:
 711 -          lib.attrsets.mapAttrsToList
 712 -            (rev: archs:
 713 -              lib.attrsets.mapAttrsToList
 714 -                (arch: image:
 715 -                  pkgs.runCommand "buildsrht-images" { } ''
 716 -                    mkdir -p $out/${distro}/${rev}/${arch}
 717 -                    ln -s ${image}/*.qcow2 $out/${distro}/${rev}/${arch}/root.img.qcow2
 718 -                  '')
 719 -                archs)
 720 -            revs)
 721 -        scfg.images);
 722 -    image_dir_pre = pkgs.symlinkJoin {
 723 -      name = "builds.sr.ht-worker-images-pre";
 724 -      paths = image_dirs ++ [
 725 -        "${pkgs.sourcehut.buildsrht}/lib/images"
 726 -      ];
 727 -    };
 728 -    image_dir = pkgs.runCommand "builds.sr.ht-worker-images" { } ''
 729 -      mkdir -p $out/images
 730 -      cp -Lr ${image_dir_pre}/* $out/images
 731 -    '';
 732 -  in
 733 -  lib.mkIf (cfg.enable && elem "builds" cfg.services) {
 734 -    users = {
 735 -      users = {
 736 -        "${user}" = {
 737 -          isSystemUser = true;
 738 -          group = user;
 739 -          extraGroups = lib.optionals cfg.builds.enableWorker [ "docker" ];
 740 -          description = "builds.sr.ht user";
 741 -        };
 742 -      };
 743 -
 744 -      groups = {
 745 -        "${user}" = { };
 746 -      };
 747 -    };
 748 -
 749 -    services.postgresql = {
 750 -      authentication = ''
 751 -        local ${database} ${user} trust
 752 -      '';
 753 -      ensureDatabases = [ database ];
 754 -      ensureUsers = [
 755 -        {
 756 -          name = user;
 757 -          ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
 758 -        }
 759 -      ];
 760 -    };
 761 -
 762 -    systemd = {
 763 -      tmpfiles.rules = [
 764 -        "d ${statePath} 0755 ${user} ${user} -"
 765 -      ] ++ (lib.optionals cfg.builds.enableWorker
 766 -        [ "d ${statePath}/logs 0775 ${user} ${user} - -" ]
 767 -      );
 768 -
 769 -      services = {
 770 -        buildsrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey
 771 -          {
 772 -            after = [ "postgresql.service" "network.target" ];
 773 -            requires = [ "postgresql.service" ];
 774 -            wantedBy = [ "multi-user.target" ];
 775 -
 776 -            description = "builds.sr.ht website service";
 777 -
 778 -            serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
 779 -
 780 -            # Hack to bypass this hack: https://git.sr.ht/~sircmpwn/core.sr.ht/tree/master/item/srht-update-profiles#L6
 781 -          } // { preStart = " "; };
 782 -
 783 -        buildsrht-worker = {
 784 -          enable = scfg.enableWorker;
 785 -          after = [ "postgresql.service" "network.target" ];
 786 -          requires = [ "postgresql.service" ];
 787 -          wantedBy = [ "multi-user.target" ];
 788 -          partOf = [ "buildsrht.service" ];
 789 -          description = "builds.sr.ht worker service";
 790 -          path = [ pkgs.openssh pkgs.docker ];
 791 -          preStart = let qemuPackage = pkgs.qemu_kvm;
 792 -          in ''
 793 -            if [[ "$(docker images -q qemu:latest 2> /dev/null)" == "" || "$(cat ${statePath}/docker-image-qemu 2> /dev/null || true)" != "${qemuPackage.version}" ]]; then
 794 -              # Create and import qemu:latest image for docker
 795 -              ${
 796 -                pkgs.dockerTools.streamLayeredImage {
 797 -                  name = "qemu";
 798 -                  tag = "latest";
 799 -                  contents = [ qemuPackage ];
 800 -                }
 801 -              } | docker load
 802 -              # Mark down current package version
 803 -              printf "%s" "${qemuPackage.version}" > ${statePath}/docker-image-qemu
 804 -            fi
 805 -          '';
 806 -          serviceConfig = {
 807 -            Type = "simple";
 808 -            User = user;
 809 -            Group = "nginx";
 810 -            Restart = "always";
 811 -          };
 812 -          serviceConfig.ExecStart = "${pkgs.sourcehut.buildsrht}/bin/builds.sr.ht-worker";
 813 -        };
 814 -      };
 815 -    };
 816 -
 817 -    services.sourcehut.settings = {
 818 -      # URL builds.sr.ht is being served at (protocol://domain)
 819 -      "builds.sr.ht".origin = mkDefault "http://builds.${cfg.originBase}";
 820 -      # Address and port to bind the debug server to
 821 -      "builds.sr.ht".debug-host = mkDefault "0.0.0.0";
 822 -      "builds.sr.ht".debug-port = mkDefault port;
 823 -      # Configures the SQLAlchemy connection string for the database.
 824 -      "builds.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
 825 -      # Set to "yes" to automatically run migrations on package upgrade.
 826 -      "builds.sr.ht".migrate-on-upgrade = mkDefault "yes";
 827 -      # builds.sr.ht's OAuth client ID and secret for meta.sr.ht
 828 -      # Register your client at meta.example.org/oauth
 829 -      "builds.sr.ht".oauth-client-id = mkDefault null;
 830 -      "builds.sr.ht".oauth-client-secret = mkDefault null;
 831 -      # The redis connection used for the celery worker
 832 -      "builds.sr.ht".redis = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/3";
 833 -      # The shell used for ssh
 834 -      "builds.sr.ht".shell = mkDefault "runner-shell";
 835 -      # Register the builds.sr.ht dispatcher
 836 -      "git.sr.ht::dispatch".${builtins.unsafeDiscardStringContext "${pkgs.sourcehut.buildsrht}/bin/buildsrht-keys"} = mkDefault "${user}:${user}";
 837 -
 838 -      # Location for build logs, images, and control command
 839 -    } // lib.attrsets.optionalAttrs scfg.enableWorker {
 840 -      # Default worker stores logs that are accessible via this address:port
 841 -      "builds.sr.ht::worker".name = mkDefault "127.0.0.1:5020";
 842 -      "builds.sr.ht::worker".buildlogs = mkDefault "${scfg.statePath}/logs";
 843 -      "builds.sr.ht::worker".images = mkDefault "${image_dir}/images";
 844 -      "builds.sr.ht::worker".controlcmd = mkDefault "${image_dir}/images/control";
 845 -      "builds.sr.ht::worker".timeout = mkDefault "3m";
 846 -    };
 847 -
 848 -    services.nginx.virtualHosts."logs.${cfg.originBase}" =
 849 -      if scfg.enableWorker then {
 850 -        listen = with builtins; let address = split ":" cfg.settings."builds.sr.ht::worker".name;
 851 -        in [{ addr = elemAt address 0; port = lib.toInt (elemAt address 2); }];
 852 -        locations."/logs".root = "${scfg.statePath}";
 853 -      } else { };
 854 -
 855 -    services.nginx.virtualHosts."builds.${cfg.originBase}" = {
 856 -      forceSSL = true;
 857 -      locations."/".proxyPass = "http://${cfg.address}:${toString port}";
 858 -      locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
 859 -      locations."/static".root = "${pkgs.sourcehut.buildsrht}/${pkgs.sourcehut.python.sitePackages}/buildsrht";
 860 -    };
 861 -  };
 862 -}
 863 diff --git a/nixos/modules/services/misc/sourcehut/default.nix b/nixos/modules/services/misc/sourcehut/default.nix
 864 index 9c812d6b043..6cea2ce6490 100644
 865 --- a/nixos/modules/services/misc/sourcehut/default.nix
 866 +++ b/nixos/modules/services/misc/sourcehut/default.nix
 867 @@ -1,14 +1,90 @@
 868  { config, pkgs, lib, ... }:
 869 -
 870  with lib;
 871  let
 872 +  inherit (config.services) nginx postfix postgresql redis;
 873 +  inherit (config.users) users groups;
 874    cfg = config.services.sourcehut;
 875 -  cfgIni = cfg.settings;
 876 -  settingsFormat = pkgs.formats.ini { };
 877 +  domain = cfg.settings."sr.ht".global-domain;
 878 +  settingsFormat = pkgs.formats.ini {
 879 +    listToValue = concatMapStringsSep "," (generators.mkValueStringDefault {});
 880 +    mkKeyValue = k: v:
 881 +      if v == null then ""
 882 +      else generators.mkKeyValueDefault {
 883 +        mkValueString = v:
 884 +          if v == true then "yes"
 885 +          else if v == false then "no"
 886 +          else generators.mkValueStringDefault {} v;
 887 +      } "=" k v;
 888 +  };
 889 +  configIniOfService = srv: settingsFormat.generate "sourcehut-${srv}-config.ini"
 890 +    # Each service needs access to only a subset of sections (and secrets).
 891 +    (filterAttrs (k: v: v != null)
 892 +    (mapAttrs (section: v:
 893 +      let srvMatch = builtins.match "^([a-z]*)\\.sr\\.ht(::.*)?$" section; in
 894 +      if srvMatch == null # Include sections shared by all services
 895 +      || head srvMatch == srv # Include sections for the service being configured
 896 +      then v
 897 +      # Enable Web links and integrations between services.
 898 +      else if tail srvMatch == [ null ] && elem (head srvMatch) cfg.services
 899 +      then {
 900 +        inherit (v) origin;
 901 +        # mansrht crashes without it
 902 +        oauth-client-id = v.oauth-client-id or null;
 903 +      }
 904 +      # Drop sub-sections of other services
 905 +      else null)
 906 +    (recursiveUpdate cfg.settings {
 907 +      # Those paths are mounted using BindPaths= or BindReadOnlyPaths=
 908 +      # for services needing access to them.
 909 +      "builds.sr.ht::worker".buildlogs = "/var/log/sourcehut/buildsrht/logs";
 910 +      "git.sr.ht".post-update-script = "/var/lib/sourcehut/gitsrht/bin/post-update-script";
 911 +      "git.sr.ht".repos = "/var/lib/sourcehut/gitsrht/repos";
 912 +      "hg.sr.ht".changegroup-script = "/var/lib/sourcehut/hgsrht/bin/changegroup-script";
 913 +      "hg.sr.ht".repos = "/var/lib/sourcehut/hgsrht/repos";
 914 +      # Making this a per service option despite being in a global section,
 915 +      # so that it uses the redis-server used by the service.
 916 +      "sr.ht".redis-host = cfg.${srv}.redis.host;
 917 +    })));
 918 +  commonServiceSettings = srv: {
 919 +    origin = mkOption {
 920 +      description = "URL ${srv}.sr.ht is being served at (protocol://domain)";
 921 +      type = types.str;
 922 +      default = "https://${srv}.${domain}";
 923 +      defaultText = "https://${srv}.example.com";
 924 +    };
 925 +    debug-host = mkOption {
 926 +      description = "Address to bind the debug server to.";
 927 +      type = with types; nullOr str;
 928 +      default = null;
 929 +    };
 930 +    debug-port = mkOption {
 931 +      description = "Port to bind the debug server to.";
 932 +      type = with types; nullOr str;
 933 +      default = null;
 934 +    };
 935 +    connection-string = mkOption {
 936 +      description = "SQLAlchemy connection string for the database.";
 937 +      type = types.str;
 938 +      default = "postgresql:///localhost?user=${srv}srht&host=/run/postgresql";
 939 +    };
 940 +    migrate-on-upgrade = mkEnableOption "automatic migrations on package upgrade" // { default = true; };
 941 +    oauth-client-id = mkOption {
 942 +      description = "${srv}.sr.ht's OAuth client id for meta.sr.ht.";
 943 +      type = types.str;
 944 +    };
 945 +    oauth-client-secret = mkOption {
 946 +      description = "${srv}.sr.ht's OAuth client secret for meta.sr.ht.";
 947 +      type = types.path;
 948 +      apply = s: "<" + toString s;
 949 +    };
 950 +  };
 951
 952    # Specialized python containing all the modules
 953    python = pkgs.sourcehut.python.withPackages (ps: with ps; [
 954      gunicorn
 955 +    eventlet
 956 +    # For monitoring Celery: sudo -u listssrht celery --app listssrht.process -b redis+socket:///run/redis-sourcehut/redis.sock?virtual_host=5 flower
 957 +    flower
 958      # Sourcehut services
 959      srht
 960      buildsrht
 961 @@ -19,69 +95,37 @@ let
 962      listssrht
 963      mansrht
 964      metasrht
 965 +    # Not a python package
 966 +    #pagessrht
 967      pastesrht
 968      todosrht
 969    ]);
 970 +  mkOptionNullOrStr = description: mkOption {
 971 +    inherit description;
 972 +    type = with types; nullOr str;
 973 +    default = null;
 974 +  };
 975  in
 976  {
 977 -  imports =
 978 -    [
 979 -      ./git.nix
 980 -      ./hg.nix
 981 -      ./hub.nix
 982 -      ./todo.nix
 983 -      ./man.nix
 984 -      ./meta.nix
 985 -      ./paste.nix
 986 -      ./builds.nix
 987 -      ./lists.nix
 988 -      ./dispatch.nix
 989 -      (mkRemovedOptionModule [ "services" "sourcehut" "nginx" "enable" ] ''
 990 -        The sourcehut module supports `nginx` as a local reverse-proxy by default and doesn't
 991 -        support other reverse-proxies officially.
 992 -
 993 -        However it's possible to use an alternative reverse-proxy by
 994 -
 995 -          * disabling nginx
 996 -          * adjusting the relevant settings for server addresses and ports directly
 997 -
 998 -        Further details about this can be found in the `Sourcehut`-section of the NixOS-manual.
 999 -      '')
1000 -    ];
1001 -
1002    options.services.sourcehut = {
1003 -    enable = mkOption {
1004 -      type = types.bool;
1005 -      default = false;
1006 -      description = ''
1007 -        Enable sourcehut - git hosting, continuous integration, mailing list, ticket tracking,
1008 -        task dispatching, wiki and account management services
1009 -      '';
1010 -    };
1011 +    enable = mkEnableOption ''
1012 +      sourcehut - git hosting, continuous integration, mailing list, ticket tracking,
1013 +      task dispatching, wiki and account management services
1014 +    '';
1015
1016      services = mkOption {
1017 -      type = types.nonEmptyListOf (types.enum [ "builds" "dispatch" "git" "hub" "hg" "lists" "man" "meta" "paste" "todo" ]);
1018 -      default = [ "man" "meta" "paste" ];
1019 -      example = [ "builds" "dispatch" "git" "hub" "hg" "lists" "man" "meta" "paste" "todo" ];
1020 +      type = with types; listOf (enum
1021 +        [ "builds" "dispatch" "git" "hg" "hub" "lists" "man" "meta" "pages" "paste" "todo" ]);
1022 +      defaultText = "locally enabled services";
1023        description = ''
1024 -        Services to enable on the sourcehut network.
1025 +        Services that may be displayed as links in the title bar of the Web interface.
1026        '';
1027      };
1028
1029 -    originBase = mkOption {
1030 +    listenAddress = mkOption {
1031        type = types.str;
1032 -      default = with config.networking; hostName + lib.optionalString (domain != null) ".${domain}";
1033 -      description = ''
1034 -        Host name used by reverse-proxy and for default settings. Will host services at git."''${originBase}". For example: git.sr.ht
1035 -      '';
1036 -    };
1037 -
1038 -    address = mkOption {
1039 -      type = types.str;
1040 -      default = "127.0.0.1";
1041 -      description = ''
1042 -        Address to bind to.
1043 -      '';
1044 +      default = "localhost";
1045 +      description = "Address to bind to.";
1046      };
1047
1048      python = mkOption {
1049 @@ -94,105 +138,1212 @@ in
1050        '';
1051      };
1052
1053 -    statePath = mkOption {
1054 -      type = types.path;
1055 -      default = "/var/lib/sourcehut";
1056 -      description = ''
1057 -        Root state path for the sourcehut network. If left as the default value
1058 -        this directory will automatically be created before the sourcehut server
1059 -        starts, otherwise the sysadmin is responsible for ensuring the
1060 -        directory exists with appropriate ownership and permissions.
1061 -      '';
1062 +    minio = {
1063 +      enable = mkEnableOption ''local minio integration'';
1064 +    };
1065 +
1066 +    nginx = {
1067 +      enable = mkEnableOption ''local nginx integration'';
1068 +      virtualHost = mkOption {
1069 +        type = types.attrs;
1070 +        default = {};
1071 +        description = "Virtual-host configuration merged with all Sourcehut's virtual-hosts.";
1072 +      };
1073 +    };
1074 +
1075 +    postfix = {
1076 +      enable = mkEnableOption ''local postfix integration'';
1077 +    };
1078 +
1079 +    postgresql = {
1080 +      enable = mkEnableOption ''local postgresql integration'';
1081 +    };
1082 +
1083 +    redis = {
1084 +      enable = mkEnableOption ''local redis integration in a dedicated redis-server'';
1085      };
1086
1087      settings = mkOption {
1088        type = lib.types.submodule {
1089          freeformType = settingsFormat.type;
1090 +        options."sr.ht" = {
1091 +          global-domain = mkOption {
1092 +            description = "Global domain name.";
1093 +            type = types.str;
1094 +            example = "example.com";
1095 +          };
1096 +          environment = mkOption {
1097 +            description = "Values other than \"production\" adds a banner to each page.";
1098 +            type = types.enum [ "development" "production" ];
1099 +            default = "development";
1100 +          };
1101 +          network-key = mkOption {
1102 +            description = ''
1103 +              An absolute file path (which should be outside the Nix-store)
1104 +              to a secret key to encrypt internal messages with. Use <code>srht-keygen network</code> to
1105 +              generate this key. It must be consistent between all services and nodes.
1106 +            '';
1107 +            type = types.path;
1108 +            apply = s: "<" + toString s;
1109 +          };
1110 +          owner-email = mkOption {
1111 +            description = "Owner's email.";
1112 +            type = types.str;
1113 +            default = "contact@example.com";
1114 +          };
1115 +          owner-name = mkOption {
1116 +            description = "Owner's name.";
1117 +            type = types.str;
1118 +            default = "John Doe";
1119 +          };
1120 +          site-blurb = mkOption {
1121 +            description = "Blurb for your site.";
1122 +            type = types.str;
1123 +            default = "the hacker's forge";
1124 +          };
1125 +          site-info = mkOption {
1126 +            description = "The top-level info page for your site.";
1127 +            type = types.str;
1128 +            default = "https://sourcehut.org";
1129 +          };
1130 +          service-key = mkOption {
1131 +            description = ''
1132 +              An absolute file path (which should be outside the Nix-store)
1133 +              to a key used for encrypting session cookies. Use <code>srht-keygen service</code> to
1134 +              generate the service key. This must be shared between each node of the same
1135 +              service (e.g. git1.sr.ht and git2.sr.ht), but different services may use
1136 +              different keys. If you configure all of your services with the same
1137 +              config.ini, you may use the same service-key for all of them.
1138 +            '';
1139 +            type = types.path;
1140 +            apply = s: "<" + toString s;
1141 +          };
1142 +          site-name = mkOption {
1143 +            description = "The name of your network of sr.ht-based sites.";
1144 +            type = types.str;
1145 +            default = "sourcehut";
1146 +          };
1147 +          source-url = mkOption {
1148 +            description = "The source code for your fork of sr.ht.";
1149 +            type = types.str;
1150 +            default = "https://git.sr.ht/~sircmpwn/srht";
1151 +          };
1152 +        };
1153 +        options.mail = {
1154 +          smtp-host = mkOptionNullOrStr "Outgoing SMTP host.";
1155 +          smtp-port = mkOption {
1156 +            description = "Outgoing SMTP port.";
1157 +            type = with types; nullOr port;
1158 +            default = null;
1159 +          };
1160 +          smtp-user = mkOptionNullOrStr "Outgoing SMTP user.";
1161 +          smtp-password = mkOptionNullOrStr "Outgoing SMTP password.";
1162 +          smtp-from = mkOptionNullOrStr "Outgoing SMTP FROM.";
1163 +          error-to = mkOptionNullOrStr "Address receiving application exceptions";
1164 +          error-from = mkOptionNullOrStr "Address sending application exceptions";
1165 +          pgp-privkey = mkOptionNullOrStr ''
1166 +            An absolute file path (which should be outside the Nix-store)
1167 +            to an OpenPGP private key.
1168 +
1169 +            Your PGP key information (DO NOT mix up pub and priv here)
1170 +            You must remove the password from your secret key, if present.
1171 +            You can do this with <code>gpg --edit-key [key-id]</code>,
1172 +            then use the <code>passwd</code> command and do not enter a new password.
1173 +          '';
1174 +          pgp-pubkey = mkOptionNullOrStr "OpenPGP public key.";
1175 +          pgp-key-id = mkOptionNullOrStr "OpenPGP key identifier.";
1176 +        };
1177 +        options.objects = {
1178 +          s3-upstream = mkOption {
1179 +            description = "Configure the S3-compatible object storage service.";
1180 +            type = with types; nullOr str;
1181 +            default = null;
1182 +          };
1183 +          s3-access-key = mkOption {
1184 +            description = "Access key to the S3-compatible object storage service";
1185 +            type = with types; nullOr str;
1186 +            default = null;
1187 +          };
1188 +          s3-secret-key = mkOption {
1189 +            description = ''
1190 +              An absolute file path (which should be outside the Nix-store)
1191 +              to the secret key of the S3-compatible object storage service.
1192 +            '';
1193 +            type = with types; nullOr path;
1194 +            default = null;
1195 +            apply = mapNullable (s: "<" + toString s);
1196 +          };
1197 +        };
1198 +        options.webhooks = {
1199 +          private-key = mkOption {
1200 +            description = ''
1201 +              An absolute file path (which should be outside the Nix-store)
1202 +              to a base64-encoded Ed25519 key for signing webhook payloads.
1203 +              This should be consistent for all *.sr.ht sites,
1204 +              as this key will be used to verify signatures
1205 +              from other sites in your network.
1206 +              Use the <code>srht-keygen webhook</code> command to generate a key.
1207 +            '';
1208 +            type = types.path;
1209 +            apply = s: "<" + toString s;
1210 +          };
1211 +        };
1212 +
1213 +        options."dispatch.sr.ht" = commonServiceSettings "dispatch" // {
1214 +        };
1215 +        options."dispatch.sr.ht::github" = {
1216 +          oauth-client-id = mkOptionNullOrStr "OAuth client id.";
1217 +          oauth-client-secret = mkOptionNullOrStr "OAuth client secret.";
1218 +        };
1219 +        options."dispatch.sr.ht::gitlab" = {
1220 +          enabled = mkEnableOption "GitLab integration";
1221 +          canonical-upstream = mkOption {
1222 +            type = types.str;
1223 +            description = "Canonical upstream.";
1224 +            default = "gitlab.com";
1225 +          };
1226 +          repo-cache = mkOption {
1227 +            type = types.str;
1228 +            description = "Repository cache directory.";
1229 +            default = "./repo-cache";
1230 +          };
1231 +          "gitlab.com" = mkOption {
1232 +            type = with types; nullOr str;
1233 +            description = "GitLab id and secret.";
1234 +            default = null;
1235 +            example = "GitLab:application id:secret";
1236 +          };
1237 +        };
1238 +
1239 +        options."builds.sr.ht" = commonServiceSettings "builds" // {
1240 +          allow-free = mkEnableOption "nonpaying users to submit builds";
1241 +          redis = mkOption {
1242 +            description = "The Redis connection used for the Celery worker.";
1243 +            type = types.str;
1244 +            default = "redis+socket:///run/redis-sourcehut-buildsrht/redis.sock?virtual_host=2";
1245 +          };
1246 +          shell = mkOption {
1247 +            description = ''
1248 +              Scripts used to launch on SSH connection.
1249 +              <literal>/usr/bin/master-shell</literal> on master,
1250 +              <literal>/usr/bin/runner-shell</literal> on runner.
1251 +              If master and worker are on the same system
1252 +              set to <literal>/usr/bin/runner-shell</literal>.
1253 +            '';
1254 +            type = types.enum ["/usr/bin/master-shell" "/usr/bin/runner-shell"];
1255 +            default = "/usr/bin/master-shell";
1256 +          };
1257 +        };
1258 +        options."builds.sr.ht::worker" = {
1259 +          bind-address = mkOption {
1260 +            description = ''
1261 +              HTTP bind address for serving local build information/monitoring.
1262 +            '';
1263 +            type = types.str;
1264 +            default = "localhost:8080";
1265 +          };
1266 +          buildlogs = mkOption {
1267 +            description = "Path to write build logs.";
1268 +            type = types.str;
1269 +            default = "/var/log/sourcehut/buildsrht";
1270 +          };
1271 +          name = mkOption {
1272 +            description = ''
1273 +              Listening address and listening port
1274 +              of the build runner (with HTTP port if not 80).
1275 +            '';
1276 +            type = types.str;
1277 +            default = "localhost:5020";
1278 +          };
1279 +          timeout = mkOption {
1280 +            description = ''
1281 +              Max build duration.
1282 +              See <link xlink:href="https://golang.org/pkg/time/#ParseDuration"/>.
1283 +            '';
1284 +            type = types.str;
1285 +            default = "3m";
1286 +          };
1287 +        };
1288 +
1289 +        options."git.sr.ht" = commonServiceSettings "git" // {
1290 +          outgoing-domain = mkOption {
1291 +            description = "Outgoing domain.";
1292 +            type = types.str;
1293 +            default = "https://git.localhost.localdomain";
1294 +          };
1295 +          post-update-script = mkOption {
1296 +            description = ''
1297 +              A post-update script which is installed in every git repo.
1298 +              This setting is propagated to newer and existing repositories.
1299 +            '';
1300 +            type = types.path;
1301 +            default = "${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook";
1302 +            defaultText = "\${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook";
1303 +            # Git hooks are run relative to their repository's directory,
1304 +            # but gitsrht-update-hook looks up ../config.ini
1305 +            apply = p: pkgs.writeShellScript "update-hook-wrapper" ''
1306 +              set -e
1307 +              test -e "''${PWD%/*}"/config.ini ||
1308 +              ln -s /run/sourcehut/gitsrht/config.ini "''${PWD%/*}"/config.ini
1309 +              exec -a "$0" '${p}' "$@"
1310 +            '';
1311 +          };
1312 +          repos = mkOption {
1313 +            description = ''
1314 +              Path to git repositories on disk.
1315 +              If changing the default, you must ensure that
1316 +              the gitsrht's user as read and write access to it.
1317 +            '';
1318 +            type = types.str;
1319 +            default = "/var/lib/sourcehut/gitsrht/repos";
1320 +          };
1321 +          webhooks = mkOption {
1322 +            description = "The Redis connection used for the webhooks worker.";
1323 +            type = types.str;
1324 +            default = "redis+socket:///run/redis-sourcehut-gitsrht/redis.sock?virtual_host=1";
1325 +          };
1326 +        };
1327 +        options."git.sr.ht::api" = {
1328 +          internal-ipnet = mkOption {
1329 +            description = ''
1330 +              Set of IP subnets which are permitted to utilize internal API
1331 +              authentication. This should be limited to the subnets
1332 +              from which your *.sr.ht services are running.
1333 +              See <xref linkend="opt-services.sourcehut.listenAddress"/>.
1334 +            '';
1335 +            type = with types; listOf str;
1336 +            default = [ "127.0.0.0/8" "::1/128" ];
1337 +          };
1338 +        };
1339 +
1340 +        options."hg.sr.ht" = commonServiceSettings "hg" // {
1341 +          changegroup-script = mkOption {
1342 +            description = ''
1343 +              A changegroup script which is installed in every mercurial repo.
1344 +              This setting is propagated to newer and existing repositories.
1345 +            '';
1346 +            type = types.str;
1347 +            default = "${cfg.python}/bin/hgsrht-hook-changegroup";
1348 +            defaultText = "\${cfg.python}/bin/hgsrht-hook-changegroup";
1349 +            # Mercurial's changegroup hooks are run relative to their repository's directory,
1350 +            # but hgsrht-hook-changegroup looks up ./config.ini
1351 +            apply = p: pkgs.writeShellScript "hook-changegroup-wrapper" ''
1352 +              set -e
1353 +              test -e "''$PWD"/config.ini ||
1354 +              ln -s /run/sourcehut/hgsrht/config.ini "''$PWD"/config.ini
1355 +              exec -a "$0" '${p}' "$@"
1356 +            '';
1357 +          };
1358 +          repos = mkOption {
1359 +            description = ''
1360 +              Path to mercurial repositories on disk.
1361 +              If changing the default, you must ensure that
1362 +              the hgsrht's user as read and write access to it.
1363 +            '';
1364 +            type = types.str;
1365 +            default = "/var/lib/sourcehut/hgsrht/repos";
1366 +          };
1367 +          srhtext = mkOptionNullOrStr ''
1368 +            Path to the srht mercurial extension
1369 +            (defaults to where the hgsrht code is)
1370 +          '';
1371 +          clone_bundle_threshold = mkOption {
1372 +            description = ".hg/store size (in MB) past which the nightly job generates clone bundles.";
1373 +            type = types.ints.unsigned;
1374 +            default = 50;
1375 +          };
1376 +          hg_ssh = mkOption {
1377 +            description = "Path to hg-ssh (if not in $PATH).";
1378 +            type = types.str;
1379 +            default = "${pkgs.mercurial}/bin/hg-ssh";
1380 +            defaultText = "\${pkgs.mercurial}/bin/hg-ssh";
1381 +          };
1382 +          webhooks = mkOption {
1383 +            description = "The Redis connection used for the webhooks worker.";
1384 +            type = types.str;
1385 +            default = "redis+socket:///run/redis-sourcehut-hgsrht/redis.sock?virtual_host=1";
1386 +          };
1387 +        };
1388 +
1389 +        options."hub.sr.ht" = commonServiceSettings "hub" // {
1390 +        };
1391 +
1392 +        options."lists.sr.ht" = commonServiceSettings "lists" // {
1393 +          allow-new-lists = mkEnableOption "Allow creation of new lists.";
1394 +          notify-from = mkOption {
1395 +            description = "Outgoing email for notifications generated by users.";
1396 +            type = types.str;
1397 +            default = "lists-notify@localhost.localdomain";
1398 +          };
1399 +          posting-domain = mkOption {
1400 +            description = "Posting domain.";
1401 +            type = types.str;
1402 +            default = "lists.localhost.localdomain";
1403 +          };
1404 +          redis = mkOption {
1405 +            description = "The Redis connection used for the Celery worker.";
1406 +            type = types.str;
1407 +            default = "redis+socket:///run/redis-sourcehut-listssrht/redis.sock?virtual_host=2";
1408 +          };
1409 +          webhooks = mkOption {
1410 +            description = "The Redis connection used for the webhooks worker.";
1411 +            type = types.str;
1412 +            default = "redis+socket:///run/redis-sourcehut-listssrht/redis.sock?virtual_host=1";
1413 +          };
1414 +        };
1415 +        options."lists.sr.ht::worker" = {
1416 +          reject-mimetypes = mkOption {
1417 +            description = ''
1418 +              Comma-delimited list of Content-Types to reject. Messages with Content-Types
1419 +              included in this list are rejected. Multipart messages are always supported,
1420 +              and each part is checked against this list.
1421 +
1422 +              Uses fnmatch for wildcard expansion.
1423 +            '';
1424 +            type = with types; listOf str;
1425 +            default = ["text/html"];
1426 +          };
1427 +          reject-url = mkOption {
1428 +            description = "Reject URL.";
1429 +            type = types.str;
1430 +            default = "https://man.sr.ht/lists.sr.ht/etiquette.md";
1431 +          };
1432 +          sock = mkOption {
1433 +            description = ''
1434 +              Path for the lmtp daemon's unix socket. Direct incoming mail to this socket.
1435 +              Alternatively, specify IP:PORT and an SMTP server will be run instead.
1436 +            '';
1437 +            type = types.str;
1438 +            default = "/tmp/lists.sr.ht-lmtp.sock";
1439 +          };
1440 +          sock-group = mkOption {
1441 +            description = ''
1442 +              The lmtp daemon will make the unix socket group-read/write
1443 +              for users in this group.
