]> Git — Sourcephile - sourcephile-nix.git/blob - nixpkgs/patches/sourcehut.diff
sourcephile / git / sourcephile-nix.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
losurdo: fallback to old screen
[sourcephile-nix.git] / nixpkgs / patches / sourcehut.diff
1 diff --git a/nixos/lib/make-options-doc/options-to-docbook.xsl b/nixos/lib/make-options-doc/options-to-docbook.xsl
2 index 18d19fddaca..304698a51ad 100644
3 --- a/nixos/lib/make-options-doc/options-to-docbook.xsl
4 +++ b/nixos/lib/make-options-doc/options-to-docbook.xsl
5 @@ -20,7 +20,7 @@
6 <title>Configuration Options</title>
7 <variablelist xml:id="configuration-variable-list">
8 <xsl:for-each select="attrs">
9 - <xsl:variable name="id" select="concat('opt-', str:replace(str:replace(str:replace(attr[@name = 'name']/string/@value, '*', '_'), '&lt;', '_'), '>', '_'))" />
10 + <xsl:variable name="id" select="concat('opt-', str:replace(str:replace(str:replace(str:replace(attr[@name = 'name']/string/@value, '*', '_'), '&lt;', '_'), '>', '_'), ':', '_'))" />
11 <varlistentry>
12 <term xlink:href="#{$id}">
13 <xsl:attribute name="xml:id"><xsl:value-of select="$id"/></xsl:attribute>
14 diff --git a/nixos/modules/services/databases/redis.nix b/nixos/modules/services/databases/redis.nix
15 index 1b9358c81a1..16159e62d9d 100644
16 --- a/nixos/modules/services/databases/redis.nix
17 +++ b/nixos/modules/services/databases/redis.nix
18 @@ -5,17 +5,18 @@ with lib;
19 let
20 cfg = config.services.redis;
21
22 - ulimitNofile = cfg.maxclients + 32;
23 -
24 mkValueString = value:
25 if value == true then "yes"
26 else if value == false then "no"
27 else generators.mkValueStringDefault { } value;
28
29 - redisConfig = pkgs.writeText "redis.conf" (generators.toKeyValue {
30 + redisConfig = settings: pkgs.writeText "redis.conf" (generators.toKeyValue {
31 listsAsDuplicateKeys = true;
32 mkKeyValue = generators.mkKeyValueDefault { inherit mkValueString; } " ";
33 - } cfg.settings);
34 + } settings);
35 +
36 + redisName = name: "redis" + optionalString (name != "") ("-"+name);
37 + enabledServers = filterAttrs (name: conf: conf.enable) config.services.redis.servers;
38
39 in {
40 imports = [
41 @@ -25,6 +26,27 @@ in {
42 (mkRemovedOptionModule [ "services" "redis" "appendOnlyFilename" ] "This option was never used.")
43 (mkRemovedOptionModule [ "services" "redis" "pidFile" ] "This option was removed.")
44 (mkRemovedOptionModule [ "services" "redis" "extraConfig" ] "Use services.redis.settings instead.")
45 + (mkRenamedOptionModule [ "services" "redis" "enable"] [ "services" "redis" "servers" "" "enable" ])
46 + (mkRenamedOptionModule [ "services" "redis" "port"] [ "services" "redis" "servers" "" "port" ])
47 + (mkRenamedOptionModule [ "services" "redis" "openFirewall"] [ "services" "redis" "servers" "" "openFirewall" ])
48 + (mkRenamedOptionModule [ "services" "redis" "bind"] [ "services" "redis" "servers" "" "bind" ])
49 + (mkRenamedOptionModule [ "services" "redis" "unixSocket"] [ "services" "redis" "servers" "" "unixSocket" ])
50 + (mkRenamedOptionModule [ "services" "redis" "unixSocketPerm"] [ "services" "redis" "servers" "" "unixSocketPerm" ])
51 + (mkRenamedOptionModule [ "services" "redis" "logLevel"] [ "services" "redis" "servers" "" "logLevel" ])
52 + (mkRenamedOptionModule [ "services" "redis" "logfile"] [ "services" "redis" "servers" "" "logfile" ])
53 + (mkRenamedOptionModule [ "services" "redis" "syslog"] [ "services" "redis" "servers" "" "syslog" ])
54 + (mkRenamedOptionModule [ "services" "redis" "databases"] [ "services" "redis" "servers" "" "databases" ])
55 + (mkRenamedOptionModule [ "services" "redis" "maxclients"] [ "services" "redis" "servers" "" "maxclients" ])
56 + (mkRenamedOptionModule [ "services" "redis" "save"] [ "services" "redis" "servers" "" "save" ])
57 + (mkRenamedOptionModule [ "services" "redis" "slaveOf"] [ "services" "redis" "servers" "" "slaveOf" ])
58 + (mkRenamedOptionModule [ "services" "redis" "masterAuth"] [ "services" "redis" "servers" "" "masterAuth" ])
59 + (mkRenamedOptionModule [ "services" "redis" "requirePass"] [ "services" "redis" "servers" "" "requirePass" ])
60 + (mkRenamedOptionModule [ "services" "redis" "requirePassFile"] [ "services" "redis" "servers" "" "requirePassFile" ])
61 + (mkRenamedOptionModule [ "services" "redis" "appendOnly"] [ "services" "redis" "servers" "" "appendOnly" ])
62 + (mkRenamedOptionModule [ "services" "redis" "appendFsync"] [ "services" "redis" "servers" "" "appendFsync" ])
63 + (mkRenamedOptionModule [ "services" "redis" "slowLogLogSlowerThan"] [ "services" "redis" "servers" "" "slowLogLogSlowerThan" ])
64 + (mkRenamedOptionModule [ "services" "redis" "slowLogMaxLen"] [ "services" "redis" "servers" "" "slowLogMaxLen" ])
65 + (mkRenamedOptionModule [ "services" "redis" "settings"] [ "services" "redis" "servers" "" "settings" ])
66 ];
67
68 ###### interface
69 @@ -32,18 +54,6 @@ in {
70 options = {
71
72 services.redis = {
73 -
74 - enable = mkOption {
75 - type = types.bool;
76 - default = false;
77 - description = ''
78 - Whether to enable the Redis server. Note that the NixOS module for
79 - Redis disables kernel support for Transparent Huge Pages (THP),
80 - because this features causes major performance problems for Redis,
81 - e.g. (https://redis.io/topics/latency).
82 - '';
83 - };
84 -
85 package = mkOption {
86 type = types.package;
87 default = pkgs.redis;
88 @@ -51,177 +61,227 @@ in {
89 description = "Which Redis derivation to use.";
90 };
91
92 - port = mkOption {
93 - type = types.port;
94 - default = 6379;
95 - description = "The port for Redis to listen to.";
96 - };
97 + vmOverCommit = mkEnableOption ''
98 + setting of vm.overcommit_memory to 1
99 + (Suggested for Background Saving: http://redis.io/topics/faq)
100 + '';
101
102 - vmOverCommit = mkOption {
103 - type = types.bool;
104 - default = false;
105 - description = ''
106 - Set vm.overcommit_memory to 1 (Suggested for Background Saving: http://redis.io/topics/faq)
107 - '';
108 - };
109 -
110 - openFirewall = mkOption {
111 - type = types.bool;
112 - default = false;
113 - description = ''
114 - Whether to open ports in the firewall for the server.
115 - '';
116 - };
117 -
118 - bind = mkOption {
119 - type = with types; nullOr str;
120 - default = "127.0.0.1";
121 - description = ''
122 - The IP interface to bind to.
123 - <literal>null</literal> means "all interfaces".
124 - '';
125 - example = "192.0.2.1";
126 - };
127 -
128 - unixSocket = mkOption {
129 - type = with types; nullOr path;
130 - default = null;
131 - description = "The path to the socket to bind to.";
132 - example = "/run/redis/redis.sock";
133 - };
134 -
135 - unixSocketPerm = mkOption {
136 - type = types.int;
137 - default = 750;
138 - description = "Change permissions for the socket";
139 - example = 700;
140 - };
141 -
142 - logLevel = mkOption {
143 - type = types.str;
144 - default = "notice"; # debug, verbose, notice, warning
145 - example = "debug";
146 - description = "Specify the server verbosity level, options: debug, verbose, notice, warning.";
147 - };
148 -
149 - logfile = mkOption {
150 - type = types.str;
151 - default = "/dev/null";
152 - description = "Specify the log file name. Also 'stdout' can be used to force Redis to log on the standard output.";
153 - example = "/var/log/redis.log";
154 - };
155 -
156 - syslog = mkOption {
157 - type = types.bool;
158 - default = true;
159 - description = "Enable logging to the system logger.";
160 - };
161 -
162 - databases = mkOption {
163 - type = types.int;
164 - default = 16;
165 - description = "Set the number of databases.";
166 - };
167 -
168 - maxclients = mkOption {
169 - type = types.int;
170 - default = 10000;
171 - description = "Set the max number of connected clients at the same time.";
172 - };
173 -
174 - save = mkOption {
175 - type = with types; listOf (listOf int);
176 - default = [ [900 1] [300 10] [60 10000] ];
177 - description = "The schedule in which data is persisted to disk, represented as a list of lists where the first element represent the amount of seconds and the second the number of changes.";
178 - example = [ [900 1] [300 10] [60 10000] ];
179 - };
180 -
181 - slaveOf = mkOption {
182 - type = with types; nullOr (submodule ({ ... }: {
183 + servers = mkOption {
184 + type = with types; attrsOf (submodule ({config, name, ...}@args: {
185 options = {
186 - ip = mkOption {
187 - type = str;
188 - description = "IP of the Redis master";
189 - example = "192.168.1.100";
190 + enable = mkEnableOption ''
191 + Redis server.
192 +
193 + Note that the NixOS module for Redis disables kernel support
194 + for Transparent Huge Pages (THP),
195 + because this features causes major performance problems for Redis,
196 + e.g. (https://redis.io/topics/latency).
197 + '';
198 +
199 + user = mkOption {
200 + type = types.str;
201 + default = redisName name;
202 + defaultText = "\"redis\" or \"redis-\${name}\" if name != \"\"";
203 + description = "The username and groupname for redis-server.";
204 };
205
206 port = mkOption {
207 - type = port;
208 - description = "port of the Redis master";
209 + type = types.port;
210 default = 6379;
211 + description = "The port for Redis to listen to.";
212 + };
213 +
214 + openFirewall = mkOption {
215 + type = types.bool;
216 + default = false;
217 + description = ''
218 + Whether to open ports in the firewall for the server.
219 + '';
220 + };
221 +
222 + bind = mkOption {
223 + type = with types; nullOr str;
224 + default = if name == "" then "127.0.0.1" else null;
225 + defaultText = "127.0.0.1 or null if name != \"\"";
226 + description = ''
227 + The IP interface to bind to.
228 + <literal>null</literal> means "all interfaces".
229 + '';
230 + example = "192.0.2.1";
231 + };
232 +
233 + unixSocket = mkOption {
234 + type = with types; nullOr path;
235 + default = "/run/${redisName name}/redis.sock";
236 + defaultText = "\"/run/redis/redis.sock\" or \"/run/redis-\${name}/redis.sock\" if name != \"\"";
237 + description = "The path to the socket to bind to.";
238 + };
239 +
240 + unixSocketPerm = mkOption {
241 + type = types.int;
242 + default = 660;
243 + description = "Change permissions for the socket";
244 + example = 600;
245 + };
246 +
247 + logLevel = mkOption {
248 + type = types.str;
249 + default = "notice"; # debug, verbose, notice, warning
250 + example = "debug";
251 + description = "Specify the server verbosity level, options: debug, verbose, notice, warning.";
252 + };
253 +
254 + logfile = mkOption {
255 + type = types.str;
256 + default = "/dev/null";
257 + description = "Specify the log file name. Also 'stdout' can be used to force Redis to log on the standard output.";
258 + example = "/var/log/redis.log";
259 + };
260 +
261 + syslog = mkOption {
262 + type = types.bool;
263 + default = true;
264 + description = "Enable logging to the system logger.";
265 + };
266 +
267 + databases = mkOption {
268 + type = types.int;
269 + default = 16;
270 + description = "Set the number of databases.";
271 + };
272 +
273 + maxclients = mkOption {
274 + type = types.int;
275 + default = 10000;
276 + description = "Set the max number of connected clients at the same time.";
277 + };
278 +
279 + save = mkOption {
280 + type = with types; listOf (listOf int);
281 + default = [ [900 1] [300 10] [60 10000] ];
282 + description = "The schedule in which data is persisted to disk, represented as a list of lists where the first element represent the amount of seconds and the second the number of changes.";
283 + example = [ [900 1] [300 10] [60 10000] ];
284 + };
285 +
286 + slaveOf = mkOption {
287 + type = with types; nullOr (submodule ({ ... }: {
288 + options = {
289 + ip = mkOption {
290 + type = str;
291 + description = "IP of the Redis master";
292 + example = "192.168.1.100";
293 + };
294 +
295 + port = mkOption {
296 + type = port;
297 + description = "port of the Redis master";
298 + default = 6379;
299 + };
300 + };
301 + }));
302 +
303 + default = null;
304 + description = "IP and port to which this redis instance acts as a slave.";
305 + example = { ip = "192.168.1.100"; port = 6379; };
306 + };
307 +
308 + masterAuth = mkOption {
309 + type = with types; nullOr str;
310 + default = null;
311 + description = ''If the master is password protected (using the requirePass configuration)
312 + it is possible to tell the slave to authenticate before starting the replication synchronization
313 + process, otherwise the master will refuse the slave request.
314 + (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';
315 + };
316 +
317 + requirePass = mkOption {
318 + type = with types; nullOr str;
319 + default = null;
320 + description = ''
321 + Password for database (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE).
322 + Use requirePassFile to store it outside of the nix store in a dedicated file.
323 + '';
324 + example = "letmein!";
325 + };
326 +
327 + requirePassFile = mkOption {
328 + type = with types; nullOr path;
329 + default = null;
330 + description = "File with password for the database.";
331 + example = "/run/keys/redis-password";
332 + };
333 +
334 + appendOnly = mkOption {
335 + type = types.bool;
336 + default = false;
337 + description = "By default data is only periodically persisted to disk, enable this option to use an append-only file for improved persistence.";
338 + };
339 +
340 + appendFsync = mkOption {
341 + type = types.str;
342 + default = "everysec"; # no, always, everysec
343 + description = "How often to fsync the append-only log, options: no, always, everysec.";
344 + };
345 +
346 + slowLogLogSlowerThan = mkOption {
347 + type = types.int;
348 + default = 10000;
349 + description = "Log queries whose execution take longer than X in milliseconds.";
350 + example = 1000;
351 + };
352 +
353 + slowLogMaxLen = mkOption {
354 + type = types.int;
355 + default = 128;
356 + description = "Maximum number of items to keep in slow log.";
357 + };
358 +
359 + settings = mkOption {
360 + # TODO: this should be converted to freeformType
361 + type = with types; attrsOf (oneOf [ bool int str (listOf str) ]);
362 + default = {};
363 + description = ''
364 + Redis configuration. Refer to
365 + <link xlink:href="https://redis.io/topics/config"/>
366 + for details on supported values.
367 + '';
368 + example = literalExample ''
369 + {
370 + loadmodule = [ "/path/to/my_module.so" "/path/to/other_module.so" ];
371 + }
372 + '';
373 };
374 };
375 + config.settings = mkMerge [
376 + {
377 + port = if config.bind == null then 0 else config.port;
378 + daemonize = false;
379 + supervised = "systemd";
380 + loglevel = config.logLevel;
381 + logfile = config.logfile;
382 + syslog-enabled = config.syslog;
383 + databases = config.databases;
384 + maxclients = config.maxclients;
385 + save = map (d: "${toString (builtins.elemAt d 0)} ${toString (builtins.elemAt d 1)}") config.save;
386 + dbfilename = "dump.rdb";
387 + dir = "/var/lib/${redisName name}";
388 + appendOnly = config.appendOnly;
389 + appendfsync = config.appendFsync;
390 + slowlog-log-slower-than = config.slowLogLogSlowerThan;
391 + slowlog-max-len = config.slowLogMaxLen;
392 + }
393 + (mkIf (config.bind != null) { bind = config.bind; })
394 + (mkIf (config.unixSocket != null) {
395 + unixsocket = config.unixSocket;
396 + unixsocketperm = toString config.unixSocketPerm;
397 + })
398 + (mkIf (config.slaveOf != null) { slaveof = "${config.slaveOf.ip} ${toString config.slaveOf.port}"; })
399 + (mkIf (config.masterAuth != null) { masterauth = config.masterAuth; })
400 + (mkIf (config.requirePass != null) { requirepass = config.requirePass; })
401 + ];
402 }));
403 -
404 - default = null;
405 - description = "IP and port to which this redis instance acts as a slave.";
406 - example = { ip = "192.168.1.100"; port = 6379; };
407 - };
408 -
409 - masterAuth = mkOption {
410 - type = with types; nullOr str;
411 - default = null;
412 - description = ''If the master is password protected (using the requirePass configuration)
413 - it is possible to tell the slave to authenticate before starting the replication synchronization
414 - process, otherwise the master will refuse the slave request.
415 - (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE)'';
416 - };
417 -
418 - requirePass = mkOption {
419 - type = with types; nullOr str;
420 - default = null;
421 - description = ''
422 - Password for database (STORED PLAIN TEXT, WORLD-READABLE IN NIX STORE).
423 - Use requirePassFile to store it outside of the nix store in a dedicated file.
424 - '';
425 - example = "letmein!";
426 - };
427 -
428 - requirePassFile = mkOption {
429 - type = with types; nullOr path;
430 - default = null;
431 - description = "File with password for the database.";
432 - example = "/run/keys/redis-password";
433 - };
434 -
435 - appendOnly = mkOption {
436 - type = types.bool;
437 - default = false;
438 - description = "By default data is only periodically persisted to disk, enable this option to use an append-only file for improved persistence.";
439 - };
440 -
441 - appendFsync = mkOption {
442 - type = types.str;
443 - default = "everysec"; # no, always, everysec
444 - description = "How often to fsync the append-only log, options: no, always, everysec.";
445 - };
446 -
447 - slowLogLogSlowerThan = mkOption {
448 - type = types.int;
449 - default = 10000;
450 - description = "Log queries whose execution take longer than X in milliseconds.";
451 - example = 1000;
452 - };
453 -
454 - slowLogMaxLen = mkOption {
455 - type = types.int;
456 - default = 128;
457 - description = "Maximum number of items to keep in slow log.";
458 - };
459 -
460 - settings = mkOption {
461 - type = with types; attrsOf (oneOf [ bool int str (listOf str) ]);
462 + description = "Configuration of multiple <literal>redis-server</literal> instances.";
463 default = {};
464 - description = ''
465 - Redis configuration. Refer to
466 - <link xlink:href="https://redis.io/topics/config"/>
467 - for details on supported values.
468 - '';
469 - example = literalExample ''
470 - {
471 - loadmodule = [ "/path/to/my_module.so" "/path/to/other_module.so" ];
472 - }
473 - '';
474 };
475 };
476
477 @@ -230,78 +290,61 @@ in {
478
479 ###### implementation
480
481 - config = mkIf config.services.redis.enable {
482 - assertions = [{
483 - assertion = cfg.requirePass != null -> cfg.requirePassFile == null;
484 - message = "You can only set one services.redis.requirePass or services.redis.requirePassFile";
485 - }];
486 - boot.kernel.sysctl = (mkMerge [
487 + config = mkIf (enabledServers != {}) {
488 +
489 + assertions = attrValues (mapAttrs (name: conf: {
490 + assertion = conf.requirePass != null -> conf.requirePassFile == null;
491 + message = ''
492 + You can only set one services.redis.servers.${name}.requirePass
493 + or services.redis.servers.${name}.requirePassFile
494 + '';
495 + }) enabledServers);
496 +
497 + boot.kernel.sysctl = mkMerge [
498 { "vm.nr_hugepages" = "0"; }
499 ( mkIf cfg.vmOverCommit { "vm.overcommit_memory" = "1"; } )
500 - ]);
501 + ];
502
503 - networking.firewall = mkIf cfg.openFirewall {
504 - allowedTCPPorts = [ cfg.port ];
505 - };
506 -
507 - users.users.redis = {
508 - description = "Redis database user";
509 - group = "redis";
510 - isSystemUser = true;
511 - };
512 - users.groups.redis = {};
513 + networking.firewall.allowedTCPPorts = concatMap (conf:
514 + optional conf.openFirewall conf.port
515 + ) (attrValues enabledServers);
516
517 environment.systemPackages = [ cfg.package ];
518
519 - services.redis.settings = mkMerge [
520 - {
521 - port = cfg.port;
522 - daemonize = false;
523 - supervised = "systemd";
524 - loglevel = cfg.logLevel;
525 - logfile = cfg.logfile;
526 - syslog-enabled = cfg.syslog;
527 - databases = cfg.databases;
528 - maxclients = cfg.maxclients;
529 - save = map (d: "${toString (builtins.elemAt d 0)} ${toString (builtins.elemAt d 1)}") cfg.save;
530 - dbfilename = "dump.rdb";
531 - dir = "/var/lib/redis";
532 - appendOnly = cfg.appendOnly;
533 - appendfsync = cfg.appendFsync;
534 - slowlog-log-slower-than = cfg.slowLogLogSlowerThan;
535 - slowlog-max-len = cfg.slowLogMaxLen;
536 - }
537 - (mkIf (cfg.bind != null) { bind = cfg.bind; })
538 - (mkIf (cfg.unixSocket != null) { unixsocket = cfg.unixSocket; unixsocketperm = "${toString cfg.unixSocketPerm}"; })
539 - (mkIf (cfg.slaveOf != null) { slaveof = "${cfg.slaveOf.ip} ${toString cfg.slaveOf.port}"; })
540 - (mkIf (cfg.masterAuth != null) { masterauth = cfg.masterAuth; })
541 - (mkIf (cfg.requirePass != null) { requirepass = cfg.requirePass; })
542 - ];
543 + users.users = mapAttrs' (name: conf: nameValuePair (redisName name) {
544 + description = "System user for the redis-server instance ${name}";
545 + isSystemUser = true;
546 + group = redisName name;
547 + }) enabledServers;
548 + users.groups = mapAttrs' (name: conf: nameValuePair (redisName name) {
549 + }) enabledServers;
550
551 - systemd.services.redis = {
552 - description = "Redis Server";
553 + systemd.services = mapAttrs' (name: conf: nameValuePair (redisName name) {
554 + description = "Redis Server - ${redisName name}";
555
556 wantedBy = [ "multi-user.target" ];
557 after = [ "network.target" ];
558
559 - preStart = ''
560 - install -m 600 ${redisConfig} /run/redis/redis.conf
561 - '' + optionalString (cfg.requirePassFile != null) ''
562 - password=$(cat ${escapeShellArg cfg.requirePassFile})
563 - echo "requirePass $password" >> /run/redis/redis.conf
564 - '';
565 -
566 serviceConfig = {
567 - ExecStart = "${cfg.package}/bin/redis-server /run/redis/redis.conf";
568 + ExecStart = "${cfg.package}/bin/redis-server /run/${redisName name}/redis.conf";
569 + ExecStartPre = [("+"+pkgs.writeShellScript "${redisName name}-credentials" (''
570 + install -o '${conf.user}' -m 600 ${redisConfig conf.settings} /run/${redisName name}/redis.conf
571 + '' + optionalString (conf.requirePassFile != null) ''
572 + {
573 + printf requirePass' '
574 + cat ${escapeShellArg conf.requirePassFile}
575 + } >>/run/${redisName name}/redis.conf
576 + '')
577 + )];
578 Type = "notify";
579 # User and group
580 - User = "redis";
581 - Group = "redis";
582 + User = conf.user;
583 + Group = conf.user;
584 # Runtime directory and mode
585 - RuntimeDirectory = "redis";
586 + RuntimeDirectory = redisName name;
587 RuntimeDirectoryMode = "0750";
588 # State directory and mode
589 - StateDirectory = "redis";
590 + StateDirectory = redisName name;
591 StateDirectoryMode = "0700";
592 # Access write directories
593 UMask = "0077";
594 @@ -310,7 +353,7 @@ in {
595 # Security
596 NoNewPrivileges = true;
597 # Process Properties
598 - LimitNOFILE = "${toString ulimitNofile}";
599 + LimitNOFILE = mkDefault "${toString (conf.maxclients + 32)}";
600 # Sandboxing
601 ProtectSystem = "strict";
602 ProtectHome = true;
603 @@ -323,7 +366,9 @@ in {
604 ProtectKernelModules = true;
605 ProtectKernelTunables = true;
606 ProtectControlGroups = true;
607 - RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
608 + RestrictAddressFamilies =
609 + optionals (conf.bind != null) ["AF_INET" "AF_INET6"] ++
610 + optional (conf.unixSocket != null) "AF_UNIX";
611 RestrictNamespaces = true;
612 LockPersonality = true;
613 MemoryDenyWriteExecute = true;
614 @@ -334,6 +379,7 @@ in {
615 SystemCallArchitectures = "native";
616 SystemCallFilter = "~@cpu-emulation @debug @keyring @memlock @mount @obsolete @privileged @resources @setuid";
617 };
618 - };
619 + }) enabledServers;
620 +
621 };
622 }
623 diff --git a/nixos/modules/services/misc/sourcehut/builds.nix b/nixos/modules/services/misc/sourcehut/builds.nix
624 deleted file mode 100644
625 index e446f08284f..00000000000
626 --- a/nixos/modules/services/misc/sourcehut/builds.nix
627 +++ /dev/null
628 @@ -1,234 +0,0 @@
629 -{ config, lib, pkgs, ... }:
630 -
631 -with lib;
632 -let
633 - cfg = config.services.sourcehut;
634 - scfg = cfg.builds;
635 - rcfg = config.services.redis;
636 - iniKey = "builds.sr.ht";
637 -
638 - drv = pkgs.sourcehut.buildsrht;
639 -in
640 -{
641 - options.services.sourcehut.builds = {
642 - user = mkOption {
643 - type = types.str;
644 - default = "buildsrht";
645 - description = ''
646 - User for builds.sr.ht.
