nixos/modules/services/misc/sourcehut/hg.nix

   1 { config, lib, pkgs, ... }:
   2
   3 with lib;
   4 let
   5   cfg = config.services.sourcehut;
   6   scfg = cfg.hg;
   7   iniKey = "hg.sr.ht";
   8   statePath = "/var/lib/sourcehut/hgsrht";
   9
  10   rcfg = config.services.redis;
  11   drv = pkgs.sourcehut.hgsrht;
  12 in
  13 {
  14   options.services.sourcehut.hg = {
  15     enable = mkEnableOption "git service";
  16
  17     user = mkOption {
  18       type = types.str;
  19       internal = true;
  20       readOnly = true;
  21       default = "hg";
  22       description = ''
  23         User for hg.sr.ht.
  24       '';
  25     };
  26
  27     port = mkOption {
  28       type = types.port;
  29       default = 5010;
  30       description = ''
  31         Port on which the "hg" module should listen.
  32       '';
  33     };
  34
  35     database = mkOption {
  36       type = types.str;
  37       default = "hg.sr.ht";
  38       description = ''
  39         PostgreSQL database name for hg.sr.ht.
  40       '';
  41     };
  42
  43     cloneBundles = mkOption {
  44       type = types.bool;
  45       default = false;
  46       description = ''
  47         Generate clonebundles (which require more disk space but dramatically speed up cloning large repositories).
  48       '';
  49     };
  50   };
  51
  52   config = with scfg; lib.mkIf (cfg.enable && scfg.enable) {
  53     # In case it ever comes into being
  54     environment.etc."ssh/hgsrht-dispatch" = {
  55       mode = "0755";
  56       text = ''
  57         #! ${pkgs.stdenv.shell}
  58         ${cfg.python}/bin/gitsrht-dispatch "$@"
  59       '';
  60     };
  61
  62     environment.systemPackages = [ pkgs.mercurial ];
  63
  64     users = {
  65       users = {
  66         "${user}" = {
  67           isSystemUser = true;
  68           group = user;
  69           # Assuming hg.sr.ht needs this too
  70           shell = pkgs.bash;
  71           description = "hg.sr.ht user";
  72         };
  73       };
  74
  75       groups = {
  76         "${user}" = { };
  77       };
  78     };
  79
  80     services = {
  81       openssh.authorizedKeysCommand = ''/etc/ssh/hgsrht-dispatch "%u" "%h" "%t" "%k"'';
  82       openssh.authorizedKeysCommandUser = "root";
  83       openssh.extraConfig = ''
  84         PermitUserEnvironment SRHT_*
  85       '';
  86
  87       postgresql = {
  88         authentication = ''
  89           local ${database} ${user} trust
  90         '';
  91         ensureDatabases = [ database ];
  92         ensureUsers = [
  93           {
  94             name = user;
  95             ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
  96           }
  97         ];
  98       };
  99     };
 100
 101     systemd = {
 102       tmpfiles.rules = [
 103         # /var/log is owned by root
 104         "f /var/log/hg-srht-shell 0644 ${user} ${user} -"
 105
 106         "d ${cfg.settings."${iniKey}".repos} 2755 ${user} ${user} -"
 107       ];
 108
 109       services = {
 110         hgsrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
 111           after = [ "redis.service" "postgresql.service" "network.target" ];
 112           requires = [ "redis.service" "postgresql.service" ];
 113           wantedBy = [ "multi-user.target" ];
 114
 115           path = [ pkgs.mercurial ];
 116           description = "hg.sr.ht website service";
 117
 118           serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
 119         };
 120
 121         hgsrht-periodic = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
 122           after = [ "hgsrht.service" ];
 123           requires = [ "hgsrht.service" ];
 124
 125           description = "hg.sr.ht periodic service";
 126
 127           serviceConfig.Type = mkForce "oneshot";
 128           serviceConfig.Restart = mkForce "no";
 129           serviceConfig.ExecStart = "${cfg.python}/bin/hgsrht-periodic";
 130         };
 131
 132         hgsrht-clonebundles = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
 133           after = [ "hgsrht.service" ];
 134           requires = [ "hgsrht.service" ];
 135
 136           description = "hg.sr.ht periodic service";
 137
 138           serviceConfig.Type = mkForce "oneshot";
 139           serviceConfig.Restart = mkForce "no";
 140           serviceConfig.ExecStart = "${cfg.python}/bin/hgsrht-periodic";
 141         };
 142       };
 143     };
 144
 145     systemd.timers = {
 146       hgsrht-periodic = {
 147         description = "hgsrht periodic timer";
 148         wantedBy = [ "timers.target" ];
 149         timerConfig = {
 150           OnCalendar = "20min";
 151           Persistent = true;
 152         };
 153       };
 154       hgsrht-clonebundles = {
 155         description = "hgsrht daily timer";
 156         wantedBy = [ "timers.target" ];
 157         timerConfig = {
 158           OnCalendar = "daily";
 159           Persistent = true;
 160           AccuracySec = "1h";
 161         };
 162       };
 163     };
 164
 165     services.sourcehut.settings = {
 166       # The authorized keys hook uses this to dispatch to various handlers
 167       # The format is a program to exec into as the key, and the user to match as the
 168       # value. When someone tries to log in as this user, this program is executed
 169       # and is expected to emit an AuthorizedKeys file.
 170       #
 171       # Uncomment the relevant lines to enable the various sr.ht dispatchers.
 172       "hg.sr.ht::dispatch"."/run/current-system/sw/bin/hgsrht-keys" = mkDefault "${user}:${user}";
 173     };
 174
 175     # TODO: requires testing and addition of hg-specific requirements
 176     services.nginx.virtualHosts."hg.${cfg.originBase}" = {
 177       forceSSL = true;
 178       locations."/".proxyPass = "http://${cfg.address}:${toString port}";
 179       locations."/query".proxyPass = cfgIni."meta.sr.ht".api-origin;
 180       locations."/static".root = "${pkgs.sourcehut.hgsrht}/${pkgs.sourcehut.python.sitePackages}/hgsrht";
 181     };
 182   };
 183 }