1444 +            '';
1445 +            type = types.str;
1446 +            default = "postfix";
1447 +          };
1448 +        };
1449 +
1450 +        options."man.sr.ht" = commonServiceSettings "man" // {
1451 +        };
1452 +
1453 +        options."meta.sr.ht" =
1454 +          removeAttrs (commonServiceSettings "meta")
1455 +            ["oauth-client-id" "oauth-client-secret"] // {
1456 +          api-origin = mkOption {
1457 +            description = "Origin URL for API, 100 more than web.";
1458 +            type = types.str;
1459 +            default = "http://${cfg.listenAddress}:${toString (cfg.meta.port + 100)}";
1460 +            defaultText = ''http://<xref linkend="opt-services.sourcehut.listenAddress"/>:''${toString (<xref linkend="opt-services.sourcehut.meta.port"/> + 100)}'';
1461 +          };
1462 +          webhooks = mkOption {
1463 +            description = "The Redis connection used for the webhooks worker.";
1464 +            type = types.str;
1465 +            default = "redis+socket:///run/redis-sourcehut-metasrht/redis.sock?virtual_host=1";
1466 +          };
1467 +          welcome-emails = mkEnableOption "sending stock sourcehut welcome emails after signup";
1468 +        };
1469 +        options."meta.sr.ht::api" = {
1470 +          internal-ipnet = mkOption {
1471 +            description = ''
1472 +              Set of IP subnets which are permitted to utilize internal API
1473 +              authentication. This should be limited to the subnets
1474 +              from which your *.sr.ht services are running.
1475 +              See <xref linkend="opt-services.sourcehut.listenAddress"/>.
1476 +            '';
1477 +            type = with types; listOf str;
1478 +            default = [ "127.0.0.0/8" "::1/128" ];
1479 +          };
1480 +        };
1481 +        options."meta.sr.ht::aliases" = mkOption {
1482 +          description = "Aliases for the client IDs of commonly used OAuth clients.";
1483 +          type = with types; attrsOf int;
1484 +          default = {};
1485 +          example = { "git.sr.ht" = 12345; };
1486 +        };
1487 +        options."meta.sr.ht::billing" = {
1488 +          enabled = mkEnableOption "the billing system";
1489 +          stripe-public-key = mkOptionNullOrStr "Public key for Stripe. Get your keys at https://dashboard.stripe.com/account/apikeys";
1490 +          stripe-secret-key = mkOptionNullOrStr ''
1491 +            An absolute file path (which should be outside the Nix-store)
1492 +            to a secret key for Stripe. Get your keys at https://dashboard.stripe.com/account/apikeys
1493 +          '' // {
1494 +            apply = mapNullable (s: "<" + toString s);
1495 +          };
1496 +        };
1497 +        options."meta.sr.ht::settings" = {
1498 +          registration = mkEnableOption "public registration";
1499 +          onboarding-redirect = mkOption {
1500 +            description = "Where to redirect new users upon registration.";
1501 +            type = types.str;
1502 +            default = "https://meta.localhost.localdomain";
1503 +          };
1504 +          user-invites = mkOption {
1505 +            description = ''
1506 +              How many invites each user is issued upon registration
1507 +              (only applicable if open registration is disabled).
1508 +            '';
1509 +            type = types.ints.unsigned;
1510 +            default = 5;
1511 +          };
1512 +        };
1513 +
1514 +        options."pages.sr.ht" = commonServiceSettings "pages" // {
1515 +          gemini-certs = mkOption {
1516 +            description = ''
1517 +              An absolute file path (which should be outside the Nix-store)
1518 +              to Gemini certificates.
1519 +            '';
1520 +            type = with types; nullOr path;
1521 +            default = null;
1522 +          };
1523 +          max-site-size = mkOption {
1524 +            description = "Maximum size of any given site (post-gunzip), in MiB.";
1525 +            type = types.int;
1526 +            default = 1024;
1527 +          };
1528 +          user-domain = mkOption {
1529 +            description = ''
1530 +              Configures the user domain, if enabled.
1531 +              All users are given &lt;username&gt;.this.domain.
1532 +            '';
1533 +            type = with types; nullOr str;
1534 +            default = null;
1535 +          };
1536 +        };
1537 +        options."pages.sr.ht::api" = {
1538 +          internal-ipnet = mkOption {
1539 +            description = ''
1540 +              Set of IP subnets which are permitted to utilize internal API
1541 +              authentication. This should be limited to the subnets
1542 +              from which your *.sr.ht services are running.
1543 +              See <xref linkend="opt-services.sourcehut.listenAddress"/>.
1544 +            '';
1545 +            type = with types; listOf str;
1546 +            default = [ "127.0.0.0/8" "::1/128" ];
1547 +          };
1548 +        };
1549 +
1550 +        options."paste.sr.ht" = commonServiceSettings "paste" // {
1551 +        };
1552 +
1553 +        options."todo.sr.ht" = commonServiceSettings "todo" // {
1554 +          notify-from = mkOption {
1555 +            description = "Outgoing email for notifications generated by users.";
1556 +            type = types.str;
1557 +            default = "todo-notify@localhost.localdomain";
1558 +          };
1559 +          webhooks = mkOption {
1560 +            description = "The Redis connection used for the webhooks worker.";
1561 +            type = types.str;
1562 +            default = "redis+socket:///run/redis-sourcehut-todosrht/redis.sock?virtual_host=1";
1563 +          };
1564 +        };
1565 +        options."todo.sr.ht::mail" = {
1566 +          posting-domain = mkOption {
1567 +            description = "Posting domain.";
1568 +            type = types.str;
1569 +            default = "todo.localhost.localdomain";
1570 +          };
1571 +          sock = mkOption {
1572 +            description = ''
1573 +              Path for the lmtp daemon's unix socket. Direct incoming mail to this socket.
1574 +              Alternatively, specify IP:PORT and an SMTP server will be run instead.
1575 +            '';
1576 +            type = types.str;
1577 +            default = "/tmp/todo.sr.ht-lmtp.sock";
1578 +          };
1579 +          sock-group = mkOption {
1580 +            description = ''
1581 +              The lmtp daemon will make the unix socket group-read/write
1582 +              for users in this group.
1583 +            '';
1584 +            type = types.str;
1585 +            default = "postfix";
1586 +          };
1587 +        };
1588        };
1589        default = { };
1590        description = ''
1591          The configuration for the sourcehut network.
1592        '';
1593      };
1594 -  };
1595
1596 -  config = mkIf cfg.enable {
1597 -    assertions =
1598 -      [
1599 -        {
1600 -          assertion = with cfgIni.webhooks; private-key != null && stringLength private-key == 44;
1601 -          message = "The webhook's private key must be defined and of a 44 byte length.";
1602 -        }
1603 +    builds = {
1604 +      enableWorker = mkEnableOption "worker for builds.sr.ht";
1605
1606 -        {
1607 -          assertion = hasAttrByPath [ "meta.sr.ht" "origin" ] cfgIni && cfgIni."meta.sr.ht".origin != null;
1608 -          message = "meta.sr.ht's origin must be defined.";
1609 -        }
1610 -      ];
1611 +      images = mkOption {
1612 +        type = with types; attrsOf (attrsOf (attrsOf package));
1613 +        default = { };
1614 +        example = lib.literalExample ''(let
1615 +            # Pinning unstable to allow usage with flakes and limit rebuilds.
1616 +            pkgs_unstable = builtins.fetchGit {
1617 +                url = "https://github.com/NixOS/nixpkgs";
1618 +                rev = "ff96a0fa5635770390b184ae74debea75c3fd534";
1619 +                ref = "nixos-unstable";
1620 +            };
1621 +            image_from_nixpkgs = (import ("${pkgs.sourcehut.buildsrht}/lib/images/nixos/image.nix") {
1622 +              pkgs = (import pkgs_unstable {});
1623 +            });
1624 +          in
1625 +          {
1626 +            nixos.unstable.x86_64 = image_from_nixpkgs;
1627 +          }
1628 +        )'';
1629 +        description = ''
1630 +          Images for builds.sr.ht. Each package should be distro.release.arch and point to a /nix/store/package/root.img.qcow2.
1631 +        '';
1632 +      };
1633 +    };
1634
1635 -    virtualisation.docker.enable = true;
1636 -    environment.etc."sr.ht/config.ini".source =
1637 -      settingsFormat.generate "sourcehut-config.ini" (mapAttrsRecursive
1638 -        (
1639 -          path: v: if v == null then "" else v
1640 -        )
1641 -        cfg.settings);
1642 +    git = {
1643 +      package = mkOption {
1644 +        type = types.package;
1645 +        default = pkgs.git;
1646 +        example = literalExample "pkgs.gitFull";
1647 +        description = ''
1648 +          Git package for git.sr.ht. This can help silence collisions.
1649 +        '';
1650 +      };
1651 +      fcgiwrap.preforkProcess = mkOption {
1652 +        description = "Number of fcgiwrap processes to prefork.";
1653 +        type = types.int;
1654 +        default = 4;
1655 +      };
1656 +    };
1657
1658 -    environment.systemPackages = [ pkgs.sourcehut.coresrht ];
1659 +    hg = {
1660 +      package = mkOption {
1661 +        type = types.package;
1662 +        default = pkgs.mercurial;
1663 +        description = ''
1664 +          Mercurial package for hg.sr.ht. This can help silence collisions.
1665 +        '';
1666 +      };
1667 +      cloneBundles = mkOption {
1668 +        type = types.bool;
1669 +        default = false;
1670 +        description = ''
1671 +          Generate clonebundles (which require more disk space but dramatically speed up cloning large repositories).
1672 +        '';
1673 +      };
1674 +    };
1675
1676 -    # PostgreSQL server
1677 -    services.postgresql.enable = mkOverride 999 true;
1678 -    # Mail server
1679 -    services.postfix.enable = mkOverride 999 true;
1680 -    # Cron daemon
1681 -    services.cron.enable = mkOverride 999 true;
1682 -    # Redis server
1683 -    services.redis.enable = mkOverride 999 true;
1684 -    services.redis.bind = mkOverride 999 "127.0.0.1";
1685 -
1686 -    services.sourcehut.settings = {
1687 -      # The name of your network of sr.ht-based sites
1688 -      "sr.ht".site-name = mkDefault "sourcehut";
1689 -      # The top-level info page for your site
1690 -      "sr.ht".site-info = mkDefault "https://sourcehut.org";
1691 -      # {{ site-name }}, {{ site-blurb }}
1692 -      "sr.ht".site-blurb = mkDefault "the hacker's forge";
1693 -      # If this != production, we add a banner to each page
1694 -      "sr.ht".environment = mkDefault "development";
1695 -      # Contact information for the site owners
1696 -      "sr.ht".owner-name = mkDefault "Drew DeVault";
1697 -      "sr.ht".owner-email = mkDefault "sir@cmpwn.com";
1698 -      # The source code for your fork of sr.ht
1699 -      "sr.ht".source-url = mkDefault "https://git.sr.ht/~sircmpwn/srht";
1700 -      # A secret key to encrypt session cookies with
1701 -      "sr.ht".secret-key = mkDefault null;
1702 -      "sr.ht".global-domain = mkDefault null;
1703 -
1704 -      # Outgoing SMTP settings
1705 -      mail.smtp-host = mkDefault null;
1706 -      mail.smtp-port = mkDefault null;
1707 -      mail.smtp-user = mkDefault null;
1708 -      mail.smtp-password = mkDefault null;
1709 -      mail.smtp-from = mkDefault null;
1710 -      # Application exceptions are emailed to this address
1711 -      mail.error-to = mkDefault null;
1712 -      mail.error-from = mkDefault null;
1713 -      # Your PGP key information (DO NOT mix up pub and priv here)
1714 -      # You must remove the password from your secret key, if present.
1715 -      # You can do this with gpg --edit-key [key-id], then use the passwd
1716 -      # command and do not enter a new password.
1717 -      mail.pgp-privkey = mkDefault null;
1718 -      mail.pgp-pubkey = mkDefault null;
1719 -      mail.pgp-key-id = mkDefault null;
1720 -
1721 -      # base64-encoded Ed25519 key for signing webhook payloads. This should be
1722 -      # consistent for all *.sr.ht sites, as we'll use this key to verify signatures
1723 -      # from other sites in your network.
1724 -      #
1725 -      # Use the srht-webhook-keygen command to generate a key.
1726 -      webhooks.private-key = mkDefault null;
1727 +    lists = {
1728 +      process = {
1729 +        extraArgs = mkOption {
1730 +          type = with types; listOf str;
1731 +          default = [ "--loglevel DEBUG" "--pool eventlet" "--without-heartbeat" ];
1732 +          description = "Extra arguments passed to the Celery responsible for processing mails.";
1733 +        };
1734 +        celeryConfig = mkOption {
1735 +          type = types.lines;
1736 +          default = "";
1737 +          description = "Content of the <literal>celeryconfig.py</literal> used by the Celery of <literal>listssrht-process</literal>.";
1738 +        };
1739 +      };
1740      };
1741    };
1742 +
1743 +  config = mkIf cfg.enable (mkMerge [
1744 +    {
1745 +      environment.systemPackages = [ pkgs.sourcehut.coresrht ];
1746 +
1747 +      services.sourcehut.settings = {
1748 +        "git.sr.ht".outgoing-domain = mkDefault "https://git.${domain}";
1749 +        "lists.sr.ht".notify-from = mkDefault "lists-notify@${domain}";
1750 +        "lists.sr.ht".posting-domain = mkDefault "lists.${domain}";
1751 +        "meta.sr.ht::settings".onboarding-redirect = mkDefault "https://meta.${domain}";
1752 +        "todo.sr.ht".notify-from = mkDefault "todo-notify@${domain}";
1753 +        "todo.sr.ht::mail".posting-domain = mkDefault "todo.${domain}";
1754 +      };
1755 +    }
1756 +    (mkIf cfg.postgresql.enable {
1757 +      assertions = [
1758 +        { assertion = postgresql.enable;
1759 +          message = "postgresql must be enabled and configured";
1760 +        }
1761 +      ];
1762 +    })
1763 +    (mkIf cfg.postfix.enable {
1764 +      assertions = [
1765 +        { assertion = postfix.enable;
1766 +          message = "postfix must be enabled and configured";
1767 +        }
1768 +      ];
1769 +      # Needed for sharing the LMTP sockets with JoinsNamespaceOf=
1770 +      systemd.services.postfix.serviceConfig.PrivateTmp = true;
1771 +    })
1772 +    (mkIf cfg.redis.enable {
1773 +      services.redis.vmOverCommit = mkDefault true;
1774 +    })
1775 +    (mkIf cfg.nginx.enable {
1776 +      assertions = [
1777 +        { assertion = nginx.enable;
1778 +          message = "nginx must be enabled and configured";
1779 +        }
1780 +      ];
1781 +      # For proxyPass= in virtual-hosts for Sourcehut services.
1782 +      services.nginx.recommendedProxySettings = mkDefault true;
1783 +    })
1784 +    (mkIf (cfg.builds.enable || cfg.git.enable || cfg.hg.enable) {
1785 +      services.openssh = {
1786 +        # Note that sshd will continue to honor AuthorizedKeysFile.
1787 +        # Note that you may want automatically rotate
1788 +        # or link to /dev/null the following log files:
1789 +        # - /var/log/gitsrht-dispatch
1790 +        # - /var/log/{build,git,hg}srht-keys
1791 +        # - /var/log/{git,hg}srht-shell
1792 +        # - /var/log/gitsrht-update-hook
1793 +        authorizedKeysCommand = ''/etc/ssh/sourcehut/subdir/srht-dispatch "%u" "%h" "%t" "%k"'';
1794 +        # srht-dispatch will setuid/setgid according to [git.sr.ht::dispatch]
1795 +        authorizedKeysCommandUser = "root";
1796 +        extraConfig = ''
1797 +          PermitUserEnvironment SRHT_*
1798 +        '';
1799 +      };
1800 +      environment.etc."ssh/sourcehut/config.ini".source =
1801 +        settingsFormat.generate "sourcehut-dispatch-config.ini"
1802 +          (filterAttrs (k: v: k == "git.sr.ht::dispatch")
1803 +          cfg.settings);
1804 +      environment.etc."ssh/sourcehut/subdir/srht-dispatch" = {
1805 +        # sshd_config(5): The program must be owned by root, not writable by group or others
1806 +        mode = "0755";
1807 +        source = pkgs.writeShellScript "srht-dispatch" ''
1808 +          set -e
1809 +          cd /etc/ssh/sourcehut/subdir
1810 +          ${cfg.python}/bin/gitsrht-dispatch "$@"
1811 +        '';
1812 +      };
1813 +      systemd.services.sshd = {
1814 +        #path = optional cfg.git.enable [ cfg.git.package ];
1815 +        serviceConfig = {
1816 +          BindReadOnlyPaths =
1817 +            # Note that those /usr/bin/* paths are hardcoded in multiple places in *.sr.ht,
1818 +            # for instance to get the user from the [git.sr.ht::dispatch] settings.
1819 +            # *srht-keys needs to:
1820 +            # - access a redis-server in [sr.ht] redis-host,
1821 +            # - access the PostgreSQL server in [*.sr.ht] connection-string,
1822 +            # - query metasrht-api (through the HTTP API).
1823 +            # Using this has the side effect of creating empty files in /usr/bin/
1824 +            optionals cfg.builds.enable [
1825 +              "${pkgs.writeShellScript "buildsrht-keys-wrapper" ''
1826 +                set -ex
1827 +                cd /run/sourcehut/buildsrht/subdir
1828 +                exec -a "$0" ${pkgs.sourcehut.buildsrht}/bin/buildsrht-keys "$@"
1829 +              ''}:/usr/bin/buildsrht-keys"
1830 +              "${pkgs.sourcehut.buildsrht}/bin/master-shell:/usr/bin/master-shell"
1831 +              "${pkgs.sourcehut.buildsrht}/bin/runner-shell:/usr/bin/runner-shell"
1832 +            ] ++
1833 +            optionals cfg.git.enable [
1834 +              # /path/to/gitsrht-keys calls /path/to/gitsrht-shell,
1835 +              # or [git.sr.ht] shell= if set.
1836 +              "${pkgs.writeShellScript "gitsrht-keys-wrapper" ''
1837 +                set -ex
1838 +                cd /run/sourcehut/gitsrht/subdir
1839 +                exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-keys "$@"
1840 +              ''}:/usr/bin/gitsrht-keys"
1841 +              "${pkgs.writeShellScript "gitsrht-shell-wrapper" ''
1842 +                set -e
1843 +                cd /run/sourcehut/gitsrht/subdir
1844 +                exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-shell "$@"
1845 +              ''}:/usr/bin/gitsrht-shell"
1846 +            ] ++
1847 +            optionals cfg.hg.enable [
1848 +              # /path/to/hgsrht-keys calls /path/to/hgsrht-shell,
1849 +              # or [hg.sr.ht] shell= if set.
1850 +              "${pkgs.writeShellScript "hgsrht-keys-wrapper" ''
1851 +                set -ex
1852 +                cd /run/sourcehut/hgsrht/subdir
1853 +                exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-keys "$@"
1854 +              ''}:/usr/bin/hgsrht-keys"
1855 +              ":/usr/bin/hgsrht-shell"
1856 +              "${pkgs.writeShellScript "hgsrht-shell-wrapper" ''
1857 +                set -e
1858 +                cd /run/sourcehut/hgsrht/subdir
1859 +                exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-shell "$@"
1860 +              ''}:/usr/bin/hgsrht-shell"
1861 +            ];
1862 +        };
1863 +      };
1864 +    })
1865 +  ]);
1866 +
1867 +  imports = [
1868 +
1869 +    (import ./service.nix "builds" {
1870 +      inherit configIniOfService;
1871 +      srvsrht = "buildsrht";
1872 +      port = 5002;
1873 +      # TODO: a celery worker on the master and worker are apparently needed
1874 +      extraServices.buildsrht-worker = let
1875 +        qemuPackage = pkgs.qemu_kvm;
1876 +        serviceName = "buildsrht-worker";
1877 +        statePath = "/var/lib/sourcehut/${serviceName}";
1878 +        in mkIf cfg.builds.enableWorker {
1879 +        path = [ pkgs.openssh pkgs.docker ];
1880 +        preStart = ''
1881 +          set -x
1882 +          if test -z "$(docker images -q qemu:latest 2>/dev/null)" \
1883 +          || test "$(cat ${statePath}/docker-image-qemu)" != "${qemuPackage.version}"
1884 +          then
1885 +            # Create and import qemu:latest image for docker
1886 +            ${pkgs.dockerTools.streamLayeredImage {
1887 +              name = "qemu";
1888 +              tag = "latest";
1889 +              contents = [ qemuPackage ];
1890 +            }} | docker load
1891 +            # Mark down current package version
1892 +            echo '${qemuPackage.version}' >${statePath}/docker-image-qemu
1893 +          fi
1894 +        '';
1895 +        serviceConfig = {
1896 +          ExecStart = "${pkgs.sourcehut.buildsrht}/bin/builds.sr.ht-worker";
1897 +          RuntimeDirectory = [ "sourcehut/${serviceName}/subdir" ];
1898 +          # builds.sr.ht-worker looks up ../config.ini
1899 +          LogsDirectory = [ "sourcehut/${serviceName}" ];
1900 +          StateDirectory = [ "sourcehut/${serviceName}" ];
1901 +          WorkingDirectory = "-"+"/run/sourcehut/${serviceName}/subdir";
1902 +        };
1903 +      };
1904 +      extraConfig = let
1905 +        image_dirs = flatten (
1906 +          mapAttrsToList (distro: revs:
1907 +            mapAttrsToList (rev: archs:
1908 +              mapAttrsToList (arch: image:
1909 +                pkgs.runCommand "buildsrht-images" { } ''
1910 +                  mkdir -p $out/${distro}/${rev}/${arch}
1911 +                  ln -s ${image}/*.qcow2 $out/${distro}/${rev}/${arch}/root.img.qcow2
1912 +                ''
1913 +              ) archs
1914 +            ) revs
1915 +          ) cfg.builds.images
1916 +        );
1917 +        image_dir_pre = pkgs.symlinkJoin {
1918 +          name = "builds.sr.ht-worker-images-pre";
1919 +          paths = image_dirs;
1920 +            # FIXME: not working, apparently because ubuntu/latest is a broken link
1921 +            # ++ [ "${pkgs.sourcehut.buildsrht}/lib/images" ];
1922 +        };
1923 +        image_dir = pkgs.runCommand "builds.sr.ht-worker-images" { } ''
1924 +          mkdir -p $out/images
1925 +          cp -Lr ${image_dir_pre}/* $out/images
1926 +        '';
1927 +        in mkMerge [
1928 +        {
1929 +          users.users.${cfg.builds.user}.shell = pkgs.bash;
1930 +
1931 +          virtualisation.docker.enable = true;
1932 +
1933 +          services.sourcehut.settings = mkMerge [
1934 +            { # Note that git.sr.ht::dispatch is not a typo,
1935 +              # gitsrht-dispatch always use this section
1936 +              "git.sr.ht::dispatch"."/usr/bin/buildsrht-keys" =
1937 +                mkDefault "${cfg.builds.user}:${cfg.builds.group}";
1938 +            }
1939 +            (mkIf cfg.builds.enableWorker {
1940 +              "builds.sr.ht::worker".shell = "/usr/bin/runner-shell";
1941 +              "builds.sr.ht::worker".images = mkDefault "${image_dir}/images";
1942 +              "builds.sr.ht::worker".controlcmd = mkDefault "${image_dir}/images/control";
1943 +            })
1944 +          ];
1945 +        }
1946 +        (mkIf cfg.builds.enableWorker {
1947 +          users.groups = {
1948 +            docker.members = [ cfg.builds.user ];
1949 +          };
1950 +        })
1951 +        (mkIf (cfg.builds.enableWorker && cfg.nginx.enable) {
1952 +          # Allow nginx access to buildlogs
1953 +          users.users.${nginx.user}.extraGroups = [ cfg.builds.group ];
1954 +          systemd.services.nginx = {
1955 +            serviceConfig.BindReadOnlyPaths = [ "${cfg.settings."builds.sr.ht::worker".buildlogs}:/var/log/nginx/buildsrht/logs" ];
1956 +          };
1957 +          services.nginx.virtualHosts."logs.${domain}" = mkMerge [ {
1958 +            /* FIXME: is a listen needed?
1959 +            listen = with builtins;
1960 +              # FIXME: not compatible with IPv6
1961 +              let address = split ":" cfg.settings."builds.sr.ht::worker".name; in
1962 +              [{ addr = elemAt address 0; port = lib.toInt (elemAt address 2); }];
1963 +            */
1964 +            locations."/logs/".alias = "/var/log/nginx/buildsrht/logs/";
1965 +          } cfg.nginx.virtualHost ];
1966 +        })
1967 +      ];
1968 +    })
1969 +
1970 +    (import ./service.nix "dispatch" {
1971 +      inherit configIniOfService;
1972 +      port = 5005;
1973 +    })
1974 +
1975 +    (import ./service.nix "git" (let
1976 +      baseService = {
1977 +        path = [ cfg.git.package ];
1978 +        serviceConfig.BindPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/gitsrht/repos" ];
1979 +        serviceConfig.BindReadOnlyPaths = [ "${cfg.settings."git.sr.ht".post-update-script}:/var/lib/sourcehut/gitsrht/bin/post-update-script" ];
1980 +      };
1981 +      in {
1982 +      inherit configIniOfService;
1983 +      mainService = mkMerge [ baseService {
1984 +        serviceConfig.StateDirectory = [ "sourcehut/gitsrht" "sourcehut/gitsrht/repos" ];
1985 +      } ];
1986 +      port = 5001;
1987 +      webhooks = true;
1988 +      extraTimers.gitsrht-periodic = {
1989 +        service = baseService;
1990 +        timerConfig.OnCalendar = ["20min"];
1991 +      };
1992 +      extraConfig = mkMerge [
1993 +        {
1994 +          # https://stackoverflow.com/questions/22314298/git-push-results-in-fatal-protocol-error-bad-line-length-character-this
1995 +          # Probably could use gitsrht-shell if output is restricted to just parameters...
1996 +          users.users.${cfg.git.user}.shell = pkgs.bash;
1997 +          services.sourcehut.settings = {
1998 +            "git.sr.ht::dispatch"."/usr/bin/gitsrht-keys" =
1999 +              mkDefault "${cfg.git.user}:${cfg.git.group}";
2000 +          };
2001 +          systemd.services.sshd = baseService;
2002 +        }
2003 +        (mkIf cfg.nginx.enable {
2004 +          services.nginx.virtualHosts."git.${domain}" = {
2005 +            locations."/authorize" = {
2006 +              proxyPass = "http://${cfg.listenAddress}:${toString cfg.git.port}";
2007 +              extraConfig = ''
2008 +                proxy_pass_request_body off;
2009 +                proxy_set_header Content-Length "";
2010 +                proxy_set_header X-Original-URI $request_uri;
2011 +              '';
2012 +            };
2013 +            locations."~ ^/([^/]+)/([^/]+)/(HEAD|info/refs|objects/info/.*|git-upload-pack).*$" = {
2014 +              root = "/var/lib/sourcehut/gitsrht/repos";
2015 +              fastcgiParams = {
2016 +                GIT_HTTP_EXPORT_ALL = "";
2017 +                GIT_PROJECT_ROOT = "$document_root";
2018 +                PATH_INFO = "$uri";
2019 +                SCRIPT_FILENAME = "${cfg.git.package}/bin/git-http-backend";
2020 +              };
2021 +              extraConfig = ''
2022 +                auth_request /authorize;
2023 +                fastcgi_read_timeout 500s;
2024 +                fastcgi_pass unix:/run/gitsrht-fcgiwrap.sock;
2025 +                gzip off;
2026 +              '';
2027 +            };
2028 +          };
2029 +          systemd.sockets.gitsrht-fcgiwrap = {
2030 +            before = [ "nginx.service" ];
2031 +            wantedBy = [ "sockets.target" "gitsrht.service" ];
2032 +            # This path remains accessible to nginx.service, which has no RootDirectory=
2033 +            socketConfig.ListenStream = "/run/gitsrht-fcgiwrap.sock";
2034 +            socketConfig.SocketUser = nginx.user;
2035 +            socketConfig.SocketMode = "600";
2036 +          };
2037 +        })
2038 +      ];
2039 +      extraServices.gitsrht-fcgiwrap = mkIf cfg.nginx.enable {
2040 +        serviceConfig = {
2041 +          # Socket is passed by gitsrht-fcgiwrap.socket
2042 +          ExecStart = "${pkgs.fcgiwrap}/sbin/fcgiwrap -c ${toString cfg.git.fcgiwrap.preforkProcess}";
2043 +          # No need for config.ini
2044 +          ExecStartPre = mkForce [];
2045 +          User = null;
2046 +          DynamicUser = true;
2047 +          BindReadOnlyPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/gitsrht/repos" ];
2048 +          IPAddressDeny = "any";
2049 +          InaccessiblePaths = [ "-+/run/postgresql" "-+/run/redis-sourcehut" ];
2050 +          PrivateNetwork = true;
2051 +          RestrictAddressFamilies = mkForce [ "none" ];
2052 +          SystemCallFilter = mkForce [
2053 +            "@system-service"
2054 +            "~@aio" "~@keyring" "~@memlock" "~@privileged" "~@resources" "~@setuid"
2055 +            # @timer is needed for alarm()
2056 +          ];
2057 +        };
2058 +      };
2059 +    }))
2060 +
2061 +    (import ./service.nix "hg" (let
2062 +      baseService = {
2063 +        path = [ cfg.hg.package ];
2064 +        serviceConfig.BindPaths = [ "${cfg.settings."hg.sr.ht".repos}:/var/lib/sourcehut/hgsrht/repos" ];
2065 +        serviceConfig.BindReadOnlyPaths = [ "${cfg.settings."ht.sr.ht".changegroup-script}:/var/lib/sourcehut/hgsrht/bin/changegroup-script" ];
2066 +      };
2067 +      in {
2068 +      inherit configIniOfService;
2069 +      mainService = mkMerge [ baseService {
2070 +        serviceConfig.StateDirectory = [ "sourcehut/hgsrht" "sourcehut/hgsrht/repos" ];
2071 +      } ];
2072 +      port = 5010;
2073 +      webhooks = true;
2074 +      extraTimers.hgsrht-periodic = {
2075 +        service = baseService;
2076 +        timerConfig.OnCalendar = ["20min"];
2077 +      };
2078 +      extraTimers.hgsrht-clonebundles = mkIf cfg.hg.cloneBundles {
2079 +        service = baseService;
2080 +        timerConfig.OnCalendar = ["daily"];
2081 +        timerConfig.AccuracySec = "1h";
2082 +      };
2083 +      extraConfig = mkMerge [
2084 +        {
2085 +          users.users.${cfg.hg.user}.shell = pkgs.bash;
2086 +          services.sourcehut.settings = {
2087 +            # Note that git.sr.ht::dispatch is not a typo,
2088 +            # gitsrht-dispatch always uses this section.
2089 +            "git.sr.ht::dispatch"."/usr/bin/hgsrht-keys" =
2090 +              mkDefault "${cfg.hg.user}:${cfg.hg.group}";
2091 +          };
2092 +          systemd.services.sshd = baseService;
2093 +        }
2094 +        (mkIf cfg.nginx.enable {
2095 +          # Allow nginx access to repositories
2096 +          users.users.${nginx.user}.extraGroups = [ cfg.hg.group ];
2097 +          services.nginx.virtualHosts."hg.${domain}" = {
2098 +            locations."/authorize" = {
2099 +              proxyPass = "http://${cfg.listenAddress}:${toString cfg.hg.port}";
2100 +              extraConfig = ''
2101 +                proxy_pass_request_body off;
2102 +                proxy_set_header Content-Length "";
2103 +                proxy_set_header X-Original-URI $request_uri;
2104 +              '';
2105 +            };
2106 +            # Let clients reach pull bundles. We don't really need to lock this down even for
2107 +            # private repos because the bundles are named after the revision hashes...