647 - '';
648 - };
649 -
650 - port = mkOption {
651 - type = types.port;
652 - default = 5002;
653 - description = ''
654 - Port on which the "builds" module should listen.
655 - '';
656 - };
657 -
658 - database = mkOption {
659 - type = types.str;
660 - default = "builds.sr.ht";
661 - description = ''
662 - PostgreSQL database name for builds.sr.ht.
663 - '';
664 - };
665 -
666 - statePath = mkOption {
667 - type = types.path;
668 - default = "${cfg.statePath}/buildsrht";
669 - description = ''
670 - State path for builds.sr.ht.
671 - '';
672 - };
673 -
674 - enableWorker = mkOption {
675 - type = types.bool;
676 - default = false;
677 - description = ''
678 - Run workers for builds.sr.ht.
679 - '';
680 - };
681 -
682 - images = mkOption {
683 - type = types.attrsOf (types.attrsOf (types.attrsOf types.package));
684 - default = { };
685 - example = lib.literalExample ''(let
686 - # Pinning unstable to allow usage with flakes and limit rebuilds.
687 - pkgs_unstable = builtins.fetchGit {
688 - url = "https://github.com/NixOS/nixpkgs";
689 - rev = "ff96a0fa5635770390b184ae74debea75c3fd534";
690 - ref = "nixos-unstable";
691 - };
692 - image_from_nixpkgs = pkgs_unstable: (import ("${pkgs.sourcehut.buildsrht}/lib/images/nixos/image.nix") {
693 - pkgs = (import pkgs_unstable {});
694 - });
695 - in
696 - {
697 - nixos.unstable.x86_64 = image_from_nixpkgs pkgs_unstable;
698 - }
699 - )'';
700 - description = ''
701 - Images for builds.sr.ht. Each package should be distro.release.arch and point to a /nix/store/package/root.img.qcow2.
702 - '';
703 - };
704 -
705 - };
706 -
707 - config = with scfg; let
708 - image_dirs = lib.lists.flatten (
709 - lib.attrsets.mapAttrsToList
710 - (distro: revs:
711 - lib.attrsets.mapAttrsToList
712 - (rev: archs:
713 - lib.attrsets.mapAttrsToList
714 - (arch: image:
715 - pkgs.runCommand "buildsrht-images" { } ''
716 - mkdir -p $out/${distro}/${rev}/${arch}
717 - ln -s ${image}/*.qcow2 $out/${distro}/${rev}/${arch}/root.img.qcow2
718 - '')
719 - archs)
720 - revs)
721 - scfg.images);
722 - image_dir_pre = pkgs.symlinkJoin {
723 - name = "builds.sr.ht-worker-images-pre";
724 - paths = image_dirs ++ [
725 - "${pkgs.sourcehut.buildsrht}/lib/images"
726 - ];
727 - };
728 - image_dir = pkgs.runCommand "builds.sr.ht-worker-images" { } ''
729 - mkdir -p $out/images
730 - cp -Lr ${image_dir_pre}/* $out/images
731 - '';
732 - in
733 - lib.mkIf (cfg.enable && elem "builds" cfg.services) {
734 - users = {
735 - users = {
736 - "${user}" = {
737 - isSystemUser = true;
738 - group = user;
739 - extraGroups = lib.optionals cfg.builds.enableWorker [ "docker" ];
740 - description = "builds.sr.ht user";
741 - };
742 - };
743 -
744 - groups = {
745 - "${user}" = { };
746 - };
747 - };
748 -
749 - services.postgresql = {
750 - authentication = ''
751 - local ${database} ${user} trust
752 - '';
753 - ensureDatabases = [ database ];
754 - ensureUsers = [
755 - {
756 - name = user;
757 - ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
758 - }
759 - ];
760 - };
761 -
762 - systemd = {
763 - tmpfiles.rules = [
764 - "d ${statePath} 0755 ${user} ${user} -"
765 - ] ++ (lib.optionals cfg.builds.enableWorker
766 - [ "d ${statePath}/logs 0775 ${user} ${user} - -" ]
767 - );
768 -
769 - services = {
770 - buildsrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey
771 - {
772 - after = [ "postgresql.service" "network.target" ];
773 - requires = [ "postgresql.service" ];
774 - wantedBy = [ "multi-user.target" ];
775 -
776 - description = "builds.sr.ht website service";
777 -
778 - serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
779 -
780 - # Hack to bypass this hack: https://git.sr.ht/~sircmpwn/core.sr.ht/tree/master/item/srht-update-profiles#L6
781 - } // { preStart = " "; };
782 -
783 - buildsrht-worker = {
784 - enable = scfg.enableWorker;
785 - after = [ "postgresql.service" "network.target" ];
786 - requires = [ "postgresql.service" ];
787 - wantedBy = [ "multi-user.target" ];
788 - partOf = [ "buildsrht.service" ];
789 - description = "builds.sr.ht worker service";
790 - path = [ pkgs.openssh pkgs.docker ];
791 - preStart = let qemuPackage = pkgs.qemu_kvm;
792 - in ''
793 - if [[ "$(docker images -q qemu:latest 2> /dev/null)" == "" || "$(cat ${statePath}/docker-image-qemu 2> /dev/null || true)" != "${qemuPackage.version}" ]]; then
794 - # Create and import qemu:latest image for docker
795 - ${
796 - pkgs.dockerTools.streamLayeredImage {
797 - name = "qemu";
798 - tag = "latest";
799 - contents = [ qemuPackage ];
800 - }
801 - } | docker load
802 - # Mark down current package version
803 - printf "%s" "${qemuPackage.version}" > ${statePath}/docker-image-qemu
804 - fi
805 - '';
806 - serviceConfig = {
807 - Type = "simple";
808 - User = user;
809 - Group = "nginx";
810 - Restart = "always";
811 - };
812 - serviceConfig.ExecStart = "${pkgs.sourcehut.buildsrht}/bin/builds.sr.ht-worker";
813 - };
814 - };
815 - };
816 -
817 - services.sourcehut.settings = {
818 - # URL builds.sr.ht is being served at (protocol://domain)
819 - "builds.sr.ht".origin = mkDefault "http://builds.${cfg.originBase}";
820 - # Address and port to bind the debug server to
821 - "builds.sr.ht".debug-host = mkDefault "0.0.0.0";
822 - "builds.sr.ht".debug-port = mkDefault port;
823 - # Configures the SQLAlchemy connection string for the database.
824 - "builds.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
825 - # Set to "yes" to automatically run migrations on package upgrade.
826 - "builds.sr.ht".migrate-on-upgrade = mkDefault "yes";
827 - # builds.sr.ht's OAuth client ID and secret for meta.sr.ht
828 - # Register your client at meta.example.org/oauth
829 - "builds.sr.ht".oauth-client-id = mkDefault null;
830 - "builds.sr.ht".oauth-client-secret = mkDefault null;
831 - # The redis connection used for the celery worker
832 - "builds.sr.ht".redis = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/3";
833 - # The shell used for ssh
834 - "builds.sr.ht".shell = mkDefault "runner-shell";
835 - # Register the builds.sr.ht dispatcher
836 - "git.sr.ht::dispatch".${builtins.unsafeDiscardStringContext "${pkgs.sourcehut.buildsrht}/bin/buildsrht-keys"} = mkDefault "${user}:${user}";
837 -
838 - # Location for build logs, images, and control command
839 - } // lib.attrsets.optionalAttrs scfg.enableWorker {
840 - # Default worker stores logs that are accessible via this address:port
841 - "builds.sr.ht::worker".name = mkDefault "127.0.0.1:5020";
842 - "builds.sr.ht::worker".buildlogs = mkDefault "${scfg.statePath}/logs";
843 - "builds.sr.ht::worker".images = mkDefault "${image_dir}/images";
844 - "builds.sr.ht::worker".controlcmd = mkDefault "${image_dir}/images/control";
845 - "builds.sr.ht::worker".timeout = mkDefault "3m";
846 - };
847 -
848 - services.nginx.virtualHosts."logs.${cfg.originBase}" =
849 - if scfg.enableWorker then {
850 - listen = with builtins; let address = split ":" cfg.settings."builds.sr.ht::worker".name;
851 - in [{ addr = elemAt address 0; port = lib.toInt (elemAt address 2); }];
852 - locations."/logs".root = "${scfg.statePath}";
853 - } else { };
854 -
855 - services.nginx.virtualHosts."builds.${cfg.originBase}" = {
856 - forceSSL = true;
857 - locations."/".proxyPass = "http://${cfg.address}:${toString port}";
858 - locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
859 - locations."/static".root = "${pkgs.sourcehut.buildsrht}/${pkgs.sourcehut.python.sitePackages}/buildsrht";
860 - };
861 - };
862 -}
863 diff --git a/nixos/modules/services/misc/sourcehut/default.nix b/nixos/modules/services/misc/sourcehut/default.nix
864 index 9c812d6b043..6cea2ce6490 100644
865 --- a/nixos/modules/services/misc/sourcehut/default.nix
866 +++ b/nixos/modules/services/misc/sourcehut/default.nix
867 @@ -1,14 +1,90 @@
868 { config, pkgs, lib, ... }:
869 -
870 with lib;
871 let
872 + inherit (config.services) nginx postfix postgresql redis;
873 + inherit (config.users) users groups;
874 cfg = config.services.sourcehut;
875 - cfgIni = cfg.settings;
876 - settingsFormat = pkgs.formats.ini { };
877 + domain = cfg.settings."sr.ht".global-domain;
878 + settingsFormat = pkgs.formats.ini {
879 + listToValue = concatMapStringsSep "," (generators.mkValueStringDefault {});
880 + mkKeyValue = k: v:
881 + if v == null then ""
882 + else generators.mkKeyValueDefault {
883 + mkValueString = v:
884 + if v == true then "yes"
885 + else if v == false then "no"
886 + else generators.mkValueStringDefault {} v;
887 + } "=" k v;
888 + };
889 + configIniOfService = srv: settingsFormat.generate "sourcehut-${srv}-config.ini"
890 + # Each service needs access to only a subset of sections (and secrets).
891 + (filterAttrs (k: v: v != null)
892 + (mapAttrs (section: v:
893 + let srvMatch = builtins.match "^([a-z]*)\\.sr\\.ht(::.*)?$" section; in
894 + if srvMatch == null # Include sections shared by all services
895 + || head srvMatch == srv # Include sections for the service being configured
896 + then v
897 + # Enable Web links and integrations between services.
898 + else if tail srvMatch == [ null ] && elem (head srvMatch) cfg.services
899 + then {
900 + inherit (v) origin;
901 + # mansrht crashes without it
902 + oauth-client-id = v.oauth-client-id or null;
903 + }
904 + # Drop sub-sections of other services
905 + else null)
906 + (recursiveUpdate cfg.settings {
907 + # Those paths are mounted using BindPaths= or BindReadOnlyPaths=
908 + # for services needing access to them.
909 + "builds.sr.ht::worker".buildlogs = "/var/log/sourcehut/buildsrht/logs";
910 + "git.sr.ht".post-update-script = "/var/lib/sourcehut/gitsrht/bin/post-update-script";
911 + "git.sr.ht".repos = "/var/lib/sourcehut/gitsrht/repos";
912 + "hg.sr.ht".changegroup-script = "/var/lib/sourcehut/hgsrht/bin/changegroup-script";
913 + "hg.sr.ht".repos = "/var/lib/sourcehut/hgsrht/repos";
914 + # Making this a per service option despite being in a global section,
915 + # so that it uses the redis-server used by the service.
916 + "sr.ht".redis-host = cfg.${srv}.redis.host;
917 + })));
918 + commonServiceSettings = srv: {
919 + origin = mkOption {
920 + description = "URL ${srv}.sr.ht is being served at (protocol://domain)";
921 + type = types.str;
922 + default = "https://${srv}.${domain}";
923 + defaultText = "https://${srv}.example.com";
924 + };
925 + debug-host = mkOption {
926 + description = "Address to bind the debug server to.";
927 + type = with types; nullOr str;
928 + default = null;
929 + };
930 + debug-port = mkOption {
931 + description = "Port to bind the debug server to.";
932 + type = with types; nullOr str;
933 + default = null;
934 + };
935 + connection-string = mkOption {
936 + description = "SQLAlchemy connection string for the database.";
937 + type = types.str;
938 + default = "postgresql:///localhost?user=${srv}srht&host=/run/postgresql";
939 + };
940 + migrate-on-upgrade = mkEnableOption "automatic migrations on package upgrade" // { default = true; };
941 + oauth-client-id = mkOption {
942 + description = "${srv}.sr.ht's OAuth client id for meta.sr.ht.";
943 + type = types.str;
944 + };
945 + oauth-client-secret = mkOption {
946 + description = "${srv}.sr.ht's OAuth client secret for meta.sr.ht.";
947 + type = types.path;
948 + apply = s: "<" + toString s;
949 + };
950 + };
951
952 # Specialized python containing all the modules
953 python = pkgs.sourcehut.python.withPackages (ps: with ps; [
954 gunicorn
955 + eventlet
956 + # For monitoring Celery: sudo -u listssrht celery --app listssrht.process -b redis+socket:///run/redis-sourcehut/redis.sock?virtual_host=5 flower
957 + flower
958 # Sourcehut services
959 srht
960 buildsrht
961 @@ -19,69 +95,37 @@ let
962 listssrht
963 mansrht
964 metasrht
965 + # Not a python package
966 + #pagessrht
967 pastesrht
968 todosrht
969 ]);
970 + mkOptionNullOrStr = description: mkOption {
971 + inherit description;
972 + type = with types; nullOr str;
973 + default = null;
974 + };
975 in
976 {
977 - imports =
978 - [
979 - ./git.nix
980 - ./hg.nix
981 - ./hub.nix
982 - ./todo.nix
983 - ./man.nix
984 - ./meta.nix
985 - ./paste.nix
986 - ./builds.nix
987 - ./lists.nix
988 - ./dispatch.nix
989 - (mkRemovedOptionModule [ "services" "sourcehut" "nginx" "enable" ] ''
990 - The sourcehut module supports `nginx` as a local reverse-proxy by default and doesn't
991 - support other reverse-proxies officially.
992 -
993 - However it's possible to use an alternative reverse-proxy by
994 -
995 - * disabling nginx
996 - * adjusting the relevant settings for server addresses and ports directly
997 -
998 - Further details about this can be found in the `Sourcehut`-section of the NixOS-manual.
999 - '')
1000 - ];
1001 -
1002 options.services.sourcehut = {
1003 - enable = mkOption {
1004 - type = types.bool;
1005 - default = false;
1006 - description = ''
1007 - Enable sourcehut - git hosting, continuous integration, mailing list, ticket tracking,
1008 - task dispatching, wiki and account management services
1009 - '';
1010 - };
1011 + enable = mkEnableOption ''
1012 + sourcehut - git hosting, continuous integration, mailing list, ticket tracking,
1013 + task dispatching, wiki and account management services
1014 + '';
1015
1016 services = mkOption {
1017 - type = types.nonEmptyListOf (types.enum [ "builds" "dispatch" "git" "hub" "hg" "lists" "man" "meta" "paste" "todo" ]);
1018 - default = [ "man" "meta" "paste" ];
1019 - example = [ "builds" "dispatch" "git" "hub" "hg" "lists" "man" "meta" "paste" "todo" ];
1020 + type = with types; listOf (enum
1021 + [ "builds" "dispatch" "git" "hg" "hub" "lists" "man" "meta" "pages" "paste" "todo" ]);
1022 + defaultText = "locally enabled services";
1023 description = ''
1024 - Services to enable on the sourcehut network.
1025 + Services that may be displayed as links in the title bar of the Web interface.
1026 '';
1027 };
1028
1029 - originBase = mkOption {
1030 + listenAddress = mkOption {
1031 type = types.str;
1032 - default = with config.networking; hostName + lib.optionalString (domain != null) ".${domain}";
1033 - description = ''
1034 - Host name used by reverse-proxy and for default settings. Will host services at git."''${originBase}". For example: git.sr.ht
1035 - '';
1036 - };
1037 -
1038 - address = mkOption {
1039 - type = types.str;
1040 - default = "127.0.0.1";
1041 - description = ''
1042 - Address to bind to.
1043 - '';
1044 + default = "localhost";
1045 + description = "Address to bind to.";
1046 };
1047
1048 python = mkOption {
1049 @@ -94,105 +138,1212 @@ in
1050 '';
1051 };
1052
1053 - statePath = mkOption {
1054 - type = types.path;
1055 - default = "/var/lib/sourcehut";
1056 - description = ''
1057 - Root state path for the sourcehut network. If left as the default value
1058 - this directory will automatically be created before the sourcehut server
1059 - starts, otherwise the sysadmin is responsible for ensuring the
1060 - directory exists with appropriate ownership and permissions.
1061 - '';
1062 + minio = {
1063 + enable = mkEnableOption ''local minio integration'';
1064 + };
1065 +
1066 + nginx = {
1067 + enable = mkEnableOption ''local nginx integration'';
1068 + virtualHost = mkOption {
1069 + type = types.attrs;
1070 + default = {};
1071 + description = "Virtual-host configuration merged with all Sourcehut's virtual-hosts.";
1072 + };
1073 + };
1074 +
1075 + postfix = {
1076 + enable = mkEnableOption ''local postfix integration'';
1077 + };
1078 +
1079 + postgresql = {
1080 + enable = mkEnableOption ''local postgresql integration'';
1081 + };
1082 +
1083 + redis = {
1084 + enable = mkEnableOption ''local redis integration in a dedicated redis-server'';
1085 };
1086
1087 settings = mkOption {
1088 type = lib.types.submodule {
1089 freeformType = settingsFormat.type;
1090 + options."sr.ht" = {
1091 + global-domain = mkOption {
1092 + description = "Global domain name.";
1093 + type = types.str;
1094 + example = "example.com";
1095 + };
1096 + environment = mkOption {
1097 + description = "Values other than \"production\" adds a banner to each page.";
1098 + type = types.enum [ "development" "production" ];
1099 + default = "development";
1100 + };
1101 + network-key = mkOption {
1102 + description = ''
1103 + An absolute file path (which should be outside the Nix-store)
1104 + to a secret key to encrypt internal messages with. Use <code>srht-keygen network</code> to
1105 + generate this key. It must be consistent between all services and nodes.
1106 + '';
1107 + type = types.path;
1108 + apply = s: "<" + toString s;
1109 + };
1110 + owner-email = mkOption {
1111 + description = "Owner's email.";
1112 + type = types.str;
1113 + default = "contact@example.com";
1114 + };
1115 + owner-name = mkOption {
1116 + description = "Owner's name.";
1117 + type = types.str;
1118 + default = "John Doe";
1119 + };
1120 + site-blurb = mkOption {
1121 + description = "Blurb for your site.";
1122 + type = types.str;
1123 + default = "the hacker's forge";
1124 + };
1125 + site-info = mkOption {
1126 + description = "The top-level info page for your site.";
1127 + type = types.str;
1128 + default = "https://sourcehut.org";
1129 + };
1130 + service-key = mkOption {
1131 + description = ''
1132 + An absolute file path (which should be outside the Nix-store)
1133 + to a key used for encrypting session cookies. Use <code>srht-keygen service</code> to
1134 + generate the service key. This must be shared between each node of the same
1135 + service (e.g. git1.sr.ht and git2.sr.ht), but different services may use
1136 + different keys. If you configure all of your services with the same
1137 + config.ini, you may use the same service-key for all of them.
1138 + '';
1139 + type = types.path;
1140 + apply = s: "<" + toString s;
1141 + };
1142 + site-name = mkOption {
1143 + description = "The name of your network of sr.ht-based sites.";
1144 + type = types.str;
1145 + default = "sourcehut";
1146 + };
1147 + source-url = mkOption {
1148 + description = "The source code for your fork of sr.ht.";
1149 + type = types.str;
1150 + default = "https://git.sr.ht/~sircmpwn/srht";
1151 + };
1152 + };
1153 + options.mail = {
1154 + smtp-host = mkOptionNullOrStr "Outgoing SMTP host.";
1155 + smtp-port = mkOption {
1156 + description = "Outgoing SMTP port.";
1157 + type = with types; nullOr port;
1158 + default = null;
1159 + };
1160 + smtp-user = mkOptionNullOrStr "Outgoing SMTP user.";
1161 + smtp-password = mkOptionNullOrStr "Outgoing SMTP password.";
1162 + smtp-from = mkOptionNullOrStr "Outgoing SMTP FROM.";
1163 + error-to = mkOptionNullOrStr "Address receiving application exceptions";
1164 + error-from = mkOptionNullOrStr "Address sending application exceptions";
1165 + pgp-privkey = mkOptionNullOrStr ''
1166 + An absolute file path (which should be outside the Nix-store)
1167 + to an OpenPGP private key.
1168 +
1169 + Your PGP key information (DO NOT mix up pub and priv here)
1170 + You must remove the password from your secret key, if present.
1171 + You can do this with <code>gpg --edit-key [key-id]</code>,
1172 + then use the <code>passwd</code> command and do not enter a new password.
1173 + '';
1174 + pgp-pubkey = mkOptionNullOrStr "OpenPGP public key.";
1175 + pgp-key-id = mkOptionNullOrStr "OpenPGP key identifier.";
1176 + };
1177 + options.objects = {
1178 + s3-upstream = mkOption {
1179 + description = "Configure the S3-compatible object storage service.";
1180 + type = with types; nullOr str;
1181 + default = null;
1182 + };
1183 + s3-access-key = mkOption {
1184 + description = "Access key to the S3-compatible object storage service";
1185 + type = with types; nullOr str;
1186 + default = null;
1187 + };
1188 + s3-secret-key = mkOption {
1189 + description = ''
1190 + An absolute file path (which should be outside the Nix-store)
1191 + to the secret key of the S3-compatible object storage service.
1192 + '';
1193 + type = with types; nullOr path;
1194 + default = null;
1195 + apply = mapNullable (s: "<" + toString s);
1196 + };
1197 + };
1198 + options.webhooks = {
1199 + private-key = mkOption {
1200 + description = ''
1201 + An absolute file path (which should be outside the Nix-store)
1202 + to a base64-encoded Ed25519 key for signing webhook payloads.
1203 + This should be consistent for all *.sr.ht sites,
1204 + as this key will be used to verify signatures
1205 + from other sites in your network.
1206 + Use the <code>srht-keygen webhook</code> command to generate a key.