2108 +            # so someone would need to know or guess a SHA value to download anything.
2109 +            # TODO: proxyPass to an hg serve service?
2110 +            locations."~ ^/[~^][a-z0-9_]+/[a-zA-Z0-9_.-]+/\\.hg/bundles/.*$" = {
2111 +              root = "/var/lib/nginx/hgsrht/repos";
2112 +              extraConfig = ''
2113 +                auth_request /authorize;
2114 +                gzip off;
2115 +              '';
2116 +            };
2117 +          };
2118 +          systemd.services.nginx = {
2119 +            serviceConfig.BindReadOnlyPaths = [ "${cfg.settings."hg.sr.ht".repos}:/var/lib/nginx/hgsrht/repos" ];
2120 +          };
2121 +        })
2122 +      ];
2123 +    }))
2124 +
2125 +    (import ./service.nix "hub" {
2126 +      inherit configIniOfService;
2127 +      port = 5014;
2128 +      extraConfig = {
2129 +        services.nginx = mkIf cfg.nginx.enable {
2130 +          virtualHosts."hub.${domain}" = mkMerge [ {
2131 +            serverAliases = [ domain ];
2132 +          } cfg.nginx.virtualHost ];
2133 +        };
2134 +      };
2135 +    })
2136 +
2137 +    (import ./service.nix "lists" (let
2138 +      srvsrht = "listssrht";
2139 +      in {
2140 +      inherit configIniOfService;
2141 +      port = 5006;
2142 +      webhooks = true;
2143 +      # Receive the mail from Postfix and enqueue them into Redis and PostgreSQL
2144 +      extraServices.listssrht-lmtp = {
2145 +        wants = [ "postfix.service" ];
2146 +        unitConfig.JoinsNamespaceOf = optional cfg.postfix.enable "postfix.service";
2147 +        serviceConfig.ExecStart = "${cfg.python}/bin/listssrht-lmtp";
2148 +        # Avoid crashing: os.chown(sock, os.getuid(), sock_gid)
2149 +        serviceConfig.PrivateUsers = mkForce false;
2150 +      };
2151 +      # Dequeue the mails from Redis and dispatch them
2152 +      extraServices.listssrht-process = {
2153 +        serviceConfig = {
2154 +          preStart = ''
2155 +            cp ${pkgs.writeText "${srvsrht}-webhooks-celeryconfig.py" cfg.lists.process.celeryConfig} \
2156 +               /run/sourcehut/${srvsrht}-webhooks/celeryconfig.py
2157 +          '';
2158 +          ExecStart = "${cfg.python}/bin/celery --app listssrht.process worker --hostname listssrht-process@%%h " + concatStringsSep " " cfg.lists.process.extraArgs;
2159 +          # Avoid crashing: os.getloadavg()
2160 +          ProcSubset = mkForce "all";
2161 +        };
2162 +      };
2163 +      extraConfig = mkIf cfg.postfix.enable {
2164 +        users.groups.${postfix.group}.members = [ cfg.lists.user ];
2165 +        services.sourcehut.settings."lists.sr.ht::mail".sock-group = postfix.group;
2166 +        services.postfix = {
2167 +          destination = [ "lists.${domain}" ];
2168 +          # FIXME: an accurate recipient list should be queried
2169 +          # from the lists.sr.ht PostgreSQL database to avoid backscattering.
2170 +          # But usernames are unfortunately not in that database but in meta.sr.ht.
2171 +          # Note that two syntaxes are allowed:
2172 +          # - ~username/list-name@lists.${domain}
2173 +          # - u.username.list-name@lists.${domain}
2174 +          localRecipients = [ "@lists.${domain}" ];
2175 +          transport = ''
2176 +            lists.${domain} lmtp:unix:${cfg.settings."lists.sr.ht::worker".sock}
2177 +          '';
2178 +        };
2179 +      };
2180 +    }))
2181 +
2182 +    (import ./service.nix "man" {
2183 +      inherit configIniOfService;
2184 +      port = 5004;
2185 +    })
2186 +
2187 +    (import ./service.nix "meta" {
2188 +      inherit configIniOfService;
2189 +      port = 5000;
2190 +      webhooks = true;
2191 +      extraServices.metasrht-api = {
2192 +        serviceConfig.Restart = "always";
2193 +        serviceConfig.RestartSec = "2s";
2194 +        preStart = "set -x\n" + concatStringsSep "\n\n" (attrValues (mapAttrs (k: s:
2195 +          let srvMatch = builtins.match "^([a-z]*)\\.sr\\.ht$" k;
2196 +              srv = head srvMatch;
2197 +          in
2198 +          # Configure client(s) as "preauthorized"
2199 +          optionalString (srvMatch != null && cfg.${srv}.enable && ((s.oauth-client-id or null) != null)) ''
2200 +            # Configure ${srv}'s OAuth client as "preauthorized"
2201 +            ${postgresql.package}/bin/psql '${cfg.settings."meta.sr.ht".connection-string}' \
2202 +              -c "UPDATE oauthclient SET preauthorized = true WHERE client_id = '${s.oauth-client-id}'"
2203 +          ''
2204 +          ) cfg.settings));
2205 +        serviceConfig.ExecStart = "${pkgs.sourcehut.metasrht}/bin/metasrht-api -b ${cfg.listenAddress}:${toString (cfg.meta.port + 100)}";
2206 +      };
2207 +      extraTimers.metasrht-daily.timerConfig = {
2208 +        OnCalendar = ["daily"];
2209 +        AccuracySec = "1h";
2210 +      };
2211 +      extraConfig = mkMerge [
2212 +        {
2213 +          assertions = [
2214 +            { assertion = let s = cfg.settings."meta.sr.ht::billing"; in
2215 +                          s.enabled == "yes" -> (s.stripe-public-key != null && s.stripe-secret-key != null);
2216 +              message = "If meta.sr.ht::billing is enabled, the keys must be defined.";
2217 +            }
2218 +          ];
2219 +          environment.systemPackages = optional cfg.meta.enable
2220 +            (pkgs.writeShellScriptBin "metasrht-manageuser" ''
2221 +              set -eux
2222 +              if test "$(${pkgs.coreutils}/bin/id -n -u)" != '${cfg.meta.user}'
2223 +              then exec sudo -u '${cfg.meta.user}' "$0" "$@"
2224 +              else
2225 +                # In order to load config.ini
2226 +                if cd /run/sourcehut/metasrht
2227 +                then exec ${cfg.python}/bin/metasrht-manageuser "$@"
2228 +                else cat <<EOF
2229 +                  Please run: sudo systemctl start metasrht
2230 +              EOF
2231 +                  exit 1
2232 +                fi
2233 +              fi
2234 +            '');
2235 +        }
2236 +        (mkIf cfg.nginx.enable {
2237 +          services.nginx.virtualHosts."meta.${domain}" = {
2238 +            locations."/query" = {
2239 +              proxyPass = cfg.settings."meta.sr.ht".api-origin;
2240 +              extraConfig = ''
2241 +                if ($request_method = 'OPTIONS') {
2242 +                  add_header 'Access-Control-Allow-Origin' '*';
2243 +                  add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
2244 +                  add_header 'Access-Control-Allow-Headers' 'User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
2245 +                  add_header 'Access-Control-Max-Age' 1728000;
2246 +                  add_header 'Content-Type' 'text/plain; charset=utf-8';
2247 +                  add_header 'Content-Length' 0;
2248 +                  return 204;
2249 +                }
2250 +
2251 +                add_header 'Access-Control-Allow-Origin' '*';
2252 +                add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
2253 +                add_header 'Access-Control-Allow-Headers' 'User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
2254 +                add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
2255 +              '';
2256 +            };
2257 +          };
2258 +        })
2259 +      ];
2260 +    })
2261 +
2262 +    (import ./service.nix "pages" {
2263 +      inherit configIniOfService;
2264 +      port = 5112;
2265 +      mainService = let
2266 +        srvsrht = "pagessrht";
2267 +        version = pkgs.sourcehut.${srvsrht}.version;
2268 +        stateDir = "/var/lib/sourcehut/${srvsrht}";
2269 +        iniKey = "pages.sr.ht";
2270 +        in {
2271 +        preStart = mkBefore ''
2272 +          set -x
2273 +          # Use the /run/sourcehut/${srvsrht}/config.ini
2274 +          # installed by a previous ExecStartPre= in baseService
2275 +          cd /run/sourcehut/${srvsrht}
2276 +
2277 +          if test ! -e ${stateDir}/db; then
2278 +            ${postgresql.package}/bin/psql '${cfg.settings.${iniKey}.connection-string}' -f ${pkgs.sourcehut.pagessrht}/share/sql/schema.sql
2279 +            echo ${version} >${stateDir}/db
2280 +          fi
2281 +
2282 +          ${optionalString cfg.settings.${iniKey}.migrate-on-upgrade ''
2283 +            # Just try all the migrations because they're not linked to the version
2284 +            for sql in ${pkgs.sourcehut.pagessrht}/share/sql/migrations/*.sql; do
2285 +              ${postgresql.package}/bin/psql '${cfg.settings.${iniKey}.connection-string}' -f "$sql" || true
2286 +            done
2287 +          ''}
2288 +
2289 +          # Disable webhook
2290 +          touch ${stateDir}/webhook
2291 +        '';
2292 +        serviceConfig = {
2293 +          ExecStart = mkForce "${pkgs.sourcehut.pagessrht}/bin/pages.sr.ht -b ${cfg.listenAddress}:${toString cfg.pages.port}";
2294 +        };
2295 +      };
2296 +    })
2297 +
2298 +    (import ./service.nix "paste" {
2299 +      inherit configIniOfService;
2300 +      port = 5011;
2301 +    })
2302 +
2303 +    (import ./service.nix "todo" {
2304 +      inherit configIniOfService;
2305 +      port = 5003;
2306 +      webhooks = true;
2307 +      extraServices.todosrht-lmtp = {
2308 +        wants = [ "postfix.service" ];
2309 +        unitConfig.JoinsNamespaceOf = optional cfg.postfix.enable "postfix.service";
2310 +        serviceConfig.ExecStart = "${cfg.python}/bin/todosrht-lmtp";
2311 +        # Avoid crashing: os.chown(sock, os.getuid(), sock_gid)
2312 +        serviceConfig.PrivateUsers = mkForce false;
2313 +      };
2314 +      extraConfig = mkIf cfg.postfix.enable {
2315 +        users.groups.${postfix.group}.members = [ cfg.todo.user ];
2316 +        services.sourcehut.settings."todo.sr.ht::mail".sock-group = postfix.group;
2317 +        services.postfix = {
2318 +          destination = [ "todo.${domain}" ];
2319 +          # FIXME: an accurate recipient list should be queried
2320 +          # from the todo.sr.ht PostgreSQL database to avoid backscattering.
2321 +          # But usernames are unfortunately not in that database but in meta.sr.ht.
2322 +          # Note that two syntaxes are allowed:
2323 +          # - ~username/tracker-name@todo.${domain}
2324 +          # - u.username.tracker-name@todo.${domain}
2325 +          localRecipients = [ "@todo.${domain}" ];
2326 +          transport = ''
2327 +            todo.${domain} lmtp:unix:${cfg.settings."todo.sr.ht::mail".sock}
2328 +          '';
2329 +        };
2330 +      };
2331 +    })
2332 +
2333 +    (mkRenamedOptionModule [ "services" "sourcehut" "originBase" ]
2334 +                           [ "services" "sourcehut" "settings" "sr.ht" "global-domain" ])
2335 +    (mkRenamedOptionModule [ "services" "sourcehut" "address" ]
2336 +                           [ "services" "sourcehut" "listenAddress" ])
2337 +
2338 +  ];
2339 +
2340    meta.doc = ./sourcehut.xml;
2341 -  meta.maintainers = with maintainers; [ tomberek ];
2342 +  meta.maintainers = with maintainers; [ julm tomberek ];
2343  }
2344 diff --git a/nixos/modules/services/misc/sourcehut/dispatch.nix b/nixos/modules/services/misc/sourcehut/dispatch.nix
2345 deleted file mode 100644
2346 index a9db17bebe8..00000000000
2347 --- a/nixos/modules/services/misc/sourcehut/dispatch.nix
2348 +++ /dev/null
2349 @@ -1,125 +0,0 @@
2350 -{ config, lib, pkgs, ... }:
2351 -
2352 -with lib;
2353 -let
2354 -  cfg = config.services.sourcehut;
2355 -  cfgIni = cfg.settings;
2356 -  scfg = cfg.dispatch;
2357 -  iniKey = "dispatch.sr.ht";
2358 -
2359 -  drv = pkgs.sourcehut.dispatchsrht;
2360 -in
2361 -{
2362 -  options.services.sourcehut.dispatch = {
2363 -    user = mkOption {
2364 -      type = types.str;
2365 -      default = "dispatchsrht";
2366 -      description = ''
2367 -        User for dispatch.sr.ht.
2368 -      '';
2369 -    };
2370 -
2371 -    port = mkOption {
2372 -      type = types.port;
2373 -      default = 5005;
2374 -      description = ''
2375 -        Port on which the "dispatch" module should listen.
2376 -      '';
2377 -    };
2378 -
2379 -    database = mkOption {
2380 -      type = types.str;
2381 -      default = "dispatch.sr.ht";
2382 -      description = ''
2383 -        PostgreSQL database name for dispatch.sr.ht.
2384 -      '';
2385 -    };
2386 -
2387 -    statePath = mkOption {
2388 -      type = types.path;
2389 -      default = "${cfg.statePath}/dispatchsrht";
2390 -      description = ''
2391 -        State path for dispatch.sr.ht.
2392 -      '';
2393 -    };
2394 -  };
2395 -
2396 -  config = with scfg; lib.mkIf (cfg.enable && elem "dispatch" cfg.services) {
2397 -
2398 -    users = {
2399 -      users = {
2400 -        "${user}" = {
2401 -          isSystemUser = true;
2402 -          group = user;
2403 -          description = "dispatch.sr.ht user";
2404 -        };
2405 -      };
2406 -
2407 -      groups = {
2408 -        "${user}" = { };
2409 -      };
2410 -    };
2411 -
2412 -    services.postgresql = {
2413 -      authentication = ''
2414 -        local ${database} ${user} trust
2415 -      '';
2416 -      ensureDatabases = [ database ];
2417 -      ensureUsers = [
2418 -        {
2419 -          name = user;
2420 -          ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
2421 -        }
2422 -      ];
2423 -    };
2424 -
2425 -    systemd = {
2426 -      tmpfiles.rules = [
2427 -        "d ${statePath} 0750 ${user} ${user} -"
2428 -      ];
2429 -
2430 -      services.dispatchsrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
2431 -        after = [ "postgresql.service" "network.target" ];
2432 -        requires = [ "postgresql.service" ];
2433 -        wantedBy = [ "multi-user.target" ];
2434 -
2435 -        description = "dispatch.sr.ht website service";
2436 -
2437 -        serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
2438 -      };
2439 -    };
2440 -
2441 -    services.sourcehut.settings = {
2442 -      # URL dispatch.sr.ht is being served at (protocol://domain)
2443 -      "dispatch.sr.ht".origin = mkDefault "http://dispatch.${cfg.originBase}";
2444 -      # Address and port to bind the debug server to
2445 -      "dispatch.sr.ht".debug-host = mkDefault "0.0.0.0";
2446 -      "dispatch.sr.ht".debug-port = mkDefault port;
2447 -      # Configures the SQLAlchemy connection string for the database.
2448 -      "dispatch.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
2449 -      # Set to "yes" to automatically run migrations on package upgrade.
2450 -      "dispatch.sr.ht".migrate-on-upgrade = mkDefault "yes";
2451 -      # dispatch.sr.ht's OAuth client ID and secret for meta.sr.ht
2452 -      # Register your client at meta.example.org/oauth
2453 -      "dispatch.sr.ht".oauth-client-id = mkDefault null;
2454 -      "dispatch.sr.ht".oauth-client-secret = mkDefault null;
2455 -
2456 -      # Github Integration
2457 -      "dispatch.sr.ht::github".oauth-client-id = mkDefault null;
2458 -      "dispatch.sr.ht::github".oauth-client-secret = mkDefault null;
2459 -
2460 -      # Gitlab Integration
2461 -      "dispatch.sr.ht::gitlab".enabled = mkDefault null;
2462 -      "dispatch.sr.ht::gitlab".canonical-upstream = mkDefault "gitlab.com";
2463 -      "dispatch.sr.ht::gitlab".repo-cache = mkDefault "./repo-cache";
2464 -      # "dispatch.sr.ht::gitlab"."gitlab.com" = mkDefault "GitLab:application id:secret";
2465 -    };
2466 -
2467 -    services.nginx.virtualHosts."dispatch.${cfg.originBase}" = {
2468 -      forceSSL = true;
2469 -      locations."/".proxyPass = "http://${cfg.address}:${toString port}";
2470 -      locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
2471 -      locations."/static".root = "${pkgs.sourcehut.dispatchsrht}/${pkgs.sourcehut.python.sitePackages}/dispatchsrht";
2472 -    };
2473 -  };
2474 -}
2475 diff --git a/nixos/modules/services/misc/sourcehut/git.nix b/nixos/modules/services/misc/sourcehut/git.nix
2476 deleted file mode 100644
2477 index 99b9aec0612..00000000000
2478 --- a/nixos/modules/services/misc/sourcehut/git.nix
2479 +++ /dev/null
2480 @@ -1,214 +0,0 @@
2481 -{ config, lib, pkgs, ... }:
2482 -
2483 -with lib;
2484 -let
2485 -  cfg = config.services.sourcehut;
2486 -  scfg = cfg.git;
2487 -  iniKey = "git.sr.ht";
2488 -
2489 -  rcfg = config.services.redis;
2490 -  drv = pkgs.sourcehut.gitsrht;
2491 -in
2492 -{
2493 -  options.services.sourcehut.git = {
2494 -    user = mkOption {
2495 -      type = types.str;
2496 -      visible = false;
2497 -      internal = true;
2498 -      readOnly = true;
2499 -      default = "git";
2500 -      description = ''
2501 -        User for git.sr.ht.
2502 -      '';
2503 -    };
2504 -
2505 -    port = mkOption {
2506 -      type = types.port;
2507 -      default = 5001;
2508 -      description = ''
2509 -        Port on which the "git" module should listen.
2510 -      '';
2511 -    };
2512 -
2513 -    database = mkOption {
2514 -      type = types.str;
2515 -      default = "git.sr.ht";
2516 -      description = ''
2517 -        PostgreSQL database name for git.sr.ht.
2518 -      '';
2519 -    };
2520 -
2521 -    statePath = mkOption {
2522 -      type = types.path;
2523 -      default = "${cfg.statePath}/gitsrht";
2524 -      description = ''
2525 -        State path for git.sr.ht.
2526 -      '';
2527 -    };
2528 -
2529 -    package = mkOption {
2530 -      type = types.package;
2531 -      default = pkgs.git;
2532 -      example = literalExample "pkgs.gitFull";
2533 -      description = ''
2534 -        Git package for git.sr.ht. This can help silence collisions.
2535 -      '';
2536 -    };
2537 -  };
2538 -
2539 -  config = with scfg; lib.mkIf (cfg.enable && elem "git" cfg.services) {
2540 -    # sshd refuses to run with `Unsafe AuthorizedKeysCommand ... bad ownership or modes for directory /nix/store`
2541 -    environment.etc."ssh/gitsrht-dispatch" = {
2542 -      mode = "0755";
2543 -      text = ''
2544 -        #! ${pkgs.stdenv.shell}
2545 -        ${cfg.python}/bin/gitsrht-dispatch "$@"
2546 -      '';
2547 -    };
2548 -
2549 -    # Needs this in the $PATH when sshing into the server
2550 -    environment.systemPackages = [ cfg.git.package ];
2551 -
2552 -    users = {
2553 -      users = {
2554 -        "${user}" = {
2555 -          isSystemUser = true;
2556 -          group = user;
2557 -          # https://stackoverflow.com/questions/22314298/git-push-results-in-fatal-protocol-error-bad-line-length-character-this
2558 -          # Probably could use gitsrht-shell if output is restricted to just parameters...
2559 -          shell = pkgs.bash;
2560 -          description = "git.sr.ht user";
2561 -        };
2562 -      };
2563 -
2564 -      groups = {
2565 -        "${user}" = { };
2566 -      };
2567 -    };
2568 -
2569 -    services = {
2570 -      cron.systemCronJobs = [ "*/20 * * * * ${cfg.python}/bin/gitsrht-periodic" ];
2571 -      fcgiwrap.enable = true;
2572 -
2573 -      openssh.authorizedKeysCommand = ''/etc/ssh/gitsrht-dispatch "%u" "%h" "%t" "%k"'';
2574 -      openssh.authorizedKeysCommandUser = "root";
2575 -      openssh.extraConfig = ''
2576 -        PermitUserEnvironment SRHT_*
2577 -      '';
2578 -
2579 -      postgresql = {
2580 -        authentication = ''
2581 -          local ${database} ${user} trust
2582 -        '';
2583 -        ensureDatabases = [ database ];
2584 -        ensureUsers = [
2585 -          {
2586 -            name = user;
2587 -            ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
2588 -          }
2589 -        ];
2590 -      };
2591 -    };
2592 -
2593 -    systemd = {
2594 -      tmpfiles.rules = [
2595 -        # /var/log is owned by root
2596 -        "f /var/log/git-srht-shell 0644 ${user} ${user} -"
2597 -
2598 -        "d ${statePath} 0750 ${user} ${user} -"
2599 -        "d ${cfg.settings."${iniKey}".repos} 2755 ${user} ${user} -"
2600 -      ];
2601 -
2602 -      services = {
2603 -        gitsrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
2604 -          after = [ "redis.service" "postgresql.service" "network.target" ];
2605 -          requires = [ "redis.service" "postgresql.service" ];
2606 -          wantedBy = [ "multi-user.target" ];
2607 -
2608 -          # Needs internally to create repos at the very least
2609 -          path = [ pkgs.git ];
2610 -          description = "git.sr.ht website service";
2611 -
2612 -          serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
2613 -        };
2614 -
2615 -        gitsrht-webhooks = {
2616 -          after = [ "postgresql.service" "network.target" ];
2617 -          requires = [ "postgresql.service" ];
2618 -          wantedBy = [ "multi-user.target" ];
2619 -
2620 -          description = "git.sr.ht webhooks service";
2621 -          serviceConfig = {
2622 -            Type = "simple";
2623 -            User = user;
2624 -            Restart = "always";
2625 -          };
2626 -
2627 -          serviceConfig.ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel=info";
2628 -        };
2629 -      };
2630 -    };
2631 -
2632 -    services.sourcehut.settings = {
2633 -      # URL git.sr.ht is being served at (protocol://domain)
2634 -      "git.sr.ht".origin = mkDefault "http://git.${cfg.originBase}";
2635 -      # Address and port to bind the debug server to
2636 -      "git.sr.ht".debug-host = mkDefault "0.0.0.0";
2637 -      "git.sr.ht".debug-port = mkDefault port;
2638 -      # Configures the SQLAlchemy connection string for the database.
2639 -      "git.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
2640 -      # Set to "yes" to automatically run migrations on package upgrade.
2641 -      "git.sr.ht".migrate-on-upgrade = mkDefault "yes";
2642 -      # The redis connection used for the webhooks worker
2643 -      "git.sr.ht".webhooks = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/1";
2644 -
2645 -      # A post-update script which is installed in every git repo.
2646 -      "git.sr.ht".post-update-script = mkDefault "${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook";
2647 -
2648 -      # git.sr.ht's OAuth client ID and secret for meta.sr.ht
2649 -      # Register your client at meta.example.org/oauth
2650 -      "git.sr.ht".oauth-client-id = mkDefault null;
2651 -      "git.sr.ht".oauth-client-secret = mkDefault null;
2652 -      # Path to git repositories on disk
2653 -      "git.sr.ht".repos = mkDefault "/var/lib/git";
2654 -
2655 -      "git.sr.ht".outgoing-domain = mkDefault "http://git.${cfg.originBase}";
2656 -
2657 -      # The authorized keys hook uses this to dispatch to various handlers
2658 -      # The format is a program to exec into as the key, and the user to match as the
2659 -      # value. When someone tries to log in as this user, this program is executed
2660 -      # and is expected to omit an AuthorizedKeys file.
2661 -      #
2662 -      # Discard of the string context is in order to allow derivation-derived strings.
2663 -      # This is safe if the relevant package is installed which will be the case if the setting is utilized.
2664 -      "git.sr.ht::dispatch".${builtins.unsafeDiscardStringContext "${pkgs.sourcehut.gitsrht}/bin/gitsrht-keys"} = mkDefault "${user}:${user}";
2665 -    };
2666 -
2667 -    services.nginx.virtualHosts."git.${cfg.originBase}" = {
2668 -      forceSSL = true;
2669 -      locations."/".proxyPass = "http://${cfg.address}:${toString port}";
2670 -      locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
2671 -      locations."/static".root = "${pkgs.sourcehut.gitsrht}/${pkgs.sourcehut.python.sitePackages}/gitsrht";
2672 -      extraConfig = ''
2673 -            location = /authorize {
2674 -            proxy_pass http://${cfg.address}:${toString port};
2675 -            proxy_pass_request_body off;
2676 -            proxy_set_header Content-Length "";
2677 -            proxy_set_header X-Original-URI $request_uri;
2678 -        }
2679 -            location ~ ^/([^/]+)/([^/]+)/(HEAD|info/refs|objects/info/.*|git-upload-pack).*$ {
2680 -                auth_request /authorize;
2681 -                root /var/lib/git;
2682 -                fastcgi_pass unix:/run/fcgiwrap.sock;
2683 -                fastcgi_param SCRIPT_FILENAME ${pkgs.git}/bin/git-http-backend;
2684 -                fastcgi_param PATH_INFO $uri;
2685 -                fastcgi_param GIT_PROJECT_ROOT $document_root;
2686 -                fastcgi_read_timeout 500s;
2687 -                include ${pkgs.nginx}/conf/fastcgi_params;
2688 -                gzip off;
2689 -            }
2690 -      '';
2691 -
2692 -    };
2693 -  };
2694 -}
2695 diff --git a/nixos/modules/services/misc/sourcehut/hg.nix b/nixos/modules/services/misc/sourcehut/hg.nix
2696 deleted file mode 100644
2697 index 5cd36bb0455..00000000000
2698 --- a/nixos/modules/services/misc/sourcehut/hg.nix
2699 +++ /dev/null
2700 @@ -1,173 +0,0 @@
2701 -{ config, lib, pkgs, ... }:
2702 -
2703 -with lib;
2704 -let
2705 -  cfg = config.services.sourcehut;
2706 -  scfg = cfg.hg;
2707 -  iniKey = "hg.sr.ht";
2708 -
2709 -  rcfg = config.services.redis;
2710 -  drv = pkgs.sourcehut.hgsrht;
2711 -in
2712 -{
2713 -  options.services.sourcehut.hg = {
2714 -    user = mkOption {
2715 -      type = types.str;
2716 -      internal = true;
2717 -      readOnly = true;
2718 -      default = "hg";
2719 -      description = ''
2720 -        User for hg.sr.ht.
2721 -      '';
2722 -    };
2723 -
2724 -    port = mkOption {
2725 -      type = types.port;
2726 -      default = 5010;
2727 -      description = ''
2728 -        Port on which the "hg" module should listen.
2729 -      '';
2730 -    };
2731 -
2732 -    database = mkOption {
2733 -      type = types.str;
2734 -      default = "hg.sr.ht";
2735 -      description = ''
2736 -        PostgreSQL database name for hg.sr.ht.
2737 -      '';
2738 -    };
2739 -
2740 -    statePath = mkOption {
2741 -      type = types.path;
2742 -      default = "${cfg.statePath}/hgsrht";
2743 -      description = ''
2744 -        State path for hg.sr.ht.
2745 -      '';
2746 -    };
2747 -
2748 -    cloneBundles = mkOption {
2749 -      type = types.bool;
2750 -      default = false;
2751 -      description = ''
2752 -        Generate clonebundles (which require more disk space but dramatically speed up cloning large repositories).
2753 -      '';
2754 -    };
2755 -  };
2756 -
2757 -  config = with scfg; lib.mkIf (cfg.enable && elem "hg" cfg.services) {
2758 -    # In case it ever comes into being
2759 -    environment.etc."ssh/hgsrht-dispatch" = {
2760 -      mode = "0755";
2761 -      text = ''
2762 -        #! ${pkgs.stdenv.shell}
2763 -        ${cfg.python}/bin/gitsrht-dispatch $@
2764 -      '';
2765 -    };
2766 -
2767 -    environment.systemPackages = [ pkgs.mercurial ];
2768 -
2769 -    users = {
2770 -      users = {
2771 -        "${user}" = {
2772 -          isSystemUser = true;
2773 -          group = user;
2774 -          # Assuming hg.sr.ht needs this too
2775 -          shell = pkgs.bash;
2776 -          description = "hg.sr.ht user";
2777 -        };
2778 -      };
2779 -
2780 -      groups = {
2781 -        "${user}" = { };
2782 -      };
2783 -    };
2784 -
2785 -    services = {
2786 -      cron.systemCronJobs = [ "*/20 * * * * ${cfg.python}/bin/hgsrht-periodic" ]
2787 -        ++ optional cloneBundles "0 * * * * ${cfg.python}/bin/hgsrht-clonebundles";
2788 -
2789 -      openssh.authorizedKeysCommand = ''/etc/ssh/hgsrht-dispatch "%u" "%h" "%t" "%k"'';
2790 -      openssh.authorizedKeysCommandUser = "root";
2791 -      openssh.extraConfig = ''
2792 -        PermitUserEnvironment SRHT_*
2793 -      '';
2794 -
2795 -      postgresql = {
2796 -        authentication = ''
2797 -          local ${database} ${user} trust
2798 -        '';
2799 -        ensureDatabases = [ database ];
2800 -        ensureUsers = [
2801 -          {
2802 -            name = user;
2803 -            ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
2804 -          }
2805 -        ];
2806 -      };
2807 -    };
2808 -
2809 -    systemd = {
2810 -      tmpfiles.rules = [
2811 -        # /var/log is owned by root
2812 -        "f /var/log/hg-srht-shell 0644 ${user} ${user} -"
2813 -
2814 -        "d ${statePath} 0750 ${user} ${user} -"
2815 -        "d ${cfg.settings."${iniKey}".repos} 2755 ${user} ${user} -"
2816 -      ];
2817 -
2818 -      services.hgsrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
2819 -        after = [ "redis.service" "postgresql.service" "network.target" ];
2820 -        requires = [ "redis.service" "postgresql.service" ];
2821 -        wantedBy = [ "multi-user.target" ];
2822 -
2823 -        path = [ pkgs.mercurial ];
2824 -        description = "hg.sr.ht website service";
2825 -
2826 -        serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
2827 -      };
2828 -    };
2829 -
2830 -    services.sourcehut.settings = {
2831 -      # URL hg.sr.ht is being served at (protocol://domain)
2832 -      "hg.sr.ht".origin = mkDefault "http://hg.${cfg.originBase}";
2833 -      # Address and port to bind the debug server to
2834 -      "hg.sr.ht".debug-host = mkDefault "0.0.0.0";
2835 -      "hg.sr.ht".debug-port = mkDefault port;
2836 -      # Configures the SQLAlchemy connection string for the database.
2837 -      "hg.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
2838 -      # The redis connection used for the webhooks worker
2839 -      "hg.sr.ht".webhooks = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/1";
2840 -      # A post-update script which is installed in every mercurial repo.
2841 -      "hg.sr.ht".changegroup-script = mkDefault "${cfg.python}/bin/hgsrht-hook-changegroup";
2842 -      # hg.sr.ht's OAuth client ID and secret for meta.sr.ht
2843 -      # Register your client at meta.example.org/oauth
2844 -      "hg.sr.ht".oauth-client-id = mkDefault null;
2845 -      "hg.sr.ht".oauth-client-secret = mkDefault null;
2846 -      # Path to mercurial repositories on disk
2847 -      "hg.sr.ht".repos = mkDefault "/var/lib/hg";
2848 -      # Path to the srht mercurial extension
2849 -      # (defaults to where the hgsrht code is)
2850 -      # "hg.sr.ht".srhtext = mkDefault null;
2851 -      # .hg/store size (in MB) past which the nightly job generates clone bundles.