1207 + '';
1208 + type = types.path;
1209 + apply = s: "<" + toString s;
1210 + };
1211 + };
1212 +
1213 + options."dispatch.sr.ht" = commonServiceSettings "dispatch" // {
1214 + };
1215 + options."dispatch.sr.ht::github" = {
1216 + oauth-client-id = mkOptionNullOrStr "OAuth client id.";
1217 + oauth-client-secret = mkOptionNullOrStr "OAuth client secret.";
1218 + };
1219 + options."dispatch.sr.ht::gitlab" = {
1220 + enabled = mkEnableOption "GitLab integration";
1221 + canonical-upstream = mkOption {
1222 + type = types.str;
1223 + description = "Canonical upstream.";
1224 + default = "gitlab.com";
1225 + };
1226 + repo-cache = mkOption {
1227 + type = types.str;
1228 + description = "Repository cache directory.";
1229 + default = "./repo-cache";
1230 + };
1231 + "gitlab.com" = mkOption {
1232 + type = with types; nullOr str;
1233 + description = "GitLab id and secret.";
1234 + default = null;
1235 + example = "GitLab:application id:secret";
1236 + };
1237 + };
1238 +
1239 + options."builds.sr.ht" = commonServiceSettings "builds" // {
1240 + allow-free = mkEnableOption "nonpaying users to submit builds";
1241 + redis = mkOption {
1242 + description = "The Redis connection used for the Celery worker.";
1243 + type = types.str;
1244 + default = "redis+socket:///run/redis-sourcehut-buildsrht/redis.sock?virtual_host=2";
1245 + };
1246 + shell = mkOption {
1247 + description = ''
1248 + Scripts used to launch on SSH connection.
1249 + <literal>/usr/bin/master-shell</literal> on master,
1250 + <literal>/usr/bin/runner-shell</literal> on runner.
1251 + If master and worker are on the same system
1252 + set to <literal>/usr/bin/runner-shell</literal>.
1253 + '';
1254 + type = types.enum ["/usr/bin/master-shell" "/usr/bin/runner-shell"];
1255 + default = "/usr/bin/master-shell";
1256 + };
1257 + };
1258 + options."builds.sr.ht::worker" = {
1259 + bind-address = mkOption {
1260 + description = ''
1261 + HTTP bind address for serving local build information/monitoring.
1262 + '';
1263 + type = types.str;
1264 + default = "localhost:8080";
1265 + };
1266 + buildlogs = mkOption {
1267 + description = "Path to write build logs.";
1268 + type = types.str;
1269 + default = "/var/log/sourcehut/buildsrht";
1270 + };
1271 + name = mkOption {
1272 + description = ''
1273 + Listening address and listening port
1274 + of the build runner (with HTTP port if not 80).
1275 + '';
1276 + type = types.str;
1277 + default = "localhost:5020";
1278 + };
1279 + timeout = mkOption {
1280 + description = ''
1281 + Max build duration.
1282 + See <link xlink:href="https://golang.org/pkg/time/#ParseDuration"/>.
1283 + '';
1284 + type = types.str;
1285 + default = "3m";
1286 + };
1287 + };
1288 +
1289 + options."git.sr.ht" = commonServiceSettings "git" // {
1290 + outgoing-domain = mkOption {
1291 + description = "Outgoing domain.";
1292 + type = types.str;
1293 + default = "https://git.localhost.localdomain";
1294 + };
1295 + post-update-script = mkOption {
1296 + description = ''
1297 + A post-update script which is installed in every git repo.
1298 + This setting is propagated to newer and existing repositories.
1299 + '';
1300 + type = types.path;
1301 + default = "${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook";
1302 + defaultText = "\${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook";
1303 + # Git hooks are run relative to their repository's directory,
1304 + # but gitsrht-update-hook looks up ../config.ini
1305 + apply = p: pkgs.writeShellScript "update-hook-wrapper" ''
1306 + set -e
1307 + test -e "''${PWD%/*}"/config.ini ||
1308 + ln -s /run/sourcehut/gitsrht/config.ini "''${PWD%/*}"/config.ini
1309 + exec -a "$0" '${p}' "$@"
1310 + '';
1311 + };
1312 + repos = mkOption {
1313 + description = ''
1314 + Path to git repositories on disk.
1315 + If changing the default, you must ensure that
1316 + the gitsrht's user as read and write access to it.
1317 + '';
1318 + type = types.str;
1319 + default = "/var/lib/sourcehut/gitsrht/repos";
1320 + };
1321 + webhooks = mkOption {
1322 + description = "The Redis connection used for the webhooks worker.";
1323 + type = types.str;
1324 + default = "redis+socket:///run/redis-sourcehut-gitsrht/redis.sock?virtual_host=1";
1325 + };
1326 + };
1327 + options."git.sr.ht::api" = {
1328 + internal-ipnet = mkOption {
1329 + description = ''
1330 + Set of IP subnets which are permitted to utilize internal API
1331 + authentication. This should be limited to the subnets
1332 + from which your *.sr.ht services are running.
1333 + See <xref linkend="opt-services.sourcehut.listenAddress"/>.
1334 + '';
1335 + type = with types; listOf str;
1336 + default = [ "127.0.0.0/8" "::1/128" ];
1337 + };
1338 + };
1339 +
1340 + options."hg.sr.ht" = commonServiceSettings "hg" // {
1341 + changegroup-script = mkOption {
1342 + description = ''
1343 + A changegroup script which is installed in every mercurial repo.
1344 + This setting is propagated to newer and existing repositories.
1345 + '';
1346 + type = types.str;
1347 + default = "${cfg.python}/bin/hgsrht-hook-changegroup";
1348 + defaultText = "\${cfg.python}/bin/hgsrht-hook-changegroup";
1349 + # Mercurial's changegroup hooks are run relative to their repository's directory,
1350 + # but hgsrht-hook-changegroup looks up ./config.ini
1351 + apply = p: pkgs.writeShellScript "hook-changegroup-wrapper" ''
1352 + set -e
1353 + test -e "''$PWD"/config.ini ||
1354 + ln -s /run/sourcehut/hgsrht/config.ini "''$PWD"/config.ini
1355 + exec -a "$0" '${p}' "$@"
1356 + '';
1357 + };
1358 + repos = mkOption {
1359 + description = ''
1360 + Path to mercurial repositories on disk.
1361 + If changing the default, you must ensure that
1362 + the hgsrht's user as read and write access to it.
1363 + '';
1364 + type = types.str;
1365 + default = "/var/lib/sourcehut/hgsrht/repos";
1366 + };
1367 + srhtext = mkOptionNullOrStr ''
1368 + Path to the srht mercurial extension
1369 + (defaults to where the hgsrht code is)
1370 + '';
1371 + clone_bundle_threshold = mkOption {
1372 + description = ".hg/store size (in MB) past which the nightly job generates clone bundles.";
1373 + type = types.ints.unsigned;
1374 + default = 50;
1375 + };
1376 + hg_ssh = mkOption {
1377 + description = "Path to hg-ssh (if not in $PATH).";
1378 + type = types.str;
1379 + default = "${pkgs.mercurial}/bin/hg-ssh";
1380 + defaultText = "\${pkgs.mercurial}/bin/hg-ssh";
1381 + };
1382 + webhooks = mkOption {
1383 + description = "The Redis connection used for the webhooks worker.";
1384 + type = types.str;
1385 + default = "redis+socket:///run/redis-sourcehut-hgsrht/redis.sock?virtual_host=1";
1386 + };
1387 + };
1388 +
1389 + options."hub.sr.ht" = commonServiceSettings "hub" // {
1390 + };
1391 +
1392 + options."lists.sr.ht" = commonServiceSettings "lists" // {
1393 + allow-new-lists = mkEnableOption "Allow creation of new lists.";
1394 + notify-from = mkOption {
1395 + description = "Outgoing email for notifications generated by users.";
1396 + type = types.str;
1397 + default = "lists-notify@localhost.localdomain";
1398 + };
1399 + posting-domain = mkOption {
1400 + description = "Posting domain.";
1401 + type = types.str;
1402 + default = "lists.localhost.localdomain";
1403 + };
1404 + redis = mkOption {
1405 + description = "The Redis connection used for the Celery worker.";
1406 + type = types.str;
1407 + default = "redis+socket:///run/redis-sourcehut-listssrht/redis.sock?virtual_host=2";
1408 + };
1409 + webhooks = mkOption {
1410 + description = "The Redis connection used for the webhooks worker.";
1411 + type = types.str;
1412 + default = "redis+socket:///run/redis-sourcehut-listssrht/redis.sock?virtual_host=1";
1413 + };
1414 + };
1415 + options."lists.sr.ht::worker" = {
1416 + reject-mimetypes = mkOption {
1417 + description = ''
1418 + Comma-delimited list of Content-Types to reject. Messages with Content-Types
1419 + included in this list are rejected. Multipart messages are always supported,
1420 + and each part is checked against this list.
1421 +
1422 + Uses fnmatch for wildcard expansion.
1423 + '';
1424 + type = with types; listOf str;
1425 + default = ["text/html"];
1426 + };
1427 + reject-url = mkOption {
1428 + description = "Reject URL.";
1429 + type = types.str;
1430 + default = "https://man.sr.ht/lists.sr.ht/etiquette.md";
1431 + };
1432 + sock = mkOption {
1433 + description = ''
1434 + Path for the lmtp daemon's unix socket. Direct incoming mail to this socket.
1435 + Alternatively, specify IP:PORT and an SMTP server will be run instead.
1436 + '';
1437 + type = types.str;
1438 + default = "/tmp/lists.sr.ht-lmtp.sock";
1439 + };
1440 + sock-group = mkOption {
1441 + description = ''
1442 + The lmtp daemon will make the unix socket group-read/write
1443 + for users in this group.
1444 + '';
1445 + type = types.str;
1446 + default = "postfix";
1447 + };
1448 + };
1449 +
1450 + options."man.sr.ht" = commonServiceSettings "man" // {
1451 + };
1452 +
1453 + options."meta.sr.ht" =
1454 + removeAttrs (commonServiceSettings "meta")
1455 + ["oauth-client-id" "oauth-client-secret"] // {
1456 + api-origin = mkOption {
1457 + description = "Origin URL for API, 100 more than web.";
1458 + type = types.str;
1459 + default = "http://${cfg.listenAddress}:${toString (cfg.meta.port + 100)}";
1460 + defaultText = ''http://<xref linkend="opt-services.sourcehut.listenAddress"/>:''${toString (<xref linkend="opt-services.sourcehut.meta.port"/> + 100)}'';
1461 + };
1462 + webhooks = mkOption {
1463 + description = "The Redis connection used for the webhooks worker.";
1464 + type = types.str;
1465 + default = "redis+socket:///run/redis-sourcehut-metasrht/redis.sock?virtual_host=1";
1466 + };
1467 + welcome-emails = mkEnableOption "sending stock sourcehut welcome emails after signup";
1468 + };
1469 + options."meta.sr.ht::api" = {
1470 + internal-ipnet = mkOption {
1471 + description = ''
1472 + Set of IP subnets which are permitted to utilize internal API
1473 + authentication. This should be limited to the subnets
1474 + from which your *.sr.ht services are running.
1475 + See <xref linkend="opt-services.sourcehut.listenAddress"/>.
1476 + '';
1477 + type = with types; listOf str;
1478 + default = [ "127.0.0.0/8" "::1/128" ];
1479 + };
1480 + };
1481 + options."meta.sr.ht::aliases" = mkOption {
1482 + description = "Aliases for the client IDs of commonly used OAuth clients.";
1483 + type = with types; attrsOf int;
1484 + default = {};
1485 + example = { "git.sr.ht" = 12345; };
1486 + };
1487 + options."meta.sr.ht::billing" = {
1488 + enabled = mkEnableOption "the billing system";
1489 + stripe-public-key = mkOptionNullOrStr "Public key for Stripe. Get your keys at https://dashboard.stripe.com/account/apikeys";
1490 + stripe-secret-key = mkOptionNullOrStr ''
1491 + An absolute file path (which should be outside the Nix-store)
1492 + to a secret key for Stripe. Get your keys at https://dashboard.stripe.com/account/apikeys
1493 + '' // {
1494 + apply = mapNullable (s: "<" + toString s);
1495 + };
1496 + };
1497 + options."meta.sr.ht::settings" = {
1498 + registration = mkEnableOption "public registration";
1499 + onboarding-redirect = mkOption {
1500 + description = "Where to redirect new users upon registration.";
1501 + type = types.str;
1502 + default = "https://meta.localhost.localdomain";
1503 + };
1504 + user-invites = mkOption {
1505 + description = ''
1506 + How many invites each user is issued upon registration
1507 + (only applicable if open registration is disabled).
1508 + '';
1509 + type = types.ints.unsigned;
1510 + default = 5;
1511 + };
1512 + };
1513 +
1514 + options."pages.sr.ht" = commonServiceSettings "pages" // {
1515 + gemini-certs = mkOption {
1516 + description = ''
1517 + An absolute file path (which should be outside the Nix-store)
1518 + to Gemini certificates.
1519 + '';
1520 + type = with types; nullOr path;
1521 + default = null;
1522 + };
1523 + max-site-size = mkOption {
1524 + description = "Maximum size of any given site (post-gunzip), in MiB.";
1525 + type = types.int;
1526 + default = 1024;
1527 + };
1528 + user-domain = mkOption {
1529 + description = ''
1530 + Configures the user domain, if enabled.
1531 + All users are given &lt;username&gt;.this.domain.
1532 + '';
1533 + type = with types; nullOr str;
1534 + default = null;
1535 + };
1536 + };
1537 + options."pages.sr.ht::api" = {
1538 + internal-ipnet = mkOption {
1539 + description = ''
1540 + Set of IP subnets which are permitted to utilize internal API
1541 + authentication. This should be limited to the subnets
1542 + from which your *.sr.ht services are running.
1543 + See <xref linkend="opt-services.sourcehut.listenAddress"/>.
1544 + '';
1545 + type = with types; listOf str;
1546 + default = [ "127.0.0.0/8" "::1/128" ];
1547 + };
1548 + };
1549 +
1550 + options."paste.sr.ht" = commonServiceSettings "paste" // {
1551 + };
1552 +
1553 + options."todo.sr.ht" = commonServiceSettings "todo" // {
1554 + notify-from = mkOption {
1555 + description = "Outgoing email for notifications generated by users.";
1556 + type = types.str;
1557 + default = "todo-notify@localhost.localdomain";
1558 + };
1559 + webhooks = mkOption {
1560 + description = "The Redis connection used for the webhooks worker.";
1561 + type = types.str;
1562 + default = "redis+socket:///run/redis-sourcehut-todosrht/redis.sock?virtual_host=1";
1563 + };
1564 + };
1565 + options."todo.sr.ht::mail" = {
1566 + posting-domain = mkOption {
1567 + description = "Posting domain.";
1568 + type = types.str;
1569 + default = "todo.localhost.localdomain";
1570 + };
1571 + sock = mkOption {
1572 + description = ''
1573 + Path for the lmtp daemon's unix socket. Direct incoming mail to this socket.
1574 + Alternatively, specify IP:PORT and an SMTP server will be run instead.
1575 + '';
1576 + type = types.str;
1577 + default = "/tmp/todo.sr.ht-lmtp.sock";
1578 + };
1579 + sock-group = mkOption {
1580 + description = ''
1581 + The lmtp daemon will make the unix socket group-read/write
1582 + for users in this group.
1583 + '';
1584 + type = types.str;
1585 + default = "postfix";
1586 + };
1587 + };
1588 };
1589 default = { };
1590 description = ''
1591 The configuration for the sourcehut network.
1592 '';
1593 };
1594 - };
1595
1596 - config = mkIf cfg.enable {
1597 - assertions =
1598 - [
1599 - {
1600 - assertion = with cfgIni.webhooks; private-key != null && stringLength private-key == 44;
1601 - message = "The webhook's private key must be defined and of a 44 byte length.";
1602 - }
1603 + builds = {
1604 + enableWorker = mkEnableOption "worker for builds.sr.ht";
1605
1606 - {
1607 - assertion = hasAttrByPath [ "meta.sr.ht" "origin" ] cfgIni && cfgIni."meta.sr.ht".origin != null;
1608 - message = "meta.sr.ht's origin must be defined.";
1609 - }
1610 - ];
1611 + images = mkOption {
1612 + type = with types; attrsOf (attrsOf (attrsOf package));
1613 + default = { };
1614 + example = lib.literalExample ''(let
1615 + # Pinning unstable to allow usage with flakes and limit rebuilds.
1616 + pkgs_unstable = builtins.fetchGit {
1617 + url = "https://github.com/NixOS/nixpkgs";
1618 + rev = "ff96a0fa5635770390b184ae74debea75c3fd534";
1619 + ref = "nixos-unstable";
1620 + };
1621 + image_from_nixpkgs = (import ("${pkgs.sourcehut.buildsrht}/lib/images/nixos/image.nix") {
1622 + pkgs = (import pkgs_unstable {});
1623 + });
1624 + in
1625 + {
1626 + nixos.unstable.x86_64 = image_from_nixpkgs;
1627 + }
1628 + )'';
1629 + description = ''
1630 + Images for builds.sr.ht. Each package should be distro.release.arch and point to a /nix/store/package/root.img.qcow2.
1631 + '';
1632 + };
1633 + };
1634
1635 - virtualisation.docker.enable = true;
1636 - environment.etc."sr.ht/config.ini".source =
1637 - settingsFormat.generate "sourcehut-config.ini" (mapAttrsRecursive
1638 - (
1639 - path: v: if v == null then "" else v
1640 - )
1641 - cfg.settings);
1642 + git = {
1643 + package = mkOption {
1644 + type = types.package;
1645 + default = pkgs.git;
1646 + example = literalExample "pkgs.gitFull";
1647 + description = ''
1648 + Git package for git.sr.ht. This can help silence collisions.
1649 + '';
1650 + };
1651 + fcgiwrap.preforkProcess = mkOption {
1652 + description = "Number of fcgiwrap processes to prefork.";
1653 + type = types.int;
1654 + default = 4;
1655 + };
1656 + };
1657
1658 - environment.systemPackages = [ pkgs.sourcehut.coresrht ];
1659 + hg = {
1660 + package = mkOption {
1661 + type = types.package;
1662 + default = pkgs.mercurial;
1663 + description = ''
1664 + Mercurial package for hg.sr.ht. This can help silence collisions.
1665 + '';
1666 + };
1667 + cloneBundles = mkOption {
1668 + type = types.bool;
1669 + default = false;
1670 + description = ''
1671 + Generate clonebundles (which require more disk space but dramatically speed up cloning large repositories).
1672 + '';
1673 + };
1674 + };
1675
1676 - # PostgreSQL server
1677 - services.postgresql.enable = mkOverride 999 true;
1678 - # Mail server
1679 - services.postfix.enable = mkOverride 999 true;
1680 - # Cron daemon
1681 - services.cron.enable = mkOverride 999 true;
1682 - # Redis server
1683 - services.redis.enable = mkOverride 999 true;
1684 - services.redis.bind = mkOverride 999 "127.0.0.1";
1685 -
1686 - services.sourcehut.settings = {
1687 - # The name of your network of sr.ht-based sites
1688 - "sr.ht".site-name = mkDefault "sourcehut";
1689 - # The top-level info page for your site
1690 - "sr.ht".site-info = mkDefault "https://sourcehut.org";
1691 - # {{ site-name }}, {{ site-blurb }}
1692 - "sr.ht".site-blurb = mkDefault "the hacker's forge";
1693 - # If this != production, we add a banner to each page
1694 - "sr.ht".environment = mkDefault "development";
1695 - # Contact information for the site owners
1696 - "sr.ht".owner-name = mkDefault "Drew DeVault";
1697 - "sr.ht".owner-email = mkDefault "sir@cmpwn.com";
1698 - # The source code for your fork of sr.ht
1699 - "sr.ht".source-url = mkDefault "https://git.sr.ht/~sircmpwn/srht";
1700 - # A secret key to encrypt session cookies with
1701 - "sr.ht".secret-key = mkDefault null;
1702 - "sr.ht".global-domain = mkDefault null;
1703 -
1704 - # Outgoing SMTP settings
1705 - mail.smtp-host = mkDefault null;
1706 - mail.smtp-port = mkDefault null;
1707 - mail.smtp-user = mkDefault null;
1708 - mail.smtp-password = mkDefault null;
1709 - mail.smtp-from = mkDefault null;
1710 - # Application exceptions are emailed to this address
1711 - mail.error-to = mkDefault null;
1712 - mail.error-from = mkDefault null;
1713 - # Your PGP key information (DO NOT mix up pub and priv here)
1714 - # You must remove the password from your secret key, if present.
1715 - # You can do this with gpg --edit-key [key-id], then use the passwd
1716 - # command and do not enter a new password.
1717 - mail.pgp-privkey = mkDefault null;
1718 - mail.pgp-pubkey = mkDefault null;
1719 - mail.pgp-key-id = mkDefault null;
1720 -
1721 - # base64-encoded Ed25519 key for signing webhook payloads. This should be
1722 - # consistent for all *.sr.ht sites, as we'll use this key to verify signatures
1723 - # from other sites in your network.
1724 - #
1725 - # Use the srht-webhook-keygen command to generate a key.
1726 - webhooks.private-key = mkDefault null;
1727 + lists = {
1728 + process = {
1729 + extraArgs = mkOption {
1730 + type = with types; listOf str;
1731 + default = [ "--loglevel DEBUG" "--pool eventlet" "--without-heartbeat" ];
1732 + description = "Extra arguments passed to the Celery responsible for processing mails.";
1733 + };
1734 + celeryConfig = mkOption {
1735 + type = types.lines;
1736 + default = "";
1737 + description = "Content of the <literal>celeryconfig.py</literal> used by the Celery of <literal>listssrht-process</literal>.";
1738 + };
1739 + };
1740 };
1741 };
1742 +
1743 + config = mkIf cfg.enable (mkMerge [
1744 + {
1745 + environment.systemPackages = [ pkgs.sourcehut.coresrht ];
1746 +
1747 + services.sourcehut.settings = {
1748 + "git.sr.ht".outgoing-domain = mkDefault "https://git.${domain}";
1749 + "lists.sr.ht".notify-from = mkDefault "lists-notify@${domain}";
1750 + "lists.sr.ht".posting-domain = mkDefault "lists.${domain}";
1751 + "meta.sr.ht::settings".onboarding-redirect = mkDefault "https://meta.${domain}";
1752 + "todo.sr.ht".notify-from = mkDefault "todo-notify@${domain}";
1753 + "todo.sr.ht::mail".posting-domain = mkDefault "todo.${domain}";
1754 + };
1755 + }
1756 + (mkIf cfg.postgresql.enable {
1757 + assertions = [
1758 + { assertion = postgresql.enable;
1759 + message = "postgresql must be enabled and configured";
1760 + }
1761 + ];
1762 + })
1763 + (mkIf cfg.postfix.enable {
1764 + assertions = [
1765 + { assertion = postfix.enable;
1766 + message = "postfix must be enabled and configured";
1767 + }
1768 + ];
1769 + # Needed for sharing the LMTP sockets with JoinsNamespaceOf=
1770 + systemd.services.postfix.serviceConfig.PrivateTmp = true;
1771 + })
1772 + (mkIf cfg.redis.enable {
1773 + services.redis.vmOverCommit = mkDefault true;
1774 + })
1775 + (mkIf cfg.nginx.enable {
1776 + assertions = [
1777 + { assertion = nginx.enable;
1778 + message = "nginx must be enabled and configured";
1779 + }
1780 + ];
1781 + # For proxyPass= in virtual-hosts for Sourcehut services.
1782 + services.nginx.recommendedProxySettings = mkDefault true;
1783 + })
1784 + (mkIf (cfg.builds.enable || cfg.git.enable || cfg.hg.enable) {
1785 + services.openssh = {
1786 + # Note that sshd will continue to honor AuthorizedKeysFile.