2852 -      # "hg.sr.ht".clone_bundle_threshold = mkDefault 50;
2853 -      # Path to hg-ssh (if not in $PATH)
2854 -      # "hg.sr.ht".hg_ssh = mkDefault /path/to/hg-ssh;
2855 -
2856 -      # The authorized keys hook uses this to dispatch to various handlers
2857 -      # The format is a program to exec into as the key, and the user to match as the
2858 -      # value. When someone tries to log in as this user, this program is executed
2859 -      # and is expected to omit an AuthorizedKeys file.
2860 -      #
2861 -      # Uncomment the relevant lines to enable the various sr.ht dispatchers.
2862 -      "hg.sr.ht::dispatch"."/run/current-system/sw/bin/hgsrht-keys" = mkDefault "${user}:${user}";
2863 -    };
2864 -
2865 -    # TODO: requires testing and addition of hg-specific requirements
2866 -    services.nginx.virtualHosts."hg.${cfg.originBase}" = {
2867 -      forceSSL = true;
2868 -      locations."/".proxyPass = "http://${cfg.address}:${toString port}";
2869 -      locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
2870 -      locations."/static".root = "${pkgs.sourcehut.hgsrht}/${pkgs.sourcehut.python.sitePackages}/hgsrht";
2871 -    };
2872 -  };
2873 -}
2874 diff --git a/nixos/modules/services/misc/sourcehut/hub.nix b/nixos/modules/services/misc/sourcehut/hub.nix
2875 deleted file mode 100644
2876 index be3ea21011c..00000000000
2877 --- a/nixos/modules/services/misc/sourcehut/hub.nix
2878 +++ /dev/null
2879 @@ -1,118 +0,0 @@
2880 -{ config, lib, pkgs, ... }:
2881 -
2882 -with lib;
2883 -let
2884 -  cfg = config.services.sourcehut;
2885 -  cfgIni = cfg.settings;
2886 -  scfg = cfg.hub;
2887 -  iniKey = "hub.sr.ht";
2888 -
2889 -  drv = pkgs.sourcehut.hubsrht;
2890 -in
2891 -{
2892 -  options.services.sourcehut.hub = {
2893 -    user = mkOption {
2894 -      type = types.str;
2895 -      default = "hubsrht";
2896 -      description = ''
2897 -        User for hub.sr.ht.
2898 -      '';
2899 -    };
2900 -
2901 -    port = mkOption {
2902 -      type = types.port;
2903 -      default = 5014;
2904 -      description = ''
2905 -        Port on which the "hub" module should listen.
2906 -      '';
2907 -    };
2908 -
2909 -    database = mkOption {
2910 -      type = types.str;
2911 -      default = "hub.sr.ht";
2912 -      description = ''
2913 -        PostgreSQL database name for hub.sr.ht.
2914 -      '';
2915 -    };
2916 -
2917 -    statePath = mkOption {
2918 -      type = types.path;
2919 -      default = "${cfg.statePath}/hubsrht";
2920 -      description = ''
2921 -        State path for hub.sr.ht.
2922 -      '';
2923 -    };
2924 -  };
2925 -
2926 -  config = with scfg; lib.mkIf (cfg.enable && elem "hub" cfg.services) {
2927 -    users = {
2928 -      users = {
2929 -        "${user}" = {
2930 -          isSystemUser = true;
2931 -          group = user;
2932 -          description = "hub.sr.ht user";
2933 -        };
2934 -      };
2935 -
2936 -      groups = {
2937 -        "${user}" = { };
2938 -      };
2939 -    };
2940 -
2941 -    services.postgresql = {
2942 -      authentication = ''
2943 -        local ${database} ${user} trust
2944 -      '';
2945 -      ensureDatabases = [ database ];
2946 -      ensureUsers = [
2947 -        {
2948 -          name = user;
2949 -          ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
2950 -        }
2951 -      ];
2952 -    };
2953 -
2954 -    systemd = {
2955 -      tmpfiles.rules = [
2956 -        "d ${statePath} 0750 ${user} ${user} -"
2957 -      ];
2958 -
2959 -      services.hubsrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
2960 -        after = [ "postgresql.service" "network.target" ];
2961 -        requires = [ "postgresql.service" ];
2962 -        wantedBy = [ "multi-user.target" ];
2963 -
2964 -        description = "hub.sr.ht website service";
2965 -
2966 -        serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
2967 -      };
2968 -    };
2969 -
2970 -    services.sourcehut.settings = {
2971 -      # URL hub.sr.ht is being served at (protocol://domain)
2972 -      "hub.sr.ht".origin = mkDefault "http://hub.${cfg.originBase}";
2973 -      # Address and port to bind the debug server to
2974 -      "hub.sr.ht".debug-host = mkDefault "0.0.0.0";
2975 -      "hub.sr.ht".debug-port = mkDefault port;
2976 -      # Configures the SQLAlchemy connection string for the database.
2977 -      "hub.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
2978 -      # Set to "yes" to automatically run migrations on package upgrade.
2979 -      "hub.sr.ht".migrate-on-upgrade = mkDefault "yes";
2980 -      # hub.sr.ht's OAuth client ID and secret for meta.sr.ht
2981 -      # Register your client at meta.example.org/oauth
2982 -      "hub.sr.ht".oauth-client-id = mkDefault null;
2983 -      "hub.sr.ht".oauth-client-secret = mkDefault null;
2984 -    };
2985 -
2986 -    services.nginx.virtualHosts."${cfg.originBase}" = {
2987 -      forceSSL = true;
2988 -      locations."/".proxyPass = "http://${cfg.address}:${toString port}";
2989 -      locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
2990 -      locations."/static".root = "${pkgs.sourcehut.hubsrht}/${pkgs.sourcehut.python.sitePackages}/hubsrht";
2991 -    };
2992 -    services.nginx.virtualHosts."hub.${cfg.originBase}" = {
2993 -      globalRedirect = "${cfg.originBase}";
2994 -      forceSSL = true;
2995 -    };
2996 -  };
2997 -}
2998 diff --git a/nixos/modules/services/misc/sourcehut/lists.nix b/nixos/modules/services/misc/sourcehut/lists.nix
2999 deleted file mode 100644
3000 index 7b1fe9fd463..00000000000
3001 --- a/nixos/modules/services/misc/sourcehut/lists.nix
3002 +++ /dev/null
3003 @@ -1,185 +0,0 @@
3004 -# Email setup is fairly involved, useful references:
3005 -# https://drewdevault.com/2018/08/05/Local-mail-server.html
3006 -
3007 -{ config, lib, pkgs, ... }:
3008 -
3009 -with lib;
3010 -let
3011 -  cfg = config.services.sourcehut;
3012 -  cfgIni = cfg.settings;
3013 -  scfg = cfg.lists;
3014 -  iniKey = "lists.sr.ht";
3015 -
3016 -  rcfg = config.services.redis;
3017 -  drv = pkgs.sourcehut.listssrht;
3018 -in
3019 -{
3020 -  options.services.sourcehut.lists = {
3021 -    user = mkOption {
3022 -      type = types.str;
3023 -      default = "listssrht";
3024 -      description = ''
3025 -        User for lists.sr.ht.
3026 -      '';
3027 -    };
3028 -
3029 -    port = mkOption {
3030 -      type = types.port;
3031 -      default = 5006;
3032 -      description = ''
3033 -        Port on which the "lists" module should listen.
3034 -      '';
3035 -    };
3036 -
3037 -    database = mkOption {
3038 -      type = types.str;
3039 -      default = "lists.sr.ht";
3040 -      description = ''
3041 -        PostgreSQL database name for lists.sr.ht.
3042 -      '';
3043 -    };
3044 -
3045 -    statePath = mkOption {
3046 -      type = types.path;
3047 -      default = "${cfg.statePath}/listssrht";
3048 -      description = ''
3049 -        State path for lists.sr.ht.
3050 -      '';
3051 -    };
3052 -  };
3053 -
3054 -  config = with scfg; lib.mkIf (cfg.enable && elem "lists" cfg.services) {
3055 -    users = {
3056 -      users = {
3057 -        "${user}" = {
3058 -          isSystemUser = true;
3059 -          group = user;
3060 -          extraGroups = [ "postfix" ];
3061 -          description = "lists.sr.ht user";
3062 -        };
3063 -      };
3064 -      groups = {
3065 -        "${user}" = { };
3066 -      };
3067 -    };
3068 -
3069 -    services.postgresql = {
3070 -      authentication = ''
3071 -        local ${database} ${user} trust
3072 -      '';
3073 -      ensureDatabases = [ database ];
3074 -      ensureUsers = [
3075 -        {
3076 -          name = user;
3077 -          ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
3078 -        }
3079 -      ];
3080 -    };
3081 -
3082 -    systemd = {
3083 -      tmpfiles.rules = [
3084 -        "d ${statePath} 0750 ${user} ${user} -"
3085 -      ];
3086 -
3087 -      services = {
3088 -        listssrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
3089 -          after = [ "postgresql.service" "network.target" ];
3090 -          requires = [ "postgresql.service" ];
3091 -          wantedBy = [ "multi-user.target" ];
3092 -
3093 -          description = "lists.sr.ht website service";
3094 -
3095 -          serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
3096 -        };
3097 -
3098 -        listssrht-process = {
3099 -          after = [ "postgresql.service" "network.target" ];
3100 -          requires = [ "postgresql.service" ];
3101 -          wantedBy = [ "multi-user.target" ];
3102 -
3103 -          description = "lists.sr.ht process service";
3104 -          serviceConfig = {
3105 -            Type = "simple";
3106 -            User = user;
3107 -            Restart = "always";
3108 -            ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.process worker --loglevel=info";
3109 -          };
3110 -        };
3111 -
3112 -        listssrht-lmtp = {
3113 -          after = [ "postgresql.service" "network.target" ];
3114 -          requires = [ "postgresql.service" ];
3115 -          wantedBy = [ "multi-user.target" ];
3116 -
3117 -          description = "lists.sr.ht process service";
3118 -          serviceConfig = {
3119 -            Type = "simple";
3120 -            User = user;
3121 -            Restart = "always";
3122 -            ExecStart = "${cfg.python}/bin/listssrht-lmtp";
3123 -          };
3124 -        };
3125 -
3126 -
3127 -        listssrht-webhooks = {
3128 -          after = [ "postgresql.service" "network.target" ];
3129 -          requires = [ "postgresql.service" ];
3130 -          wantedBy = [ "multi-user.target" ];
3131 -
3132 -          description = "lists.sr.ht webhooks service";
3133 -          serviceConfig = {
3134 -            Type = "simple";
3135 -            User = user;
3136 -            Restart = "always";
3137 -            ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel=info";
3138 -          };
3139 -        };
3140 -      };
3141 -    };
3142 -
3143 -    services.sourcehut.settings = {
3144 -      # URL lists.sr.ht is being served at (protocol://domain)
3145 -      "lists.sr.ht".origin = mkDefault "http://lists.${cfg.originBase}";
3146 -      # Address and port to bind the debug server to
3147 -      "lists.sr.ht".debug-host = mkDefault "0.0.0.0";
3148 -      "lists.sr.ht".debug-port = mkDefault port;
3149 -      # Configures the SQLAlchemy connection string for the database.
3150 -      "lists.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
3151 -      # Set to "yes" to automatically run migrations on package upgrade.
3152 -      "lists.sr.ht".migrate-on-upgrade = mkDefault "yes";
3153 -      # lists.sr.ht's OAuth client ID and secret for meta.sr.ht
3154 -      # Register your client at meta.example.org/oauth
3155 -      "lists.sr.ht".oauth-client-id = mkDefault null;
3156 -      "lists.sr.ht".oauth-client-secret = mkDefault null;
3157 -      # Outgoing email for notifications generated by users
3158 -      "lists.sr.ht".notify-from = mkDefault "CHANGEME@example.org";
3159 -      # The redis connection used for the webhooks worker
3160 -      "lists.sr.ht".webhooks = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/2";
3161 -      # The redis connection used for the celery worker
3162 -      "lists.sr.ht".redis = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/4";
3163 -      # Network-key
3164 -      "lists.sr.ht".network-key = mkDefault null;
3165 -      # Allow creation
3166 -      "lists.sr.ht".allow-new-lists = mkDefault "no";
3167 -      # Posting Domain
3168 -      "lists.sr.ht".posting-domain = mkDefault "lists.${cfg.originBase}";
3169 -
3170 -      # Path for the lmtp daemon's unix socket. Direct incoming mail to this socket.
3171 -      # Alternatively, specify IP:PORT and an SMTP server will be run instead.
3172 -      "lists.sr.ht::worker".sock = mkDefault "/tmp/lists.sr.ht-lmtp.sock";
3173 -      # The lmtp daemon will make the unix socket group-read/write for users in this
3174 -      # group.
3175 -      "lists.sr.ht::worker".sock-group = mkDefault "postfix";
3176 -      "lists.sr.ht::worker".reject-url = mkDefault "https://man.sr.ht/lists.sr.ht/etiquette.md";
3177 -      "lists.sr.ht::worker".reject-mimetypes = mkDefault "text/html";
3178 -
3179 -    };
3180 -
3181 -    services.nginx.virtualHosts."lists.${cfg.originBase}" = {
3182 -      forceSSL = true;
3183 -      locations."/".proxyPass = "http://${cfg.address}:${toString port}";
3184 -      locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
3185 -      locations."/static".root = "${pkgs.sourcehut.listssrht}/${pkgs.sourcehut.python.sitePackages}/listssrht";
3186 -    };
3187 -  };
3188 -}
3189 diff --git a/nixos/modules/services/misc/sourcehut/man.nix b/nixos/modules/services/misc/sourcehut/man.nix
3190 deleted file mode 100644
3191 index 7693396d187..00000000000
3192 --- a/nixos/modules/services/misc/sourcehut/man.nix
3193 +++ /dev/null
3194 @@ -1,122 +0,0 @@
3195 -{ config, lib, pkgs, ... }:
3196 -
3197 -with lib;
3198 -let
3199 -  cfg = config.services.sourcehut;
3200 -  cfgIni = cfg.settings;
3201 -  scfg = cfg.man;
3202 -  iniKey = "man.sr.ht";
3203 -
3204 -  drv = pkgs.sourcehut.mansrht;
3205 -in
3206 -{
3207 -  options.services.sourcehut.man = {
3208 -    user = mkOption {
3209 -      type = types.str;
3210 -      default = "mansrht";
3211 -      description = ''
3212 -        User for man.sr.ht.
3213 -      '';
3214 -    };
3215 -
3216 -    port = mkOption {
3217 -      type = types.port;
3218 -      default = 5004;
3219 -      description = ''
3220 -        Port on which the "man" module should listen.
3221 -      '';
3222 -    };
3223 -
3224 -    database = mkOption {
3225 -      type = types.str;
3226 -      default = "man.sr.ht";
3227 -      description = ''
3228 -        PostgreSQL database name for man.sr.ht.
3229 -      '';
3230 -    };
3231 -
3232 -    statePath = mkOption {
3233 -      type = types.path;
3234 -      default = "${cfg.statePath}/mansrht";
3235 -      description = ''
3236 -        State path for man.sr.ht.
3237 -      '';
3238 -    };
3239 -  };
3240 -
3241 -  config = with scfg; lib.mkIf (cfg.enable && elem "man" cfg.services) {
3242 -    assertions =
3243 -      [
3244 -        {
3245 -          assertion = hasAttrByPath [ "git.sr.ht" "oauth-client-id" ] cfgIni;
3246 -          message = "man.sr.ht needs access to git.sr.ht.";
3247 -        }
3248 -      ];
3249 -
3250 -    users = {
3251 -      users = {
3252 -        "${user}" = {
3253 -          isSystemUser = true;
3254 -          group = user;
3255 -          description = "man.sr.ht user";
3256 -        };
3257 -      };
3258 -
3259 -      groups = {
3260 -        "${user}" = { };
3261 -      };
3262 -    };
3263 -
3264 -    services.postgresql = {
3265 -      authentication = ''
3266 -        local ${database} ${user} trust
3267 -      '';
3268 -      ensureDatabases = [ database ];
3269 -      ensureUsers = [
3270 -        {
3271 -          name = user;
3272 -          ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
3273 -        }
3274 -      ];
3275 -    };
3276 -
3277 -    systemd = {
3278 -      tmpfiles.rules = [
3279 -        "d ${statePath} 0750 ${user} ${user} -"
3280 -      ];
3281 -
3282 -      services.mansrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
3283 -        after = [ "postgresql.service" "network.target" ];
3284 -        requires = [ "postgresql.service" ];
3285 -        wantedBy = [ "multi-user.target" ];
3286 -
3287 -        description = "man.sr.ht website service";
3288 -
3289 -        serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
3290 -      };
3291 -    };
3292 -
3293 -    services.sourcehut.settings = {
3294 -      # URL man.sr.ht is being served at (protocol://domain)
3295 -      "man.sr.ht".origin = mkDefault "http://man.${cfg.originBase}";
3296 -      # Address and port to bind the debug server to
3297 -      "man.sr.ht".debug-host = mkDefault "0.0.0.0";
3298 -      "man.sr.ht".debug-port = mkDefault port;
3299 -      # Configures the SQLAlchemy connection string for the database.
3300 -      "man.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
3301 -      # Set to "yes" to automatically run migrations on package upgrade.
3302 -      "man.sr.ht".migrate-on-upgrade = mkDefault "yes";
3303 -      # man.sr.ht's OAuth client ID and secret for meta.sr.ht
3304 -      # Register your client at meta.example.org/oauth
3305 -      "man.sr.ht".oauth-client-id = mkDefault null;
3306 -      "man.sr.ht".oauth-client-secret = mkDefault null;
3307 -    };
3308 -
3309 -    services.nginx.virtualHosts."man.${cfg.originBase}" = {
3310 -      forceSSL = true;
3311 -      locations."/".proxyPass = "http://${cfg.address}:${toString port}";
3312 -      locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
3313 -      locations."/static".root = "${pkgs.sourcehut.mansrht}/${pkgs.sourcehut.python.sitePackages}/mansrht";
3314 -    };
3315 -  };
3316 -}
3317 diff --git a/nixos/modules/services/misc/sourcehut/meta.nix b/nixos/modules/services/misc/sourcehut/meta.nix
3318 deleted file mode 100644
3319 index 56127a824eb..00000000000
3320 --- a/nixos/modules/services/misc/sourcehut/meta.nix
3321 +++ /dev/null
3322 @@ -1,211 +0,0 @@
3323 -{ config, lib, pkgs, ... }:
3324 -
3325 -with lib;
3326 -let
3327 -  cfg = config.services.sourcehut;
3328 -  cfgIni = cfg.settings;
3329 -  scfg = cfg.meta;
3330 -  iniKey = "meta.sr.ht";
3331 -
3332 -  rcfg = config.services.redis;
3333 -  drv = pkgs.sourcehut.metasrht;
3334 -in
3335 -{
3336 -  options.services.sourcehut.meta = {
3337 -    user = mkOption {
3338 -      type = types.str;
3339 -      default = "metasrht";
3340 -      description = ''
3341 -        User for meta.sr.ht.
3342 -      '';
3343 -    };
3344 -
3345 -    port = mkOption {
3346 -      type = types.port;
3347 -      default = 5000;
3348 -      description = ''
3349 -        Port on which the "meta" module should listen.
3350 -      '';
3351 -    };
3352 -
3353 -    database = mkOption {
3354 -      type = types.str;
3355 -      default = "meta.sr.ht";
3356 -      description = ''
3357 -        PostgreSQL database name for meta.sr.ht.
3358 -      '';
3359 -    };
3360 -
3361 -    statePath = mkOption {
3362 -      type = types.path;
3363 -      default = "${cfg.statePath}/metasrht";
3364 -      description = ''
3365 -        State path for meta.sr.ht.
3366 -      '';
3367 -    };
3368 -  };
3369 -
3370 -  config = with scfg; lib.mkIf (cfg.enable && elem "meta" cfg.services) {
3371 -    assertions =
3372 -      [
3373 -        {
3374 -          assertion = with cfgIni."meta.sr.ht::billing"; enabled == "yes" -> (stripe-public-key != null && stripe-secret-key != null);
3375 -          message = "If meta.sr.ht::billing is enabled, the keys should be defined.";
3376 -        }
3377 -      ];
3378 -
3379 -    users = {
3380 -      users = {
3381 -        ${user} = {
3382 -          isSystemUser = true;
3383 -          group = user;
3384 -          description = "meta.sr.ht user";
3385 -        };
3386 -      };
3387 -
3388 -      groups = {
3389 -        "${user}" = { };
3390 -      };
3391 -    };
3392 -
3393 -    services.cron.systemCronJobs = [ "0 0 * * * ${cfg.python}/bin/metasrht-daily" ];
3394 -    services.postgresql = {
3395 -      authentication = ''
3396 -        local ${database} ${user} trust
3397 -      '';
3398 -      ensureDatabases = [ database ];
3399 -      ensureUsers = [
3400 -        {
3401 -          name = user;
3402 -          ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
3403 -        }
3404 -      ];
3405 -    };
3406 -
3407 -    systemd = {
3408 -      tmpfiles.rules = [
3409 -        "d ${statePath} 0750 ${user} ${user} -"
3410 -      ];
3411 -
3412 -      services = {
3413 -        metasrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
3414 -          after = [ "postgresql.service" "network.target" ];
3415 -          requires = [ "postgresql.service" ];
3416 -          wantedBy = [ "multi-user.target" ];
3417 -
3418 -          description = "meta.sr.ht website service";
3419 -
3420 -          preStart = ''
3421 -            # Configure client(s) as "preauthorized"
3422 -            ${concatMapStringsSep "\n\n"
3423 -              (attr: ''
3424 -                if ! test -e "${statePath}/${attr}.oauth" || [ "$(cat ${statePath}/${attr}.oauth)" != "${cfgIni."${attr}".oauth-client-id}" ]; then
3425 -                  # Configure ${attr}'s OAuth client as "preauthorized"
3426 -                  psql ${database} \
3427 -                    -c "UPDATE oauthclient SET preauthorized = true WHERE client_id = '${cfgIni."${attr}".oauth-client-id}'"
3428 -
3429 -                  printf "%s" "${cfgIni."${attr}".oauth-client-id}" > "${statePath}/${attr}.oauth"
3430 -                fi
3431 -              '')
3432 -              (builtins.attrNames (filterAttrs
3433 -                (k: v: !(hasInfix "::" k) && builtins.hasAttr "oauth-client-id" v && v.oauth-client-id != null)
3434 -                cfg.settings))}
3435 -          '';
3436 -
3437 -          serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
3438 -        };
3439 -
3440 -        metasrht-api = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
3441 -          after = [ "postgresql.service" "network.target" ];
3442 -          requires = [ "postgresql.service" ];
3443 -          wantedBy = [ "multi-user.target" ];
3444 -
3445 -          description = "meta.sr.ht api service";
3446 -
3447 -          preStart = ''
3448 -            # Configure client(s) as "preauthorized"
3449 -            ${concatMapStringsSep "\n\n"
3450 -              (attr: ''
3451 -                if ! test -e "${statePath}/${attr}.oauth" || [ "$(cat ${statePath}/${attr}.oauth)" != "${cfgIni."${attr}".oauth-client-id}" ]; then
3452 -                  # Configure ${attr}'s OAuth client as "preauthorized"
3453 -                  psql ${database} \
3454 -                    -c "UPDATE oauthclient SET preauthorized = true WHERE client_id = '${cfgIni."${attr}".oauth-client-id}'"
3455 -
3456 -                  printf "%s" "${cfgIni."${attr}".oauth-client-id}" > "${statePath}/${attr}.oauth"
3457 -                fi
3458 -              '')
3459 -              (builtins.attrNames (filterAttrs
3460 -                (k: v: !(hasInfix "::" k) && builtins.hasAttr "oauth-client-id" v && v.oauth-client-id != null)
3461 -                cfg.settings))}
3462 -          '';
3463 -
3464 -          serviceConfig.ExecStart = "${pkgs.sourcehut.metasrht}/bin/metasrht-api -b :${toString (port + 100)}";
3465 -        };
3466 -
3467 -        metasrht-webhooks = {
3468 -          after = [ "postgresql.service" "network.target" ];
3469 -          requires = [ "postgresql.service" ];
3470 -          wantedBy = [ "multi-user.target" ];
3471 -
3472 -          description = "meta.sr.ht webhooks service";
3473 -          serviceConfig = {
3474 -            Type = "simple";
3475 -            User = user;
3476 -            Restart = "always";
3477 -            ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel=info";
3478 -          };
3479 -
3480 -        };
3481 -      };
3482 -    };
3483 -
3484 -    services.sourcehut.settings = {
3485 -      # URL meta.sr.ht is being served at (protocol://domain)
3486 -      "meta.sr.ht".origin = mkDefault "https://meta.${cfg.originBase}";
3487 -      # Address and port to bind the debug server to
3488 -      "meta.sr.ht".debug-host = mkDefault "0.0.0.0";
3489 -      "meta.sr.ht".debug-port = mkDefault port;
3490 -      # Configures the SQLAlchemy connection string for the database.
3491 -      "meta.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
3492 -      # Set to "yes" to automatically run migrations on package upgrade.
3493 -      "meta.sr.ht".migrate-on-upgrade = mkDefault "yes";
3494 -      # If "yes", the user will be sent the stock sourcehut welcome emails after
3495 -      # signup (requires cron to be configured properly). These are specific to the
3496 -      # sr.ht instance so you probably want to patch these before enabling this.
3497 -      "meta.sr.ht".welcome-emails = mkDefault "no";
3498 -
3499 -      # The redis connection used for the webhooks worker
3500 -      "meta.sr.ht".webhooks = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/6";
3501 -
3502 -      # If "no", public registration will not be permitted.
3503 -      "meta.sr.ht::settings".registration = mkDefault "no";
3504 -      # Where to redirect new users upon registration
3505 -      "meta.sr.ht::settings".onboarding-redirect = mkDefault "https://meta.${cfg.originBase}";
3506 -      # How many invites each user is issued upon registration (only applicable if
3507 -      # open registration is disabled)
3508 -      "meta.sr.ht::settings".user-invites = mkDefault 5;
3509 -
3510 -      # Origin URL for API, 100 more than web
3511 -      "meta.sr.ht".api-origin = mkDefault "http://localhost:5100";
3512 -
3513 -      # You can add aliases for the client IDs of commonly used OAuth clients here.
3514 -      #
3515 -      # Example:
3516 -      "meta.sr.ht::aliases" = mkDefault { };
3517 -      # "meta.sr.ht::aliases"."git.sr.ht" = 12345;
3518 -
3519 -      # "yes" to enable the billing system
3520 -      "meta.sr.ht::billing".enabled = mkDefault "no";
3521 -      # Get your keys at https://dashboard.stripe.com/account/apikeys
3522 -      "meta.sr.ht::billing".stripe-public-key = mkDefault null;
3523 -      "meta.sr.ht::billing".stripe-secret-key = mkDefault null;
3524 -    };
3525 -
3526 -    services.nginx.virtualHosts."meta.${cfg.originBase}" = {
3527 -      forceSSL = true;
3528 -      locations."/".proxyPass = "http://${cfg.address}:${toString port}";
3529 -      locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
3530 -      locations."/static".root = "${pkgs.sourcehut.metasrht}/${pkgs.sourcehut.python.sitePackages}/metasrht";
3531 -    };
3532 -  };
3533 -}
3534 diff --git a/nixos/modules/services/misc/sourcehut/paste.nix b/nixos/modules/services/misc/sourcehut/paste.nix
3535 deleted file mode 100644
3536 index b2d5151969e..00000000000
3537 --- a/nixos/modules/services/misc/sourcehut/paste.nix
3538 +++ /dev/null
3539 @@ -1,133 +0,0 @@
3540 -{ config, lib, pkgs, ... }:
3541 -
3542 -with lib;
3543 -let
3544 -  cfg = config.services.sourcehut;
3545 -  cfgIni = cfg.settings;
3546 -  scfg = cfg.paste;
3547 -  iniKey = "paste.sr.ht";
3548 -
3549 -  rcfg = config.services.redis;
3550 -  drv = pkgs.sourcehut.pastesrht;
3551 -in
3552 -{
3553 -  options.services.sourcehut.paste = {
3554 -    user = mkOption {
3555 -      type = types.str;
3556 -      default = "pastesrht";
3557 -      description = ''
3558 -        User for paste.sr.ht.
3559 -      '';
3560 -    };
3561 -
3562 -    port = mkOption {
3563 -      type = types.port;
3564 -      default = 5011;
3565 -      description = ''
3566 -        Port on which the "paste" module should listen.
3567 -      '';
3568 -    };
3569 -
3570 -    database = mkOption {
3571 -      type = types.str;
3572 -      default = "paste.sr.ht";
3573 -      description = ''
3574 -        PostgreSQL database name for paste.sr.ht.
3575 -      '';
3576 -    };
3577 -
3578 -    statePath = mkOption {
3579 -      type = types.path;
3580 -      default = "${cfg.statePath}/pastesrht";
3581 -      description = ''
3582 -        State path for pastesrht.sr.ht.
3583 -      '';
3584 -    };
3585 -  };
3586 -
3587 -  config = with scfg; lib.mkIf (cfg.enable && elem "paste" cfg.services) {
3588 -    users = {
3589 -      users = {
3590 -        "${user}" = {
3591 -          isSystemUser = true;
3592 -          group = user;
3593 -          description = "paste.sr.ht user";
3594 -        };
3595 -      };
3596 -
3597 -      groups = {
3598 -        "${user}" = { };
3599 -      };
3600 -    };
3601 -
3602 -    services.postgresql = {
3603 -      authentication = ''
3604 -        local ${database} ${user} trust
3605 -      '';
3606 -      ensureDatabases = [ database ];
3607 -      ensureUsers = [
3608 -        {
3609 -          name = user;
3610 -          ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
3611 -        }
3612 -      ];
3613 -    };
3614 -
3615 -    systemd = {
3616 -      tmpfiles.rules = [
3617 -        "d ${statePath} 0750 ${user} ${user} -"
3618 -      ];
3619 -
3620 -      services = {
3621 -        pastesrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
3622 -          after = [ "postgresql.service" "network.target" ];
3623 -          requires = [ "postgresql.service" ];
3624 -          wantedBy = [ "multi-user.target" ];
3625 -
3626 -          description = "paste.sr.ht website service";
3627 -
3628 -          serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
3629 -        };
3630 -
3631 -        pastesrht-webhooks = {
3632 -          after = [ "postgresql.service" "network.target" ];
3633 -          requires = [ "postgresql.service" ];
3634 -          wantedBy = [ "multi-user.target" ];
3635 -
3636 -          description = "paste.sr.ht webhooks service";
3637 -          serviceConfig = {
3638 -            Type = "simple";
3639 -            User = user;
3640 -            Restart = "always";
3641 -            ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel=info";
3642 -          };
3643 -
3644 -        };
3645 -      };
3646 -    };
3647 -
3648 -    services.sourcehut.settings = {
3649 -      # URL paste.sr.ht is being served at (protocol://domain)
3650 -      "paste.sr.ht".origin = mkDefault "http://paste.${cfg.originBase}";
3651 -      # Address and port to bind the debug server to
3652 -      "paste.sr.ht".debug-host = mkDefault "0.0.0.0";
3653 -      "paste.sr.ht".debug-port = mkDefault port;
3654 -      # Configures the SQLAlchemy connection string for the database.
3655 -      "paste.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
3656 -      # Set to "yes" to automatically run migrations on package upgrade.