1787 + # Note that you may want automatically rotate
1788 + # or link to /dev/null the following log files:
1789 + # - /var/log/gitsrht-dispatch
1790 + # - /var/log/{build,git,hg}srht-keys
1791 + # - /var/log/{git,hg}srht-shell
1792 + # - /var/log/gitsrht-update-hook
1793 + authorizedKeysCommand = ''/etc/ssh/sourcehut/subdir/srht-dispatch "%u" "%h" "%t" "%k"'';
1794 + # srht-dispatch will setuid/setgid according to [git.sr.ht::dispatch]
1795 + authorizedKeysCommandUser = "root";
1796 + extraConfig = ''
1797 + PermitUserEnvironment SRHT_*
1798 + '';
1799 + };
1800 + environment.etc."ssh/sourcehut/config.ini".source =
1801 + settingsFormat.generate "sourcehut-dispatch-config.ini"
1802 + (filterAttrs (k: v: k == "git.sr.ht::dispatch")
1803 + cfg.settings);
1804 + environment.etc."ssh/sourcehut/subdir/srht-dispatch" = {
1805 + # sshd_config(5): The program must be owned by root, not writable by group or others
1806 + mode = "0755";
1807 + source = pkgs.writeShellScript "srht-dispatch" ''
1808 + set -e
1809 + cd /etc/ssh/sourcehut/subdir
1810 + ${cfg.python}/bin/gitsrht-dispatch "$@"
1811 + '';
1812 + };
1813 + systemd.services.sshd = {
1814 + #path = optional cfg.git.enable [ cfg.git.package ];
1815 + serviceConfig = {
1816 + BindReadOnlyPaths =
1817 + # Note that those /usr/bin/* paths are hardcoded in multiple places in *.sr.ht,
1818 + # for instance to get the user from the [git.sr.ht::dispatch] settings.
1819 + # *srht-keys needs to:
1820 + # - access a redis-server in [sr.ht] redis-host,
1821 + # - access the PostgreSQL server in [*.sr.ht] connection-string,
1822 + # - query metasrht-api (through the HTTP API).
1823 + # Using this has the side effect of creating empty files in /usr/bin/
1824 + optionals cfg.builds.enable [
1825 + "${pkgs.writeShellScript "buildsrht-keys-wrapper" ''
1826 + set -ex
1827 + cd /run/sourcehut/buildsrht/subdir
1828 + exec -a "$0" ${pkgs.sourcehut.buildsrht}/bin/buildsrht-keys "$@"
1829 + ''}:/usr/bin/buildsrht-keys"
1830 + "${pkgs.sourcehut.buildsrht}/bin/master-shell:/usr/bin/master-shell"
1831 + "${pkgs.sourcehut.buildsrht}/bin/runner-shell:/usr/bin/runner-shell"
1832 + ] ++
1833 + optionals cfg.git.enable [
1834 + # /path/to/gitsrht-keys calls /path/to/gitsrht-shell,
1835 + # or [git.sr.ht] shell= if set.
1836 + "${pkgs.writeShellScript "gitsrht-keys-wrapper" ''
1837 + set -ex
1838 + cd /run/sourcehut/gitsrht/subdir
1839 + exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-keys "$@"
1840 + ''}:/usr/bin/gitsrht-keys"
1841 + "${pkgs.writeShellScript "gitsrht-shell-wrapper" ''
1842 + set -e
1843 + cd /run/sourcehut/gitsrht/subdir
1844 + exec -a "$0" ${pkgs.sourcehut.gitsrht}/bin/gitsrht-shell "$@"
1845 + ''}:/usr/bin/gitsrht-shell"
1846 + ] ++
1847 + optionals cfg.hg.enable [
1848 + # /path/to/hgsrht-keys calls /path/to/hgsrht-shell,
1849 + # or [hg.sr.ht] shell= if set.
1850 + "${pkgs.writeShellScript "hgsrht-keys-wrapper" ''
1851 + set -ex
1852 + cd /run/sourcehut/hgsrht/subdir
1853 + exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-keys "$@"
1854 + ''}:/usr/bin/hgsrht-keys"
1855 + ":/usr/bin/hgsrht-shell"
1856 + "${pkgs.writeShellScript "hgsrht-shell-wrapper" ''
1857 + set -e
1858 + cd /run/sourcehut/hgsrht/subdir
1859 + exec -a "$0" ${pkgs.sourcehut.hgsrht}/bin/hgsrht-shell "$@"
1860 + ''}:/usr/bin/hgsrht-shell"
1861 + ];
1862 + };
1863 + };
1864 + })
1865 + ]);
1866 +
1867 + imports = [
1868 +
1869 + (import ./service.nix "builds" {
1870 + inherit configIniOfService;
1871 + srvsrht = "buildsrht";
1872 + port = 5002;
1873 + # TODO: a celery worker on the master and worker are apparently needed
1874 + extraServices.buildsrht-worker = let
1875 + qemuPackage = pkgs.qemu_kvm;
1876 + serviceName = "buildsrht-worker";
1877 + statePath = "/var/lib/sourcehut/${serviceName}";
1878 + in mkIf cfg.builds.enableWorker {
1879 + path = [ pkgs.openssh pkgs.docker ];
1880 + preStart = ''
1881 + set -x
1882 + if test -z "$(docker images -q qemu:latest 2>/dev/null)" \
1883 + || test "$(cat ${statePath}/docker-image-qemu)" != "${qemuPackage.version}"
1884 + then
1885 + # Create and import qemu:latest image for docker
1886 + ${pkgs.dockerTools.streamLayeredImage {
1887 + name = "qemu";
1888 + tag = "latest";
1889 + contents = [ qemuPackage ];
1890 + }} | docker load
1891 + # Mark down current package version
1892 + echo '${qemuPackage.version}' >${statePath}/docker-image-qemu
1893 + fi
1894 + '';
1895 + serviceConfig = {
1896 + ExecStart = "${pkgs.sourcehut.buildsrht}/bin/builds.sr.ht-worker";
1897 + RuntimeDirectory = [ "sourcehut/${serviceName}/subdir" ];
1898 + # builds.sr.ht-worker looks up ../config.ini
1899 + LogsDirectory = [ "sourcehut/${serviceName}" ];
1900 + StateDirectory = [ "sourcehut/${serviceName}" ];
1901 + WorkingDirectory = "-"+"/run/sourcehut/${serviceName}/subdir";
1902 + };
1903 + };
1904 + extraConfig = let
1905 + image_dirs = flatten (
1906 + mapAttrsToList (distro: revs:
1907 + mapAttrsToList (rev: archs:
1908 + mapAttrsToList (arch: image:
1909 + pkgs.runCommand "buildsrht-images" { } ''
1910 + mkdir -p $out/${distro}/${rev}/${arch}
1911 + ln -s ${image}/*.qcow2 $out/${distro}/${rev}/${arch}/root.img.qcow2
1912 + ''
1913 + ) archs
1914 + ) revs
1915 + ) cfg.builds.images
1916 + );
1917 + image_dir_pre = pkgs.symlinkJoin {
1918 + name = "builds.sr.ht-worker-images-pre";
1919 + paths = image_dirs;
1920 + # FIXME: not working, apparently because ubuntu/latest is a broken link
1921 + # ++ [ "${pkgs.sourcehut.buildsrht}/lib/images" ];
1922 + };
1923 + image_dir = pkgs.runCommand "builds.sr.ht-worker-images" { } ''
1924 + mkdir -p $out/images
1925 + cp -Lr ${image_dir_pre}/* $out/images
1926 + '';
1927 + in mkMerge [
1928 + {
1929 + users.users.${cfg.builds.user}.shell = pkgs.bash;
1930 +
1931 + virtualisation.docker.enable = true;
1932 +
1933 + services.sourcehut.settings = mkMerge [
1934 + { # Note that git.sr.ht::dispatch is not a typo,
1935 + # gitsrht-dispatch always use this section
1936 + "git.sr.ht::dispatch"."/usr/bin/buildsrht-keys" =
1937 + mkDefault "${cfg.builds.user}:${cfg.builds.group}";
1938 + }
1939 + (mkIf cfg.builds.enableWorker {
1940 + "builds.sr.ht::worker".shell = "/usr/bin/runner-shell";
1941 + "builds.sr.ht::worker".images = mkDefault "${image_dir}/images";
1942 + "builds.sr.ht::worker".controlcmd = mkDefault "${image_dir}/images/control";
1943 + })
1944 + ];
1945 + }
1946 + (mkIf cfg.builds.enableWorker {
1947 + users.groups = {
1948 + docker.members = [ cfg.builds.user ];
1949 + };
1950 + })
1951 + (mkIf (cfg.builds.enableWorker && cfg.nginx.enable) {
1952 + # Allow nginx access to buildlogs
1953 + users.users.${nginx.user}.extraGroups = [ cfg.builds.group ];
1954 + systemd.services.nginx = {
1955 + serviceConfig.BindReadOnlyPaths = [ "${cfg.settings."builds.sr.ht::worker".buildlogs}:/var/log/nginx/buildsrht/logs" ];
1956 + };
1957 + services.nginx.virtualHosts."logs.${domain}" = mkMerge [ {
1958 + /* FIXME: is a listen needed?
1959 + listen = with builtins;
1960 + # FIXME: not compatible with IPv6
1961 + let address = split ":" cfg.settings."builds.sr.ht::worker".name; in
1962 + [{ addr = elemAt address 0; port = lib.toInt (elemAt address 2); }];
1963 + */
1964 + locations."/logs/".alias = "/var/log/nginx/buildsrht/logs/";
1965 + } cfg.nginx.virtualHost ];
1966 + })
1967 + ];
1968 + })
1969 +
1970 + (import ./service.nix "dispatch" {
1971 + inherit configIniOfService;
1972 + port = 5005;
1973 + })
1974 +
1975 + (import ./service.nix "git" (let
1976 + baseService = {
1977 + path = [ cfg.git.package ];
1978 + serviceConfig.BindPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/gitsrht/repos" ];
1979 + serviceConfig.BindReadOnlyPaths = [ "${cfg.settings."git.sr.ht".post-update-script}:/var/lib/sourcehut/gitsrht/bin/post-update-script" ];
1980 + };
1981 + in {
1982 + inherit configIniOfService;
1983 + mainService = mkMerge [ baseService {
1984 + serviceConfig.StateDirectory = [ "sourcehut/gitsrht" "sourcehut/gitsrht/repos" ];
1985 + } ];
1986 + port = 5001;
1987 + webhooks = true;
1988 + extraTimers.gitsrht-periodic = {
1989 + service = baseService;
1990 + timerConfig.OnCalendar = ["20min"];
1991 + };
1992 + extraConfig = mkMerge [
1993 + {
1994 + # https://stackoverflow.com/questions/22314298/git-push-results-in-fatal-protocol-error-bad-line-length-character-this
1995 + # Probably could use gitsrht-shell if output is restricted to just parameters...
1996 + users.users.${cfg.git.user}.shell = pkgs.bash;
1997 + services.sourcehut.settings = {
1998 + "git.sr.ht::dispatch"."/usr/bin/gitsrht-keys" =
1999 + mkDefault "${cfg.git.user}:${cfg.git.group}";
2000 + };
2001 + systemd.services.sshd = baseService;
2002 + }
2003 + (mkIf cfg.nginx.enable {
2004 + services.nginx.virtualHosts."git.${domain}" = {
2005 + locations."/authorize" = {
2006 + proxyPass = "http://${cfg.listenAddress}:${toString cfg.git.port}";
2007 + extraConfig = ''
2008 + proxy_pass_request_body off;
2009 + proxy_set_header Content-Length "";
2010 + proxy_set_header X-Original-URI $request_uri;
2011 + '';
2012 + };
2013 + locations."~ ^/([^/]+)/([^/]+)/(HEAD|info/refs|objects/info/.*|git-upload-pack).*$" = {
2014 + root = "/var/lib/sourcehut/gitsrht/repos";
2015 + fastcgiParams = {
2016 + GIT_HTTP_EXPORT_ALL = "";
2017 + GIT_PROJECT_ROOT = "$document_root";
2018 + PATH_INFO = "$uri";
2019 + SCRIPT_FILENAME = "${cfg.git.package}/bin/git-http-backend";
2020 + };
2021 + extraConfig = ''
2022 + auth_request /authorize;
2023 + fastcgi_read_timeout 500s;
2024 + fastcgi_pass unix:/run/gitsrht-fcgiwrap.sock;
2025 + gzip off;
2026 + '';
2027 + };
2028 + };
2029 + systemd.sockets.gitsrht-fcgiwrap = {
2030 + before = [ "nginx.service" ];
2031 + wantedBy = [ "sockets.target" "gitsrht.service" ];
2032 + # This path remains accessible to nginx.service, which has no RootDirectory=
2033 + socketConfig.ListenStream = "/run/gitsrht-fcgiwrap.sock";
2034 + socketConfig.SocketUser = nginx.user;
2035 + socketConfig.SocketMode = "600";
2036 + };
2037 + })
2038 + ];
2039 + extraServices.gitsrht-fcgiwrap = mkIf cfg.nginx.enable {
2040 + serviceConfig = {
2041 + # Socket is passed by gitsrht-fcgiwrap.socket
2042 + ExecStart = "${pkgs.fcgiwrap}/sbin/fcgiwrap -c ${toString cfg.git.fcgiwrap.preforkProcess}";
2043 + # No need for config.ini
2044 + ExecStartPre = mkForce [];
2045 + User = null;
2046 + DynamicUser = true;
2047 + BindReadOnlyPaths = [ "${cfg.settings."git.sr.ht".repos}:/var/lib/sourcehut/gitsrht/repos" ];
2048 + IPAddressDeny = "any";
2049 + InaccessiblePaths = [ "-+/run/postgresql" "-+/run/redis-sourcehut" ];
2050 + PrivateNetwork = true;
2051 + RestrictAddressFamilies = mkForce [ "none" ];
2052 + SystemCallFilter = mkForce [
2053 + "@system-service"
2054 + "~@aio" "~@keyring" "~@memlock" "~@privileged" "~@resources" "~@setuid"
2055 + # @timer is needed for alarm()
2056 + ];
2057 + };
2058 + };
2059 + }))
2060 +
2061 + (import ./service.nix "hg" (let
2062 + baseService = {
2063 + path = [ cfg.hg.package ];
2064 + serviceConfig.BindPaths = [ "${cfg.settings."hg.sr.ht".repos}:/var/lib/sourcehut/hgsrht/repos" ];
2065 + serviceConfig.BindReadOnlyPaths = [ "${cfg.settings."ht.sr.ht".changegroup-script}:/var/lib/sourcehut/hgsrht/bin/changegroup-script" ];
2066 + };
2067 + in {
2068 + inherit configIniOfService;
2069 + mainService = mkMerge [ baseService {
2070 + serviceConfig.StateDirectory = [ "sourcehut/hgsrht" "sourcehut/hgsrht/repos" ];
2071 + } ];
2072 + port = 5010;
2073 + webhooks = true;
2074 + extraTimers.hgsrht-periodic = {
2075 + service = baseService;
2076 + timerConfig.OnCalendar = ["20min"];
2077 + };
2078 + extraTimers.hgsrht-clonebundles = mkIf cfg.hg.cloneBundles {
2079 + service = baseService;
2080 + timerConfig.OnCalendar = ["daily"];
2081 + timerConfig.AccuracySec = "1h";
2082 + };
2083 + extraConfig = mkMerge [
2084 + {
2085 + users.users.${cfg.hg.user}.shell = pkgs.bash;
2086 + services.sourcehut.settings = {
2087 + # Note that git.sr.ht::dispatch is not a typo,
2088 + # gitsrht-dispatch always uses this section.
2089 + "git.sr.ht::dispatch"."/usr/bin/hgsrht-keys" =
2090 + mkDefault "${cfg.hg.user}:${cfg.hg.group}";
2091 + };
2092 + systemd.services.sshd = baseService;
2093 + }
2094 + (mkIf cfg.nginx.enable {
2095 + # Allow nginx access to repositories
2096 + users.users.${nginx.user}.extraGroups = [ cfg.hg.group ];
2097 + services.nginx.virtualHosts."hg.${domain}" = {
2098 + locations."/authorize" = {
2099 + proxyPass = "http://${cfg.listenAddress}:${toString cfg.hg.port}";
2100 + extraConfig = ''
2101 + proxy_pass_request_body off;
2102 + proxy_set_header Content-Length "";
2103 + proxy_set_header X-Original-URI $request_uri;
2104 + '';
2105 + };
2106 + # Let clients reach pull bundles. We don't really need to lock this down even for
2107 + # private repos because the bundles are named after the revision hashes...
2108 + # so someone would need to know or guess a SHA value to download anything.
2109 + # TODO: proxyPass to an hg serve service?
2110 + locations."~ ^/[~^][a-z0-9_]+/[a-zA-Z0-9_.-]+/\\.hg/bundles/.*$" = {
2111 + root = "/var/lib/nginx/hgsrht/repos";
2112 + extraConfig = ''
2113 + auth_request /authorize;
2114 + gzip off;
2115 + '';
2116 + };
2117 + };
2118 + systemd.services.nginx = {
2119 + serviceConfig.BindReadOnlyPaths = [ "${cfg.settings."hg.sr.ht".repos}:/var/lib/nginx/hgsrht/repos" ];
2120 + };
2121 + })
2122 + ];
2123 + }))
2124 +
2125 + (import ./service.nix "hub" {
2126 + inherit configIniOfService;
2127 + port = 5014;
2128 + extraConfig = {
2129 + services.nginx = mkIf cfg.nginx.enable {
2130 + virtualHosts."hub.${domain}" = mkMerge [ {
2131 + serverAliases = [ domain ];
2132 + } cfg.nginx.virtualHost ];
2133 + };
2134 + };
2135 + })
2136 +
2137 + (import ./service.nix "lists" (let
2138 + srvsrht = "listssrht";
2139 + in {
2140 + inherit configIniOfService;
2141 + port = 5006;
2142 + webhooks = true;
2143 + # Receive the mail from Postfix and enqueue them into Redis and PostgreSQL
2144 + extraServices.listssrht-lmtp = {
2145 + wants = [ "postfix.service" ];
2146 + unitConfig.JoinsNamespaceOf = optional cfg.postfix.enable "postfix.service";
2147 + serviceConfig.ExecStart = "${cfg.python}/bin/listssrht-lmtp";
2148 + # Avoid crashing: os.chown(sock, os.getuid(), sock_gid)
2149 + serviceConfig.PrivateUsers = mkForce false;
2150 + };
2151 + # Dequeue the mails from Redis and dispatch them
2152 + extraServices.listssrht-process = {
2153 + serviceConfig = {
2154 + preStart = ''
2155 + cp ${pkgs.writeText "${srvsrht}-webhooks-celeryconfig.py" cfg.lists.process.celeryConfig} \
2156 + /run/sourcehut/${srvsrht}-webhooks/celeryconfig.py
2157 + '';
2158 + ExecStart = "${cfg.python}/bin/celery --app listssrht.process worker --hostname listssrht-process@%%h " + concatStringsSep " " cfg.lists.process.extraArgs;
2159 + # Avoid crashing: os.getloadavg()
2160 + ProcSubset = mkForce "all";
2161 + };
2162 + };
2163 + extraConfig = mkIf cfg.postfix.enable {
2164 + users.groups.${postfix.group}.members = [ cfg.lists.user ];
2165 + services.sourcehut.settings."lists.sr.ht::mail".sock-group = postfix.group;
2166 + services.postfix = {
2167 + destination = [ "lists.${domain}" ];
2168 + # FIXME: an accurate recipient list should be queried
2169 + # from the lists.sr.ht PostgreSQL database to avoid backscattering.
2170 + # But usernames are unfortunately not in that database but in meta.sr.ht.
2171 + # Note that two syntaxes are allowed:
2172 + # - ~username/list-name@lists.${domain}
2173 + # - u.username.list-name@lists.${domain}
2174 + localRecipients = [ "@lists.${domain}" ];
2175 + transport = ''
2176 + lists.${domain} lmtp:unix:${cfg.settings."lists.sr.ht::worker".sock}
2177 + '';
2178 + };
2179 + };
2180 + }))
2181 +
2182 + (import ./service.nix "man" {
2183 + inherit configIniOfService;
2184 + port = 5004;
2185 + })
2186 +
2187 + (import ./service.nix "meta" {
2188 + inherit configIniOfService;
2189 + port = 5000;
2190 + webhooks = true;
2191 + extraServices.metasrht-api = {
2192 + serviceConfig.Restart = "always";
2193 + serviceConfig.RestartSec = "2s";
2194 + preStart = "set -x\n" + concatStringsSep "\n\n" (attrValues (mapAttrs (k: s:
2195 + let srvMatch = builtins.match "^([a-z]*)\\.sr\\.ht$" k;
2196 + srv = head srvMatch;
2197 + in
2198 + # Configure client(s) as "preauthorized"
2199 + optionalString (srvMatch != null && cfg.${srv}.enable && ((s.oauth-client-id or null) != null)) ''
2200 + # Configure ${srv}'s OAuth client as "preauthorized"
2201 + ${postgresql.package}/bin/psql '${cfg.settings."meta.sr.ht".connection-string}' \
2202 + -c "UPDATE oauthclient SET preauthorized = true WHERE client_id = '${s.oauth-client-id}'"
2203 + ''
2204 + ) cfg.settings));
2205 + serviceConfig.ExecStart = "${pkgs.sourcehut.metasrht}/bin/metasrht-api -b ${cfg.listenAddress}:${toString (cfg.meta.port + 100)}";
2206 + };
2207 + extraTimers.metasrht-daily.timerConfig = {
2208 + OnCalendar = ["daily"];
2209 + AccuracySec = "1h";
2210 + };
2211 + extraConfig = mkMerge [
2212 + {
2213 + assertions = [
2214 + { assertion = let s = cfg.settings."meta.sr.ht::billing"; in
2215 + s.enabled == "yes" -> (s.stripe-public-key != null && s.stripe-secret-key != null);
2216 + message = "If meta.sr.ht::billing is enabled, the keys must be defined.";
2217 + }
2218 + ];
2219 + environment.systemPackages = optional cfg.meta.enable
2220 + (pkgs.writeShellScriptBin "metasrht-manageuser" ''
2221 + set -eux
2222 + if test "$(${pkgs.coreutils}/bin/id -n -u)" != '${cfg.meta.user}'
2223 + then exec sudo -u '${cfg.meta.user}' "$0" "$@"
2224 + else
2225 + # In order to load config.ini
2226 + if cd /run/sourcehut/metasrht
2227 + then exec ${cfg.python}/bin/metasrht-manageuser "$@"
2228 + else cat <<EOF
2229 + Please run: sudo systemctl start metasrht
2230 + EOF
2231 + exit 1
2232 + fi
2233 + fi
2234 + '');
2235 + }
2236 + (mkIf cfg.nginx.enable {
2237 + services.nginx.virtualHosts."meta.${domain}" = {
2238 + locations."/query" = {
2239 + proxyPass = cfg.settings."meta.sr.ht".api-origin;
2240 + extraConfig = ''
2241 + if ($request_method = 'OPTIONS') {
2242 + add_header 'Access-Control-Allow-Origin' '*';
2243 + add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
2244 + add_header 'Access-Control-Allow-Headers' 'User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
2245 + add_header 'Access-Control-Max-Age' 1728000;
2246 + add_header 'Content-Type' 'text/plain; charset=utf-8';
2247 + add_header 'Content-Length' 0;
2248 + return 204;
2249 + }
2250 +
2251 + add_header 'Access-Control-Allow-Origin' '*';
2252 + add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
2253 + add_header 'Access-Control-Allow-Headers' 'User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range';
2254 + add_header 'Access-Control-Expose-Headers' 'Content-Length,Content-Range';
2255 + '';
2256 + };
2257 + };
2258 + })
2259 + ];
2260 + })
2261 +
2262 + (import ./service.nix "pages" {
2263 + inherit configIniOfService;
2264 + port = 5112;
2265 + mainService = let
2266 + srvsrht = "pagessrht";
2267 + version = pkgs.sourcehut.${srvsrht}.version;
2268 + stateDir = "/var/lib/sourcehut/${srvsrht}";
2269 + iniKey = "pages.sr.ht";
2270 + in {
2271 + preStart = mkBefore ''
2272 + set -x
2273 + # Use the /run/sourcehut/${srvsrht}/config.ini
2274 + # installed by a previous ExecStartPre= in baseService
2275 + cd /run/sourcehut/${srvsrht}
2276 +
2277 + if test ! -e ${stateDir}/db; then
2278 + ${postgresql.package}/bin/psql '${cfg.settings.${iniKey}.connection-string}' -f ${pkgs.sourcehut.pagessrht}/share/sql/schema.sql
2279 + echo ${version} >${stateDir}/db
2280 + fi
2281 +
2282 + ${optionalString cfg.settings.${iniKey}.migrate-on-upgrade ''
2283 + # Just try all the migrations because they're not linked to the version
2284 + for sql in ${pkgs.sourcehut.pagessrht}/share/sql/migrations/*.sql; do
2285 + ${postgresql.package}/bin/psql '${cfg.settings.${iniKey}.connection-string}' -f "$sql" || true
2286 + done
2287 + ''}
2288 +
2289 + # Disable webhook
2290 + touch ${stateDir}/webhook
2291 + '';
2292 + serviceConfig = {
2293 + ExecStart = mkForce "${pkgs.sourcehut.pagessrht}/bin/pages.sr.ht -b ${cfg.listenAddress}:${toString cfg.pages.port}";
2294 + };
2295 + };
2296 + })
2297 +
2298 + (import ./service.nix "paste" {
2299 + inherit configIniOfService;
2300 + port = 5011;
2301 + })
2302 +
2303 + (import ./service.nix "todo" {
2304 + inherit configIniOfService;
2305 + port = 5003;
2306 + webhooks = true;
2307 + extraServices.todosrht-lmtp = {
2308 + wants = [ "postfix.service" ];
2309 + unitConfig.JoinsNamespaceOf = optional cfg.postfix.enable "postfix.service";
2310 + serviceConfig.ExecStart = "${cfg.python}/bin/todosrht-lmtp";
2311 + # Avoid crashing: os.chown(sock, os.getuid(), sock_gid)
2312 + serviceConfig.PrivateUsers = mkForce false;
2313 + };
2314 + extraConfig = mkIf cfg.postfix.enable {
2315 + users.groups.${postfix.group}.members = [ cfg.todo.user ];
2316 + services.sourcehut.settings."todo.sr.ht::mail".sock-group = postfix.group;
2317 + services.postfix = {
2318 + destination = [ "todo.${domain}" ];
2319 + # FIXME: an accurate recipient list should be queried
2320 + # from the todo.sr.ht PostgreSQL database to avoid backscattering.
2321 + # But usernames are unfortunately not in that database but in meta.sr.ht.
2322 + # Note that two syntaxes are allowed:
2323 + # - ~username/tracker-name@todo.${domain}
2324 + # - u.username.tracker-name@todo.${domain}
2325 + localRecipients = [ "@todo.${domain}" ];
2326 + transport = ''
2327 + todo.${domain} lmtp:unix:${cfg.settings."todo.sr.ht::mail".sock}
2328 + '';
2329 + };
2330 + };
2331 + })
2332 +
2333 + (mkRenamedOptionModule [ "services" "sourcehut" "originBase" ]
2334 + [ "services" "sourcehut" "settings" "sr.ht" "global-domain" ])
2335 + (mkRenamedOptionModule [ "services" "sourcehut" "address" ]
2336 + [ "services" "sourcehut" "listenAddress" ])
2337 +
2338 + ];
2339 +
2340 meta.doc = ./sourcehut.xml;
2341 - meta.maintainers = with maintainers; [ tomberek ];
2342 + meta.maintainers = with maintainers; [ julm tomberek ];
2343 }
2344 diff --git a/nixos/modules/services/misc/sourcehut/dispatch.nix b/nixos/modules/services/misc/sourcehut/dispatch.nix
2345 deleted file mode 100644
2346 index a9db17bebe8..00000000000
2347 --- a/nixos/modules/services/misc/sourcehut/dispatch.nix
2348 +++ /dev/null
2349 @@ -1,125 +0,0 @@
2350 -{ config, lib, pkgs, ... }:
2351 -
2352 -with lib;
2353 -let
2354 - cfg = config.services.sourcehut;
2355 - cfgIni = cfg.settings;
2356 - scfg = cfg.dispatch;
2357 - iniKey = "dispatch.sr.ht";
2358 -
2359 - drv = pkgs.sourcehut.dispatchsrht;
2360 -in
2361 -{
2362 - options.services.sourcehut.dispatch = {
2363 - user = mkOption {
2364 - type = types.str;
2365 - default = "dispatchsrht";
2366 - description = ''
2367 - User for dispatch.sr.ht.
2368 - '';
2369 - };
2370 -
2371 - port = mkOption {
2372 - type = types.port;
2373 - default = 5005;
2374 - description = ''
2375 - Port on which the "dispatch" module should listen.
2376 - '';
2377 - };
2378 -
2379 - database = mkOption {
2380 - type = types.str;
2381 - default = "dispatch.sr.ht";
2382 - description = ''
2383 - PostgreSQL database name for dispatch.sr.ht.
2384 - '';
2385 - };
2386 -
2387 - statePath = mkOption {
2388 - type = types.path;
2389 - default = "${cfg.statePath}/dispatchsrht";
2390 - description = ''
2391 - State path for dispatch.sr.ht.
2392 - '';
2393 - };
2394 - };
2395 -
2396 - config = with scfg; lib.mkIf (cfg.enable && elem "dispatch" cfg.services) {
2397 -
2398 - users = {
2399 - users = {
2400 - "${user}" = {
2401 - isSystemUser = true;
2402 - group = user;
2403 - description = "dispatch.sr.ht user";
2404 - };
2405 - };
2406 -
2407 - groups = {
2408 - "${user}" = { };
2409 - };
2410 - };
2411 -
2412 - services.postgresql = {
2413 - authentication = ''
2414 - local ${database} ${user} trust
2415 - '';
2416 - ensureDatabases = [ database ];
2417 - ensureUsers = [
2418 - {
2419 - name = user;
2420 - ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
2421 - }
2422 - ];
2423 - };
2424 -
2425 - systemd = {
2426 - tmpfiles.rules = [
2427 - "d ${statePath} 0750 ${user} ${user} -"
2428 - ];
2429 -
2430 - services.dispatchsrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
2431 - after = [ "postgresql.service" "network.target" ];
2432 - requires = [ "postgresql.service" ];
2433 - wantedBy = [ "multi-user.target" ];
2434 -
2435 - description = "dispatch.sr.ht website service";
2436 -
2437 - serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
2438 - };
2439 - };
2440 -
2441 - services.sourcehut.settings = {
2442 - # URL dispatch.sr.ht is being served at (protocol://domain)
2443 - "dispatch.sr.ht".origin = mkDefault "http://dispatch.${cfg.originBase}";
2444 - # Address and port to bind the debug server to
2445 - "dispatch.sr.ht".debug-host = mkDefault "0.0.0.0";
2446 - "dispatch.sr.ht".debug-port = mkDefault port;
2447 - # Configures the SQLAlchemy connection string for the database.
2448 - "dispatch.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
2449 - # Set to "yes" to automatically run migrations on package upgrade.
2450 - "dispatch.sr.ht".migrate-on-upgrade = mkDefault "yes";
2451 - # dispatch.sr.ht's OAuth client ID and secret for meta.sr.ht
2452 - # Register your client at meta.example.org/oauth
2453 - "dispatch.sr.ht".oauth-client-id = mkDefault null;
2454 - "dispatch.sr.ht".oauth-client-secret = mkDefault null;
2455 -
2456 - # Github Integration
2457 - "dispatch.sr.ht::github".oauth-client-id = mkDefault null;
2458 - "dispatch.sr.ht::github".oauth-client-secret = mkDefault null;
2459 -
2460 - # Gitlab Integration
2461 - "dispatch.sr.ht::gitlab".enabled = mkDefault null;
2462 - "dispatch.sr.ht::gitlab".canonical-upstream = mkDefault "gitlab.com";
2463 - "dispatch.sr.ht::gitlab".repo-cache = mkDefault "./repo-cache";
2464 - # "dispatch.sr.ht::gitlab"."gitlab.com" = mkDefault "GitLab:application id:secret";
2465 - };
2466 -
2467 - services.nginx.virtualHosts."dispatch.${cfg.originBase}" = {
2468 - forceSSL = true;
2469 - locations."/".proxyPass = "http://${cfg.address}:${toString port}";
2470 - locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
2471 - locations."/static".root = "${pkgs.sourcehut.dispatchsrht}/${pkgs.sourcehut.python.sitePackages}/dispatchsrht";
2472 - };
2473 - };
2474 -}
2475 diff --git a/nixos/modules/services/misc/sourcehut/git.nix b/nixos/modules/services/misc/sourcehut/git.nix
2476 deleted file mode 100644
2477 index 99b9aec0612..00000000000
2478 --- a/nixos/modules/services/misc/sourcehut/git.nix
2479 +++ /dev/null
2480 @@ -1,214 +0,0 @@
2481 -{ config, lib, pkgs, ... }:
2482 -
2483 -with lib;
2484 -let
2485 - cfg = config.services.sourcehut;
2486 - scfg = cfg.git;
2487 - iniKey = "git.sr.ht";
2488 -
2489 - rcfg = config.services.redis;
2490 - drv = pkgs.sourcehut.gitsrht;
2491 -in
2492 -{
2493 - options.services.sourcehut.git = {
2494 - user = mkOption {
2495 - type = types.str;
2496 - visible = false;
2497 - internal = true;
2498 - readOnly = true;
2499 - default = "git";
2500 - description = ''
2501 - User for git.sr.ht.
2502 - '';
2503 - };
2504 -
2505 - port = mkOption {
2506 - type = types.port;
2507 - default = 5001;
2508 - description = ''
2509 - Port on which the "git" module should listen.
2510 - '';
2511 - };
2512 -
2513 - database = mkOption {
2514 - type = types.str;
2515 - default = "git.sr.ht";
2516 - description = ''
2517 - PostgreSQL database name for git.sr.ht.
2518 - '';
2519 - };
2520 -
2521 - statePath = mkOption {
2522 - type = types.path;
2523 - default = "${cfg.statePath}/gitsrht";
2524 - description = ''
2525 - State path for git.sr.ht.
2526 - '';
2527 - };
2528 -
2529 - package = mkOption {
2530 - type = types.package;
2531 - default = pkgs.git;
2532 - example = literalExample "pkgs.gitFull";
2533 - description = ''
2534 - Git package for git.sr.ht. This can help silence collisions.
2535 - '';
2536 - };
2537 - };
2538 -
2539 - config = with scfg; lib.mkIf (cfg.enable && elem "git" cfg.services) {
2540 - # sshd refuses to run with `Unsafe AuthorizedKeysCommand ... bad ownership or modes for directory /nix/store`
2541 - environment.etc."ssh/gitsrht-dispatch" = {
2542 - mode = "0755";
2543 - text = ''
2544 - #! ${pkgs.stdenv.shell}
2545 - ${cfg.python}/bin/gitsrht-dispatch "$@"
2546 - '';
2547 - };
2548 -
2549 - # Needs this in the $PATH when sshing into the server
2550 - environment.systemPackages = [ cfg.git.package ];
2551 -
2552 - users = {
2553 - users = {
2554 - "${user}" = {
2555 - isSystemUser = true;
2556 - group = user;
2557 - # https://stackoverflow.com/questions/22314298/git-push-results-in-fatal-protocol-error-bad-line-length-character-this
2558 - # Probably could use gitsrht-shell if output is restricted to just parameters...
2559 - shell = pkgs.bash;
2560 - description = "git.sr.ht user";
2561 - };
2562 - };
2563 -
2564 - groups = {
2565 - "${user}" = { };
2566 - };
2567 - };
2568 -
2569 - services = {
2570 - cron.systemCronJobs = [ "*/20 * * * * ${cfg.python}/bin/gitsrht-periodic" ];
2571 - fcgiwrap.enable = true;
2572 -
2573 - openssh.authorizedKeysCommand = ''/etc/ssh/gitsrht-dispatch "%u" "%h" "%t" "%k"'';
2574 - openssh.authorizedKeysCommandUser = "root";
2575 - openssh.extraConfig = ''
2576 - PermitUserEnvironment SRHT_*
2577 - '';
2578 -
2579 - postgresql = {
2580 - authentication = ''
2581 - local ${database} ${user} trust
2582 - '';
2583 - ensureDatabases = [ database ];
2584 - ensureUsers = [
2585 - {
2586 - name = user;
2587 - ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
2588 - }
2589 - ];
2590 - };
2591 - };
2592 -
2593 - systemd = {
2594 - tmpfiles.rules = [
2595 - # /var/log is owned by root
2596 - "f /var/log/git-srht-shell 0644 ${user} ${user} -"
2597 -
2598 - "d ${statePath} 0750 ${user} ${user} -"
2599 - "d ${cfg.settings."${iniKey}".repos} 2755 ${user} ${user} -"
2600 - ];
2601 -
2602 - services = {
2603 - gitsrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
2604 - after = [ "redis.service" "postgresql.service" "network.target" ];
2605 - requires = [ "redis.service" "postgresql.service" ];
2606 - wantedBy = [ "multi-user.target" ];
2607 -
2608 - # Needs internally to create repos at the very least
2609 - path = [ pkgs.git ];
2610 - description = "git.sr.ht website service";
2611 -
2612 - serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
2613 - };
2614 -
2615 - gitsrht-webhooks = {
2616 - after = [ "postgresql.service" "network.target" ];
2617 - requires = [ "postgresql.service" ];
2618 - wantedBy = [ "multi-user.target" ];
2619 -
2620 - description = "git.sr.ht webhooks service";
2621 - serviceConfig = {
2622 - Type = "simple";
2623 - User = user;
2624 - Restart = "always";
2625 - };
2626 -
2627 - serviceConfig.ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel=info";
2628 - };
2629 - };
2630 - };
2631 -
2632 - services.sourcehut.settings = {
2633 - # URL git.sr.ht is being served at (protocol://domain)
2634 - "git.sr.ht".origin = mkDefault "http://git.${cfg.originBase}";
2635 - # Address and port to bind the debug server to
2636 - "git.sr.ht".debug-host = mkDefault "0.0.0.0";
2637 - "git.sr.ht".debug-port = mkDefault port;
2638 - # Configures the SQLAlchemy connection string for the database.
2639 - "git.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
2640 - # Set to "yes" to automatically run migrations on package upgrade.
2641 - "git.sr.ht".migrate-on-upgrade = mkDefault "yes";
2642 - # The redis connection used for the webhooks worker
2643 - "git.sr.ht".webhooks = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/1";
2644 -
2645 - # A post-update script which is installed in every git repo.
2646 - "git.sr.ht".post-update-script = mkDefault "${pkgs.sourcehut.gitsrht}/bin/gitsrht-update-hook";
2647 -
2648 - # git.sr.ht's OAuth client ID and secret for meta.sr.ht
2649 - # Register your client at meta.example.org/oauth
2650 - "git.sr.ht".oauth-client-id = mkDefault null;
2651 - "git.sr.ht".oauth-client-secret = mkDefault null;
2652 - # Path to git repositories on disk
2653 - "git.sr.ht".repos = mkDefault "/var/lib/git";
2654 -
2655 - "git.sr.ht".outgoing-domain = mkDefault "http://git.${cfg.originBase}";
2656 -
2657 - # The authorized keys hook uses this to dispatch to various handlers
2658 - # The format is a program to exec into as the key, and the user to match as the
2659 - # value. When someone tries to log in as this user, this program is executed
2660 - # and is expected to omit an AuthorizedKeys file.
2661 - #
2662 - # Discard of the string context is in order to allow derivation-derived strings.
2663 - # This is safe if the relevant package is installed which will be the case if the setting is utilized.
2664 - "git.sr.ht::dispatch".${builtins.unsafeDiscardStringContext "${pkgs.sourcehut.gitsrht}/bin/gitsrht-keys"} = mkDefault "${user}:${user}";
2665 - };
2666 -
2667 - services.nginx.virtualHosts."git.${cfg.originBase}" = {
2668 - forceSSL = true;
2669 - locations."/".proxyPass = "http://${cfg.address}:${toString port}";
2670 - locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
2671 - locations."/static".root = "${pkgs.sourcehut.gitsrht}/${pkgs.sourcehut.python.sitePackages}/gitsrht";
2672 - extraConfig = ''
2673 - location = /authorize {
2674 - proxy_pass http://${cfg.address}:${toString port};
2675 - proxy_pass_request_body off;
2676 - proxy_set_header Content-Length "";
2677 - proxy_set_header X-Original-URI $request_uri;
2678 - }
2679 - location ~ ^/([^/]+)/([^/]+)/(HEAD|info/refs|objects/info/.*|git-upload-pack).*$ {
2680 - auth_request /authorize;
2681 - root /var/lib/git;
2682 - fastcgi_pass unix:/run/fcgiwrap.sock;
2683 - fastcgi_param SCRIPT_FILENAME ${pkgs.git}/bin/git-http-backend;
2684 - fastcgi_param PATH_INFO $uri;
2685 - fastcgi_param GIT_PROJECT_ROOT $document_root;
2686 - fastcgi_read_timeout 500s;
2687 - include ${pkgs.nginx}/conf/fastcgi_params;
2688 - gzip off;
2689 - }
2690 - '';
2691 -
2692 - };
2693 - };
2694 -}
2695 diff --git a/nixos/modules/services/misc/sourcehut/hg.nix b/nixos/modules/services/misc/sourcehut/hg.nix
2696 deleted file mode 100644
2697 index 5cd36bb0455..00000000000
2698 --- a/nixos/modules/services/misc/sourcehut/hg.nix
2699 +++ /dev/null
2700 @@ -1,173 +0,0 @@
2701 -{ config, lib, pkgs, ... }:
2702 -
2703 -with lib;
2704 -let
2705 - cfg = config.services.sourcehut;
2706 - scfg = cfg.hg;
2707 - iniKey = "hg.sr.ht";
2708 -
2709 - rcfg = config.services.redis;
2710 - drv = pkgs.sourcehut.hgsrht;
2711 -in
2712 -{
2713 - options.services.sourcehut.hg = {
2714 - user = mkOption {
2715 - type = types.str;
2716 - internal = true;
2717 - readOnly = true;
2718 - default = "hg";
2719 - description = ''
2720 - User for hg.sr.ht.
2721 - '';
2722 - };
2723 -
2724 - port = mkOption {
2725 - type = types.port;
2726 - default = 5010;
2727 - description = ''
2728 - Port on which the "hg" module should listen.
2729 - '';
2730 - };
2731 -
2732 - database = mkOption {
2733 - type = types.str;
2734 - default = "hg.sr.ht";
2735 - description = ''
2736 - PostgreSQL database name for hg.sr.ht.
2737 - '';
2738 - };
2739 -
2740 - statePath = mkOption {
2741 - type = types.path;
2742 - default = "${cfg.statePath}/hgsrht";
2743 - description = ''
2744 - State path for hg.sr.ht.
2745 - '';
2746 - };
2747 -
2748 - cloneBundles = mkOption {
2749 - type = types.bool;
2750 - default = false;
2751 - description = ''
2752 - Generate clonebundles (which require more disk space but dramatically speed up cloning large repositories).
2753 - '';
2754 - };
2755 - };
2756 -
2757 - config = with scfg; lib.mkIf (cfg.enable && elem "hg" cfg.services) {
2758 - # In case it ever comes into being
2759 - environment.etc."ssh/hgsrht-dispatch" = {
2760 - mode = "0755";
2761 - text = ''
2762 - #! ${pkgs.stdenv.shell}
2763 - ${cfg.python}/bin/gitsrht-dispatch $@
2764 - '';
2765 - };
2766 -
2767 - environment.systemPackages = [ pkgs.mercurial ];
2768 -
2769 - users = {
2770 - users = {
2771 - "${user}" = {
2772 - isSystemUser = true;
2773 - group = user;
2774 - # Assuming hg.sr.ht needs this too
2775 - shell = pkgs.bash;
2776 - description = "hg.sr.ht user";
2777 - };
2778 - };
2779 -
2780 - groups = {
2781 - "${user}" = { };
2782 - };
2783 - };
2784 -
2785 - services = {
2786 - cron.systemCronJobs = [ "*/20 * * * * ${cfg.python}/bin/hgsrht-periodic" ]
2787 - ++ optional cloneBundles "0 * * * * ${cfg.python}/bin/hgsrht-clonebundles";
2788 -
2789 - openssh.authorizedKeysCommand = ''/etc/ssh/hgsrht-dispatch "%u" "%h" "%t" "%k"'';
2790 - openssh.authorizedKeysCommandUser = "root";
2791 - openssh.extraConfig = ''
2792 - PermitUserEnvironment SRHT_*
2793 - '';
2794 -
2795 - postgresql = {
2796 - authentication = ''
2797 - local ${database} ${user} trust
2798 - '';
2799 - ensureDatabases = [ database ];
2800 - ensureUsers = [
2801 - {
2802 - name = user;
2803 - ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
2804 - }
2805 - ];
2806 - };
2807 - };
2808 -
2809 - systemd = {
2810 - tmpfiles.rules = [
2811 - # /var/log is owned by root
2812 - "f /var/log/hg-srht-shell 0644 ${user} ${user} -"
2813 -
2814 - "d ${statePath} 0750 ${user} ${user} -"
2815 - "d ${cfg.settings."${iniKey}".repos} 2755 ${user} ${user} -"
2816 - ];
2817 -
2818 - services.hgsrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
2819 - after = [ "redis.service" "postgresql.service" "network.target" ];
2820 - requires = [ "redis.service" "postgresql.service" ];
2821 - wantedBy = [ "multi-user.target" ];
2822 -
2823 - path = [ pkgs.mercurial ];
2824 - description = "hg.sr.ht website service";
2825 -
2826 - serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
2827 - };
2828 - };
2829 -
2830 - services.sourcehut.settings = {
2831 - # URL hg.sr.ht is being served at (protocol://domain)
2832 - "hg.sr.ht".origin = mkDefault "http://hg.${cfg.originBase}";
2833 - # Address and port to bind the debug server to
2834 - "hg.sr.ht".debug-host = mkDefault "0.0.0.0";
2835 - "hg.sr.ht".debug-port = mkDefault port;
2836 - # Configures the SQLAlchemy connection string for the database.
2837 - "hg.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
2838 - # The redis connection used for the webhooks worker
2839 - "hg.sr.ht".webhooks = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/1";
2840 - # A post-update script which is installed in every mercurial repo.
2841 - "hg.sr.ht".changegroup-script = mkDefault "${cfg.python}/bin/hgsrht-hook-changegroup";
2842 - # hg.sr.ht's OAuth client ID and secret for meta.sr.ht
2843 - # Register your client at meta.example.org/oauth
2844 - "hg.sr.ht".oauth-client-id = mkDefault null;
2845 - "hg.sr.ht".oauth-client-secret = mkDefault null;
2846 - # Path to mercurial repositories on disk
2847 - "hg.sr.ht".repos = mkDefault "/var/lib/hg";
2848 - # Path to the srht mercurial extension
2849 - # (defaults to where the hgsrht code is)
2850 - # "hg.sr.ht".srhtext = mkDefault null;
2851 - # .hg/store size (in MB) past which the nightly job generates clone bundles.
2852 - # "hg.sr.ht".clone_bundle_threshold = mkDefault 50;
2853 - # Path to hg-ssh (if not in $PATH)
2854 - # "hg.sr.ht".hg_ssh = mkDefault /path/to/hg-ssh;
2855 -
2856 - # The authorized keys hook uses this to dispatch to various handlers
2857 - # The format is a program to exec into as the key, and the user to match as the
2858 - # value. When someone tries to log in as this user, this program is executed
2859 - # and is expected to omit an AuthorizedKeys file.
2860 - #
2861 - # Uncomment the relevant lines to enable the various sr.ht dispatchers.
2862 - "hg.sr.ht::dispatch"."/run/current-system/sw/bin/hgsrht-keys" = mkDefault "${user}:${user}";
2863 - };
2864 -
2865 - # TODO: requires testing and addition of hg-specific requirements
2866 - services.nginx.virtualHosts."hg.${cfg.originBase}" = {
2867 - forceSSL = true;
2868 - locations."/".proxyPass = "http://${cfg.address}:${toString port}";
2869 - locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
2870 - locations."/static".root = "${pkgs.sourcehut.hgsrht}/${pkgs.sourcehut.python.sitePackages}/hgsrht";
2871 - };
2872 - };
2873 -}
2874 diff --git a/nixos/modules/services/misc/sourcehut/hub.nix b/nixos/modules/services/misc/sourcehut/hub.nix
2875 deleted file mode 100644
2876 index be3ea21011c..00000000000
2877 --- a/nixos/modules/services/misc/sourcehut/hub.nix
2878 +++ /dev/null
2879 @@ -1,118 +0,0 @@
2880 -{ config, lib, pkgs, ... }:
2881 -
2882 -with lib;
2883 -let
2884 - cfg = config.services.sourcehut;
2885 - cfgIni = cfg.settings;
2886 - scfg = cfg.hub;
2887 - iniKey = "hub.sr.ht";
2888 -
2889 - drv = pkgs.sourcehut.hubsrht;
2890 -in
2891 -{
2892 - options.services.sourcehut.hub = {
2893 - user = mkOption {
2894 - type = types.str;
2895 - default = "hubsrht";
2896 - description = ''
2897 - User for hub.sr.ht.