3657 -      "paste.sr.ht".migrate-on-upgrade = mkDefault "yes";
3658 -      # paste.sr.ht's OAuth client ID and secret for meta.sr.ht
3659 -      # Register your client at meta.example.org/oauth
3660 -      "paste.sr.ht".oauth-client-id = mkDefault null;
3661 -      "paste.sr.ht".oauth-client-secret = mkDefault null;
3662 -      "paste.sr.ht".webhooks = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/5";
3663 -    };
3664 -
3665 -    services.nginx.virtualHosts."paste.${cfg.originBase}" = {
3666 -      forceSSL = true;
3667 -      locations."/".proxyPass = "http://${cfg.address}:${toString port}";
3668 -      locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
3669 -      locations."/static".root = "${pkgs.sourcehut.pastesrht}/${pkgs.sourcehut.python.sitePackages}/pastesrht";
3670 -    };
3671 -  };
3672 -}
3673 diff --git a/nixos/modules/services/misc/sourcehut/service.nix b/nixos/modules/services/misc/sourcehut/service.nix
3674 index 65b4ad020f9..b3c0efc07dd 100644
3675 --- a/nixos/modules/services/misc/sourcehut/service.nix
3676 +++ b/nixos/modules/services/misc/sourcehut/service.nix
3677 @@ -1,66 +1,375 @@
3678 -{ config, pkgs, lib }:
3679 -serviceCfg: serviceDrv: iniKey: attrs:
3680 +srv:
3681 +{ configIniOfService
3682 +, srvsrht ? "${srv}srht" # Because "buildsrht" does not follow that pattern (missing an "s").
3683 +, iniKey ? "${srv}.sr.ht"
3684 +, webhooks ? false
3685 +, extraTimers ? {}
3686 +, mainService ? {}
3687 +, extraServices ? {}
3688 +, extraConfig ? {}
3689 +, port
3690 +}:
3691 +{ config, lib, pkgs, ... }:
3692 +
3693 +with lib;
3694  let
3695 +  inherit (config.services) postgresql;
3696 +  redis = config.services.redis.servers."sourcehut-${srvsrht}";
3697 +  inherit (config.users) users;
3698    cfg = config.services.sourcehut;
3699 -  cfgIni = cfg.settings."${iniKey}";
3700 -  pgSuperUser = config.services.postgresql.superUser;
3701 -
3702 -  setupDB = pkgs.writeScript "${serviceDrv.pname}-gen-db" ''
3703 -    #! ${cfg.python}/bin/python
3704 -    from ${serviceDrv.pname}.app import db
3705 -    db.create()
3706 -  '';
3707 +  configIni = configIniOfService srv;
3708 +  srvCfg = cfg.${srv};
3709 +  baseService = serviceName: { allowStripe ? false }: extraService: let
3710 +    runDir = "/run/sourcehut/${serviceName}";
3711 +    rootDir = "/run/sourcehut/chroots/${serviceName}";
3712 +    in
3713 +    mkMerge [ extraService {
3714 +    after = [ "network.target" ] ++
3715 +      optional cfg.postgresql.enable "postgresql.service" ++
3716 +      optional cfg.redis.enable "redis-sourcehut-${srvsrht}.service";
3717 +    requires =
3718 +      optional cfg.postgresql.enable "postgresql.service" ++
3719 +      optional cfg.redis.enable "redis-sourcehut-${srvsrht}.service";
3720 +    path = [ pkgs.gawk ];
3721 +    environment.HOME = runDir;
3722 +    serviceConfig = {
3723 +      User = mkDefault srvCfg.user;
3724 +      Group = mkDefault srvCfg.group;
3725 +      RuntimeDirectory = [
3726 +        "sourcehut/${serviceName}"
3727 +        # Used by *srht-keys which reads ../config.ini
3728 +        "sourcehut/${serviceName}/subdir"
3729 +        "sourcehut/chroots/${serviceName}"
3730 +      ];
3731 +      RuntimeDirectoryMode = "2750";
3732 +      # No need for the chroot path once inside the chroot
3733 +      InaccessiblePaths = [ "-+${rootDir}" ];
3734 +      # g+rx is for group members (eg. fcgiwrap or nginx)
3735 +      # to read Git/Mercurial repositories, buildlogs, etc.
3736 +      # o+x is for intermediate directories created by BindPaths= and like,
3737 +      # as they're owned by root:root.
3738 +      UMask = "0026";
3739 +      RootDirectory = rootDir;
3740 +      RootDirectoryStartOnly = true;
3741 +      PrivateTmp = true;
3742 +      MountAPIVFS = true;
3743 +      # config.ini is looked up in there, before /etc/srht/config.ini
3744 +      # Note that it fails to be set in ExecStartPre=
3745 +      WorkingDirectory = mkDefault ("-"+runDir);
3746 +      BindReadOnlyPaths = [
3747 +        builtins.storeDir
3748 +        "/etc"
3749 +        "/run/booted-system"
3750 +        "/run/current-system"
3751 +        "/run/systemd"
3752 +        ] ++
3753 +        optional cfg.postgresql.enable "/run/postgresql" ++
3754 +        optional cfg.redis.enable "/run/redis-sourcehut-${srvsrht}";
3755 +      # LoadCredential= are unfortunately not available in ExecStartPre=
3756 +      # Hence this one is run as root (the +) with RootDirectoryStartOnly=
3757 +      # to reach credentials wherever they are.
3758 +      # Note that each systemd service gets its own ${runDir}/config.ini file.
3759 +      ExecStartPre = mkBefore [("+"+pkgs.writeShellScript "${serviceName}-credentials" ''
3760 +        set -x
3761 +        # Replace values begining with a '<' by the content of the file whose name is after.
3762 +        gawk '{ if (match($0,/^([^=]+=)<(.+)/,m)) { getline f < m[2]; print m[1] f } else print $0 }' ${configIni} |
3763 +        ${optionalString (!allowStripe) "gawk '!/^stripe-secret-key=/' |"}
3764 +        install -o ${srvCfg.user} -g root -m 400 /dev/stdin ${runDir}/config.ini
3765 +      '')];
3766 +      # The following options are only for optimizing:
3767 +      # systemd-analyze security
3768 +      AmbientCapabilities = "";
3769 +      CapabilityBoundingSet = "";
3770 +      # ProtectClock= adds DeviceAllow=char-rtc r
3771 +      DeviceAllow = "";
3772 +      LockPersonality = true;
3773 +      MemoryDenyWriteExecute = true;
3774 +      NoNewPrivileges = true;
3775 +      PrivateDevices = true;
3776 +      PrivateMounts = true;
3777 +      PrivateNetwork = mkDefault false;
3778 +      PrivateUsers = true;
3779 +      ProcSubset = "pid";
3780 +      ProtectClock = true;
3781 +      ProtectControlGroups = true;
3782 +      ProtectHome = true;
3783 +      ProtectHostname = true;
3784 +      ProtectKernelLogs = true;
3785 +      ProtectKernelModules = true;
3786 +      ProtectKernelTunables = true;
3787 +      ProtectProc = "invisible";
3788 +      ProtectSystem = "strict";
3789 +      RemoveIPC = true;
3790 +      RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
3791 +      RestrictNamespaces = true;
3792 +      RestrictRealtime = true;
3793 +      RestrictSUIDSGID = true;
3794 +      #SocketBindAllow = [ "tcp:${toString srvCfg.port}" "tcp:${toString srvCfg.prometheusPort}" ];
3795 +      #SocketBindDeny = "any";
3796 +      SystemCallFilter = [
3797 +        "@system-service"
3798 +        "~@aio" "~@keyring" "~@memlock" "~@privileged" "~@resources" "~@timer"
3799 +        "@chown" "@setuid"
3800 +      ];
3801 +      SystemCallArchitectures = "native";
3802 +    };
3803 +  } ];
3804  in
3805 -with serviceCfg; with lib; recursiveUpdate
3806  {
3807 -  environment.HOME = statePath;
3808 -  path = [ config.services.postgresql.package ] ++ (attrs.path or [ ]);
3809 -  restartTriggers = [ config.environment.etc."sr.ht/config.ini".source ];
3810 -  serviceConfig = {
3811 -    Type = "simple";
3812 -    User = user;
3813 -    Group = user;
3814 -    Restart = "always";
3815 -    WorkingDirectory = statePath;
3816 -  } // (if (cfg.statePath == "/var/lib/sourcehut/${serviceDrv.pname}") then {
3817 -          StateDirectory = [ "sourcehut/${serviceDrv.pname}" ];
3818 -        } else {})
3819 -  ;
3820 +  options.services.sourcehut.${srv} = {
3821 +    enable = mkEnableOption "${srv} service";
3822
3823 -  preStart = ''
3824 -    if ! test -e ${statePath}/db; then
3825 -      # Setup the initial database
3826 -      ${setupDB}
3827 +    user = mkOption {
3828 +      type = types.str;
3829 +      default = srvsrht;
3830 +      description = ''
3831 +        User for ${srv}.sr.ht.
3832 +      '';
3833 +    };
3834
3835 -      # Set the initial state of the database for future database upgrades
3836 -      if test -e ${cfg.python}/bin/${serviceDrv.pname}-migrate; then
3837 -        # Run alembic stamp head once to tell alembic the schema is up-to-date
3838 -        ${cfg.python}/bin/${serviceDrv.pname}-migrate stamp head
3839 -      fi
3840 +    group = mkOption {
3841 +      type = types.str;
3842 +      default = srvsrht;
3843 +      description = ''
3844 +        Group for ${srv}.sr.ht.
3845 +        Membership grants access to the Git/Mercurial repositories by default,
3846 +        but not to the config.ini file (where secrets are).
3847 +      '';
3848 +    };
3849
3850 -      printf "%s" "${serviceDrv.version}" > ${statePath}/db
3851 -    fi
3852 +    port = mkOption {
3853 +      type = types.port;
3854 +      default = port;
3855 +      description = ''
3856 +        Port on which the "${srv}" backend should listen.
3857 +      '';
3858 +    };
3859
3860 -    # Update copy of each users' profile to the latest
3861 -    # See https://lists.sr.ht/~sircmpwn/sr.ht-admins/<20190302181207.GA13778%40cirno.my.domain>
3862 -    if ! test -e ${statePath}/webhook; then
3863 -      # Update ${iniKey}'s users' profile copy to the latest
3864 -      ${cfg.python}/bin/srht-update-profiles ${iniKey}
3865 +    redis = {
3866 +      host = mkOption {
3867 +        type = types.str;
3868 +        default = "unix:/run/redis-sourcehut-${srvsrht}/redis.sock?db=0";
3869 +        example = "redis://shared.wireguard:6379/0";
3870 +        description = ''
3871 +          The redis host URL. This is used for caching and temporary storage, and must
3872 +          be shared between nodes (e.g. git1.sr.ht and git2.sr.ht), but need not be
3873 +          shared between services. It may be shared between services, however, with no
3874 +          ill effect, if this better suits your infrastructure.
3875 +        '';
3876 +      };
3877 +    };
3878
3879 -      touch ${statePath}/webhook
3880 -    fi
3881 +    postgresql = {
3882 +      database = mkOption {
3883 +        type = types.str;
3884 +        default = "${srv}.sr.ht";
3885 +        description = ''
3886 +          PostgreSQL database name for the ${srv}.sr.ht service,
3887 +          used if <xref linkend="opt-services.sourcehut.postgresql.enable"/> is <literal>true</literal>.
3888 +        '';
3889 +      };
3890 +    };
3891
3892 -    ${optionalString (builtins.hasAttr "migrate-on-upgrade" cfgIni && cfgIni.migrate-on-upgrade == "yes") ''
3893 -      if [ "$(cat ${statePath}/db)" != "${serviceDrv.version}" ]; then
3894 -        # Manage schema migrations using alembic
3895 -        ${cfg.python}/bin/${serviceDrv.pname}-migrate -a upgrade head
3896 +    gunicorn = {
3897 +      extraArgs = mkOption {
3898 +        type = with types; listOf str;
3899 +        default = ["--timeout 120" "--workers 1" "--log-level=info"];
3900 +        description = "Extra arguments passed to Gunicorn.";
3901 +      };
3902 +    };
3903 +  } // optionalAttrs webhooks {
3904 +    webhooks = {
3905 +      extraArgs = mkOption {
3906 +        type = with types; listOf str;
3907 +        default = ["--loglevel DEBUG" "--pool eventlet" "--without-heartbeat"];
3908 +        description = "Extra arguments passed to the Celery responsible for webhooks.";
3909 +      };
3910 +      celeryConfig = mkOption {
3911 +        type = types.lines;
3912 +        default = "";
3913 +        description = "Content of the <literal>celeryconfig.py</literal> used by the Celery responsible for webhooks.";
3914 +      };
3915 +    };
3916 +  };
3917
3918 -        # Mark down current package version
3919 -        printf "%s" "${serviceDrv.version}" > ${statePath}/db
3920 -      fi
3921 -    ''}
3922 +  config = lib.mkIf (cfg.enable && srvCfg.enable) (mkMerge [ extraConfig {
3923 +    users = {
3924 +      users = {
3925 +        "${srvCfg.user}" = {
3926 +          isSystemUser = true;
3927 +          group = mkDefault srvCfg.group;
3928 +          description = mkDefault "sourcehut user for ${srv}.sr.ht";
3929 +        };
3930 +      };
3931 +      groups = {
3932 +        "${srvCfg.group}" = { };
3933 +      } // optionalAttrs (cfg.postgresql.enable
3934 +        && hasSuffix "0" (postgresql.settings.unix_socket_permissions or "")) {
3935 +        "postgres".members = [ srvCfg.user ];
3936 +      } // optionalAttrs (cfg.redis.enable
3937 +        && hasSuffix "0" (redis.settings.unixsocketperm or "")) {
3938 +        "redis-sourcehut-${srvsrht}".members = [ srvCfg.user ];
3939 +      };
3940 +    };
3941
3942 -    ${attrs.preStart or ""}
3943 -  '';
3944 +    services.nginx = mkIf cfg.nginx.enable {
3945 +      virtualHosts."${srv}.${cfg.settings."sr.ht".global-domain}" = mkMerge [ {
3946 +        forceSSL = true;
3947 +        locations."/".proxyPass = "http://${cfg.listenAddress}:${toString srvCfg.port}";
3948 +        locations."/static" = {
3949 +          root = "${pkgs.sourcehut.${srvsrht}}/${pkgs.sourcehut.python.sitePackages}/${srvsrht}";
3950 +          extraConfig = mkDefault ''
3951 +            expires 30d;
3952 +          '';
3953 +        };
3954 +      } cfg.nginx.virtualHost ];
3955 +    };
3956 +
3957 +    services.postgresql = mkIf cfg.postgresql.enable {
3958 +      authentication = ''
3959 +        local ${srvCfg.postgresql.database} ${srvCfg.user} trust
3960 +      '';
3961 +      ensureDatabases = [ srvCfg.postgresql.database ];
3962 +      ensureUsers = map (name: {
3963 +          inherit name;
3964 +          ensurePermissions = { "DATABASE \"${srvCfg.postgresql.database}\"" = "ALL PRIVILEGES"; };
3965 +        }) [srvCfg.user];
3966 +    };
3967 +
3968 +    services.sourcehut.services = mkDefault (filter (s: cfg.${s}.enable)
3969 +      [ "builds" "dispatch" "git" "hg" "hub" "lists" "man" "meta" "pages" "paste" "todo" ]);
3970 +
3971 +    services.sourcehut.settings = mkMerge [
3972 +      {
3973 +        "${srv}.sr.ht".origin = mkDefault "https://${srv}.${cfg.settings."sr.ht".global-domain}";
3974 +      }
3975 +
3976 +      (mkIf cfg.postgresql.enable {
3977 +        "${srv}.sr.ht".connection-string = mkDefault "postgresql:///${srvCfg.postgresql.database}?user=${srvCfg.user}&host=/run/postgresql";
3978 +      })
3979 +    ];
3980 +
3981 +    services.redis.servers."sourcehut-${srvsrht}" = mkIf cfg.redis.enable {
3982 +      enable = true;
3983 +      databases = 3;
3984 +      syslog = true;
3985 +      # TODO: set a more informed value
3986 +      save = mkDefault [ [1800 10] [300 100] ];
3987 +      settings = {
3988 +        # TODO: set a more informed value
3989 +        maxmemory = "128MB";
3990 +        maxmemory-policy = "volatile-ttl";
3991 +      };
3992 +    };
3993 +
3994 +    systemd.services = mkMerge [
3995 +      {
3996 +        "${srvsrht}" = baseService srvsrht { allowStripe = srv == "meta"; } (mkMerge [
3997 +        {
3998 +          description = "sourcehut ${srv}.sr.ht website service";
3999 +          before = optional cfg.nginx.enable "nginx.service";
4000 +          wants = optional cfg.nginx.enable "nginx.service";
4001 +          wantedBy = [ "multi-user.target" ];
4002 +          path = optional cfg.postgresql.enable postgresql.package;
4003 +          # Beware: change in credentials' content will not trigger restart.
4004 +          restartTriggers = [ configIni ];
4005 +          serviceConfig = {
4006 +            Type = "simple";
4007 +            Restart = mkDefault "always";
4008 +            #RestartSec = mkDefault "2min";
4009 +            StateDirectory = [ "sourcehut/${srvsrht}" ];
4010 +            StateDirectoryMode = "2750";
4011 +            ExecStart = "${cfg.python}/bin/gunicorn ${srvsrht}.app:app --name ${srvsrht} --bind ${cfg.listenAddress}:${toString srvCfg.port} " + concatStringsSep " " srvCfg.gunicorn.extraArgs;
4012 +          };
4013 +          preStart = let
4014 +            version = pkgs.sourcehut.${srvsrht}.version;
4015 +            stateDir = "/var/lib/sourcehut/${srvsrht}";
4016 +            in mkBefore ''
4017 +            set -x
4018 +            # Use the /run/sourcehut/${srvsrht}/config.ini
4019 +            # installed by a previous ExecStartPre= in baseService
4020 +            cd /run/sourcehut/${srvsrht}
4021 +
4022 +            if test ! -e ${stateDir}/db; then
4023 +              # Setup the initial database.
4024 +              # Note that it stamps the alembic head afterward
4025 +              ${cfg.python}/bin/${srvsrht}-initdb
4026 +              echo ${version} >${stateDir}/db
4027 +            fi
4028 +
4029 +            ${optionalString cfg.settings.${iniKey}.migrate-on-upgrade ''
4030 +              if [ "$(cat ${stateDir}/db)" != "${version}" ]; then
4031 +                # Manage schema migrations using alembic
4032 +                ${cfg.python}/bin/${srvsrht}-migrate -a upgrade head
4033 +                echo ${version} >${stateDir}/db
4034 +              fi
4035 +            ''}
4036 +
4037 +            # Update copy of each users' profile to the latest
4038 +            # See https://lists.sr.ht/~sircmpwn/sr.ht-admins/<20190302181207.GA13778%40cirno.my.domain>
4039 +            if test ! -e ${stateDir}/webhook; then
4040 +              # Update ${iniKey}'s users' profile copy to the latest
4041 +              ${cfg.python}/bin/srht-update-profiles ${iniKey}
4042 +              touch ${stateDir}/webhook
4043 +            fi
4044 +          '';
4045 +        } mainService ]);
4046 +      }
4047 +
4048 +      (mkIf webhooks {
4049 +        "${srvsrht}-webhooks" = baseService "${srvsrht}-webhooks" {}
4050 +          {
4051 +            description = "sourcehut ${srv}.sr.ht webhooks service";
4052 +            after = [ "${srvsrht}.service" ];
4053 +            wantedBy = [ "${srvsrht}.service" ];
4054 +            partOf = [ "${srvsrht}.service" ];
4055 +            preStart = ''
4056 +              cp ${pkgs.writeText "${srvsrht}-webhooks-celeryconfig.py" srvCfg.webhooks.celeryConfig} \
4057 +                 /run/sourcehut/${srvsrht}-webhooks/celeryconfig.py
4058 +            '';
4059 +            serviceConfig = {
4060 +              Type = "simple";
4061 +              Restart = "always";
4062 +              ExecStart = "${cfg.python}/bin/celery --app ${srvsrht}.webhooks worker --hostname ${srvsrht}-webhooks@%%h " + concatStringsSep " " srvCfg.webhooks.extraArgs;
4063 +              # Avoid crashing: os.getloadavg()
4064 +              ProcSubset = mkForce "all";
4065 +            };
4066 +          };
4067 +      })
4068 +
4069 +      (mapAttrs (timerName: timer: (baseService timerName {} (mkMerge [
4070 +        {
4071 +          description = "sourcehut ${timerName} service";
4072 +          after = [ "network.target" "${srvsrht}.service" ];
4073 +          serviceConfig = {
4074 +            Type = "oneshot";
4075 +            ExecStart = "${cfg.python}/bin/${timerName}";
4076 +          };
4077 +        }
4078 +        (timer.service or {})
4079 +      ]))) extraTimers)
4080 +
4081 +      (mapAttrs (serviceName: extraService: baseService serviceName {} (mkMerge [
4082 +        {
4083 +          description = "sourcehut ${serviceName} service";
4084 +          # So that extraServices have the PostgreSQL database initialized.
4085 +          after = [ "${srvsrht}.service" ];
4086 +          wantedBy = [ "${srvsrht}.service" ];
4087 +          partOf = [ "${srvsrht}.service" ];
4088 +          serviceConfig = {
4089 +            Type = "simple";
4090 +            Restart = mkDefault "always";
4091 +          };
4092 +        }
4093 +        extraService
4094 +      ])) extraServices)
4095 +    ];
4096 +
4097 +    systemd.timers = mapAttrs (timerName: timer:
4098 +      {
4099 +        description = "sourcehut timer for ${timerName}";
4100 +        wantedBy = [ "timers.target" ];
4101 +        inherit (timer) timerConfig;
4102 +      }) extraTimers;
4103 +  } ]);
4104  }
4105 -  (builtins.removeAttrs attrs [ "path" "preStart" ])
4106 diff --git a/nixos/modules/services/misc/sourcehut/sourcehut.xml b/nixos/modules/services/misc/sourcehut/sourcehut.xml
4107 index ab9a8c6cb4b..41094f65a94 100644
4108 --- a/nixos/modules/services/misc/sourcehut/sourcehut.xml
4109 +++ b/nixos/modules/services/misc/sourcehut/sourcehut.xml
4110 @@ -14,13 +14,12 @@
4111    <title>Basic usage</title>
4112    <para>
4113     Sourcehut is a Python and Go based set of applications.
4114 -   <literal><link linkend="opt-services.sourcehut.enable">services.sourcehut</link></literal>
4115 -   by default will use
4116 +   This NixOS module also provides basic configuration integrating Sourcehut into locally running
4117     <literal><link linkend="opt-services.nginx.enable">services.nginx</link></literal>,
4118 -   <literal><link linkend="opt-services.nginx.enable">services.redis</link></literal>,
4119 -   <literal><link linkend="opt-services.nginx.enable">services.cron</link></literal>,
4120 +   <literal><link linkend="opt-services.redis.servers">services.redis.servers.sourcehut</link></literal>,
4121 +   <literal><link linkend="opt-services.postfix.enable">services.postfix</link></literal>
4122     and
4123 -   <literal><link linkend="opt-services.postgresql.enable">services.postgresql</link></literal>.
4124 +   <literal><link linkend="opt-services.postgresql.enable">services.postgresql</link></literal> services.
4125    </para>
4126
4127    <para>
4128 @@ -42,18 +41,23 @@ in {
4129
4130    services.sourcehut = {
4131      <link linkend="opt-services.sourcehut.enable">enable</link> = true;
4132 -    <link linkend="opt-services.sourcehut.originBase">originBase</link> = fqdn;
4133 -    <link linkend="opt-services.sourcehut.services">services</link> = [ "meta" "man" "git" ];
4134 +    <link linkend="opt-services.sourcehut.git.enable">git.enable</link> = true;
4135 +    <link linkend="opt-services.sourcehut.man.enable">man.enable</link> = true;
4136 +    <link linkend="opt-services.sourcehut.meta.enable">meta.enable</link> = true;
4137 +    <link linkend="opt-services.sourcehut.nginx.enable">nginx.enable</link> = true;
4138 +    <link linkend="opt-services.sourcehut.postfix.enable">postfix.enable</link> = true;
4139 +    <link linkend="opt-services.sourcehut.postgresql.enable">postgresql.enable</link> = true;
4140 +    <link linkend="opt-services.sourcehut.redis.enable">redis.enable</link> = true;
4141      <link linkend="opt-services.sourcehut.settings">settings</link> = {
4142          "sr.ht" = {
4143            environment = "production";
4144            global-domain = fqdn;
4145            origin = "https://${fqdn}";
4146            # Produce keys with srht-keygen from <package>sourcehut.coresrht</package>.
4147 -          network-key = "SECRET";
4148 -          service-key = "SECRET";
4149 +          network-key = "/run/keys/path/to/network-key";
4150 +          service-key = "/run/keys/path/to/service-key";
4151          };
4152 -        webhooks.private-key= "SECRET";
4153 +        webhooks.private-key= "/run/keys/path/to/webhook-key";
4154      };
4155    };
4156
4157 diff --git a/nixos/modules/services/misc/sourcehut/todo.nix b/nixos/modules/services/misc/sourcehut/todo.nix
4158 deleted file mode 100644
4159 index aec773b0669..00000000000
4160 --- a/nixos/modules/services/misc/sourcehut/todo.nix
4161 +++ /dev/null
4162 @@ -1,161 +0,0 @@
4163 -{ config, lib, pkgs, ... }:
4164 -
4165 -with lib;
4166 -let
4167 -  cfg = config.services.sourcehut;
4168 -  cfgIni = cfg.settings;
4169 -  scfg = cfg.todo;
4170 -  iniKey = "todo.sr.ht";
4171 -
4172 -  rcfg = config.services.redis;
4173 -  drv = pkgs.sourcehut.todosrht;
4174 -in
4175 -{
4176 -  options.services.sourcehut.todo = {
4177 -    user = mkOption {
4178 -      type = types.str;
4179 -      default = "todosrht";
4180 -      description = ''
4181 -        User for todo.sr.ht.
4182 -      '';
4183 -    };
4184 -
4185 -    port = mkOption {
4186 -      type = types.port;
4187 -      default = 5003;
4188 -      description = ''
4189 -        Port on which the "todo" module should listen.
4190 -      '';
4191 -    };
4192 -
4193 -    database = mkOption {
4194 -      type = types.str;
4195 -      default = "todo.sr.ht";
4196 -      description = ''
4197 -        PostgreSQL database name for todo.sr.ht.
4198 -      '';
4199 -    };
4200 -
4201 -    statePath = mkOption {
4202 -      type = types.path;
4203 -      default = "${cfg.statePath}/todosrht";
4204 -      description = ''
4205 -        State path for todo.sr.ht.
4206 -      '';
4207 -    };
4208 -  };
4209 -
4210 -  config = with scfg; lib.mkIf (cfg.enable && elem "todo" cfg.services) {
4211 -    users = {
4212 -      users = {
4213 -        "${user}" = {
4214 -          isSystemUser = true;
4215 -          group = user;
4216 -          extraGroups = [ "postfix" ];
4217 -          description = "todo.sr.ht user";
4218 -        };
4219 -      };
4220 -      groups = {
4221 -        "${user}" = { };
4222 -      };
4223 -    };
4224 -
4225 -    services.postgresql = {
4226 -      authentication = ''
4227 -        local ${database} ${user} trust
4228 -      '';
4229 -      ensureDatabases = [ database ];
4230 -      ensureUsers = [
4231 -        {
4232 -          name = user;
4233 -          ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
4234 -        }
4235 -      ];
4236 -    };
4237 -
4238 -    systemd = {
4239 -      tmpfiles.rules = [
4240 -        "d ${statePath} 0750 ${user} ${user} -"
4241 -      ];
4242 -
4243 -      services = {
4244 -        todosrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
4245 -          after = [ "postgresql.service" "network.target" ];
4246 -          requires = [ "postgresql.service" ];
4247 -          wantedBy = [ "multi-user.target" ];
4248 -
4249 -          description = "todo.sr.ht website service";
4250 -
4251 -          serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
4252 -        };
4253 -
4254 -       todosrht-lmtp = {
4255 -         after = [ "postgresql.service" "network.target" ];
4256 -         bindsTo = [ "postgresql.service" ];
4257 -         wantedBy = [ "multi-user.target" ];
4258 -
4259 -         description = "todo.sr.ht process service";
4260 -         serviceConfig = {
4261 -           Type = "simple";
4262 -           User = user;
4263 -           Restart = "always";
4264 -           ExecStart = "${cfg.python}/bin/todosrht-lmtp";
4265 -         };
4266 -       };
4267 -
4268 -        todosrht-webhooks = {
4269 -          after = [ "postgresql.service" "network.target" ];
4270 -          requires = [ "postgresql.service" ];
4271 -          wantedBy = [ "multi-user.target" ];
4272 -
4273 -          description = "todo.sr.ht webhooks service";
4274 -          serviceConfig = {
4275 -            Type = "simple";
4276 -            User = user;
4277 -            Restart = "always";
4278 -            ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel=info";
4279 -          };
4280 -
4281 -        };
4282 -      };
4283 -    };
4284 -
4285 -    services.sourcehut.settings = {
4286 -      # URL todo.sr.ht is being served at (protocol://domain)
4287 -      "todo.sr.ht".origin = mkDefault "http://todo.${cfg.originBase}";
4288 -      # Address and port to bind the debug server to
4289 -      "todo.sr.ht".debug-host = mkDefault "0.0.0.0";
4290 -      "todo.sr.ht".debug-port = mkDefault port;
4291 -      # Configures the SQLAlchemy connection string for the database.
4292 -      "todo.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
4293 -      # Set to "yes" to automatically run migrations on package upgrade.
4294 -      "todo.sr.ht".migrate-on-upgrade = mkDefault "yes";
4295 -      # todo.sr.ht's OAuth client ID and secret for meta.sr.ht
4296 -      # Register your client at meta.example.org/oauth
4297 -      "todo.sr.ht".oauth-client-id = mkDefault null;
4298 -      "todo.sr.ht".oauth-client-secret = mkDefault null;
4299 -      # Outgoing email for notifications generated by users
4300 -      "todo.sr.ht".notify-from = mkDefault "CHANGEME@example.org";
4301 -      # The redis connection used for the webhooks worker
4302 -      "todo.sr.ht".webhooks = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/1";
4303 -      # Network-key
4304 -      "todo.sr.ht".network-key = mkDefault null;
4305 -
4306 -      # Path for the lmtp daemon's unix socket. Direct incoming mail to this socket.
4307 -      # Alternatively, specify IP:PORT and an SMTP server will be run instead.
4308 -      "todo.sr.ht::mail".sock = mkDefault "/tmp/todo.sr.ht-lmtp.sock";
4309 -      # The lmtp daemon will make the unix socket group-read/write for users in this
4310 -      # group.