2898 - '';
2899 - };
2900 -
2901 - port = mkOption {
2902 - type = types.port;
2903 - default = 5014;
2904 - description = ''
2905 - Port on which the "hub" module should listen.
2906 - '';
2907 - };
2908 -
2909 - database = mkOption {
2910 - type = types.str;
2911 - default = "hub.sr.ht";
2912 - description = ''
2913 - PostgreSQL database name for hub.sr.ht.
2914 - '';
2915 - };
2916 -
2917 - statePath = mkOption {
2918 - type = types.path;
2919 - default = "${cfg.statePath}/hubsrht";
2920 - description = ''
2921 - State path for hub.sr.ht.
2922 - '';
2923 - };
2924 - };
2925 -
2926 - config = with scfg; lib.mkIf (cfg.enable && elem "hub" cfg.services) {
2927 - users = {
2928 - users = {
2929 - "${user}" = {
2930 - isSystemUser = true;
2931 - group = user;
2932 - description = "hub.sr.ht user";
2933 - };
2934 - };
2935 -
2936 - groups = {
2937 - "${user}" = { };
2938 - };
2939 - };
2940 -
2941 - services.postgresql = {
2942 - authentication = ''
2943 - local ${database} ${user} trust
2944 - '';
2945 - ensureDatabases = [ database ];
2946 - ensureUsers = [
2947 - {
2948 - name = user;
2949 - ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
2950 - }
2951 - ];
2952 - };
2953 -
2954 - systemd = {
2955 - tmpfiles.rules = [
2956 - "d ${statePath} 0750 ${user} ${user} -"
2957 - ];
2958 -
2959 - services.hubsrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
2960 - after = [ "postgresql.service" "network.target" ];
2961 - requires = [ "postgresql.service" ];
2962 - wantedBy = [ "multi-user.target" ];
2963 -
2964 - description = "hub.sr.ht website service";
2965 -
2966 - serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
2967 - };
2968 - };
2969 -
2970 - services.sourcehut.settings = {
2971 - # URL hub.sr.ht is being served at (protocol://domain)
2972 - "hub.sr.ht".origin = mkDefault "http://hub.${cfg.originBase}";
2973 - # Address and port to bind the debug server to
2974 - "hub.sr.ht".debug-host = mkDefault "0.0.0.0";
2975 - "hub.sr.ht".debug-port = mkDefault port;
2976 - # Configures the SQLAlchemy connection string for the database.
2977 - "hub.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
2978 - # Set to "yes" to automatically run migrations on package upgrade.
2979 - "hub.sr.ht".migrate-on-upgrade = mkDefault "yes";
2980 - # hub.sr.ht's OAuth client ID and secret for meta.sr.ht
2981 - # Register your client at meta.example.org/oauth
2982 - "hub.sr.ht".oauth-client-id = mkDefault null;
2983 - "hub.sr.ht".oauth-client-secret = mkDefault null;
2984 - };
2985 -
2986 - services.nginx.virtualHosts."${cfg.originBase}" = {
2987 - forceSSL = true;
2988 - locations."/".proxyPass = "http://${cfg.address}:${toString port}";
2989 - locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
2990 - locations."/static".root = "${pkgs.sourcehut.hubsrht}/${pkgs.sourcehut.python.sitePackages}/hubsrht";
2991 - };
2992 - services.nginx.virtualHosts."hub.${cfg.originBase}" = {
2993 - globalRedirect = "${cfg.originBase}";
2994 - forceSSL = true;
2995 - };
2996 - };
2997 -}
2998 diff --git a/nixos/modules/services/misc/sourcehut/lists.nix b/nixos/modules/services/misc/sourcehut/lists.nix
2999 deleted file mode 100644
3000 index 7b1fe9fd463..00000000000
3001 --- a/nixos/modules/services/misc/sourcehut/lists.nix
3002 +++ /dev/null
3003 @@ -1,185 +0,0 @@
3004 -# Email setup is fairly involved, useful references:
3005 -# https://drewdevault.com/2018/08/05/Local-mail-server.html
3006 -
3007 -{ config, lib, pkgs, ... }:
3008 -
3009 -with lib;
3010 -let
3011 - cfg = config.services.sourcehut;
3012 - cfgIni = cfg.settings;
3013 - scfg = cfg.lists;
3014 - iniKey = "lists.sr.ht";
3015 -
3016 - rcfg = config.services.redis;
3017 - drv = pkgs.sourcehut.listssrht;
3018 -in
3019 -{
3020 - options.services.sourcehut.lists = {
3021 - user = mkOption {
3022 - type = types.str;
3023 - default = "listssrht";
3024 - description = ''
3025 - User for lists.sr.ht.
3026 - '';
3027 - };
3028 -
3029 - port = mkOption {
3030 - type = types.port;
3031 - default = 5006;
3032 - description = ''
3033 - Port on which the "lists" module should listen.
3034 - '';
3035 - };
3036 -
3037 - database = mkOption {
3038 - type = types.str;
3039 - default = "lists.sr.ht";
3040 - description = ''
3041 - PostgreSQL database name for lists.sr.ht.
3042 - '';
3043 - };
3044 -
3045 - statePath = mkOption {
3046 - type = types.path;
3047 - default = "${cfg.statePath}/listssrht";
3048 - description = ''
3049 - State path for lists.sr.ht.
3050 - '';
3051 - };
3052 - };
3053 -
3054 - config = with scfg; lib.mkIf (cfg.enable && elem "lists" cfg.services) {
3055 - users = {
3056 - users = {
3057 - "${user}" = {
3058 - isSystemUser = true;
3059 - group = user;
3060 - extraGroups = [ "postfix" ];
3061 - description = "lists.sr.ht user";
3062 - };
3063 - };
3064 - groups = {
3065 - "${user}" = { };
3066 - };
3067 - };
3068 -
3069 - services.postgresql = {
3070 - authentication = ''
3071 - local ${database} ${user} trust
3072 - '';
3073 - ensureDatabases = [ database ];
3074 - ensureUsers = [
3075 - {
3076 - name = user;
3077 - ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
3078 - }
3079 - ];
3080 - };
3081 -
3082 - systemd = {
3083 - tmpfiles.rules = [
3084 - "d ${statePath} 0750 ${user} ${user} -"
3085 - ];
3086 -
3087 - services = {
3088 - listssrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
3089 - after = [ "postgresql.service" "network.target" ];
3090 - requires = [ "postgresql.service" ];
3091 - wantedBy = [ "multi-user.target" ];
3092 -
3093 - description = "lists.sr.ht website service";
3094 -
3095 - serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
3096 - };
3097 -
3098 - listssrht-process = {
3099 - after = [ "postgresql.service" "network.target" ];
3100 - requires = [ "postgresql.service" ];
3101 - wantedBy = [ "multi-user.target" ];
3102 -
3103 - description = "lists.sr.ht process service";
3104 - serviceConfig = {
3105 - Type = "simple";
3106 - User = user;
3107 - Restart = "always";
3108 - ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.process worker --loglevel=info";
3109 - };
3110 - };
3111 -
3112 - listssrht-lmtp = {
3113 - after = [ "postgresql.service" "network.target" ];
3114 - requires = [ "postgresql.service" ];
3115 - wantedBy = [ "multi-user.target" ];
3116 -
3117 - description = "lists.sr.ht process service";
3118 - serviceConfig = {
3119 - Type = "simple";
3120 - User = user;
3121 - Restart = "always";
3122 - ExecStart = "${cfg.python}/bin/listssrht-lmtp";
3123 - };
3124 - };
3125 -
3126 -
3127 - listssrht-webhooks = {
3128 - after = [ "postgresql.service" "network.target" ];
3129 - requires = [ "postgresql.service" ];
3130 - wantedBy = [ "multi-user.target" ];
3131 -
3132 - description = "lists.sr.ht webhooks service";
3133 - serviceConfig = {
3134 - Type = "simple";
3135 - User = user;
3136 - Restart = "always";
3137 - ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel=info";
3138 - };
3139 - };
3140 - };
3141 - };
3142 -
3143 - services.sourcehut.settings = {
3144 - # URL lists.sr.ht is being served at (protocol://domain)
3145 - "lists.sr.ht".origin = mkDefault "http://lists.${cfg.originBase}";
3146 - # Address and port to bind the debug server to
3147 - "lists.sr.ht".debug-host = mkDefault "0.0.0.0";
3148 - "lists.sr.ht".debug-port = mkDefault port;
3149 - # Configures the SQLAlchemy connection string for the database.
3150 - "lists.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
3151 - # Set to "yes" to automatically run migrations on package upgrade.
3152 - "lists.sr.ht".migrate-on-upgrade = mkDefault "yes";
3153 - # lists.sr.ht's OAuth client ID and secret for meta.sr.ht
3154 - # Register your client at meta.example.org/oauth
3155 - "lists.sr.ht".oauth-client-id = mkDefault null;
3156 - "lists.sr.ht".oauth-client-secret = mkDefault null;
3157 - # Outgoing email for notifications generated by users
3158 - "lists.sr.ht".notify-from = mkDefault "CHANGEME@example.org";
3159 - # The redis connection used for the webhooks worker
3160 - "lists.sr.ht".webhooks = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/2";
3161 - # The redis connection used for the celery worker
3162 - "lists.sr.ht".redis = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/4";
3163 - # Network-key
3164 - "lists.sr.ht".network-key = mkDefault null;
3165 - # Allow creation
3166 - "lists.sr.ht".allow-new-lists = mkDefault "no";
3167 - # Posting Domain
3168 - "lists.sr.ht".posting-domain = mkDefault "lists.${cfg.originBase}";
3169 -
3170 - # Path for the lmtp daemon's unix socket. Direct incoming mail to this socket.
3171 - # Alternatively, specify IP:PORT and an SMTP server will be run instead.
3172 - "lists.sr.ht::worker".sock = mkDefault "/tmp/lists.sr.ht-lmtp.sock";
3173 - # The lmtp daemon will make the unix socket group-read/write for users in this
3174 - # group.
3175 - "lists.sr.ht::worker".sock-group = mkDefault "postfix";
3176 - "lists.sr.ht::worker".reject-url = mkDefault "https://man.sr.ht/lists.sr.ht/etiquette.md";
3177 - "lists.sr.ht::worker".reject-mimetypes = mkDefault "text/html";
3178 -
3179 - };
3180 -
3181 - services.nginx.virtualHosts."lists.${cfg.originBase}" = {
3182 - forceSSL = true;
3183 - locations."/".proxyPass = "http://${cfg.address}:${toString port}";
3184 - locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
3185 - locations."/static".root = "${pkgs.sourcehut.listssrht}/${pkgs.sourcehut.python.sitePackages}/listssrht";
3186 - };
3187 - };
3188 -}
3189 diff --git a/nixos/modules/services/misc/sourcehut/man.nix b/nixos/modules/services/misc/sourcehut/man.nix
3190 deleted file mode 100644
3191 index 7693396d187..00000000000
3192 --- a/nixos/modules/services/misc/sourcehut/man.nix
3193 +++ /dev/null
3194 @@ -1,122 +0,0 @@
3195 -{ config, lib, pkgs, ... }:
3196 -
3197 -with lib;
3198 -let
3199 - cfg = config.services.sourcehut;
3200 - cfgIni = cfg.settings;
3201 - scfg = cfg.man;
3202 - iniKey = "man.sr.ht";
3203 -
3204 - drv = pkgs.sourcehut.mansrht;
3205 -in
3206 -{
3207 - options.services.sourcehut.man = {
3208 - user = mkOption {
3209 - type = types.str;
3210 - default = "mansrht";
3211 - description = ''
3212 - User for man.sr.ht.
3213 - '';
3214 - };
3215 -
3216 - port = mkOption {
3217 - type = types.port;
3218 - default = 5004;
3219 - description = ''
3220 - Port on which the "man" module should listen.
3221 - '';
3222 - };
3223 -
3224 - database = mkOption {
3225 - type = types.str;
3226 - default = "man.sr.ht";
3227 - description = ''
3228 - PostgreSQL database name for man.sr.ht.
3229 - '';
3230 - };
3231 -
3232 - statePath = mkOption {
3233 - type = types.path;
3234 - default = "${cfg.statePath}/mansrht";
3235 - description = ''
3236 - State path for man.sr.ht.
3237 - '';
3238 - };
3239 - };
3240 -
3241 - config = with scfg; lib.mkIf (cfg.enable && elem "man" cfg.services) {
3242 - assertions =
3243 - [
3244 - {
3245 - assertion = hasAttrByPath [ "git.sr.ht" "oauth-client-id" ] cfgIni;
3246 - message = "man.sr.ht needs access to git.sr.ht.";
3247 - }
3248 - ];
3249 -
3250 - users = {
3251 - users = {
3252 - "${user}" = {
3253 - isSystemUser = true;
3254 - group = user;
3255 - description = "man.sr.ht user";
3256 - };
3257 - };
3258 -
3259 - groups = {
3260 - "${user}" = { };
3261 - };
3262 - };
3263 -
3264 - services.postgresql = {
3265 - authentication = ''
3266 - local ${database} ${user} trust
3267 - '';
3268 - ensureDatabases = [ database ];
3269 - ensureUsers = [
3270 - {
3271 - name = user;
3272 - ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
3273 - }
3274 - ];
3275 - };
3276 -
3277 - systemd = {
3278 - tmpfiles.rules = [
3279 - "d ${statePath} 0750 ${user} ${user} -"
3280 - ];
3281 -
3282 - services.mansrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
3283 - after = [ "postgresql.service" "network.target" ];
3284 - requires = [ "postgresql.service" ];
3285 - wantedBy = [ "multi-user.target" ];
3286 -
3287 - description = "man.sr.ht website service";
3288 -
3289 - serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
3290 - };
3291 - };
3292 -
3293 - services.sourcehut.settings = {
3294 - # URL man.sr.ht is being served at (protocol://domain)
3295 - "man.sr.ht".origin = mkDefault "http://man.${cfg.originBase}";
3296 - # Address and port to bind the debug server to
3297 - "man.sr.ht".debug-host = mkDefault "0.0.0.0";
3298 - "man.sr.ht".debug-port = mkDefault port;
3299 - # Configures the SQLAlchemy connection string for the database.
3300 - "man.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
3301 - # Set to "yes" to automatically run migrations on package upgrade.
3302 - "man.sr.ht".migrate-on-upgrade = mkDefault "yes";
3303 - # man.sr.ht's OAuth client ID and secret for meta.sr.ht
3304 - # Register your client at meta.example.org/oauth
3305 - "man.sr.ht".oauth-client-id = mkDefault null;
3306 - "man.sr.ht".oauth-client-secret = mkDefault null;
3307 - };
3308 -
3309 - services.nginx.virtualHosts."man.${cfg.originBase}" = {
3310 - forceSSL = true;
3311 - locations."/".proxyPass = "http://${cfg.address}:${toString port}";
3312 - locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
3313 - locations."/static".root = "${pkgs.sourcehut.mansrht}/${pkgs.sourcehut.python.sitePackages}/mansrht";
3314 - };
3315 - };
3316 -}
3317 diff --git a/nixos/modules/services/misc/sourcehut/meta.nix b/nixos/modules/services/misc/sourcehut/meta.nix
3318 deleted file mode 100644
3319 index 56127a824eb..00000000000
3320 --- a/nixos/modules/services/misc/sourcehut/meta.nix
3321 +++ /dev/null
3322 @@ -1,211 +0,0 @@
3323 -{ config, lib, pkgs, ... }:
3324 -
3325 -with lib;
3326 -let
3327 - cfg = config.services.sourcehut;
3328 - cfgIni = cfg.settings;
3329 - scfg = cfg.meta;
3330 - iniKey = "meta.sr.ht";
3331 -
3332 - rcfg = config.services.redis;
3333 - drv = pkgs.sourcehut.metasrht;
3334 -in
3335 -{
3336 - options.services.sourcehut.meta = {
3337 - user = mkOption {
3338 - type = types.str;
3339 - default = "metasrht";
3340 - description = ''
3341 - User for meta.sr.ht.
3342 - '';
3343 - };
3344 -
3345 - port = mkOption {
3346 - type = types.port;
3347 - default = 5000;
3348 - description = ''
3349 - Port on which the "meta" module should listen.
3350 - '';
3351 - };
3352 -
3353 - database = mkOption {
3354 - type = types.str;
3355 - default = "meta.sr.ht";
3356 - description = ''
3357 - PostgreSQL database name for meta.sr.ht.
3358 - '';
3359 - };
3360 -
3361 - statePath = mkOption {
3362 - type = types.path;
3363 - default = "${cfg.statePath}/metasrht";
3364 - description = ''
3365 - State path for meta.sr.ht.
3366 - '';
3367 - };
3368 - };
3369 -
3370 - config = with scfg; lib.mkIf (cfg.enable && elem "meta" cfg.services) {
3371 - assertions =
3372 - [
3373 - {
3374 - assertion = with cfgIni."meta.sr.ht::billing"; enabled == "yes" -> (stripe-public-key != null && stripe-secret-key != null);
3375 - message = "If meta.sr.ht::billing is enabled, the keys should be defined.";
3376 - }
3377 - ];
3378 -
3379 - users = {
3380 - users = {
3381 - ${user} = {
3382 - isSystemUser = true;
3383 - group = user;
3384 - description = "meta.sr.ht user";
3385 - };
3386 - };
3387 -
3388 - groups = {
3389 - "${user}" = { };
3390 - };
3391 - };
3392 -
3393 - services.cron.systemCronJobs = [ "0 0 * * * ${cfg.python}/bin/metasrht-daily" ];
3394 - services.postgresql = {
3395 - authentication = ''
3396 - local ${database} ${user} trust
3397 - '';
3398 - ensureDatabases = [ database ];
3399 - ensureUsers = [
3400 - {
3401 - name = user;
3402 - ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
3403 - }
3404 - ];
3405 - };
3406 -
3407 - systemd = {
3408 - tmpfiles.rules = [
3409 - "d ${statePath} 0750 ${user} ${user} -"
3410 - ];
3411 -
3412 - services = {
3413 - metasrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
3414 - after = [ "postgresql.service" "network.target" ];
3415 - requires = [ "postgresql.service" ];
3416 - wantedBy = [ "multi-user.target" ];
3417 -
3418 - description = "meta.sr.ht website service";
3419 -
3420 - preStart = ''
3421 - # Configure client(s) as "preauthorized"
3422 - ${concatMapStringsSep "\n\n"
3423 - (attr: ''
3424 - if ! test -e "${statePath}/${attr}.oauth" || [ "$(cat ${statePath}/${attr}.oauth)" != "${cfgIni."${attr}".oauth-client-id}" ]; then
3425 - # Configure ${attr}'s OAuth client as "preauthorized"
3426 - psql ${database} \
3427 - -c "UPDATE oauthclient SET preauthorized = true WHERE client_id = '${cfgIni."${attr}".oauth-client-id}'"
3428 -
3429 - printf "%s" "${cfgIni."${attr}".oauth-client-id}" > "${statePath}/${attr}.oauth"
3430 - fi
3431 - '')
3432 - (builtins.attrNames (filterAttrs
3433 - (k: v: !(hasInfix "::" k) && builtins.hasAttr "oauth-client-id" v && v.oauth-client-id != null)
3434 - cfg.settings))}
3435 - '';
3436 -
3437 - serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
3438 - };
3439 -
3440 - metasrht-api = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
3441 - after = [ "postgresql.service" "network.target" ];
3442 - requires = [ "postgresql.service" ];
3443 - wantedBy = [ "multi-user.target" ];
3444 -
3445 - description = "meta.sr.ht api service";
3446 -
3447 - preStart = ''
3448 - # Configure client(s) as "preauthorized"
3449 - ${concatMapStringsSep "\n\n"
3450 - (attr: ''
3451 - if ! test -e "${statePath}/${attr}.oauth" || [ "$(cat ${statePath}/${attr}.oauth)" != "${cfgIni."${attr}".oauth-client-id}" ]; then
3452 - # Configure ${attr}'s OAuth client as "preauthorized"
3453 - psql ${database} \
3454 - -c "UPDATE oauthclient SET preauthorized = true WHERE client_id = '${cfgIni."${attr}".oauth-client-id}'"
3455 -
3456 - printf "%s" "${cfgIni."${attr}".oauth-client-id}" > "${statePath}/${attr}.oauth"
3457 - fi
3458 - '')
3459 - (builtins.attrNames (filterAttrs
3460 - (k: v: !(hasInfix "::" k) && builtins.hasAttr "oauth-client-id" v && v.oauth-client-id != null)
3461 - cfg.settings))}
3462 - '';
3463 -
3464 - serviceConfig.ExecStart = "${pkgs.sourcehut.metasrht}/bin/metasrht-api -b :${toString (port + 100)}";
3465 - };
3466 -
3467 - metasrht-webhooks = {
3468 - after = [ "postgresql.service" "network.target" ];
3469 - requires = [ "postgresql.service" ];
3470 - wantedBy = [ "multi-user.target" ];
3471 -
3472 - description = "meta.sr.ht webhooks service";
3473 - serviceConfig = {
3474 - Type = "simple";
3475 - User = user;
3476 - Restart = "always";
3477 - ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel=info";
3478 - };
3479 -
3480 - };
3481 - };
3482 - };
3483 -
3484 - services.sourcehut.settings = {
3485 - # URL meta.sr.ht is being served at (protocol://domain)
3486 - "meta.sr.ht".origin = mkDefault "https://meta.${cfg.originBase}";
3487 - # Address and port to bind the debug server to
3488 - "meta.sr.ht".debug-host = mkDefault "0.0.0.0";
3489 - "meta.sr.ht".debug-port = mkDefault port;
3490 - # Configures the SQLAlchemy connection string for the database.
3491 - "meta.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
3492 - # Set to "yes" to automatically run migrations on package upgrade.
3493 - "meta.sr.ht".migrate-on-upgrade = mkDefault "yes";
3494 - # If "yes", the user will be sent the stock sourcehut welcome emails after
3495 - # signup (requires cron to be configured properly). These are specific to the
3496 - # sr.ht instance so you probably want to patch these before enabling this.
3497 - "meta.sr.ht".welcome-emails = mkDefault "no";
3498 -
3499 - # The redis connection used for the webhooks worker
3500 - "meta.sr.ht".webhooks = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/6";
3501 -
3502 - # If "no", public registration will not be permitted.
3503 - "meta.sr.ht::settings".registration = mkDefault "no";
3504 - # Where to redirect new users upon registration
3505 - "meta.sr.ht::settings".onboarding-redirect = mkDefault "https://meta.${cfg.originBase}";
3506 - # How many invites each user is issued upon registration (only applicable if
3507 - # open registration is disabled)
3508 - "meta.sr.ht::settings".user-invites = mkDefault 5;
3509 -
3510 - # Origin URL for API, 100 more than web
3511 - "meta.sr.ht".api-origin = mkDefault "http://localhost:5100";
3512 -
3513 - # You can add aliases for the client IDs of commonly used OAuth clients here.
3514 - #
3515 - # Example:
3516 - "meta.sr.ht::aliases" = mkDefault { };
3517 - # "meta.sr.ht::aliases"."git.sr.ht" = 12345;
3518 -
3519 - # "yes" to enable the billing system
3520 - "meta.sr.ht::billing".enabled = mkDefault "no";
3521 - # Get your keys at https://dashboard.stripe.com/account/apikeys
3522 - "meta.sr.ht::billing".stripe-public-key = mkDefault null;
3523 - "meta.sr.ht::billing".stripe-secret-key = mkDefault null;
3524 - };
3525 -
3526 - services.nginx.virtualHosts."meta.${cfg.originBase}" = {
3527 - forceSSL = true;
3528 - locations."/".proxyPass = "http://${cfg.address}:${toString port}";
3529 - locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
3530 - locations."/static".root = "${pkgs.sourcehut.metasrht}/${pkgs.sourcehut.python.sitePackages}/metasrht";
3531 - };
3532 - };
3533 -}
3534 diff --git a/nixos/modules/services/misc/sourcehut/paste.nix b/nixos/modules/services/misc/sourcehut/paste.nix
3535 deleted file mode 100644
3536 index b2d5151969e..00000000000
3537 --- a/nixos/modules/services/misc/sourcehut/paste.nix
3538 +++ /dev/null
3539 @@ -1,133 +0,0 @@
3540 -{ config, lib, pkgs, ... }:
3541 -
3542 -with lib;
3543 -let
3544 - cfg = config.services.sourcehut;
3545 - cfgIni = cfg.settings;
3546 - scfg = cfg.paste;
3547 - iniKey = "paste.sr.ht";
3548 -
3549 - rcfg = config.services.redis;
3550 - drv = pkgs.sourcehut.pastesrht;
3551 -in
3552 -{
3553 - options.services.sourcehut.paste = {
3554 - user = mkOption {
3555 - type = types.str;
3556 - default = "pastesrht";
3557 - description = ''
3558 - User for paste.sr.ht.