4311 -      "todo.sr.ht::mail".sock-group = mkDefault "postfix";
4312 -
4313 -      "todo.sr.ht::mail".posting-domain = mkDefault "todo.${cfg.originBase}";
4314 -    };
4315 -
4316 -    services.nginx.virtualHosts."todo.${cfg.originBase}" = {
4317 -      forceSSL = true;
4318 -      locations."/".proxyPass = "http://${cfg.address}:${toString port}";
4319 -      locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
4320 -      locations."/static".root = "${pkgs.sourcehut.todosrht}/${pkgs.sourcehut.python.sitePackages}/todosrht";
4321 -    };
4322 -  };
4323 -}
4324 diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
4325 index dab99dd8d04..2b6ba687fe8 100644
4326 --- a/nixos/tests/all-tests.nix
4327 +++ b/nixos/tests/all-tests.nix
4328 @@ -408,6 +408,7 @@ in
4329    solanum = handleTest ./solanum.nix {};
4330    solr = handleTest ./solr.nix {};
4331    sonarr = handleTest ./sonarr.nix {};
4332 +  sourcehut = handleTest ./sourcehut.nix {};
4333    spacecookie = handleTest ./spacecookie.nix {};
4334    spike = handleTest ./spike.nix {};
4335    sslh = handleTest ./sslh.nix {};
4336 diff --git a/nixos/tests/sourcehut.nix b/nixos/tests/sourcehut.nix
4337 index b56a14ebf85..6492250bd57 100644
4338 --- a/nixos/tests/sourcehut.nix
4339 +++ b/nixos/tests/sourcehut.nix
4340 @@ -12,10 +12,20 @@ import ./make-test-python.nix ({ pkgs, ... }:
4341      services.sourcehut = {
4342        enable = true;
4343        services = [ "meta" ];
4344 -      originBase = "sourcehut";
4345 -      settings."sr.ht".service-key =   "8888888888888888888888888888888888888888888888888888888888888888";
4346 -      settings."sr.ht".network-key = "0000000000000000000000000000000000000000000=";
4347 -      settings.webhooks.private-key = "0000000000000000000000000000000000000000000=";
4348 +      redis.enable = true;
4349 +      postgresql.enable = true;
4350 +      meta.enable = true;
4351 +      settings."sr.ht" = {
4352 +        global-domain = "sourcehut";
4353 +        service-key = pkgs.writeText "service-key" "8b327279b77e32a3620e2fc9aabce491cc46e7d821fd6713b2a2e650ce114d01";
4354 +        network-key = pkgs.writeText "network-key" "cEEmc30BRBGkgQZcHFksiG7hjc6_dK1XR2Oo5Jb9_nQ=";
4355 +      };
4356 +      settings.webhooks.private-key = pkgs.writeText "webhook-key" "Ra3IjxgFiwG9jxgp4WALQIZw/BMYt30xWiOsqD0J7EA=";
4357 +    };
4358 +    services.postgresql = {
4359 +      enable = true;
4360 +      enableTCPIP = false;
4361 +      settings.unix_socket_permissions = "0770";
4362      };
4363    };
4364
4365 diff --git a/pkgs/applications/version-management/sourcehut/builds.nix b/pkgs/applications/version-management/sourcehut/builds.nix
4366 index c8163caf8ea..7ea2fef54bb 100644
4367 --- a/pkgs/applications/version-management/sourcehut/builds.nix
4368 +++ b/pkgs/applications/version-management/sourcehut/builds.nix
4369 @@ -11,26 +11,55 @@
4370  , python
4371  }:
4372  let
4373 -  version = "0.66.7";
4374 -
4375 -  buildWorker = src: buildGoModule {
4376 -    inherit src version;
4377 -    pname = "builds-sr-ht-worker";
4378 -
4379 -    vendorSha256 = "sha256-giOaldV46aBqXyFH/cQVsbUr6Rb4VMhbBO86o48tRZY=";
4380 -  };
4381 -in
4382 -buildPythonPackage rec {
4383 -  inherit version;
4384 -  pname = "buildsrht";
4385 +  version = "0.71.6";
4386
4387    src = fetchFromSourcehut {
4388      owner = "~sircmpwn";
4389      repo = "builds.sr.ht";
4390      rev = version;
4391 -    sha256 = "sha256-2MLs/DOXHjEYarXDVUcPZe3o0fmZbzVxn528SE72lhM=";
4392 +    sha256 = "sha256-c2xp2uIP8+WeRMz0efA1H58Nkot65bc03e7rrrZk3jo=";
4393    };
4394
4395 +  worker = buildGoModule rec {
4396 +    inherit src version;
4397 +    sourceRoot = "source/worker";
4398 +    pname = "buildsrht-worker";
4399 +
4400 +    vendorSha256 = "sha256-iMlCZPCIwhppPAYUi6E8td1BoNaqBuQCI5E83cnEBJ0=";
4401 +
4402 +    # What follows is only to update go-redis,
4403 +    # and thus also using a patched srht-keys.
4404 +    # go.{mod,sum} could be patched directly but that would be less resilient
4405 +    # to changes from upstream, and thus harder to maintain the patching
4406 +    # while it hasn't been merged upstream.
4407 +
4408 +    overrideModAttrs = old: {
4409 +      inherit patches patchFlags;
4410 +      preBuild = ''
4411 +        go get github.com/go-redis/redis/v8
4412 +        go get github.com/go-redis/redis@none
4413 +        go mod tidy
4414 +      '';
4415 +      # Pass updated go.{mod,sum} from go-modules to worker's vendor/go.{mod,sum}
4416 +      postInstall = ''
4417 +        cp --reflink=auto go.* $out/
4418 +      '';
4419 +    };
4420 +
4421 +    patches = [
4422 +      # Update go-redis to support Unix sockets
4423 +      patches/redis-socket/build/v3-0001-worker-update-go-redis-to-support-Unix-sockets.patch
4424 +    ];
4425 +    patchFlags = "-p2";
4426 +    postConfigure = ''
4427 +      cp -v vendor/go.{mod,sum} .
4428 +    '';
4429 +  };
4430 +in
4431 +buildPythonPackage rec {
4432 +  inherit src version;
4433 +  pname = "buildsrht";
4434 +
4435    nativeBuildInputs = srht.nativeBuildInputs;
4436
4437    propagatedBuildInputs = [
4438 @@ -53,13 +82,17 @@ buildPythonPackage rec {
4439
4440      cp -r images $out/lib
4441      cp contrib/submit_image_build $out/bin/builds.sr.ht
4442 -    cp ${buildWorker "${src}/worker"}/bin/worker $out/bin/builds.sr.ht-worker
4443 +    cp ${worker}/bin/worker $out/bin/builds.sr.ht-worker
4444    '';
4445
4446 +  pythonImportsCheck = [ "buildsrht" ];
4447 +
4448 +  passthru = { inherit worker; };
4449 +
4450    meta = with lib; {
4451      homepage = "https://git.sr.ht/~sircmpwn/builds.sr.ht";
4452      description = "Continuous integration service for the sr.ht network";
4453 -    license = licenses.agpl3;
4454 +    license = licenses.agpl3Only;
4455      maintainers = with maintainers; [ eadwu ];
4456    };
4457  }
4458 diff --git a/pkgs/applications/version-management/sourcehut/core.nix b/pkgs/applications/version-management/sourcehut/core.nix
4459 index 7c3a516ed9d..2b302d1441c 100644
4460 --- a/pkgs/applications/version-management/sourcehut/core.nix
4461 +++ b/pkgs/applications/version-management/sourcehut/core.nix
4462 @@ -25,17 +25,16 @@
4463  , sassc
4464  , nodejs
4465  , redis
4466 -, writeText
4467  }:
4468
4469  buildPythonPackage rec {
4470    pname = "srht";
4471 -  version = "0.67.4";
4472 +  version = "0.67.25";
4473
4474    src = fetchgit {
4475      url = "https://git.sr.ht/~sircmpwn/core.sr.ht";
4476      rev = version;
4477 -    sha256 = "sha256-XvzFfcBK5Mq8p7xEBAF/eupUE1kkUBh5k+ByM/WA9bc=";
4478 +    sha256 = "sha256-JZXIpNEY1/KUaYh0Vk5j/zVO9JQc2F1RmnZ/5TFN0PI=";
4479      fetchSubmodules = true;
4480    };
4481
4482 @@ -46,7 +45,10 @@ buildPythonPackage rec {
4483    };
4484
4485    patches = [
4486 -    ./disable-npm-install.patch
4487 +    # Disable check for npm
4488 +    patches/disable-npm-install.patch
4489 +    # Add Unix socket support for redis-host=
4490 +    patches/redis-socket/core/v3-0001-add-Unix-socket-support-for-redis-host.patch
4491    ];
4492
4493    nativeBuildInputs = [
4494 @@ -87,6 +89,7 @@ buildPythonPackage rec {
4495    '';
4496
4497    dontUseSetuptoolsCheck = true;
4498 +  pythonImportsCheck = [ "srht" ];
4499
4500    meta = with lib; {
4501      homepage = "https://git.sr.ht/~sircmpwn/srht";
4502 diff --git a/pkgs/applications/version-management/sourcehut/default.nix b/pkgs/applications/version-management/sourcehut/default.nix
4503 index 401a1437b7d..7dde841b543 100644
4504 --- a/pkgs/applications/version-management/sourcehut/default.nix
4505 +++ b/pkgs/applications/version-management/sourcehut/default.nix
4506 @@ -22,10 +22,12 @@ let
4507        listssrht = self.callPackage ./lists.nix { };
4508        mansrht = self.callPackage ./man.nix { };
4509        metasrht = self.callPackage ./meta.nix { };
4510 +      pagessrht = self.callPackage ./pages.nix { };
4511        pastesrht = self.callPackage ./paste.nix { };
4512        todosrht = self.callPackage ./todo.nix { };
4513
4514        scmsrht = self.callPackage ./scm.nix { };
4515 +      srht-keys = self.scmsrht.srht-keys;
4516      };
4517    };
4518  in
4519 @@ -40,6 +42,8 @@ with python.pkgs; recurseIntoAttrs {
4520    listssrht = toPythonApplication listssrht;
4521    mansrht = toPythonApplication mansrht;
4522    metasrht = toPythonApplication metasrht;
4523 +  pagessrht = pagessrht;
4524    pastesrht = toPythonApplication pastesrht;
4525    todosrht = toPythonApplication todosrht;
4526 +  srht-keys = scmsrht.srht-keys;
4527  }
4528 diff --git a/pkgs/applications/version-management/sourcehut/dispatch.nix b/pkgs/applications/version-management/sourcehut/dispatch.nix
4529 index 637c6f9c1df..9456d0c998c 100644
4530 --- a/pkgs/applications/version-management/sourcehut/dispatch.nix
4531 +++ b/pkgs/applications/version-management/sourcehut/dispatch.nix
4532 @@ -9,13 +9,13 @@
4533
4534  buildPythonPackage rec {
4535    pname = "dispatchsrht";
4536 -  version = "0.15.8";
4537 +  version = "0.15.32";
4538
4539    src = fetchFromSourcehut {
4540      owner = "~sircmpwn";
4541      repo = "dispatch.sr.ht";
4542      rev = version;
4543 -    sha256 = "sha256-zWCGPjIgMKHXHJUs9aciV7IFgo0rpahon6KXHDwcfss=";
4544 +    sha256 = "sha256-4P4cXhjcZ8IBzpRfmYIJkzl9U4Plo36a48Pf/KjmhFY=";
4545    };
4546
4547    nativeBuildInputs = srht.nativeBuildInputs;
4548 @@ -31,10 +31,12 @@ buildPythonPackage rec {
4549      export SRHT_PATH=${srht}/${python.sitePackages}/srht
4550    '';
4551
4552 +  pythonImportsCheck = [ "dispatchsrht" ];
4553 +
4554    meta = with lib; {
4555      homepage = "https://dispatch.sr.ht/~sircmpwn/dispatch.sr.ht";
4556      description = "Task dispatcher and service integration tool for the sr.ht network";
4557 -    license = licenses.agpl3;
4558 +    license = licenses.agpl3Only;
4559      maintainers = with maintainers; [ eadwu ];
4560    };
4561  }
4562 diff --git a/pkgs/applications/version-management/sourcehut/git.nix b/pkgs/applications/version-management/sourcehut/git.nix
4563 index e44fb9cd6c6..2aed7b4a5fe 100644
4564 --- a/pkgs/applications/version-management/sourcehut/git.nix
4565 +++ b/pkgs/applications/version-management/sourcehut/git.nix
4566 @@ -6,42 +6,111 @@
4567  , srht
4568  , pygit2
4569  , scmsrht
4570 +, srht-keys
4571  }:
4572  let
4573 -  version = "0.72.8";
4574 +  version = "0.72.47";
4575
4576    src = fetchFromSourcehut {
4577      owner = "~sircmpwn";
4578      repo = "git.sr.ht";
4579      rev = version;
4580 -    sha256 = "sha256-AB2uzajO5PtcpJfbOOTfuDFM6is5K39v3AZJ1hShRNc=";
4581 +    sha256 = "sha256-jk2DFC/fDYN88nofntJrBtYfCWr39YaNv2azH/tdZtQ=";
4582    };
4583
4584 -  buildShell = src: buildGoModule {
4585 +  gitsrht-shell = buildGoModule {
4586      inherit src version;
4587 +    sourceRoot = "source/gitsrht-shell";
4588      pname = "gitsrht-shell";
4589      vendorSha256 = "sha256-aqUFICp0C2reqb2p6JCPAUIRsxzSv0t9BHoNWrTYfqk=";
4590    };
4591
4592 -  buildDispatcher = src: buildGoModule {
4593 +  gitsrht-dispatch = buildGoModule {
4594      inherit src version;
4595 +    sourceRoot = "source/gitsrht-dispatch";
4596      pname = "gitsrht-dispatcher";
4597      vendorSha256 = "sha256-qWXPHo86s6iuRBhRMtmD5jxnAWKdrWHtA/iSUkdw89M=";
4598 +    patches = [
4599 +      # Add support for supplementary groups
4600 +      patches/redis-socket/git/v3-0003-gitsrht-dispatch-add-support-for-supplementary-gr.patch
4601 +    ];
4602 +    patchFlags = "-p2";
4603    };
4604
4605 -  buildKeys = src: buildGoModule {
4606 +  gitsrht-keys = buildGoModule rec {
4607      inherit src version;
4608 +    sourceRoot = "source/gitsrht-keys";
4609      pname = "gitsrht-keys";
4610 -    vendorSha256 = "1d94cqy7x0q0agwg515xxsbl70b3qrzxbzsyjhn1pbyj532brn7f";
4611 +    vendorSha256 = "sha256-m6uIrYDWqGagi+jjfYo4C59SjLqaaXwDq9vO0b9EW6M=";
4612 +
4613 +    # What follows is only to update go-redis,
4614 +    # and thus also using a patched srht-keys.
4615 +    # go.{mod,sum} could be patched directly but that would be less resilient
4616 +    # to changes from upstream, and thus harder to maintain the patching
4617 +    # while it hasn't been merged upstream.
4618 +
4619 +    overrideModAttrs = old: {
4620 +      inherit patches patchFlags;
4621 +      preBuild = ''
4622 +        # This is a fixed-output derivation so it is not allowed to reference other derivations,
4623 +        # but here srht-keys will be copied to vendor/ by go mod vendor
4624 +        ln -s ${srht-keys} srht-keys
4625 +        go mod edit -replace git.sr.ht/~sircmpwn/scm.sr.ht/srht-keys=$PWD/srht-keys
4626 +        go get github.com/go-redis/redis/v8
4627 +        go get github.com/go-redis/redis@none
4628 +        go mod tidy
4629 +      '';
4630 +      # Pass updated go.{mod,sum} from go-modules to gitsrht-keys' vendor/go.{mod,sum}
4631 +      postInstall = ''
4632 +        cp --reflink=auto go.* $out/
4633 +      '';
4634 +    };
4635 +
4636 +    patches = [
4637 +      # Update go-redis to support Unix sockets
4638 +      patches/redis-socket/git/v3-0001-gitsrht-keys-update-go-redis-to-support-Unix-sock.patch
4639 +    ];
4640 +    patchFlags = "-p2";
4641 +    postConfigure = ''
4642 +      cp -v vendor/go.{mod,sum} .
4643 +    '';
4644    };
4645
4646 -  buildUpdateHook = src: buildGoModule {
4647 +  gitsrht-update-hook = buildGoModule rec {
4648      inherit src version;
4649 +    sourceRoot = "source/gitsrht-update-hook";
4650      pname = "gitsrht-update-hook";
4651 -    vendorSha256 = "0fwzqpjv8x5y3w3bfjd0x0cvqjjak23m0zj88hf32jpw49xmjkih";
4652 -  };
4653 +    vendorSha256 = "sha256-UoHxGVYEgTDqFzVQ2Dv6BRT4jVt+/QpNqEH3G2UWFjs=";
4654
4655 -  updateHook = buildUpdateHook "${src}/gitsrht-update-hook";
4656 +    # What follows is only to update go-redis
4657 +    # and thus also using a patched srht-keys.
4658 +
4659 +    overrideModAttrs = old: {
4660 +      inherit patches patchFlags;
4661 +      preBuild = ''
4662 +        # This is a fixed-output derivation so it is not allowed to reference other derivations,
4663 +        # but here srht-keys will be copied to vendor/ by go mod vendor
4664 +        ln -s ${srht-keys} srht-keys
4665 +        go mod edit -replace git.sr.ht/~sircmpwn/scm.sr.ht/srht-keys=$PWD/srht-keys
4666 +        go get github.com/go-redis/redis/v8
4667 +        go get github.com/go-redis/redis@none
4668 +        go mod tidy
4669 +      '';
4670 +      # Pass updated go.{mod,sum} from go-modules to gitsrht-keys' vendor/go.{mod,sum}
4671 +      postInstall = ''
4672 +        cp --reflink=auto go.* $out/
4673 +      '';
4674 +    };
4675 +
4676 +    patches = [
4677 +      # Update go-redis to support Unix sockets
4678 +      patches/redis-socket/git/v3-0002-gitsrht-update-hook-update-go-redis-to-support-Un.patch
4679 +    ];
4680 +    patchFlags = "-p2";
4681 +    postConfigure = ''
4682 +      cp -v vendor/go.{mod,sum} .
4683 +    '';
4684 +  };
4685
4686  in
4687  buildPythonPackage rec {
4688 @@ -63,19 +132,21 @@ buildPythonPackage rec {
4689
4690    postInstall = ''
4691      mkdir -p $out/bin
4692 -    cp ${buildShell "${src}/gitsrht-shell"}/bin/gitsrht-shell $out/bin/gitsrht-shell
4693 -    cp ${buildDispatcher "${src}/gitsrht-dispatch"}/bin/gitsrht-dispatch $out/bin/gitsrht-dispatch
4694 -    cp ${buildKeys "${src}/gitsrht-keys"}/bin/gitsrht-keys $out/bin/gitsrht-keys
4695 -    cp ${updateHook}/bin/gitsrht-update-hook $out/bin/gitsrht-update-hook
4696 +    cp ${gitsrht-shell}/bin/gitsrht-shell $out/bin/gitsrht-shell
4697 +    cp ${gitsrht-dispatch}/bin/gitsrht-dispatch $out/bin/gitsrht-dispatch
4698 +    cp ${gitsrht-keys}/bin/gitsrht-keys $out/bin/gitsrht-keys
4699 +    cp ${gitsrht-update-hook}/bin/gitsrht-update-hook $out/bin/gitsrht-update-hook
4700    '';
4701    passthru = {
4702 -    inherit updateHook;
4703 +    inherit gitsrht-shell gitsrht-dispatch gitsrht-keys gitsrht-update-hook;
4704    };
4705
4706 +  pythonImportsCheck = [ "gitsrht" ];
4707 +
4708    meta = with lib; {
4709      homepage = "https://git.sr.ht/~sircmpwn/git.sr.ht";
4710      description = "Git repository hosting service for the sr.ht network";
4711 -    license = licenses.agpl3;
4712 +    license = licenses.agpl3Only;
4713      maintainers = with maintainers; [ eadwu ];
4714    };
4715  }
4716 diff --git a/pkgs/applications/version-management/sourcehut/hg.nix b/pkgs/applications/version-management/sourcehut/hg.nix
4717 index cddb76cabf2..1d6062d81cc 100644
4718 --- a/pkgs/applications/version-management/sourcehut/hg.nix
4719 +++ b/pkgs/applications/version-management/sourcehut/hg.nix
4720 @@ -10,12 +10,12 @@
4721
4722  buildPythonPackage rec {
4723    pname = "hgsrht";
4724 -  version = "0.27.4";
4725 +  version = "0.27.6";
4726
4727    src = fetchhg {
4728      url = "https://hg.sr.ht/~sircmpwn/hg.sr.ht";
4729      rev = version;
4730 -    sha256 = "1c0qfi0gmbfngvds6917fy9ii2iglawn429757rh7b4bvzn7n6mr";
4731 +    sha256 = "ibijvKjS4CiWTYrO6Qdh3RkD0EUE7BY8wjdPwrD6vkA=";
4732    };
4733
4734    nativeBuildInputs = srht.nativeBuildInputs;
4735 @@ -32,10 +32,12 @@ buildPythonPackage rec {
4736      export SRHT_PATH=${srht}/${python.sitePackages}/srht
4737    '';
4738
4739 +  pythonImportsCheck = [ "hgsrht" ];
4740 +
4741    meta = with lib; {
4742      homepage = "https://git.sr.ht/~sircmpwn/hg.sr.ht";
4743      description = "Mercurial repository hosting service for the sr.ht network";
4744 -    license = licenses.agpl3;
4745 +    license = licenses.agpl3Only;
4746      maintainers = with maintainers; [ eadwu ];
4747    };
4748  }
4749 diff --git a/pkgs/applications/version-management/sourcehut/hub.nix b/pkgs/applications/version-management/sourcehut/hub.nix
4750 index 17cb3fe4b61..31975b305c5 100644
4751 --- a/pkgs/applications/version-management/sourcehut/hub.nix
4752 +++ b/pkgs/applications/version-management/sourcehut/hub.nix
4753 @@ -6,13 +6,13 @@
4754
4755  buildPythonPackage rec {
4756    pname = "hubsrht";
4757 -  version = "0.13.1";
4758 +  version = "0.13.11";
4759
4760    src = fetchFromSourcehut {
4761      owner = "~sircmpwn";
4762      repo = "hub.sr.ht";
4763      rev = version;
4764 -    sha256 = "sha256-Kqzy4mh5Nn1emzHBco/LVuXro/tW3NX+OYqdEwBSQ/U=";
4765 +    sha256 = "sha256-AIpP7gfXoBvl6s8+dA3XrjuUHsPTtKFsZqwqbjBKYUk=";
4766    };
4767
4768    nativeBuildInputs = srht.nativeBuildInputs;
4769 @@ -26,11 +26,12 @@ buildPythonPackage rec {
4770    '';
4771
4772    dontUseSetuptoolsCheck = true;
4773 +  pythonImportsCheck = [ "hubsrht" ];
4774
4775    meta = with lib; {
4776      homepage = "https://git.sr.ht/~sircmpwn/hub.sr.ht";
4777      description = "Project hub service for the sr.ht network";
4778 -    license = licenses.agpl3;
4779 +    license = licenses.agpl3Only;
4780      maintainers = with maintainers; [ eadwu ];
4781    };
4782  }
4783 diff --git a/pkgs/applications/version-management/sourcehut/lists.nix b/pkgs/applications/version-management/sourcehut/lists.nix
4784 index b419b49f7b5..51b1a3627db 100644
4785 --- a/pkgs/applications/version-management/sourcehut/lists.nix
4786 +++ b/pkgs/applications/version-management/sourcehut/lists.nix
4787 @@ -12,13 +12,13 @@
4788
4789  buildPythonPackage rec {
4790    pname = "listssrht";
4791 -  version = "0.48.19";
4792 +  version = "0.50.1";
4793
4794    src = fetchFromSourcehut {
4795      owner = "~sircmpwn";
4796      repo = "lists.sr.ht";
4797      rev = version;
4798 -    sha256 = "sha256-bsakEMyvWaxiE4/SGcAP4mlGG9jkdHfFxpt9H+TJn/8=";
4799 +    sha256 = "sha256-FrC3Au/ZdDtJuczGgaAhAEZu0hVa74LOM8z3aOiqGZc=";
4800    };
4801
4802    nativeBuildInputs = srht.nativeBuildInputs;
4803 @@ -37,10 +37,12 @@ buildPythonPackage rec {
4804      export SRHT_PATH=${srht}/${python.sitePackages}/srht
4805    '';
4806
4807 +  pythonImportsCheck = [ "listssrht" ];
4808 +
4809    meta = with lib; {
4810      homepage = "https://git.sr.ht/~sircmpwn/lists.sr.ht";
4811      description = "Mailing list service for the sr.ht network";
4812 -    license = licenses.agpl3;
4813 +    license = licenses.agpl3Only;
4814      maintainers = with maintainers; [ eadwu ];
4815    };
4816  }
4817 diff --git a/pkgs/applications/version-management/sourcehut/man.nix b/pkgs/applications/version-management/sourcehut/man.nix
4818 index bd331f000a7..47c6bb0ac4f 100644
4819 --- a/pkgs/applications/version-management/sourcehut/man.nix
4820 +++ b/pkgs/applications/version-management/sourcehut/man.nix
4821 @@ -8,13 +8,13 @@
4822
4823  buildPythonPackage rec {
4824    pname = "mansrht";
4825 -  version = "0.15.12";
4826 +  version = "0.15.20";
4827
4828    src = fetchFromSourcehut {
4829      owner = "~sircmpwn";
4830      repo = "man.sr.ht";
4831      rev = version;
4832 -    sha256 = "sha256-MqH/8K9XRvEg6P7GHE6XXtWnhDP3wT8iGoNaFtYQbio=";
4833 +    sha256 = "sha256-ulwdrVrw2bwdafgc3NrJ1J15evQ5btpHLTaiqsyA58U=";
4834    };
4835
4836    nativeBuildInputs = srht.nativeBuildInputs;
4837 @@ -29,10 +29,12 @@ buildPythonPackage rec {
4838      export SRHT_PATH=${srht}/${python.sitePackages}/srht
4839    '';
4840
4841 +  pythonImportsCheck = [ "mansrht" ];
4842 +
4843    meta = with lib; {
4844      homepage = "https://git.sr.ht/~sircmpwn/man.sr.ht";
4845      description = "Wiki service for the sr.ht network";
4846 -    license = licenses.agpl3;
4847 +    license = licenses.agpl3Only;
4848      maintainers = with maintainers; [ eadwu ];
4849    };
4850  }
4851 diff --git a/pkgs/applications/version-management/sourcehut/meta.nix b/pkgs/applications/version-management/sourcehut/meta.nix
4852 index 86d293973d7..0964960fea0 100644
4853 --- a/pkgs/applications/version-management/sourcehut/meta.nix
4854 +++ b/pkgs/applications/version-management/sourcehut/meta.nix
4855 @@ -18,19 +18,19 @@
4856  , python
4857  }:
4858  let
4859 -  version = "0.53.14";
4860 +  version = "0.56.0";
4861
4862    src = fetchFromSourcehut {
4863      owner = "~sircmpwn";
4864      repo = "meta.sr.ht";
4865      rev = version;
4866 -    sha256 = "sha256-/+r/XLDkcSTW647xPMh5bcJmR2xZNNH74AJ5jemna2k=";
4867 +    sha256 = "sha256-+fCNtW+k9fmjh1TLK0WUv0EgWKGlhURYS6atUH5EOjM=";
4868    };
4869
4870    buildApi = src: buildGoModule {
4871      inherit src version;
4872      pname = "metasrht-api";
4873 -    vendorSha256 = "sha256-eZyDrr2VcNMxI++18qUy7LA1Q1YDlWCoRtl00L8lfR4=";
4874 +    vendorSha256 = "sha256-m9j9tmss+utTVMywI9wB1n9EK8sbElW0ej2YqK1yL5M=";
4875    };
4876
4877  in
4878 @@ -66,10 +66,12 @@ buildPythonPackage rec {
4879      cp ${buildApi "${src}/api/"}/bin/api $out/bin/metasrht-api
4880    '';
4881
4882 +  pythonImportsCheck = [ "metasrht" ];
4883 +
4884    meta = with lib; {
4885      homepage = "https://git.sr.ht/~sircmpwn/meta.sr.ht";
4886      description = "Account management service for the sr.ht network";
4887 -    license = licenses.agpl3;
4888 +    license = licenses.agpl3Only;
4889      maintainers = with maintainers; [ eadwu ];
4890    };
4891  }
4892 diff --git a/pkgs/applications/version-management/sourcehut/pages.nix b/pkgs/applications/version-management/sourcehut/pages.nix
4893 new file mode 100644
4894 index 00000000000..4a3d9f8c7d0
4895 --- /dev/null
4896 +++ b/pkgs/applications/version-management/sourcehut/pages.nix
4897 @@ -0,0 +1,32 @@
4898 +{ lib
4899 +, fetchFromSourcehut
4900 +, buildGoModule
4901 +}:
4902 +let
4903 +  version = "0.4.10";
4904 +
4905 +  src = fetchFromSourcehut {
4906 +    owner = "~sircmpwn";
4907 +    repo = "pages.sr.ht";
4908 +    rev = version;
4909 +    sha256 = "sha256-Lq/xCCAywxxjX5nHbOvmCaQ4wtLgjcMo3Qc7xO1fdAs=";
4910 +  };
4911 +
4912 +in
4913 +buildGoModule {
4914 +  inherit src version;
4915 +  pname = "pagessrht";
4916 +  vendorSha256 = "sha256-YFRBoflFy48ipTvXdZ4qPSEgTIYvm4752JRZSzRG++U=";
4917 +
4918 +  postInstall = ''
4919 +    mkdir -p $out/share/sql/
4920 +    cp -r -t $out/share/sql/ schema.sql migrations
4921 +  '';
4922 +
4923 +  meta = with lib; {
4924 +    homepage = "https://git.sr.ht/~sircmpwn/pages.sr.ht";
4925 +    description = "Web hosting service for the sr.ht network";
4926 +    license = licenses.agpl3Only;
4927 +    maintainers = with maintainers; [ eadwu ];
4928 +  };
4929 +}
4930 diff --git a/pkgs/applications/version-management/sourcehut/paste.nix b/pkgs/applications/version-management/sourcehut/paste.nix
4931 index 0d8c9135493..ecd31c25deb 100644
4932 --- a/pkgs/applications/version-management/sourcehut/paste.nix
4933 +++ b/pkgs/applications/version-management/sourcehut/paste.nix
4934 @@ -8,13 +8,13 @@
4935
4936  buildPythonPackage rec {
4937    pname = "pastesrht";
4938 -  version = "0.12.1";
4939 +  version = "0.12.4";
4940
4941    src = fetchFromSourcehut {
4942      owner = "~sircmpwn";
4943      repo = "paste.sr.ht";
4944      rev = version;
4945 -    sha256 = "sha256-QQhd2LeH9BLmlHilhsv+9fZ+RPNmEMSmOpFA3dsMBFc=";
4946 +    sha256 = "sha256-hFjWa7L7JiQoG3Hm9NyoP2FNypDiW+nGDmQ2DoZkAIw=";
4947    };
4948
4949    nativeBuildInputs = srht.nativeBuildInputs;
4950 @@ -29,10 +29,12 @@ buildPythonPackage rec {
4951      export SRHT_PATH=${srht}/${python.sitePackages}/srht
4952    '';
4953
4954 +  pythonImportsCheck = [ "pastesrht" ];
4955 +
4956    meta = with lib; {
4957      homepage = "https://git.sr.ht/~sircmpwn/paste.sr.ht";
4958      description = "Ad-hoc text file hosting service for the sr.ht network";
4959 -    license = licenses.agpl3;
4960 +    license = licenses.agpl3Only;
4961      maintainers = with maintainers; [ eadwu ];
4962    };
4963  }
4964 diff --git a/pkgs/applications/version-management/sourcehut/disable-npm-install.patch b/pkgs/applications/version-management/sourcehut/patches/disable-npm-install.patch
4965 similarity index 100%
4966 rename from pkgs/applications/version-management/sourcehut/disable-npm-install.patch
4967 rename to pkgs/applications/version-management/sourcehut/patches/disable-npm-install.patch
4968 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/v3-0001-worker-update-go-redis-to-support-Unix-sockets.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/v3-0001-worker-update-go-redis-to-support-Unix-sockets.patch
4969 new file mode 100644
4970 index 00000000000..4efd12be875
4971 --- /dev/null
4972 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/v3-0001-worker-update-go-redis-to-support-Unix-sockets.patch
4973 @@ -0,0 +1,113 @@
4974 +From 5991960a5d412f0e1bdc505b970248c68b44a720 Mon Sep 17 00:00:00 2001
4975 +From: Julien Moutinho <julm+srht@sourcephile.fr>
4976 +Date: Wed, 15 Sep 2021 19:45:41 +0200
4977 +Subject: [PATCH builds.sr.ht v3 1/2] worker: update go-redis to support Unix
4978 + sockets
4979 +
4980 +---
4981 + worker/context.go |  4 ++--
4982 + worker/main.go    | 11 +++++++----
4983 + worker/tasks.go   | 10 +++++-----
4984 + 3 files changed, 14 insertions(+), 11 deletions(-)
4985 +
4986 +diff --git a/worker/context.go b/worker/context.go
4987 +index f84a60c..be54717 100644
4988 +--- a/worker/context.go
4989 ++++ b/worker/context.go
4990 +@@ -14,7 +14,7 @@ import (
4991 +       "strings"
4992 +       "time"
4993 +
4994 +-      "github.com/go-redis/redis"
4995 ++      goredis "github.com/go-redis/redis/v8"
4996 +       "github.com/google/shlex"
4997 +       "github.com/pkg/errors"
4998 +       "github.com/prometheus/client_golang/prometheus"
4999 +@@ -41,7 +41,7 @@ var (
5000 +
5001 + type WorkerContext struct {
5002 +       Db    *sql.DB
5003 +-      Redis *redis.Client
5004 ++      Redis *goredis.Client
5005 +       Conf  func(section, key string) string
5006 + }
5007 +
5008 +diff --git a/worker/main.go b/worker/main.go
5009 +index 274ba68..e22ab6b 100644
5010 +--- a/worker/main.go
5011 ++++ b/worker/main.go
5012 +@@ -1,6 +1,7 @@
5013 + package main
5014 +
5015 + import (
5016 ++      "context"
5017 +       "database/sql"
5018 +       "flag"
5019 +       "log"
5020 +@@ -9,7 +10,7 @@ import (
5021 +       "runtime"
5022 +       "sync"
5023 +
5024 +-      "github.com/go-redis/redis"
5025 ++      goredis "github.com/go-redis/redis/v8"
5026 +       "github.com/vaughan0/go-ini"
5027 +       "git.sr.ht/~sircmpwn/core-go/crypto"
5028 +
5029 +@@ -26,6 +27,8 @@ var (
5030 +       jobsMutex sync.Mutex
5031 + )
5032 +
5033 ++var redisctx = context.Background()
5034 ++
5035 + func main() {
5036 +       flag.IntVar(&workers, "workers", runtime.NumCPU(),
5037 +               "configure number of workers")
5038 +@@ -68,12 +71,12 @@ func main() {
5039 +       if !ok {
5040 +               redisHost = "redis://localhost:6379"
5041 +       }
5042 +-      ropts, err := redis.ParseURL(redisHost)
5043 ++      ropts, err := goredis.ParseURL(redisHost)
5044 +       if err != nil {
5045 +               panic(err)
5046 +       }
5047 +-      localRedis := redis.NewClient(ropts)
5048 +-      if _, err := localRedis.Ping().Result(); err != nil {
5049 ++      localRedis := goredis.NewClient(ropts)
5050 ++      if _, err := localRedis.Ping(redisctx).Result(); err != nil {
5051 +               panic(err)
5052 +       }
5053 +
5054 +diff --git a/worker/tasks.go b/worker/tasks.go
5055 +index d27bf33..d0c28f1 100644
5056 +--- a/worker/tasks.go
5057 ++++ b/worker/tasks.go
5058 +@@ -19,7 +19,7 @@ import (
5059 +       "time"
5060 +
5061 +       "git.sr.ht/~sircmpwn/core-go/auth"
5062 +-      "github.com/go-redis/redis"
5063 ++      goredis "github.com/go-redis/redis/v8"
5064 +       "github.com/kr/pty"
5065 +       "github.com/minio/minio-go/v6"
5066 +       "github.com/pkg/errors"
5067 +@@ -39,12 +39,12 @@ var (
5068 +       }, []string{"image", "arch"})
5069 + )
5070 +
5071 +-func (ctx *JobContext) Boot(r *redis.Client) func() {
5072 +-      port, err := r.Incr("builds.sr.ht.ssh-port").Result()
5073 ++func (ctx *JobContext) Boot(r *goredis.Client) func() {
5074 ++      port, err := r.Incr(ctx.Context, "builds.sr.ht.ssh-port").Result()
5075 +       if err == nil && port < 22000 {
5076 +-              err = r.Set("builds.sr.ht.ssh-port", 22100, 0).Err()
5077 ++              err = r.Set(ctx.Context, "builds.sr.ht.ssh-port", 22100, 0).Err()
5078 +       } else if err == nil && port >= 23000 {
5079 +-              err = r.Set("builds.sr.ht.ssh-port", 22000, 0).Err()
5080 ++              err = r.Set(ctx.Context, "builds.sr.ht.ssh-port", 22000, 0).Err()
5081 +       }
5082 +       if err != nil {
5083 +               panic(errors.Wrap(err, "assign port"))
5084 +--
5085 +2.32.0
5086 +
5087 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/v3-0002-worker-update-go.-mod-sum-for-go-redis.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/v3-0002-worker-update-go.-mod-sum-for-go-redis.patch
5088 new file mode 100644
5089 index 00000000000..c9368d05c18
5090 --- /dev/null
5091 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/v3-0002-worker-update-go.-mod-sum-for-go-redis.patch