3559 - '';
3560 - };
3561 -
3562 - port = mkOption {
3563 - type = types.port;
3564 - default = 5011;
3565 - description = ''
3566 - Port on which the "paste" module should listen.
3567 - '';
3568 - };
3569 -
3570 - database = mkOption {
3571 - type = types.str;
3572 - default = "paste.sr.ht";
3573 - description = ''
3574 - PostgreSQL database name for paste.sr.ht.
3575 - '';
3576 - };
3577 -
3578 - statePath = mkOption {
3579 - type = types.path;
3580 - default = "${cfg.statePath}/pastesrht";
3581 - description = ''
3582 - State path for pastesrht.sr.ht.
3583 - '';
3584 - };
3585 - };
3586 -
3587 - config = with scfg; lib.mkIf (cfg.enable && elem "paste" cfg.services) {
3588 - users = {
3589 - users = {
3590 - "${user}" = {
3591 - isSystemUser = true;
3592 - group = user;
3593 - description = "paste.sr.ht user";
3594 - };
3595 - };
3596 -
3597 - groups = {
3598 - "${user}" = { };
3599 - };
3600 - };
3601 -
3602 - services.postgresql = {
3603 - authentication = ''
3604 - local ${database} ${user} trust
3605 - '';
3606 - ensureDatabases = [ database ];
3607 - ensureUsers = [
3608 - {
3609 - name = user;
3610 - ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
3611 - }
3612 - ];
3613 - };
3614 -
3615 - systemd = {
3616 - tmpfiles.rules = [
3617 - "d ${statePath} 0750 ${user} ${user} -"
3618 - ];
3619 -
3620 - services = {
3621 - pastesrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
3622 - after = [ "postgresql.service" "network.target" ];
3623 - requires = [ "postgresql.service" ];
3624 - wantedBy = [ "multi-user.target" ];
3625 -
3626 - description = "paste.sr.ht website service";
3627 -
3628 - serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
3629 - };
3630 -
3631 - pastesrht-webhooks = {
3632 - after = [ "postgresql.service" "network.target" ];
3633 - requires = [ "postgresql.service" ];
3634 - wantedBy = [ "multi-user.target" ];
3635 -
3636 - description = "paste.sr.ht webhooks service";
3637 - serviceConfig = {
3638 - Type = "simple";
3639 - User = user;
3640 - Restart = "always";
3641 - ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel=info";
3642 - };
3643 -
3644 - };
3645 - };
3646 - };
3647 -
3648 - services.sourcehut.settings = {
3649 - # URL paste.sr.ht is being served at (protocol://domain)
3650 - "paste.sr.ht".origin = mkDefault "http://paste.${cfg.originBase}";
3651 - # Address and port to bind the debug server to
3652 - "paste.sr.ht".debug-host = mkDefault "0.0.0.0";
3653 - "paste.sr.ht".debug-port = mkDefault port;
3654 - # Configures the SQLAlchemy connection string for the database.
3655 - "paste.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
3656 - # Set to "yes" to automatically run migrations on package upgrade.
3657 - "paste.sr.ht".migrate-on-upgrade = mkDefault "yes";
3658 - # paste.sr.ht's OAuth client ID and secret for meta.sr.ht
3659 - # Register your client at meta.example.org/oauth
3660 - "paste.sr.ht".oauth-client-id = mkDefault null;
3661 - "paste.sr.ht".oauth-client-secret = mkDefault null;
3662 - "paste.sr.ht".webhooks = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/5";
3663 - };
3664 -
3665 - services.nginx.virtualHosts."paste.${cfg.originBase}" = {
3666 - forceSSL = true;
3667 - locations."/".proxyPass = "http://${cfg.address}:${toString port}";
3668 - locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
3669 - locations."/static".root = "${pkgs.sourcehut.pastesrht}/${pkgs.sourcehut.python.sitePackages}/pastesrht";
3670 - };
3671 - };
3672 -}
3673 diff --git a/nixos/modules/services/misc/sourcehut/service.nix b/nixos/modules/services/misc/sourcehut/service.nix
3674 index 65b4ad020f9..b3c0efc07dd 100644
3675 --- a/nixos/modules/services/misc/sourcehut/service.nix
3676 +++ b/nixos/modules/services/misc/sourcehut/service.nix
3677 @@ -1,66 +1,375 @@
3678 -{ config, pkgs, lib }:
3679 -serviceCfg: serviceDrv: iniKey: attrs:
3680 +srv:
3681 +{ configIniOfService
3682 +, srvsrht ? "${srv}srht" # Because "buildsrht" does not follow that pattern (missing an "s").
3683 +, iniKey ? "${srv}.sr.ht"
3684 +, webhooks ? false
3685 +, extraTimers ? {}
3686 +, mainService ? {}
3687 +, extraServices ? {}
3688 +, extraConfig ? {}
3689 +, port
3690 +}:
3691 +{ config, lib, pkgs, ... }:
3692 +
3693 +with lib;
3694 let
3695 + inherit (config.services) postgresql;
3696 + redis = config.services.redis.servers."sourcehut-${srvsrht}";
3697 + inherit (config.users) users;
3698 cfg = config.services.sourcehut;
3699 - cfgIni = cfg.settings."${iniKey}";
3700 - pgSuperUser = config.services.postgresql.superUser;
3701 -
3702 - setupDB = pkgs.writeScript "${serviceDrv.pname}-gen-db" ''
3703 - #! ${cfg.python}/bin/python
3704 - from ${serviceDrv.pname}.app import db
3705 - db.create()
3706 - '';
3707 + configIni = configIniOfService srv;
3708 + srvCfg = cfg.${srv};
3709 + baseService = serviceName: { allowStripe ? false }: extraService: let
3710 + runDir = "/run/sourcehut/${serviceName}";
3711 + rootDir = "/run/sourcehut/chroots/${serviceName}";
3712 + in
3713 + mkMerge [ extraService {
3714 + after = [ "network.target" ] ++
3715 + optional cfg.postgresql.enable "postgresql.service" ++
3716 + optional cfg.redis.enable "redis-sourcehut-${srvsrht}.service";
3717 + requires =
3718 + optional cfg.postgresql.enable "postgresql.service" ++
3719 + optional cfg.redis.enable "redis-sourcehut-${srvsrht}.service";
3720 + path = [ pkgs.gawk ];
3721 + environment.HOME = runDir;
3722 + serviceConfig = {
3723 + User = mkDefault srvCfg.user;
3724 + Group = mkDefault srvCfg.group;
3725 + RuntimeDirectory = [
3726 + "sourcehut/${serviceName}"
3727 + # Used by *srht-keys which reads ../config.ini
3728 + "sourcehut/${serviceName}/subdir"
3729 + "sourcehut/chroots/${serviceName}"
3730 + ];
3731 + RuntimeDirectoryMode = "2750";
3732 + # No need for the chroot path once inside the chroot
3733 + InaccessiblePaths = [ "-+${rootDir}" ];
3734 + # g+rx is for group members (eg. fcgiwrap or nginx)
3735 + # to read Git/Mercurial repositories, buildlogs, etc.
3736 + # o+x is for intermediate directories created by BindPaths= and like,
3737 + # as they're owned by root:root.
3738 + UMask = "0026";
3739 + RootDirectory = rootDir;
3740 + RootDirectoryStartOnly = true;
3741 + PrivateTmp = true;
3742 + MountAPIVFS = true;
3743 + # config.ini is looked up in there, before /etc/srht/config.ini
3744 + # Note that it fails to be set in ExecStartPre=
3745 + WorkingDirectory = mkDefault ("-"+runDir);
3746 + BindReadOnlyPaths = [
3747 + builtins.storeDir
3748 + "/etc"
3749 + "/run/booted-system"
3750 + "/run/current-system"
3751 + "/run/systemd"
3752 + ] ++
3753 + optional cfg.postgresql.enable "/run/postgresql" ++
3754 + optional cfg.redis.enable "/run/redis-sourcehut-${srvsrht}";
3755 + # LoadCredential= are unfortunately not available in ExecStartPre=
3756 + # Hence this one is run as root (the +) with RootDirectoryStartOnly=
3757 + # to reach credentials wherever they are.
3758 + # Note that each systemd service gets its own ${runDir}/config.ini file.
3759 + ExecStartPre = mkBefore [("+"+pkgs.writeShellScript "${serviceName}-credentials" ''
3760 + set -x
3761 + # Replace values begining with a '<' by the content of the file whose name is after.
3762 + gawk '{ if (match($0,/^([^=]+=)<(.+)/,m)) { getline f < m[2]; print m[1] f } else print $0 }' ${configIni} |
3763 + ${optionalString (!allowStripe) "gawk '!/^stripe-secret-key=/' |"}
3764 + install -o ${srvCfg.user} -g root -m 400 /dev/stdin ${runDir}/config.ini
3765 + '')];
3766 + # The following options are only for optimizing:
3767 + # systemd-analyze security
3768 + AmbientCapabilities = "";
3769 + CapabilityBoundingSet = "";
3770 + # ProtectClock= adds DeviceAllow=char-rtc r
3771 + DeviceAllow = "";
3772 + LockPersonality = true;
3773 + MemoryDenyWriteExecute = true;
3774 + NoNewPrivileges = true;
3775 + PrivateDevices = true;
3776 + PrivateMounts = true;
3777 + PrivateNetwork = mkDefault false;
3778 + PrivateUsers = true;
3779 + ProcSubset = "pid";
3780 + ProtectClock = true;
3781 + ProtectControlGroups = true;
3782 + ProtectHome = true;
3783 + ProtectHostname = true;
3784 + ProtectKernelLogs = true;
3785 + ProtectKernelModules = true;
3786 + ProtectKernelTunables = true;
3787 + ProtectProc = "invisible";
3788 + ProtectSystem = "strict";
3789 + RemoveIPC = true;
3790 + RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ];
3791 + RestrictNamespaces = true;
3792 + RestrictRealtime = true;
3793 + RestrictSUIDSGID = true;
3794 + #SocketBindAllow = [ "tcp:${toString srvCfg.port}" "tcp:${toString srvCfg.prometheusPort}" ];
3795 + #SocketBindDeny = "any";
3796 + SystemCallFilter = [
3797 + "@system-service"
3798 + "~@aio" "~@keyring" "~@memlock" "~@privileged" "~@resources" "~@timer"
3799 + "@chown" "@setuid"
3800 + ];
3801 + SystemCallArchitectures = "native";
3802 + };
3803 + } ];
3804 in
3805 -with serviceCfg; with lib; recursiveUpdate
3806 {
3807 - environment.HOME = statePath;
3808 - path = [ config.services.postgresql.package ] ++ (attrs.path or [ ]);
3809 - restartTriggers = [ config.environment.etc."sr.ht/config.ini".source ];
3810 - serviceConfig = {
3811 - Type = "simple";
3812 - User = user;
3813 - Group = user;
3814 - Restart = "always";
3815 - WorkingDirectory = statePath;
3816 - } // (if (cfg.statePath == "/var/lib/sourcehut/${serviceDrv.pname}") then {
3817 - StateDirectory = [ "sourcehut/${serviceDrv.pname}" ];
3818 - } else {})
3819 - ;
3820 + options.services.sourcehut.${srv} = {
3821 + enable = mkEnableOption "${srv} service";
3822
3823 - preStart = ''
3824 - if ! test -e ${statePath}/db; then
3825 - # Setup the initial database
3826 - ${setupDB}
3827 + user = mkOption {
3828 + type = types.str;
3829 + default = srvsrht;
3830 + description = ''
3831 + User for ${srv}.sr.ht.
3832 + '';
3833 + };
3834
3835 - # Set the initial state of the database for future database upgrades
3836 - if test -e ${cfg.python}/bin/${serviceDrv.pname}-migrate; then
3837 - # Run alembic stamp head once to tell alembic the schema is up-to-date
3838 - ${cfg.python}/bin/${serviceDrv.pname}-migrate stamp head
3839 - fi
3840 + group = mkOption {
3841 + type = types.str;
3842 + default = srvsrht;
3843 + description = ''
3844 + Group for ${srv}.sr.ht.
3845 + Membership grants access to the Git/Mercurial repositories by default,
3846 + but not to the config.ini file (where secrets are).
3847 + '';
3848 + };
3849
3850 - printf "%s" "${serviceDrv.version}" > ${statePath}/db
3851 - fi
3852 + port = mkOption {
3853 + type = types.port;
3854 + default = port;
3855 + description = ''
3856 + Port on which the "${srv}" backend should listen.
3857 + '';
3858 + };
3859
3860 - # Update copy of each users' profile to the latest
3861 - # See https://lists.sr.ht/~sircmpwn/sr.ht-admins/<20190302181207.GA13778%40cirno.my.domain>
3862 - if ! test -e ${statePath}/webhook; then
3863 - # Update ${iniKey}'s users' profile copy to the latest
3864 - ${cfg.python}/bin/srht-update-profiles ${iniKey}
3865 + redis = {
3866 + host = mkOption {
3867 + type = types.str;
3868 + default = "unix:/run/redis-sourcehut-${srvsrht}/redis.sock?db=0";
3869 + example = "redis://shared.wireguard:6379/0";
3870 + description = ''
3871 + The redis host URL. This is used for caching and temporary storage, and must
3872 + be shared between nodes (e.g. git1.sr.ht and git2.sr.ht), but need not be
3873 + shared between services. It may be shared between services, however, with no
3874 + ill effect, if this better suits your infrastructure.
3875 + '';
3876 + };
3877 + };
3878
3879 - touch ${statePath}/webhook
3880 - fi
3881 + postgresql = {
3882 + database = mkOption {
3883 + type = types.str;
3884 + default = "${srv}.sr.ht";
3885 + description = ''
3886 + PostgreSQL database name for the ${srv}.sr.ht service,
3887 + used if <xref linkend="opt-services.sourcehut.postgresql.enable"/> is <literal>true</literal>.
3888 + '';
3889 + };
3890 + };
3891
3892 - ${optionalString (builtins.hasAttr "migrate-on-upgrade" cfgIni && cfgIni.migrate-on-upgrade == "yes") ''
3893 - if [ "$(cat ${statePath}/db)" != "${serviceDrv.version}" ]; then
3894 - # Manage schema migrations using alembic
3895 - ${cfg.python}/bin/${serviceDrv.pname}-migrate -a upgrade head
3896 + gunicorn = {
3897 + extraArgs = mkOption {
3898 + type = with types; listOf str;
3899 + default = ["--timeout 120" "--workers 1" "--log-level=info"];
3900 + description = "Extra arguments passed to Gunicorn.";
3901 + };
3902 + };
3903 + } // optionalAttrs webhooks {
3904 + webhooks = {
3905 + extraArgs = mkOption {
3906 + type = with types; listOf str;
3907 + default = ["--loglevel DEBUG" "--pool eventlet" "--without-heartbeat"];
3908 + description = "Extra arguments passed to the Celery responsible for webhooks.";
3909 + };
3910 + celeryConfig = mkOption {
3911 + type = types.lines;
3912 + default = "";
3913 + description = "Content of the <literal>celeryconfig.py</literal> used by the Celery responsible for webhooks.";
3914 + };
3915 + };
3916 + };
3917
3918 - # Mark down current package version
3919 - printf "%s" "${serviceDrv.version}" > ${statePath}/db
3920 - fi
3921 - ''}
3922 + config = lib.mkIf (cfg.enable && srvCfg.enable) (mkMerge [ extraConfig {
3923 + users = {
3924 + users = {
3925 + "${srvCfg.user}" = {
3926 + isSystemUser = true;
3927 + group = mkDefault srvCfg.group;
3928 + description = mkDefault "sourcehut user for ${srv}.sr.ht";
3929 + };
3930 + };
3931 + groups = {
3932 + "${srvCfg.group}" = { };
3933 + } // optionalAttrs (cfg.postgresql.enable
3934 + && hasSuffix "0" (postgresql.settings.unix_socket_permissions or "")) {
3935 + "postgres".members = [ srvCfg.user ];
3936 + } // optionalAttrs (cfg.redis.enable
3937 + && hasSuffix "0" (redis.settings.unixsocketperm or "")) {
3938 + "redis-sourcehut-${srvsrht}".members = [ srvCfg.user ];
3939 + };
3940 + };
3941
3942 - ${attrs.preStart or ""}
3943 - '';
3944 + services.nginx = mkIf cfg.nginx.enable {
3945 + virtualHosts."${srv}.${cfg.settings."sr.ht".global-domain}" = mkMerge [ {
3946 + forceSSL = true;
3947 + locations."/".proxyPass = "http://${cfg.listenAddress}:${toString srvCfg.port}";
3948 + locations."/static" = {
3949 + root = "${pkgs.sourcehut.${srvsrht}}/${pkgs.sourcehut.python.sitePackages}/${srvsrht}";
3950 + extraConfig = mkDefault ''
3951 + expires 30d;
3952 + '';
3953 + };
3954 + } cfg.nginx.virtualHost ];
3955 + };
3956 +
3957 + services.postgresql = mkIf cfg.postgresql.enable {
3958 + authentication = ''
3959 + local ${srvCfg.postgresql.database} ${srvCfg.user} trust
3960 + '';
3961 + ensureDatabases = [ srvCfg.postgresql.database ];
3962 + ensureUsers = map (name: {
3963 + inherit name;
3964 + ensurePermissions = { "DATABASE \"${srvCfg.postgresql.database}\"" = "ALL PRIVILEGES"; };
3965 + }) [srvCfg.user];
3966 + };
3967 +
3968 + services.sourcehut.services = mkDefault (filter (s: cfg.${s}.enable)
3969 + [ "builds" "dispatch" "git" "hg" "hub" "lists" "man" "meta" "pages" "paste" "todo" ]);
3970 +
3971 + services.sourcehut.settings = mkMerge [
3972 + {
3973 + "${srv}.sr.ht".origin = mkDefault "https://${srv}.${cfg.settings."sr.ht".global-domain}";
3974 + }
3975 +
3976 + (mkIf cfg.postgresql.enable {
3977 + "${srv}.sr.ht".connection-string = mkDefault "postgresql:///${srvCfg.postgresql.database}?user=${srvCfg.user}&host=/run/postgresql";
3978 + })
3979 + ];
3980 +
3981 + services.redis.servers."sourcehut-${srvsrht}" = mkIf cfg.redis.enable {
3982 + enable = true;
3983 + databases = 3;
3984 + syslog = true;
3985 + # TODO: set a more informed value
3986 + save = mkDefault [ [1800 10] [300 100] ];
3987 + settings = {
3988 + # TODO: set a more informed value
3989 + maxmemory = "128MB";
3990 + maxmemory-policy = "volatile-ttl";
3991 + };
3992 + };
3993 +
3994 + systemd.services = mkMerge [
3995 + {
3996 + "${srvsrht}" = baseService srvsrht { allowStripe = srv == "meta"; } (mkMerge [
3997 + {
3998 + description = "sourcehut ${srv}.sr.ht website service";
3999 + before = optional cfg.nginx.enable "nginx.service";
4000 + wants = optional cfg.nginx.enable "nginx.service";
4001 + wantedBy = [ "multi-user.target" ];
4002 + path = optional cfg.postgresql.enable postgresql.package;
4003 + # Beware: change in credentials' content will not trigger restart.
4004 + restartTriggers = [ configIni ];
4005 + serviceConfig = {
4006 + Type = "simple";
4007 + Restart = mkDefault "always";
4008 + #RestartSec = mkDefault "2min";
4009 + StateDirectory = [ "sourcehut/${srvsrht}" ];
4010 + StateDirectoryMode = "2750";
4011 + ExecStart = "${cfg.python}/bin/gunicorn ${srvsrht}.app:app --name ${srvsrht} --bind ${cfg.listenAddress}:${toString srvCfg.port} " + concatStringsSep " " srvCfg.gunicorn.extraArgs;
4012 + };
4013 + preStart = let
4014 + version = pkgs.sourcehut.${srvsrht}.version;
4015 + stateDir = "/var/lib/sourcehut/${srvsrht}";
4016 + in mkBefore ''
4017 + set -x
4018 + # Use the /run/sourcehut/${srvsrht}/config.ini
4019 + # installed by a previous ExecStartPre= in baseService
4020 + cd /run/sourcehut/${srvsrht}
4021 +
4022 + if test ! -e ${stateDir}/db; then
4023 + # Setup the initial database.
4024 + # Note that it stamps the alembic head afterward
4025 + ${cfg.python}/bin/${srvsrht}-initdb
4026 + echo ${version} >${stateDir}/db
4027 + fi
4028 +
4029 + ${optionalString cfg.settings.${iniKey}.migrate-on-upgrade ''
4030 + if [ "$(cat ${stateDir}/db)" != "${version}" ]; then
4031 + # Manage schema migrations using alembic
4032 + ${cfg.python}/bin/${srvsrht}-migrate -a upgrade head
4033 + echo ${version} >${stateDir}/db
4034 + fi
4035 + ''}
4036 +
4037 + # Update copy of each users' profile to the latest
4038 + # See https://lists.sr.ht/~sircmpwn/sr.ht-admins/<20190302181207.GA13778%40cirno.my.domain>
4039 + if test ! -e ${stateDir}/webhook; then
4040 + # Update ${iniKey}'s users' profile copy to the latest
4041 + ${cfg.python}/bin/srht-update-profiles ${iniKey}
4042 + touch ${stateDir}/webhook
4043 + fi
4044 + '';
4045 + } mainService ]);
4046 + }
4047 +
4048 + (mkIf webhooks {
4049 + "${srvsrht}-webhooks" = baseService "${srvsrht}-webhooks" {}
4050 + {
4051 + description = "sourcehut ${srv}.sr.ht webhooks service";
4052 + after = [ "${srvsrht}.service" ];
4053 + wantedBy = [ "${srvsrht}.service" ];
4054 + partOf = [ "${srvsrht}.service" ];
4055 + preStart = ''
4056 + cp ${pkgs.writeText "${srvsrht}-webhooks-celeryconfig.py" srvCfg.webhooks.celeryConfig} \
4057 + /run/sourcehut/${srvsrht}-webhooks/celeryconfig.py
4058 + '';
4059 + serviceConfig = {
4060 + Type = "simple";
4061 + Restart = "always";
4062 + ExecStart = "${cfg.python}/bin/celery --app ${srvsrht}.webhooks worker --hostname ${srvsrht}-webhooks@%%h " + concatStringsSep " " srvCfg.webhooks.extraArgs;
4063 + # Avoid crashing: os.getloadavg()
4064 + ProcSubset = mkForce "all";
4065 + };
4066 + };
4067 + })
4068 +
4069 + (mapAttrs (timerName: timer: (baseService timerName {} (mkMerge [
4070 + {
4071 + description = "sourcehut ${timerName} service";
4072 + after = [ "network.target" "${srvsrht}.service" ];
4073 + serviceConfig = {
4074 + Type = "oneshot";
4075 + ExecStart = "${cfg.python}/bin/${timerName}";
4076 + };
4077 + }
4078 + (timer.service or {})
4079 + ]))) extraTimers)
4080 +
4081 + (mapAttrs (serviceName: extraService: baseService serviceName {} (mkMerge [
4082 + {
4083 + description = "sourcehut ${serviceName} service";
4084 + # So that extraServices have the PostgreSQL database initialized.