5092 @@ -0,0 +1,378 @@
5093 +From eac18e913e4ee48895b94acfa56cf1c6a3fb49fa Mon Sep 17 00:00:00 2001
5094 +From: Julien Moutinho <julm+srht@sourcephile.fr>
5095 +Date: Wed, 15 Sep 2021 20:11:49 +0200
5096 +Subject: [PATCH builds.sr.ht v3 2/2] worker: update go.{mod,sum} for go-redis
5097 +
5098 +---
5099 + worker/go.mod |  8 +------
5100 + worker/go.sum | 64 +++++++++++++++++++--------------------------------
5101 + 2 files changed, 25 insertions(+), 47 deletions(-)
5102 +
5103 +diff --git a/worker/go.mod b/worker/go.mod
5104 +index 6e9a11c..4893dfa 100644
5105 +--- a/worker/go.mod
5106 ++++ b/worker/go.mod
5107 +@@ -2,24 +2,18 @@ module git.sr.ht/~sircmpwn/builds.sr.ht/worker
5108 +
5109 + require (
5110 +       git.sr.ht/~sircmpwn/core-go v0.0.0-20210108160653-070566136c1a
5111 +-      github.com/go-gomail/gomail v0.0.0-20160411212932-81ebce5c23df
5112 +-      github.com/go-redis/redis v6.15.2+incompatible
5113 ++      github.com/go-redis/redis/v8 v8.2.3
5114 +       github.com/gocelery/gocelery v0.0.0-20201111034804-825d89059344
5115 +-      github.com/gomodule/redigo v2.0.0+incompatible // indirect
5116 +       github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
5117 +-      github.com/jpillora/longestcommon v0.0.0-20161227235612-adb9d91ee629
5118 +       github.com/kr/pty v1.1.3
5119 +       github.com/lib/pq v1.8.0
5120 +       github.com/martinlindhe/base36 v1.1.0
5121 +-      github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
5122 +       github.com/minio/minio-go/v6 v6.0.49
5123 +       github.com/mitchellh/mapstructure v1.1.2
5124 +       github.com/pkg/errors v0.9.1
5125 +       github.com/prometheus/client_golang v1.7.1
5126 +-      github.com/shicky/gocelery v0.0.0-20180807061531-b2f0dd7ec05b
5127 +       github.com/streadway/amqp v1.0.0 // indirect
5128 +       github.com/vaughan0/go-ini v0.0.0-20130923145212-a98ad7ee00ec
5129 +-      golang.org/x/sys v0.0.0-20201013132646-2da7054afaeb
5130 +       gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
5131 +       gopkg.in/mail.v2 v2.3.1
5132 +       gopkg.in/yaml.v2 v2.3.0
5133 +diff --git a/worker/go.sum b/worker/go.sum
5134 +index 1cd3989..4a2d6d9 100644
5135 +--- a/worker/go.sum
5136 ++++ b/worker/go.sum
5137 +@@ -10,6 +10,7 @@ git.sr.ht/~sircmpwn/go-bare v0.0.0-20200812160916-d2c72e1a5018/go.mod h1:BVJwbDf
5138 + github.com/99designs/gqlgen v0.13.0 h1:haLTcUp3Vwp80xMVEg5KRNwzfUrgFdRmtBY8fuB8scA=
5139 + github.com/99designs/gqlgen v0.13.0/go.mod h1:NV130r6f4tpRWuAI+zsrSdooO/eWUv+Gyyoi3rEfXIk=
5140 + github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
5141 ++github.com/DATA-DOG/go-sqlmock v1.5.0 h1:Shsta01QNfFxHCfpW6YH2STWB0MudeXXEWMr20OEh60=
5142 + github.com/DATA-DOG/go-sqlmock v1.5.0/go.mod h1:f/Ixk793poVmq4qj/V1dPUg2JEAKC73Q5eFN3EC/SaM=
5143 + github.com/Knetic/govaluate v3.0.1-0.20171022003610-9aa49832a739+incompatible/go.mod h1:r7JcOSlj0wfOMncg0iLm8Leh48TZaKVeNIfJntJ2wa0=
5144 + github.com/Masterminds/squirrel v1.4.0 h1:he5i/EXixZxrBUWcxzDYMiju9WZ3ld/l7QBNuo/eN3w=
5145 +@@ -25,6 +26,7 @@ github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuy
5146 + github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
5147 + github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
5148 + github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
5149 ++github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
5150 + github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
5151 + github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
5152 + github.com/apache/thrift v0.13.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
5153 +@@ -36,7 +38,6 @@ github.com/aryann/difflib v0.0.0-20170710044230-e206f873d14a/go.mod h1:DAHtR1m6l
5154 + github.com/aws/aws-lambda-go v1.13.3/go.mod h1:4UKl9IzQMoD+QF79YdCuzCwp8VbmG4VAQwij/eHl5CU=
5155 + github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
5156 + github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
5157 +-github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973 h1:xJ4a3vCFaGF/jqvzLMYoU8P317H5OQ+Via4RmuPwCS0=
5158 + github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
5159 + github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
5160 + github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
5161 +@@ -58,8 +59,10 @@ github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:ma
5162 + github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
5163 + github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
5164 + github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5165 ++github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
5166 + github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5167 + github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
5168 ++github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
5169 + github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
5170 + github.com/dgryski/trifles v0.0.0-20190318185328-a8d75aae118c/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
5171 + github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
5172 +@@ -84,22 +87,18 @@ github.com/fernet/fernet-go v0.0.0-20191111064656-eff2850e6001/go.mod h1:2H9hjfb
5173 + github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBjqR7JHJk0brhHOZYGmfBYOrK0ZhYMEtBr4=
5174 + github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8/go.mod h1:ZhphrRTfi2rbfLwlschooIH4+wKKDR4Pdxhh+TRoA20=
5175 + github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
5176 ++github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
5177 + github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
5178 + github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
5179 + github.com/go-chi/chi v3.3.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
5180 + github.com/go-chi/chi v4.1.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
5181 +-github.com/go-gomail/gomail v0.0.0-20160411212932-81ebce5c23df h1:Bao6dhmbTA1KFVxmJ6nBoMuOJit2yjEgLJpIMYpop0E=
5182 +-github.com/go-gomail/gomail v0.0.0-20160411212932-81ebce5c23df/go.mod h1:GJr+FCSXshIwgHBtLglIg9M2l2kQSi6QjVAngtzI08Y=
5183 + github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
5184 + github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
5185 + github.com/go-kit/kit v0.10.0/go.mod h1:xUsJbQ/Fp4kEt7AFgCuvyX4a71u8h9jB8tj/ORgOZ7o=
5186 + github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
5187 + github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
5188 + github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
5189 +-github.com/go-redis/redis v6.14.1+incompatible h1:kSJohAREGMr344uMa8PzuIg5OU6ylCbyDkWkkNOfEik=
5190 +-github.com/go-redis/redis v6.14.1+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
5191 +-github.com/go-redis/redis v6.15.2+incompatible h1:9SpNVG76gr6InJGxoZ6IuuxaCOQwDAhzyXg+Bs+0Sb4=
5192 +-github.com/go-redis/redis v6.15.2+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
5193 ++github.com/go-redis/redis/v8 v8.2.3 h1:eNesND+DWt/sjQOtPFxAbQkTIXaXX00qNLxjVWkZ70k=
5194 + github.com/go-redis/redis/v8 v8.2.3/go.mod h1:ysgGY09J/QeDYbu3HikWEIPCwaeOkuNoTgKayTEaEOw=
5195 + github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
5196 + github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
5197 +@@ -114,7 +113,6 @@ github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfU
5198 + github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
5199 + github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
5200 + github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
5201 +-github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
5202 + github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
5203 + github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
5204 + github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
5205 +@@ -136,12 +134,14 @@ github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
5206 + github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
5207 + github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
5208 + github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
5209 ++github.com/google/go-cmp v0.5.1 h1:JFrFEBb2xKufg6XkJsJr+WbKb4FQlURi5RUcBveYu9k=
5210 + github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
5211 + github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
5212 + github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
5213 + github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
5214 + github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
5215 + github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
5216 ++github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
5217 + github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
5218 + github.com/gorilla/context v0.0.0-20160226214623-1ea25387ff6f/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
5219 + github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
5220 +@@ -180,12 +180,11 @@ github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d/go.mod
5221 + github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
5222 + github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
5223 + github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
5224 +-github.com/jpillora/longestcommon v0.0.0-20161227235612-adb9d91ee629 h1:1dSBUfGlorLAua2CRx0zFN7kQsTpE2DQSmr7rrTNgY8=
5225 +-github.com/jpillora/longestcommon v0.0.0-20161227235612-adb9d91ee629/go.mod h1:mb5nS4uRANwOJSZj8rlCWAfAcGi72GGMIXx+xGOjA7M=
5226 + github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
5227 + github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
5228 + github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
5229 + github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
5230 ++github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
5231 + github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
5232 + github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
5233 + github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
5234 +@@ -200,20 +199,18 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
5235 + github.com/kr/pty v1.1.3 h1:/Um6a/ZmD5tF7peoOJ5oN5KMQ0DrGVQSXLNwyckutPk=
5236 + github.com/kr/pty v1.1.3/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
5237 + github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
5238 ++github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
5239 + github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
5240 + github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 h1:SOEGU9fKiNWd/HOJuq6+3iTQz8KNCLtVX6idSoTLdUw=
5241 + github.com/lann/builder v0.0.0-20180802200727-47ae307949d0/go.mod h1:dXGbAdH5GtBTC4WfIxhKZfyBF/HBFgRZSWwZ9g/He9o=
5242 + github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 h1:P6pPBnrTSX3DEVR4fDembhRWSsG5rVo6hYhAB/ADZrk=
5243 + github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0/go.mod h1:vmVJ0l/dxyfGW6FmdpVm2joNMFikkuWg0EoCKLGUMNw=
5244 +-github.com/lib/pq v1.0.0 h1:X5PMW56eZitiTeO7tKzZxFCSpbFZJtkMMooicw2us9A=
5245 +-github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
5246 + github.com/lib/pq v1.8.0 h1:9xohqzkUwzR4Ga4ivdTcawVS89YSDVxXMa3xJX3cGzg=
5247 + github.com/lib/pq v1.8.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
5248 + github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-bc2310a04743/go.mod h1:qklhhLq1aX+mtWk9cPHPzaBjWImj5ULL6C7HFJtXQMM=
5249 + github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4=
5250 + github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
5251 + github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ=
5252 +-github.com/martinlindhe/base36 v1.0.0 h1:eYsumTah144C0A8P1T/AVSUk5ZoLnhfYFM3OGQxB52A=
5253 + github.com/martinlindhe/base36 v1.0.0/go.mod h1:+AtEs8xrBpCeYgSLoY/aJ6Wf37jtBuR0s35750M27+8=
5254 + github.com/martinlindhe/base36 v1.1.0 h1:cIwvvwYse/0+1CkUPYH5ZvVIYG3JrILmQEIbLuar02Y=
5255 + github.com/martinlindhe/base36 v1.1.0/go.mod h1:+AtEs8xrBpCeYgSLoY/aJ6Wf37jtBuR0s35750M27+8=
5256 +@@ -228,7 +225,6 @@ github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzp
5257 + github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
5258 + github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
5259 + github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
5260 +-github.com/minio/minio-go v6.0.14+incompatible h1:fnV+GD28LeqdN6vT2XdGKW8Qe/IfjJDswNVuni6km9o=
5261 + github.com/minio/minio-go/v6 v6.0.49 h1:bU4kIa/qChTLC1jrWZ8F+8gOiw1MClubddAJVR4gW3w=
5262 + github.com/minio/minio-go/v6 v6.0.49/go.mod h1:qD0lajrGW49lKZLtXKtCB4X/qkMf0a5tBvN2PaZg7Gg=
5263 + github.com/minio/sha256-simd v0.1.1 h1:5QHSlgo3nt5yKOJrC7W8w7X+NFl8cMPZm96iu8kKUJU=
5264 +@@ -242,8 +238,6 @@ github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS4
5265 + github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
5266 + github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
5267 + github.com/mitchellh/mapstructure v0.0.0-20180203102830-a4e142e9c047/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
5268 +-github.com/mitchellh/mapstructure v1.0.0 h1:vVpGvMXJPqSDh2VYHF7gsfQj8Ncx+Xw5Y1KHeTRY+7I=
5269 +-github.com/mitchellh/mapstructure v1.0.0/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
5270 + github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
5271 + github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
5272 + github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
5273 +@@ -259,7 +253,9 @@ github.com/nats-io/nats.go v1.9.1/go.mod h1:ZjDU1L/7fJ09jvUSRVBR2e7+RnLiiIQyqyzE
5274 + github.com/nats-io/nkeys v0.1.0/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxziKVo7w=
5275 + github.com/nats-io/nkeys v0.1.3/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxziKVo7w=
5276 + github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
5277 ++github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
5278 + github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
5279 ++github.com/nxadm/tail v1.4.4 h1:DQuhQpB1tVlglWS2hLQ5OV6B5r8aGxSrPc5Qo6uTN78=
5280 + github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
5281 + github.com/oklog/oklog v0.3.2/go.mod h1:FCV+B7mhrz4o+ueLpx+KqkyXRGMWOYEvfiXtdGtbWGs=
5282 + github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
5283 +@@ -267,10 +263,12 @@ github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:v
5284 + github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
5285 + github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
5286 + github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
5287 ++github.com/onsi/ginkgo v1.14.1 h1:jMU0WaQrP0a/YAEq8eJmJKjBoMs+pClEr1vDMlM/Do4=
5288 + github.com/onsi/ginkgo v1.14.1/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
5289 + github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
5290 + github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
5291 + github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
5292 ++github.com/onsi/gomega v1.10.2 h1:aY/nuoWlKJud2J6U0E3NWsjlg+0GtwXxgEqthRdzlcs=
5293 + github.com/onsi/gomega v1.10.2/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
5294 + github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
5295 + github.com/opentracing-contrib/go-observer v0.0.0-20170622124052-a52f23424492/go.mod h1:Ngi6UdF0k5OKD5t5wlmGhe/EDKPoUM3BXZSSfIuJbis=
5296 +@@ -287,22 +285,20 @@ github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtP
5297 + github.com/performancecopilot/speed v3.0.0+incompatible/go.mod h1:/CLtqpZ5gBg1M9iaPbIdPPGyKcA8hKdoy6hAWba7Yac=
5298 + github.com/pierrec/lz4 v1.0.2-0.20190131084431-473cd7ce01a1/go.mod h1:3/3N9NVKO0jef7pBehbT1qWhCMrIgbYNnFAZCqQ5LRc=
5299 + github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
5300 +-github.com/pkg/errors v0.8.0 h1:WdK/asTD0HN+q6hsWO3/vpuAkAr+tw6aNJNDFFf0+qw=
5301 + github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
5302 + github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
5303 + github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
5304 + github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
5305 + github.com/pkg/profile v1.2.1/go.mod h1:hJw3o1OdXxsrSjjVksARp5W95eeEaEfptyVZyv6JUPA=
5306 ++github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
5307 + github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
5308 + github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
5309 +-github.com/prometheus/client_golang v0.9.1 h1:K47Rk0v/fkEfwfQet2KWhscE0cJzjgCCDBG2KHZoVno=
5310 + github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
5311 + github.com/prometheus/client_golang v0.9.3-0.20190127221311-3c4408c8b829/go.mod h1:p2iRAGwDERtqlqzRXnrOVns+ignqQo//hLXqYxZYVNs=
5312 + github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
5313 + github.com/prometheus/client_golang v1.3.0/go.mod h1:hJaj2vgQTGQmVCsAACORcieXFeDPbaTKGT+JTgUa3og=
5314 + github.com/prometheus/client_golang v1.7.1 h1:NTGy1Ja9pByO+xAeH/qiWnLrKtr3hJPNjaVUwnjpdpA=
5315 + github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
5316 +-github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910 h1:idejC8f05m9MGOsuEi1ATq9shN03HrxNkD/luQvxCv8=
5317 + github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
5318 + github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
5319 + github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
5320 +@@ -310,15 +306,12 @@ github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:
5321 + github.com/prometheus/client_model v0.1.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
5322 + github.com/prometheus/client_model v0.2.0 h1:uq5h0d+GuxiXLJLNABMgp2qUWDPiLvgCzz2dUR+/W/M=
5323 + github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
5324 +-github.com/prometheus/common v0.0.0-20181020173914-7e9e6cabbd39 h1:Cto4X6SVMWRPBkJ/3YHn1iDGDGc/Z+sW+AEMKHMVvN4=
5325 +-github.com/prometheus/common v0.0.0-20181020173914-7e9e6cabbd39/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
5326 + github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
5327 + github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
5328 + github.com/prometheus/common v0.7.0/go.mod h1:DjGbpBbp5NYNiECxcL/VnbXCCaQpKd3tt26CguLLsqA=
5329 + github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
5330 + github.com/prometheus/common v0.14.0 h1:RHRyE8UocrbjU+6UvRzwi6HjiDfxrrBU91TtbKzkGp4=
5331 + github.com/prometheus/common v0.14.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
5332 +-github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d h1:GoAlyOgbOEIFdaDqxJVlbOQ1DtGmZWs/Qau0hIlk+WQ=
5333 + github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
5334 + github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
5335 + github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
5336 +@@ -333,36 +326,28 @@ github.com/rs/cors v1.6.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
5337 + github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
5338 + github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
5339 + github.com/samuel/go-zookeeper v0.0.0-20190923202752-2cc03de413da/go.mod h1:gi+0XIa01GRL2eRQVjQkKGqKF3SF9vZR/HnPullcV2E=
5340 +-github.com/satori/go.uuid v1.1.0 h1:B9KXyj+GzIpJbV7gmr873NsY6zpbxNy24CBtGrk7jHo=
5341 +-github.com/satori/go.uuid v1.1.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
5342 +-github.com/satori/go.uuid v1.2.0 h1:0uYX9dsZ2yD7q2RtLRtPSdGDWzjeM3TbMJP9utgA0ww=
5343 +-github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
5344 +-github.com/satori/go.uuid v1.2.1-0.20180103174451-36e9d2ebbde5 h1:Jw7W4WMfQDxsXvfeFSaS2cHlY7bAF4MGrgnbd0+Uo78=
5345 +-github.com/satori/go.uuid v1.2.1-0.20180103174451-36e9d2ebbde5/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
5346 + github.com/satori/go.uuid v1.2.1-0.20181028125025-b2ce2384e17b h1:gQZ0qzfKHQIybLANtM3mBXNUtOfsCFXeTsnBqCsx1KM=
5347 + github.com/satori/go.uuid v1.2.1-0.20181028125025-b2ce2384e17b/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
5348 + github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
5349 + github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
5350 ++github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
5351 + github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
5352 +-github.com/shicky/gocelery v0.0.0-20180807061531-b2f0dd7ec05b h1:7kJLeBNcPG1orS3ksAFN0qoJGtf8jvwgOh5Q+bsNZvc=
5353 +-github.com/shicky/gocelery v0.0.0-20180807061531-b2f0dd7ec05b/go.mod h1:kn4CkFIzvsrXBvbNk2hX9DpIM8xo/74mYhiYTpGhYXE=
5354 + github.com/shurcooL/httpfs v0.0.0-20171119174359-809beceb2371/go.mod h1:ZY1cvUeJuFPAdZ/B6v7RHavJWZn2YPVFQ1OSXhCGOkg=
5355 + github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
5356 + github.com/shurcooL/vfsgen v0.0.0-20180121065927-ffb13db8def0/go.mod h1:TrYk7fJVaAttu97ZZKrO9UbRa8izdowaMIZcxYMbVaw=
5357 + github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
5358 + github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
5359 + github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
5360 ++github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
5361 + github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
5362 + github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
5363 ++github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
5364 + github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
5365 + github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
5366 + github.com/sony/gobreaker v0.4.1/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
5367 + github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
5368 + github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
5369 +-github.com/streadway/amqp v0.0.0-20180806233856-70e15c650864 h1:Oj3PUEs+OUSYUpn35O+BE/ivHGirKixA3+vqA0Atu9A=
5370 +-github.com/streadway/amqp v0.0.0-20180806233856-70e15c650864/go.mod h1:1WNBiOZtZQLpVAyu0iTduoJL9hEsMloAK5XWrtW0xdY=
5371 + github.com/streadway/amqp v0.0.0-20190404075320-75d898a42a94/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
5372 +-github.com/streadway/amqp v0.0.0-20190827072141-edfb9018d271 h1:WhxRHzgeVGETMlmVfqhRn8RIeeNoPr2Czh33I4Zdccw=
5373 + github.com/streadway/amqp v0.0.0-20190827072141-edfb9018d271/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
5374 + github.com/streadway/amqp v1.0.0 h1:kuuDrUJFZL1QYL9hUNuCxNObNzB0bV/ZG5jV3RWAQgo=
5375 + github.com/streadway/amqp v1.0.0/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
5376 +@@ -373,6 +358,7 @@ github.com/stretchr/testify v1.2.1/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf
5377 + github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
5378 + github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
5379 + github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
5380 ++github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
5381 + github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
5382 + github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
5383 + github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
5384 +@@ -391,6 +377,7 @@ go.etcd.io/etcd v0.0.0-20191023171146-3cf2f69b5738/go.mod h1:dnLIgRNXwCJa5e+c6mI
5385 + go.opencensus.io v0.20.1/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
5386 + go.opencensus.io v0.20.2/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
5387 + go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
5388 ++go.opentelemetry.io/otel v0.11.0 h1:IN2tzQa9Gc4ZVKnTaMbPVcHjvzOdg5n9QfnmlqiET7E=
5389 + go.opentelemetry.io/otel v0.11.0/go.mod h1:G8UCk+KooF2HLkgo8RHX9epABH/aRGYET7gQOqBVdB0=
5390 + go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
5391 + go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
5392 +@@ -403,7 +390,6 @@ golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnf
5393 + golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
5394 + golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
5395 + golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
5396 +-golang.org/x/crypto v0.0.0-20190513172903-22d7a77e9e5f h1:R423Cnkcp5JABoeemiGEPlt9tHXFfw5kvc0yqlxRPWo=
5397 + golang.org/x/crypto v0.0.0-20190513172903-22d7a77e9e5f/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
5398 + golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
5399 + golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
5400 +@@ -431,7 +417,6 @@ golang.org/x/net v0.0.0-20190125091013-d26f9f9a57f3/go.mod h1:mL1N/T3taQHkDXs73r
5401 + golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
5402 + golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
5403 + golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
5404 +-golang.org/x/net v0.0.0-20190522155817-f3200d17e092 h1:4QSRKanuywn15aTZvI/mIDEgPQpswuFndXpOj3rKEco=
5405 + golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
5406 + golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
5407 + golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
5408 +@@ -451,7 +436,6 @@ golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJ
5409 + golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5410 + golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5411 + golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5412 +-golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e h1:o3PsSEY8E4eXWkXrIP9YJALUkVZqzHJT5DOasTyn8Vs=
5413 + golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5414 + golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5415 + golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5416 +@@ -460,7 +444,6 @@ golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5h
5417 + golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5418 + golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5419 + golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5420 +-golang.org/x/sys v0.0.0-20190422165155-953cdadca894 h1:Cz4ceDQGXuKRnVBDTS23GTn/pU5OE2C0WrNTOYK1Uuc=
5421 + golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5422 + golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5423 + golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5424 +@@ -477,7 +460,6 @@ golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7w
5425 + golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5426 + golang.org/x/sys v0.0.0-20201013132646-2da7054afaeb h1:HS9IzC4UFbpMBLQUDSQcU+ViVT1vdFCQVjdPVpTlZrs=
5427 + golang.org/x/sys v0.0.0-20201013132646-2da7054afaeb/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5428 +-golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
5429 + golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
5430 + golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
5431 + golang.org/x/text v0.3.4-0.20201021145329-22f1617af38e h1:0kyKOEC0chG7FKmnf/1uNwvDLc3NtNTRip2rXAN9nwI=
5432 +@@ -502,6 +484,7 @@ golang.org/x/tools v0.0.0-20200103221440-774c71fcf114/go.mod h1:TB2adYChydJhpapK
5433 + golang.org/x/tools v0.0.0-20200114235610-7ae403b6b589/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
5434 + golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
5435 + golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
5436 ++golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
5437 + golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
5438 + google.golang.org/api v0.3.1/go.mod h1:6wY9I6uQWHQ8EM57III9mq/AjF+i8G65rmVagqKMtkk=
5439 + google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
5440 +@@ -539,6 +522,7 @@ gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod
5441 + gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
5442 + gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
5443 + gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
5444 ++gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
5445 + gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
5446 + gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
5447 + gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
5448 +@@ -549,6 +533,7 @@ gopkg.in/ini.v1 v1.42.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
5449 + gopkg.in/mail.v2 v2.3.1 h1:WYFn/oANrAGP2C0dcV6/pbkPzv8yGzqTjPmTeO7qoXk=
5450 + gopkg.in/mail.v2 v2.3.1/go.mod h1:htwXN1Qh09vZJ1NVKxQqHPBaCBbzKhp5GzuJEA4VJWw=
5451 + gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
5452 ++gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
5453 + gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
5454 + gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
5455 + gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
5456 +@@ -556,10 +541,9 @@ gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5457 + gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5458 + gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5459 + gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5460 +-gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
5461 +-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5462 + gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
5463 + gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5464 ++gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
5465 + gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
5466 + honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
5467 + honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
5468 +--
5469 +2.32.0
5470 +
5471 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/core/v3-0001-add-Unix-socket-support-for-redis-host.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/core/v3-0001-add-Unix-socket-support-for-redis-host.patch
5472 new file mode 100644
5473 index 00000000000..299ad3d83c5
5474 --- /dev/null
5475 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/core/v3-0001-add-Unix-socket-support-for-redis-host.patch
5476 @@ -0,0 +1,30 @@
5477 +From c0ccc8db051a2f8278edf59b41ed238fa71aa4c0 Mon Sep 17 00:00:00 2001
5478 +From: Julien Moutinho <julm+srht@sourcephile.fr>
5479 +Date: Mon, 23 Aug 2021 18:43:18 +0200
5480 +Subject: [PATCH core.sr.ht v3] add Unix socket support for redis-host=
5481 +
5482 +---
5483 + srht/redis.py | 11 ++---------
5484 + 1 file changed, 2 insertions(+), 9 deletions(-)
5485 +
5486 +diff --git a/srht/redis.py b/srht/redis.py
5487 +index 8a9347c..2e91c35 100644
5488 +--- a/srht/redis.py
5489 ++++ b/srht/redis.py
5490 +@@ -1,11 +1,4 @@
5491 +-from redis import Redis
5492 ++from redis import from_url
5493 + from srht.config import cfg
5494 +-from urllib.parse import urlparse
5495 +
5496 +-url = cfg("sr.ht", "redis-host", "redis://localhost")
5497 +-url = urlparse(url)
5498 +-
5499 +-redis = Redis(host=url.hostname,
5500 +-        port=(url.port or 6379),
5501 +-        password=url.password,
5502 +-        db=int(url.path[1:]) if url.path else 0)
5503 ++redis = from_url(cfg("sr.ht", "redis-host", "redis://localhost"))
5504 +--
5505 +2.32.0
5506 +
5507 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0001-gitsrht-keys-update-go-redis-to-support-Unix-sock.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0001-gitsrht-keys-update-go-redis-to-support-Unix-sock.patch
5508 new file mode 100644
5509 index 00000000000..48e91ac739b
5510 --- /dev/null
5511 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0001-gitsrht-keys-update-go-redis-to-support-Unix-sock.patch
5512 @@ -0,0 +1,26 @@
5513 +From 083e4791771d998c9a6c881a4101d24296e38252 Mon Sep 17 00:00:00 2001
5514 +From: Julien Moutinho <julm+srht@sourcephile.fr>
5515 +Date: Fri, 27 Aug 2021 15:38:28 +0200
5516 +Subject: [PATCH git.sr.ht v3 1/3] gitsrht-keys: update go-redis to support
5517 + Unix sockets
5518 +
5519 +---
5520 + gitsrht-keys/main.go | 2 +-
5521 + 1 file changed, 1 insertion(+), 1 deletion(-)
5522 +
5523 +diff --git a/gitsrht-keys/main.go b/gitsrht-keys/main.go
5524 +index 0c1aea1..fa17183 100644
5525 +--- a/gitsrht-keys/main.go
5526 ++++ b/gitsrht-keys/main.go
5527 +@@ -5,7 +5,7 @@ import (
5528 +       "os"
5529 +       "path"
5530 +
5531 +-      goredis "github.com/go-redis/redis"
5532 ++      goredis "github.com/go-redis/redis/v8"
5533 +       "github.com/vaughan0/go-ini"
5534 +       "git.sr.ht/~sircmpwn/scm.sr.ht/srht-keys"
5535 + )
5536 +--
5537 +2.32.0
5538 +
5539 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0002-gitsrht-update-hook-update-go-redis-to-support-Un.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0002-gitsrht-update-hook-update-go-redis-to-support-Un.patch
5540 new file mode 100644
5541 index 00000000000..41847ac8717
5542 --- /dev/null
5543 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0002-gitsrht-update-hook-update-go-redis-to-support-Un.patch
5544 @@ -0,0 +1,109 @@
5545 +From d9683aced0dc3a94c56de2fde31c1765054900fa Mon Sep 17 00:00:00 2001
5546 +From: Julien Moutinho <julm+srht@sourcephile.fr>
5547 +Date: Fri, 27 Aug 2021 15:39:29 +0200
5548 +Subject: [PATCH git.sr.ht v3 2/3] gitsrht-update-hook: update go-redis to
5549 + support Unix sockets
5550 +
5551 +---
5552 + gitsrht-update-hook/options.go     | 12 +++++++-----
5553 + gitsrht-update-hook/post-update.go |  4 ++--
5554 + gitsrht-update-hook/update.go      |  4 ++--
5555 + 3 files changed, 11 insertions(+), 9 deletions(-)
5556 +
5557 +diff --git a/gitsrht-update-hook/options.go b/gitsrht-update-hook/options.go
5558 +index 8efbb0a..962502a 100644
5559 +--- a/gitsrht-update-hook/options.go
5560 ++++ b/gitsrht-update-hook/options.go
5561 +@@ -1,15 +1,17 @@
5562 + package main
5563 +
5564 + import (
5565 ++      "context"
5566 +       "fmt"
5567 +       "os"
5568 +       "strconv"
5569 +       "strings"
5570 +       "time"
5571 +
5572 +-      goredis "github.com/go-redis/redis"
5573 ++      goredis "github.com/go-redis/redis/v8"
5574 + )
5575 +
5576 ++var ctx = context.Background()
5577 + var options map[string]string
5578 +
5579 + func loadOptions() {
5580 +@@ -35,10 +37,10 @@ func loadOptions() {
5581 +       var n int
5582 +       if nopts, ok := os.LookupEnv("GIT_PUSH_OPTION_COUNT"); ok {
5583 +               n, _ = strconv.Atoi(nopts)
5584 +-              redis.Set(fmt.Sprintf("git.sr.ht.options.%s", uuid),
5585 ++              redis.Set(ctx, fmt.Sprintf("git.sr.ht.options.%s", uuid),
5586 +                       nopts, 10*time.Minute)
5587 +       } else {
5588 +-              nopts, err := redis.Get(fmt.Sprintf(
5589 ++              nopts, err := redis.Get(ctx, fmt.Sprintf(
5590 +                       "git.sr.ht.options.%s", uuid)).Result()
5591 +               if err != nil {
5592 +                       return
5593 +@@ -51,12 +53,12 @@ func loadOptions() {
5594 +               opt, ok := os.LookupEnv(fmt.Sprintf("GIT_PUSH_OPTION_%d", i))
5595 +               optkey := fmt.Sprintf("git.sr.ht.options.%s.%d", uuid, i)
5596 +               if !ok {
5597 +-                      opt, err = redis.Get(optkey).Result()
5598 ++                      opt, err = redis.Get(ctx, optkey).Result()
5599 +                       if err != nil {
5600 +                               return
5601 +                       }
5602 +               } else {
5603 +-                      redis.Set(optkey, opt, 10*time.Minute)
5604 ++                      redis.Set(ctx, optkey, opt, 10*time.Minute)
5605 +               }
5606 +               parts := strings.SplitN(opt, "=", 2)
5607 +               if len(parts) == 1 {
5608 +diff --git a/gitsrht-update-hook/post-update.go b/gitsrht-update-hook/post-update.go
5609 +index d14d616..fcd7864 100644
5610 +--- a/gitsrht-update-hook/post-update.go
5611 ++++ b/gitsrht-update-hook/post-update.go
5612 +@@ -15,7 +15,7 @@ import (
5613 +       "github.com/go-git/go-git/v5/plumbing"
5614 +       "github.com/go-git/go-git/v5/plumbing/object"
5615 +       "github.com/go-git/go-git/v5/plumbing/storer"
5616 +-      goredis "github.com/go-redis/redis"
5617 ++      goredis "github.com/go-redis/redis/v8"
5618 +       _ "github.com/lib/pq"
5619 + )
5620 +
5621 +@@ -220,7 +220,7 @@ func postUpdate() {
5622 +               var oldref, newref string
5623 +               var oldobj, newobj object.Object
5624 +               updateKey := fmt.Sprintf("update.%s.%s", pushUuid, refname)
5625 +-              update, err := redis.Get(updateKey).Result()
5626 ++              update, err := redis.Get(ctx, updateKey).Result()
5627 +               if update == "" || err != nil {
5628 +                       logger.Println("redis.Get: missing key")
5629 +                       continue
5630 +diff --git a/gitsrht-update-hook/update.go b/gitsrht-update-hook/update.go
5631 +index 72c661a..e33fd4b 100644
5632 +--- a/gitsrht-update-hook/update.go
5633 ++++ b/gitsrht-update-hook/update.go
5634 +@@ -5,7 +5,7 @@ import (
5635 +       "os"
5636 +       "time"
5637 +
5638 +-      goredis "github.com/go-redis/redis"
5639 ++      goredis "github.com/go-redis/redis/v8"
5640 + )
5641 +
5642 + // XXX: This is run once for every single ref that's pushed. If someone pushes
5643 +@@ -31,6 +31,6 @@ func update() {
5644 +               logger.Fatalf("Failed to parse redis host: %v", err)
5645 +       }
5646 +       redis := goredis.NewClient(ropts)
5647 +-      redis.Set(fmt.Sprintf("update.%s.%s", pushUuid, refname),
5648 ++      redis.Set(ctx, fmt.Sprintf("update.%s.%s", pushUuid, refname),
5649 +               fmt.Sprintf("%s:%s", oldref, newref), 10*time.Minute)
5650 + }
5651 +--
5652 +2.32.0
5653 +
5654 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0003-gitsrht-dispatch-add-support-for-supplementary-gr.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0003-gitsrht-dispatch-add-support-for-supplementary-gr.patch
5655 new file mode 100644
5656 index 00000000000..9a4b0300921
5657 --- /dev/null
5658 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0003-gitsrht-dispatch-add-support-for-supplementary-gr.patch
5659 @@ -0,0 +1,57 @@
5660 +From fcbec39a406562c29dfcf7eeef6f284da28bc619 Mon Sep 17 00:00:00 2001
5661 +From: Julien Moutinho <julm+srht@sourcephile.fr>
5662 +Date: Fri, 27 Aug 2021 17:42:33 +0200
5663 +Subject: [PATCH git.sr.ht v3 3/3] gitsrht-dispatch: add support for
5664 + supplementary groups
5665 +
5666 +---
5667 + gitsrht-dispatch/main.go | 17 ++++++++++++++---
5668 + 1 file changed, 14 insertions(+), 3 deletions(-)
5669 +
5670 +diff --git a/gitsrht-dispatch/main.go b/gitsrht-dispatch/main.go
5671 +index d7aee14..5f17b75 100644
5672 +--- a/gitsrht-dispatch/main.go
5673 ++++ b/gitsrht-dispatch/main.go
5674 +@@ -17,6 +17,7 @@ type Dispatcher struct {
5675 +       cmd string
5676 +       uid int
5677 +       gid int
5678 ++      gids []int
5679 + }
5680 +
5681 + func main() {
5682 +@@ -70,11 +71,20 @@ AuthorizedKeysUser=root`, os.Args[0])
5683 +               if err != nil {
5684 +                       logger.Fatalf("Error looking up group %s: %v", spec[1], err)
5685 +               }
5686 ++              groups, err := user.GroupIds()
5687 ++              if err != nil {
5688 ++                      logger.Fatalf("Error looking up supplementary groups of user %s: %v", spec[0], err)
5689 ++              }
5690 ++              gids := make([]int, len(groups))
5691 ++              for i, grp := range groups {
5692 ++                      sgid, _ := strconv.Atoi(grp)
5693 ++                      gids[i] = sgid
5694 ++              }
5695 +               uid, _ := strconv.Atoi(user.Uid)
5696 +               gid, _ := strconv.Atoi(group.Gid)
5697 +-              dispatchers[uid] = Dispatcher{cmd, uid, gid}
5698 +-              logger.Printf("Registered dispatcher for %s(%d):%s(%d): %s",
5699 +-                      spec[0], uid, spec[1], gid, cmd)
5700 ++              dispatchers[uid] = Dispatcher{cmd, uid, gid, gids}
5701 ++              logger.Printf("Registered dispatcher for %s(%d):%s(%d):(%s): %s",
5702 ++                      spec[0], uid, spec[1], gid, strings.Join(groups, ","), cmd)
5703 +       }
5704 +
5705 +       var user *osuser.User
5706 +@@ -93,6 +103,7 @@ AuthorizedKeysUser=root`, os.Args[0])
5707 +
5708 +       if dispatcher, ok := dispatchers[uid]; ok {
5709 +               logger.Printf("Dispatching to %s", dispatcher.cmd)
5710 ++              syscall.Setgroups(dispatcher.gids)
5711 +               syscall.Setgid(dispatcher.gid)
5712 +               syscall.Setuid(dispatcher.uid)
5713 +               if err := syscall.Exec(dispatcher.cmd, append([]string{
5714 +--
5715 +2.32.0
5716 +
5717 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/scm/v3-0001-srht-keys-update-go-redis-to-support-Unix-sockets.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/scm/v3-0001-srht-keys-update-go-redis-to-support-Unix-sockets.patch
5718 new file mode 100644
5719 index 00000000000..191ff61b826
5720 --- /dev/null
5721 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/scm/v3-0001-srht-keys-update-go-redis-to-support-Unix-sockets.patch
5722 @@ -0,0 +1,61 @@
5723 +From e244cb7398758f91cc6deaabf278a1b6412ee477 Mon Sep 17 00:00:00 2001
5724 +From: Julien Moutinho <julm+srht@sourcephile.fr>
5725 +Date: Fri, 27 Aug 2021 12:48:56 +0200
5726 +Subject: [PATCH scm.sr.ht v3 1/2] srht-keys: update go-redis to support Unix
5727 + sockets
5728 +
5729 +---
5730 + srht-keys/srhtkeys.go | 9 ++++++---
5731 + 1 file changed, 6 insertions(+), 3 deletions(-)
5732 +
5733 +diff --git a/srht-keys/srhtkeys.go b/srht-keys/srhtkeys.go
5734 +index be925ed..1a300d5 100644
5735 +--- a/srht-keys/srhtkeys.go
5736 ++++ b/srht-keys/srhtkeys.go
5737 +@@ -1,6 +1,7 @@
5738 + package srhtkeys
5739 +
5740 + import (
5741 ++      "context"
5742 +       "database/sql"
5743 +       "encoding/json"
5744 +       "errors"
5745 +@@ -12,7 +13,7 @@ import (
5746 +       "path"
5747 +       "time"
5748 +
5749 +-      goredis "github.com/go-redis/redis"
5750 ++      goredis "github.com/go-redis/redis/v8"
5751 +       "github.com/google/uuid"
5752 +       _ "github.com/lib/pq"
5753 +       "github.com/vaughan0/go-ini"
5754 +@@ -37,6 +38,8 @@ type MetaSSHKey struct {
5755 +       Owner       MetaUser `json:"owner"`
5756 + }
5757 +
5758 ++var ctx = context.Background()
5759 ++
5760 + // Stores the SSH key in the database and returns the user's ID.
5761 + func storeKey(logger *log.Logger, db *sql.DB, key *MetaSSHKey) (int, error) {
5762 +       logger.Println("Storing meta.sr.ht key in database")
5763 +@@ -145,7 +148,7 @@ func fetchKeysFromMeta(logger *log.Logger, config ini.File,
5764 +       if err != nil {
5765 +               logger.Printf("Caching SSH key in redis failed: %v", err)
5766 +       } else {
5767 +-              redis.Set(cacheKey, cacheBytes, 7*24*time.Hour)
5768 ++              redis.Set(ctx, cacheKey, cacheBytes, 7*24*time.Hour)
5769 +       }
5770 +
5771 +       return key.Owner.Username, userId
5772 +@@ -168,7 +171,7 @@ func UserFromKey(logger *log.Logger, config ini.File,
5773 +
5774 +       cacheKey := fmt.Sprintf("%s.ssh-keys.%s", service, b64key)
5775 +       logger.Printf("Cache key for SSH key lookup: %s", cacheKey)
5776 +-      cacheBytes, err := redis.Get(cacheKey).Bytes()
5777 ++      cacheBytes, err := redis.Get(ctx, cacheKey).Bytes()
5778 +       var (
5779 +               username string
5780 +               userId   int
5781 +--
5782 +2.32.0
5783 +
5784 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/scm/v3-0002-srht-keys-update-go.-mod-sum-for-go-redis.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/scm/v3-0002-srht-keys-update-go.-mod-sum-for-go-redis.patch
5785 new file mode 100644
5786 index 00000000000..c5407a26491
5787 --- /dev/null
5788 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/scm/v3-0002-srht-keys-update-go.-mod-sum-for-go-redis.patch
5789 @@ -0,0 +1,155 @@
5790 +From aeb3e0dc2270e6ab3cd0f651ea735275e527e7ce Mon Sep 17 00:00:00 2001
5791 +From: Julien Moutinho <julm+srht@sourcephile.fr>
5792 +Date: Fri, 27 Aug 2021 13:06:27 +0200
5793 +Subject: [PATCH scm.sr.ht v3 2/2] srht-keys: update go.{mod,sum} for go-redis
5794 +
5795 +---
5796 + srht-keys/go.mod |   2 +-
5797 + srht-keys/go.sum | 103 ++++++++++++++++++++++++++++++++++++++++++++---
5798 + 2 files changed, 99 insertions(+), 6 deletions(-)
5799 +
5800 +diff --git a/srht-keys/go.mod b/srht-keys/go.mod
5801 +index d275913..8d1c10a 100644
5802 +--- a/srht-keys/go.mod
5803 ++++ b/srht-keys/go.mod
5804 +@@ -4,7 +4,7 @@ go 1.13
5805 +
5806 + require (
5807 +       git.sr.ht/~sircmpwn/core-go v0.0.0-20201005173246-a9e49d17a1e6
5808 +-      github.com/go-redis/redis v6.15.9+incompatible
5809 ++      github.com/go-redis/redis/v8 v8.11.3
5810 +       github.com/google/uuid v1.1.1
5811 +       github.com/lib/pq v1.8.0
5812 +       github.com/vaughan0/go-ini v0.0.0-20130923145212-a98ad7ee00ec
5813 +diff --git a/srht-keys/go.sum b/srht-keys/go.sum
5814 +index 974326e..a264a26 100644
5815 +--- a/srht-keys/go.sum
5816 ++++ b/srht-keys/go.sum
5817 +@@ -1,26 +1,119 @@
5818 +-git.sr.ht/~sircmpwn/core-go v0.0.0-20200820135923-98806e712f5e h1:TJqf/neVU5peFAS9WcR1aADXcflPOvAd7ABEirmU7m0=
5819 +-git.sr.ht/~sircmpwn/core-go v0.0.0-20200820135923-98806e712f5e/go.mod h1:aXSNgRsGoI3tTFKlwD0xm2htbEzKlR2xUm1osRxfhOM=
5820 + git.sr.ht/~sircmpwn/core-go v0.0.0-20201005173246-a9e49d17a1e6 h1:Ky6HzcRmbMUxOrWXv04+mb97GkyxO/Nx7v8uJBUdpNk=
5821 + git.sr.ht/~sircmpwn/core-go v0.0.0-20201005173246-a9e49d17a1e6/go.mod h1:HpPX22ilJUWKOA4NDhrOcIyblQhdiKHPg4oMJFYdh0Y=
5822 ++github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY=
5823 ++github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
5824 + github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5825 ++github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
5826 ++github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5827 ++github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
5828 ++github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
5829 ++github.com/fernet/fernet-go v0.0.0-20191111064656-eff2850e6001 h1:/UMxx5lGDg30aioUL9e7xJnbJfJeX7vhcm57fa5udaI=
5830 + github.com/fernet/fernet-go v0.0.0-20191111064656-eff2850e6001/go.mod h1:2H9hjfbpSMHwY503FclkV/lZTBh2YlOmLLSda12uL8c=
5831 +-github.com/go-redis/redis v6.15.9+incompatible h1:K0pv1D7EQUjfyoMql+r/jZqCLizCGKFlFgcHWWmHQjg=
5832 +-github.com/go-redis/redis v6.15.9+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
5833 ++github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
5834 ++github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
5835 ++github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
5836 ++github.com/go-redis/redis/v8 v8.11.3 h1:GCjoYp8c+yQTJfc0n69iwSiHjvuAdruxl7elnZCxgt8=
5837 ++github.com/go-redis/redis/v8 v8.11.3/go.mod h1:xNJ9xDG09FsIPwh3bWdk+0oDWHbtF9rPN0F/oD9XeKc=
5838 ++github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
5839 ++github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
5840 ++github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
5841 ++github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
5842 ++github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
5843 ++github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
5844 ++github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
5845 ++github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
5846 ++github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
5847 ++github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
5848 ++github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
5849 ++github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
5850 ++github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
5851 ++github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
5852 ++github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
5853 ++github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=
5854 ++github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
5855 + github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
5856 + github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
5857 ++github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
5858 + github.com/lib/pq v1.8.0 h1:9xohqzkUwzR4Ga4ivdTcawVS89YSDVxXMa3xJX3cGzg=
5859 + github.com/lib/pq v1.8.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
5860 ++github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
5861 ++github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
5862 ++github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
5863 ++github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
5864 ++github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
5865 ++github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
5866 ++github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
5867 ++github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
5868 ++github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
5869 ++github.com/onsi/gomega v1.15.0 h1:WjP/FQ/sk43MRmnEcT+MlDw2TFvkrXlprrPST/IudjU=
5870 ++github.com/onsi/gomega v1.15.0/go.mod h1:cIuvLEne0aoVhAgh/O6ac0Op8WWw9H6eYCriF+tEHG0=
5871 ++github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
5872 + github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
5873 + github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
5874 ++github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
5875 ++github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
5876 + github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
5877 + github.com/vaughan0/go-ini v0.0.0-20130923145212-a98ad7ee00ec h1:DGmKwyZwEB8dI7tbLt/I/gQuP559o/0FrAkHKlQM/Ks=
5878 + github.com/vaughan0/go-ini v0.0.0-20130923145212-a98ad7ee00ec/go.mod h1:owBmyHYMLkxyrugmfwE/DLJyW8Ro9mkphwuVErQ0iUw=
5879 ++github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
5880 + golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
5881 +-golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de h1:ikNHVSjEfnvz6sxdSPCaPt572qowuyMDMJLLm3Db3ig=
5882 ++golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
5883 ++golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
5884 + golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
5885 ++golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
5886 ++golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
5887 + golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
5888 ++golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
5889 ++golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
5890 ++golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
5891 ++golang.org/x/net v0.0.0-20210428140749-89ef3d95e781 h1:DzZ89McO9/gWPsQXS/FVKAlG02ZjaQ6AlZRBimEYOd0=
5892 ++golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
5893 ++golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
5894 ++golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
5895 ++golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
5896 ++golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5897 + golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5898 + golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5899 ++golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5900 ++golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5901 ++golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5902 ++golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5903 ++golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5904 ++golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5905 ++golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5906 ++golang.org/x/sys v0.0.0-20210423082822-04245dca01da h1:b3NXsE2LusjYGGjL5bxEVZZORm/YEFFrWFjR8eFrw/c=
5907 ++golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5908 ++golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
5909 + golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
5910 ++golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
5911 ++golang.org/x/text v0.3.6 h1:aRYxNxv6iGQlyVaZmk6ZgYEDa+Jg18DxebPSrd6bg1M=
5912 ++golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
5913 ++golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
5914 ++golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
5915 ++golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
5916 ++golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
5917 ++golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
5918 ++golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
5919 ++golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
5920 ++golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
5921 ++google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
5922 ++google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
5923 ++google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
5924 ++google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
5925 ++google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
5926 ++google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
5927 ++google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
5928 ++google.golang.org/protobuf v1.26.0 h1:bxAC2xTBsZGibn2RTntX0oH50xLsqy1OxA9tTL3p/lk=
5929 ++google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
5930 ++gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
5931 + gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
5932 ++gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
5933 ++gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
5934 ++gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
5935 ++gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5936 ++gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5937 ++gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5938 ++gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
5939 ++gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
5940 ++gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
5941 + gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
5942 +--
5943 +2.32.0
5944 +
5945 diff --git a/pkgs/applications/version-management/sourcehut/scm.nix b/pkgs/applications/version-management/sourcehut/scm.nix
5946 index 1f385265360..257f8deaf90 100644
5947 --- a/pkgs/applications/version-management/sourcehut/scm.nix
5948 +++ b/pkgs/applications/version-management/sourcehut/scm.nix
5949 @@ -1,22 +1,58 @@
5950  { lib
5951  , fetchFromSourcehut
5952 +, buildGoModule
5953  , buildPythonPackage
5954  , srht
5955  , redis
5956  , pyyaml
5957 -, buildsrht
5958 -, writeText
5959 +, applyPatches
5960  }:
5961
5962  buildPythonPackage rec {
5963    pname = "scmsrht";
5964 -  version = "0.22.9";
5965 +  version = "0.22.13";
5966
5967    src = fetchFromSourcehut {
5968      owner = "~sircmpwn";
5969      repo = "scm.sr.ht";
5970      rev = version;
5971 -    sha256 = "sha256-327G6C8FW+iZx+167D7TQsFtV6FGc8MpMVo9L/cUUqU=";
5972 +    sha256 = "sha256-9iRmQBt4Cxr5itTk34b8iDRyXYDHTDfZjV0SIDT/kkM=";
5973 +  };
5974 +
5975 +  passthru = {
5976 +    srht-keys = buildGoModule rec {
5977 +      inherit src version;
5978 +      sourceRoot = "source/srht-keys";
5979 +      pname = "srht-keys";
5980 +      vendorSha256 = "sha256-lQk1dymMCefHMFJhO3yC/muBP/cxI//5Yz991D2YZY4=";
5981 +
5982 +      # What follows is only to update go-redis
5983 +      # go.{mod,sum} could be patched directly but that would be less resilient
5984 +      # to changes from upstream, and thus harder to maintain the patching
5985 +      # while it hasn't been merged upstream.
5986 +
5987 +      overrideModAttrs = old: {
5988 +        inherit patches patchFlags;
5989 +        preBuild = ''
5990 +          go get github.com/go-redis/redis/v8
5991 +          go get github.com/go-redis/redis@none
5992 +          go mod tidy
5993 +        '';
5994 +        # Pass updated go.{mod,sum} from go-modules to srht-keys's vendor/go.{mod,sum}
5995 +        postInstall = ''
5996 +          cp --reflink=auto go.* $out
5997 +        '';
5998 +      };
5999 +
6000 +      patches = [
6001 +        # Update go-redis to support Unix sockets
6002 +        patches/redis-socket/scm/v3-0001-srht-keys-update-go-redis-to-support-Unix-sockets.patch
6003 +      ];
6004 +      patchFlags = "-p2";
6005 +      postInstall = ''
6006 +        cp --reflink=auto *.go vendor/go.* $out
6007 +      '';
6008 +    };
6009    };
6010
6011    nativeBuildInputs = srht.nativeBuildInputs;
6012 @@ -25,7 +61,6 @@ buildPythonPackage rec {
6013      srht
6014      redis
6015      pyyaml
6016 -    buildsrht
6017    ];
6018
6019    preBuild = ''
6020 @@ -33,11 +68,12 @@ buildPythonPackage rec {
6021    '';
6022
6023    dontUseSetuptoolsCheck = true;
6024 +  pythonImportsCheck = [ "scmsrht" ];
6025
6026    meta = with lib; {
6027      homepage = "https://git.sr.ht/~sircmpwn/git.sr.ht";
6028      description = "Shared support code for sr.ht source control services.";
6029 -    license = licenses.agpl3;
6030 +    license = licenses.agpl3Only;
6031      maintainers = with maintainers; [ eadwu ];
6032    };
6033  }
6034 diff --git a/pkgs/applications/version-management/sourcehut/todo.nix b/pkgs/applications/version-management/sourcehut/todo.nix
6035 index 85e1f5637b6..88b7a33495a 100644
6036 --- a/pkgs/applications/version-management/sourcehut/todo.nix
6037 +++ b/pkgs/applications/version-management/sourcehut/todo.nix
6038 @@ -12,13 +12,13 @@
6039
6040  buildPythonPackage rec {
6041    pname = "todosrht";
6042 -  version = "0.64.14";
6043 +  version = "0.64.28";
6044
6045    src = fetchFromSourcehut {
6046      owner = "~sircmpwn";
6047      repo = "todo.sr.ht";
6048      rev = version;
6049 -    sha256 = "sha256-huIAhn6h1F5w5ST4/yBwr82kAzyYwhLu+gpRuOQgnsE=";
6050 +    sha256 = "sha256-uClWcR0saH4dUGRRTueLv7T4IBefMVSI5khCdeDBRv4=";
6051    };
6052
6053    nativeBuildInputs = srht.nativeBuildInputs;
6054 @@ -42,11 +42,12 @@ buildPythonPackage rec {
6055    ];
6056
6057    dontUseSetuptoolsCheck = true;
6058 +  pythonImportsCheck = [ "todosrht" ];
6059
6060    meta = with lib; {
6061      homepage = "https://todo.sr.ht/~sircmpwn/todo.sr.ht";
6062      description = "Ticket tracking service for the sr.ht network";
6063 -    license = licenses.agpl3;
6064 +    license = licenses.agpl3Only;
6065      maintainers = with maintainers; [ eadwu ];
6066    };
6067  }
6068 diff --git a/pkgs/applications/version-management/sourcehut/update.sh b/pkgs/applications/version-management/sourcehut/update.sh
6069 index 156d4cc35e4..6733046d000 100755
6070 --- a/pkgs/applications/version-management/sourcehut/update.sh
6071 +++ b/pkgs/applications/version-management/sourcehut/update.sh
6072 @@ -1,8 +1,11 @@
6073  #! /usr/bin/env nix-shell
6074  #! nix-shell -i bash -p git mercurial common-updater-scripts
6075 +set -x
6076
6077 -cd "$(dirname "${BASH_SOURCE[0]}")"
6078 +cd "$(dirname "${BASH_SOURCE[0]}")" || exit 1
6079  root=../../../..
6080 +tmp=$(mktemp -d)
6081 +trap 'rm -rf "$tmp"' EXIT
6082
6083  default() {
6084    (cd "$root" && nix-instantiate --eval --strict -A "sourcehut.python.pkgs.$1.meta.position" | sed -re 's/^"(.*):[0-9]+"$/\1/')
6085 @@ -13,19 +16,18 @@ version() {
6086  }
6087
6088  src_url() {
6089 -  (cd "$root" && nix-instantiate --eval --strict -A "sourcehut.python.pkgs.$1.src.drvAttrs.url" | tr -d '"')
6090 +  nix-instantiate --eval --strict --expr " with import $root {}; let src = sourcehut.python.pkgs.$1.drvAttrs.src; in src.url or src.meta.homepage" | tr -d '"'
6091  }
6092
6093  get_latest_version() {
6094    src="$(src_url "$1")"
6095 -  tmp=$(mktemp -d)
6096 -
6097 +  rm -rf "$tmp"
6098    if [ "$1" = "hgsrht" ]; then
6099 -    hg clone "$src" "$tmp" &> /dev/null
6100 +    hg clone "$src" "$tmp" >/dev/null
6101      printf "%s" "$(cd "$tmp" && hg log --limit 1 --template '{latesttag}')"
6102    else
6103 -    git clone "$src" "$tmp"
6104 -    printf "%s" "$(cd "$tmp" && git describe $(git rev-list --tags --max-count=1))"
6105 +    git clone "$src" "$tmp" >/dev/null
6106 +    printf "%s" "$(cd "$tmp" && git describe "$(git rev-list --tags --max-count=1)")"
6107    fi
6108  }
6109
6110 @@ -36,19 +38,33 @@ update_version() {
6111
6112    (cd "$root" && update-source-version "sourcehut.python.pkgs.$1" "$version")
6113
6114 +  # Update vendorSha256 of Go modules
6115 +  nixFile="${1%srht}".nix
6116 +  nixFile="${nixFile/build/builds}"
6117 +  retry=true
6118 +  while "$retry"; do
6119 +    retry=false;
6120 +    exec < <(exec nix -L build -f "$root" sourcehut.python.pkgs."$1" 2>&1)
6121 +    while IFS=' :' read -r origin hash; do
6122 +      case "$origin" in
6123 +        (expected|specified) oldHash="$hash";;
6124 +        (got) sed -i "s|$oldHash|$(nix hash to-sri --type sha256 "$hash")|" "$nixFile"; retry=true; break;;
6125 +        (*) printf >&2 "%s\n" "$origin${hash:+:$hash}"
6126 +      esac
6127 +    done
6128 +  done
6129 +
6130    git add "$default_nix"
6131 -  git commit -m "$1: $version_old -> $version"
6132 +  git commit -m "sourcehut.$1: $version_old -> $version"
6133  }
6134
6135 -services=( "srht" "buildsrht" "dispatchsrht" "gitsrht" "hgsrht" "hubsrht" "listssrht" "mansrht"
6136 -           "metasrht" "pastesrht" "todosrht" "scmsrht" )
6137 -
6138 -# Whether or not a specific service is requested
6139 -if [ -n "$1" ]; then
6140 -  version="$(get_latest_version "$1")"
6141 -  (cd "$root" && update-source-version "sourcehut.python.pkgs.$1" "$version")
6142 +if [ $# -gt 0 ]; then
6143 +  services=("$@")
6144  else
6145 -  for service in "${services[@]}"; do
6146 -    update_version "$service"
6147 -  done
6148 +  services=( "srht" "buildsrht" "dispatchsrht" "gitsrht" "hgsrht" "hubsrht" "listssrht" "mansrht"
6149 +             "metasrht" "pagessrht" "pastesrht" "todosrht" "scmsrht" )
6150  fi
6151 +
6152 +for service in "${services[@]}"; do
6153 +  update_version "$service"
6154 +done