4085 + after = [ "${srvsrht}.service" ];
4086 + wantedBy = [ "${srvsrht}.service" ];
4087 + partOf = [ "${srvsrht}.service" ];
4088 + serviceConfig = {
4089 + Type = "simple";
4090 + Restart = mkDefault "always";
4091 + };
4092 + }
4093 + extraService
4094 + ])) extraServices)
4095 + ];
4096 +
4097 + systemd.timers = mapAttrs (timerName: timer:
4098 + {
4099 + description = "sourcehut timer for ${timerName}";
4100 + wantedBy = [ "timers.target" ];
4101 + inherit (timer) timerConfig;
4102 + }) extraTimers;
4103 + } ]);
4104 }
4105 - (builtins.removeAttrs attrs [ "path" "preStart" ])
4106 diff --git a/nixos/modules/services/misc/sourcehut/sourcehut.xml b/nixos/modules/services/misc/sourcehut/sourcehut.xml
4107 index ab9a8c6cb4b..41094f65a94 100644
4108 --- a/nixos/modules/services/misc/sourcehut/sourcehut.xml
4109 +++ b/nixos/modules/services/misc/sourcehut/sourcehut.xml
4110 @@ -14,13 +14,12 @@
4111 <title>Basic usage</title>
4112 <para>
4113 Sourcehut is a Python and Go based set of applications.
4114 - <literal><link linkend="opt-services.sourcehut.enable">services.sourcehut</link></literal>
4115 - by default will use
4116 + This NixOS module also provides basic configuration integrating Sourcehut into locally running
4117 <literal><link linkend="opt-services.nginx.enable">services.nginx</link></literal>,
4118 - <literal><link linkend="opt-services.nginx.enable">services.redis</link></literal>,
4119 - <literal><link linkend="opt-services.nginx.enable">services.cron</link></literal>,
4120 + <literal><link linkend="opt-services.redis.servers">services.redis.servers.sourcehut</link></literal>,
4121 + <literal><link linkend="opt-services.postfix.enable">services.postfix</link></literal>
4122 and
4123 - <literal><link linkend="opt-services.postgresql.enable">services.postgresql</link></literal>.
4124 + <literal><link linkend="opt-services.postgresql.enable">services.postgresql</link></literal> services.
4125 </para>
4126
4127 <para>
4128 @@ -42,18 +41,23 @@ in {
4129
4130 services.sourcehut = {
4131 <link linkend="opt-services.sourcehut.enable">enable</link> = true;
4132 - <link linkend="opt-services.sourcehut.originBase">originBase</link> = fqdn;
4133 - <link linkend="opt-services.sourcehut.services">services</link> = [ "meta" "man" "git" ];
4134 + <link linkend="opt-services.sourcehut.git.enable">git.enable</link> = true;
4135 + <link linkend="opt-services.sourcehut.man.enable">man.enable</link> = true;
4136 + <link linkend="opt-services.sourcehut.meta.enable">meta.enable</link> = true;
4137 + <link linkend="opt-services.sourcehut.nginx.enable">nginx.enable</link> = true;
4138 + <link linkend="opt-services.sourcehut.postfix.enable">postfix.enable</link> = true;
4139 + <link linkend="opt-services.sourcehut.postgresql.enable">postgresql.enable</link> = true;
4140 + <link linkend="opt-services.sourcehut.redis.enable">redis.enable</link> = true;
4141 <link linkend="opt-services.sourcehut.settings">settings</link> = {
4142 "sr.ht" = {
4143 environment = "production";
4144 global-domain = fqdn;
4145 origin = "https://${fqdn}";
4146 # Produce keys with srht-keygen from <package>sourcehut.coresrht</package>.
4147 - network-key = "SECRET";
4148 - service-key = "SECRET";
4149 + network-key = "/run/keys/path/to/network-key";
4150 + service-key = "/run/keys/path/to/service-key";
4151 };
4152 - webhooks.private-key= "SECRET";
4153 + webhooks.private-key= "/run/keys/path/to/webhook-key";
4154 };
4155 };
4156
4157 diff --git a/nixos/modules/services/misc/sourcehut/todo.nix b/nixos/modules/services/misc/sourcehut/todo.nix
4158 deleted file mode 100644
4159 index aec773b0669..00000000000
4160 --- a/nixos/modules/services/misc/sourcehut/todo.nix
4161 +++ /dev/null
4162 @@ -1,161 +0,0 @@
4163 -{ config, lib, pkgs, ... }:
4164 -
4165 -with lib;
4166 -let
4167 - cfg = config.services.sourcehut;
4168 - cfgIni = cfg.settings;
4169 - scfg = cfg.todo;
4170 - iniKey = "todo.sr.ht";
4171 -
4172 - rcfg = config.services.redis;
4173 - drv = pkgs.sourcehut.todosrht;
4174 -in
4175 -{
4176 - options.services.sourcehut.todo = {
4177 - user = mkOption {
4178 - type = types.str;
4179 - default = "todosrht";
4180 - description = ''
4181 - User for todo.sr.ht.
4182 - '';
4183 - };
4184 -
4185 - port = mkOption {
4186 - type = types.port;
4187 - default = 5003;
4188 - description = ''
4189 - Port on which the "todo" module should listen.
4190 - '';
4191 - };
4192 -
4193 - database = mkOption {
4194 - type = types.str;
4195 - default = "todo.sr.ht";
4196 - description = ''
4197 - PostgreSQL database name for todo.sr.ht.
4198 - '';
4199 - };
4200 -
4201 - statePath = mkOption {
4202 - type = types.path;
4203 - default = "${cfg.statePath}/todosrht";
4204 - description = ''
4205 - State path for todo.sr.ht.
4206 - '';
4207 - };
4208 - };
4209 -
4210 - config = with scfg; lib.mkIf (cfg.enable && elem "todo" cfg.services) {
4211 - users = {
4212 - users = {
4213 - "${user}" = {
4214 - isSystemUser = true;
4215 - group = user;
4216 - extraGroups = [ "postfix" ];
4217 - description = "todo.sr.ht user";
4218 - };
4219 - };
4220 - groups = {
4221 - "${user}" = { };
4222 - };
4223 - };
4224 -
4225 - services.postgresql = {
4226 - authentication = ''
4227 - local ${database} ${user} trust
4228 - '';
4229 - ensureDatabases = [ database ];
4230 - ensureUsers = [
4231 - {
4232 - name = user;
4233 - ensurePermissions = { "DATABASE \"${database}\"" = "ALL PRIVILEGES"; };
4234 - }
4235 - ];
4236 - };
4237 -
4238 - systemd = {
4239 - tmpfiles.rules = [
4240 - "d ${statePath} 0750 ${user} ${user} -"
4241 - ];
4242 -
4243 - services = {
4244 - todosrht = import ./service.nix { inherit config pkgs lib; } scfg drv iniKey {
4245 - after = [ "postgresql.service" "network.target" ];
4246 - requires = [ "postgresql.service" ];
4247 - wantedBy = [ "multi-user.target" ];
4248 -
4249 - description = "todo.sr.ht website service";
4250 -
4251 - serviceConfig.ExecStart = "${cfg.python}/bin/gunicorn ${drv.pname}.app:app -b ${cfg.address}:${toString port}";
4252 - };
4253 -
4254 - todosrht-lmtp = {
4255 - after = [ "postgresql.service" "network.target" ];
4256 - bindsTo = [ "postgresql.service" ];
4257 - wantedBy = [ "multi-user.target" ];
4258 -
4259 - description = "todo.sr.ht process service";
4260 - serviceConfig = {
4261 - Type = "simple";
4262 - User = user;
4263 - Restart = "always";
4264 - ExecStart = "${cfg.python}/bin/todosrht-lmtp";
4265 - };
4266 - };
4267 -
4268 - todosrht-webhooks = {
4269 - after = [ "postgresql.service" "network.target" ];
4270 - requires = [ "postgresql.service" ];
4271 - wantedBy = [ "multi-user.target" ];
4272 -
4273 - description = "todo.sr.ht webhooks service";
4274 - serviceConfig = {
4275 - Type = "simple";
4276 - User = user;
4277 - Restart = "always";
4278 - ExecStart = "${cfg.python}/bin/celery -A ${drv.pname}.webhooks worker --loglevel=info";
4279 - };
4280 -
4281 - };
4282 - };
4283 - };
4284 -
4285 - services.sourcehut.settings = {
4286 - # URL todo.sr.ht is being served at (protocol://domain)
4287 - "todo.sr.ht".origin = mkDefault "http://todo.${cfg.originBase}";
4288 - # Address and port to bind the debug server to
4289 - "todo.sr.ht".debug-host = mkDefault "0.0.0.0";
4290 - "todo.sr.ht".debug-port = mkDefault port;
4291 - # Configures the SQLAlchemy connection string for the database.
4292 - "todo.sr.ht".connection-string = mkDefault "postgresql:///${database}?user=${user}&host=/var/run/postgresql";
4293 - # Set to "yes" to automatically run migrations on package upgrade.
4294 - "todo.sr.ht".migrate-on-upgrade = mkDefault "yes";
4295 - # todo.sr.ht's OAuth client ID and secret for meta.sr.ht
4296 - # Register your client at meta.example.org/oauth
4297 - "todo.sr.ht".oauth-client-id = mkDefault null;
4298 - "todo.sr.ht".oauth-client-secret = mkDefault null;
4299 - # Outgoing email for notifications generated by users
4300 - "todo.sr.ht".notify-from = mkDefault "CHANGEME@example.org";
4301 - # The redis connection used for the webhooks worker
4302 - "todo.sr.ht".webhooks = mkDefault "redis://${rcfg.bind}:${toString rcfg.port}/1";
4303 - # Network-key
4304 - "todo.sr.ht".network-key = mkDefault null;
4305 -
4306 - # Path for the lmtp daemon's unix socket. Direct incoming mail to this socket.
4307 - # Alternatively, specify IP:PORT and an SMTP server will be run instead.
4308 - "todo.sr.ht::mail".sock = mkDefault "/tmp/todo.sr.ht-lmtp.sock";
4309 - # The lmtp daemon will make the unix socket group-read/write for users in this
4310 - # group.
4311 - "todo.sr.ht::mail".sock-group = mkDefault "postfix";
4312 -
4313 - "todo.sr.ht::mail".posting-domain = mkDefault "todo.${cfg.originBase}";
4314 - };
4315 -
4316 - services.nginx.virtualHosts."todo.${cfg.originBase}" = {
4317 - forceSSL = true;
4318 - locations."/".proxyPass = "http://${cfg.address}:${toString port}";
4319 - locations."/query".proxyPass = "http://${cfg.address}:${toString (port + 100)}";
4320 - locations."/static".root = "${pkgs.sourcehut.todosrht}/${pkgs.sourcehut.python.sitePackages}/todosrht";
4321 - };
4322 - };
4323 -}
4324 diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
4325 index dab99dd8d04..2b6ba687fe8 100644
4326 --- a/nixos/tests/all-tests.nix
4327 +++ b/nixos/tests/all-tests.nix
4328 @@ -408,6 +408,7 @@ in
4329 solanum = handleTest ./solanum.nix {};
4330 solr = handleTest ./solr.nix {};
4331 sonarr = handleTest ./sonarr.nix {};
4332 + sourcehut = handleTest ./sourcehut.nix {};
4333 spacecookie = handleTest ./spacecookie.nix {};
4334 spike = handleTest ./spike.nix {};
4335 sslh = handleTest ./sslh.nix {};
4336 diff --git a/nixos/tests/sourcehut.nix b/nixos/tests/sourcehut.nix
4337 index b56a14ebf85..6492250bd57 100644
4338 --- a/nixos/tests/sourcehut.nix
4339 +++ b/nixos/tests/sourcehut.nix
4340 @@ -12,10 +12,20 @@ import ./make-test-python.nix ({ pkgs, ... }:
4341 services.sourcehut = {
4342 enable = true;
4343 services = [ "meta" ];
4344 - originBase = "sourcehut";
4345 - settings."sr.ht".service-key = "8888888888888888888888888888888888888888888888888888888888888888";
4346 - settings."sr.ht".network-key = "0000000000000000000000000000000000000000000=";
4347 - settings.webhooks.private-key = "0000000000000000000000000000000000000000000=";
4348 + redis.enable = true;
4349 + postgresql.enable = true;
4350 + meta.enable = true;
4351 + settings."sr.ht" = {
4352 + global-domain = "sourcehut";
4353 + service-key = pkgs.writeText "service-key" "8b327279b77e32a3620e2fc9aabce491cc46e7d821fd6713b2a2e650ce114d01";
4354 + network-key = pkgs.writeText "network-key" "cEEmc30BRBGkgQZcHFksiG7hjc6_dK1XR2Oo5Jb9_nQ=";
4355 + };
4356 + settings.webhooks.private-key = pkgs.writeText "webhook-key" "Ra3IjxgFiwG9jxgp4WALQIZw/BMYt30xWiOsqD0J7EA=";
4357 + };
4358 + services.postgresql = {
4359 + enable = true;
4360 + enableTCPIP = false;
4361 + settings.unix_socket_permissions = "0770";
4362 };
4363 };
4364
4365 diff --git a/pkgs/applications/version-management/sourcehut/builds.nix b/pkgs/applications/version-management/sourcehut/builds.nix
4366 index c8163caf8ea..7ea2fef54bb 100644
4367 --- a/pkgs/applications/version-management/sourcehut/builds.nix
4368 +++ b/pkgs/applications/version-management/sourcehut/builds.nix
4369 @@ -11,26 +11,55 @@
4370 , python
4371 }:
4372 let
4373 - version = "0.66.7";
4374 -
4375 - buildWorker = src: buildGoModule {
4376 - inherit src version;
4377 - pname = "builds-sr-ht-worker";
4378 -
4379 - vendorSha256 = "sha256-giOaldV46aBqXyFH/cQVsbUr6Rb4VMhbBO86o48tRZY=";
4380 - };
4381 -in
4382 -buildPythonPackage rec {
4383 - inherit version;
4384 - pname = "buildsrht";
4385 + version = "0.71.6";
4386
4387 src = fetchFromSourcehut {
4388 owner = "~sircmpwn";
4389 repo = "builds.sr.ht";
4390 rev = version;
4391 - sha256 = "sha256-2MLs/DOXHjEYarXDVUcPZe3o0fmZbzVxn528SE72lhM=";
4392 + sha256 = "sha256-c2xp2uIP8+WeRMz0efA1H58Nkot65bc03e7rrrZk3jo=";
4393 };
4394
4395 + worker = buildGoModule rec {
4396 + inherit src version;
4397 + sourceRoot = "source/worker";
4398 + pname = "buildsrht-worker";
4399 +
4400 + vendorSha256 = "sha256-iMlCZPCIwhppPAYUi6E8td1BoNaqBuQCI5E83cnEBJ0=";
4401 +
4402 + # What follows is only to update go-redis,
4403 + # and thus also using a patched srht-keys.
4404 + # go.{mod,sum} could be patched directly but that would be less resilient
4405 + # to changes from upstream, and thus harder to maintain the patching
4406 + # while it hasn't been merged upstream.
4407 +
4408 + overrideModAttrs = old: {
4409 + inherit patches patchFlags;
4410 + preBuild = ''
4411 + go get github.com/go-redis/redis/v8
4412 + go get github.com/go-redis/redis@none
4413 + go mod tidy
4414 + '';
4415 + # Pass updated go.{mod,sum} from go-modules to worker's vendor/go.{mod,sum}
4416 + postInstall = ''
4417 + cp --reflink=auto go.* $out/
4418 + '';
4419 + };
4420 +
4421 + patches = [
4422 + # Update go-redis to support Unix sockets
4423 + patches/redis-socket/build/v3-0001-worker-update-go-redis-to-support-Unix-sockets.patch
4424 + ];
4425 + patchFlags = "-p2";
4426 + postConfigure = ''
4427 + cp -v vendor/go.{mod,sum} .
4428 + '';
4429 + };
4430 +in
4431 +buildPythonPackage rec {
4432 + inherit src version;
4433 + pname = "buildsrht";
4434 +
4435 nativeBuildInputs = srht.nativeBuildInputs;
4436
4437 propagatedBuildInputs = [
4438 @@ -53,13 +82,17 @@ buildPythonPackage rec {
4439
4440 cp -r images $out/lib
4441 cp contrib/submit_image_build $out/bin/builds.sr.ht
4442 - cp ${buildWorker "${src}/worker"}/bin/worker $out/bin/builds.sr.ht-worker
4443 + cp ${worker}/bin/worker $out/bin/builds.sr.ht-worker
4444 '';
4445
4446 + pythonImportsCheck = [ "buildsrht" ];
4447 +
4448 + passthru = { inherit worker; };
4449 +
4450 meta = with lib; {
4451 homepage = "https://git.sr.ht/~sircmpwn/builds.sr.ht";
4452 description = "Continuous integration service for the sr.ht network";
4453 - license = licenses.agpl3;
4454 + license = licenses.agpl3Only;
4455 maintainers = with maintainers; [ eadwu ];
4456 };
4457 }
4458 diff --git a/pkgs/applications/version-management/sourcehut/core.nix b/pkgs/applications/version-management/sourcehut/core.nix
4459 index 7c3a516ed9d..2b302d1441c 100644
4460 --- a/pkgs/applications/version-management/sourcehut/core.nix
4461 +++ b/pkgs/applications/version-management/sourcehut/core.nix
4462 @@ -25,17 +25,16 @@
4463 , sassc
4464 , nodejs
4465 , redis
4466 -, writeText
4467 }:
4468
4469 buildPythonPackage rec {
4470 pname = "srht";
4471 - version = "0.67.4";
4472 + version = "0.67.25";
4473
4474 src = fetchgit {
4475 url = "https://git.sr.ht/~sircmpwn/core.sr.ht";
4476 rev = version;
4477 - sha256 = "sha256-XvzFfcBK5Mq8p7xEBAF/eupUE1kkUBh5k+ByM/WA9bc=";
4478 + sha256 = "sha256-JZXIpNEY1/KUaYh0Vk5j/zVO9JQc2F1RmnZ/5TFN0PI=";
4479 fetchSubmodules = true;
4480 };
4481
4482 @@ -46,7 +45,10 @@ buildPythonPackage rec {
4483 };
4484
4485 patches = [
4486 - ./disable-npm-install.patch
4487 + # Disable check for npm
4488 + patches/disable-npm-install.patch
4489 + # Add Unix socket support for redis-host=
4490 + patches/redis-socket/core/v3-0001-add-Unix-socket-support-for-redis-host.patch
4491 ];
4492
4493 nativeBuildInputs = [
4494 @@ -87,6 +89,7 @@ buildPythonPackage rec {
4495 '';
4496
4497 dontUseSetuptoolsCheck = true;
4498 + pythonImportsCheck = [ "srht" ];
4499
4500 meta = with lib; {
4501 homepage = "https://git.sr.ht/~sircmpwn/srht";
4502 diff --git a/pkgs/applications/version-management/sourcehut/default.nix b/pkgs/applications/version-management/sourcehut/default.nix
4503 index 401a1437b7d..7dde841b543 100644
4504 --- a/pkgs/applications/version-management/sourcehut/default.nix
4505 +++ b/pkgs/applications/version-management/sourcehut/default.nix
4506 @@ -22,10 +22,12 @@ let
4507 listssrht = self.callPackage ./lists.nix { };
4508 mansrht = self.callPackage ./man.nix { };
4509 metasrht = self.callPackage ./meta.nix { };
4510 + pagessrht = self.callPackage ./pages.nix { };
4511 pastesrht = self.callPackage ./paste.nix { };
4512 todosrht = self.callPackage ./todo.nix { };
4513
4514 scmsrht = self.callPackage ./scm.nix { };
4515 + srht-keys = self.scmsrht.srht-keys;
4516 };
4517 };
4518 in
4519 @@ -40,6 +42,8 @@ with python.pkgs; recurseIntoAttrs {
4520 listssrht = toPythonApplication listssrht;
4521 mansrht = toPythonApplication mansrht;
4522 metasrht = toPythonApplication metasrht;
4523 + pagessrht = pagessrht;
4524 pastesrht = toPythonApplication pastesrht;
4525 todosrht = toPythonApplication todosrht;
4526 + srht-keys = scmsrht.srht-keys;
4527 }
4528 diff --git a/pkgs/applications/version-management/sourcehut/dispatch.nix b/pkgs/applications/version-management/sourcehut/dispatch.nix
4529 index 637c6f9c1df..9456d0c998c 100644
4530 --- a/pkgs/applications/version-management/sourcehut/dispatch.nix
4531 +++ b/pkgs/applications/version-management/sourcehut/dispatch.nix
4532 @@ -9,13 +9,13 @@
4533
4534 buildPythonPackage rec {
4535 pname = "dispatchsrht";
4536 - version = "0.15.8";
4537 + version = "0.15.32";
4538
4539 src = fetchFromSourcehut {
4540 owner = "~sircmpwn";
4541 repo = "dispatch.sr.ht";
4542 rev = version;
4543 - sha256 = "sha256-zWCGPjIgMKHXHJUs9aciV7IFgo0rpahon6KXHDwcfss=";
4544 + sha256 = "sha256-4P4cXhjcZ8IBzpRfmYIJkzl9U4Plo36a48Pf/KjmhFY=";
4545 };
4546
4547 nativeBuildInputs = srht.nativeBuildInputs;
4548 @@ -31,10 +31,12 @@ buildPythonPackage rec {
4549 export SRHT_PATH=${srht}/${python.sitePackages}/srht
4550 '';
4551
4552 + pythonImportsCheck = [ "dispatchsrht" ];
4553 +
4554 meta = with lib; {
4555 homepage = "https://dispatch.sr.ht/~sircmpwn/dispatch.sr.ht";
4556 description = "Task dispatcher and service integration tool for the sr.ht network";
4557 - license = licenses.agpl3;
4558 + license = licenses.agpl3Only;
4559 maintainers = with maintainers; [ eadwu ];
4560 };
4561 }
4562 diff --git a/pkgs/applications/version-management/sourcehut/git.nix b/pkgs/applications/version-management/sourcehut/git.nix
4563 index e44fb9cd6c6..2aed7b4a5fe 100644
4564 --- a/pkgs/applications/version-management/sourcehut/git.nix
4565 +++ b/pkgs/applications/version-management/sourcehut/git.nix
4566 @@ -6,42 +6,111 @@
4567 , srht
4568 , pygit2
4569 , scmsrht
4570 +, srht-keys
4571 }:
4572 let
4573 - version = "0.72.8";
4574 + version = "0.72.47";
4575
4576 src = fetchFromSourcehut {
4577 owner = "~sircmpwn";
4578 repo = "git.sr.ht";
4579 rev = version;
4580 - sha256 = "sha256-AB2uzajO5PtcpJfbOOTfuDFM6is5K39v3AZJ1hShRNc=";
4581 + sha256 = "sha256-jk2DFC/fDYN88nofntJrBtYfCWr39YaNv2azH/tdZtQ=";
4582 };
4583
4584 - buildShell = src: buildGoModule {
4585 + gitsrht-shell = buildGoModule {
4586 inherit src version;
4587 + sourceRoot = "source/gitsrht-shell";
4588 pname = "gitsrht-shell";
4589 vendorSha256 = "sha256-aqUFICp0C2reqb2p6JCPAUIRsxzSv0t9BHoNWrTYfqk=";
4590 };
4591
4592 - buildDispatcher = src: buildGoModule {
4593 + gitsrht-dispatch = buildGoModule {
4594 inherit src version;
4595 + sourceRoot = "source/gitsrht-dispatch";
4596 pname = "gitsrht-dispatcher";
4597 vendorSha256 = "sha256-qWXPHo86s6iuRBhRMtmD5jxnAWKdrWHtA/iSUkdw89M=";
4598 + patches = [
4599 + # Add support for supplementary groups
4600 + patches/redis-socket/git/v3-0003-gitsrht-dispatch-add-support-for-supplementary-gr.patch
4601 + ];
4602 + patchFlags = "-p2";
4603 };
4604
4605 - buildKeys = src: buildGoModule {
4606 + gitsrht-keys = buildGoModule rec {
4607 inherit src version;
4608 + sourceRoot = "source/gitsrht-keys";
4609 pname = "gitsrht-keys";
4610 - vendorSha256 = "1d94cqy7x0q0agwg515xxsbl70b3qrzxbzsyjhn1pbyj532brn7f";
4611 + vendorSha256 = "sha256-m6uIrYDWqGagi+jjfYo4C59SjLqaaXwDq9vO0b9EW6M=";
4612 +
4613 + # What follows is only to update go-redis,
4614 + # and thus also using a patched srht-keys.
4615 + # go.{mod,sum} could be patched directly but that would be less resilient
4616 + # to changes from upstream, and thus harder to maintain the patching
4617 + # while it hasn't been merged upstream.
4618 +
4619 + overrideModAttrs = old: {
4620 + inherit patches patchFlags;
4621 + preBuild = ''
4622 + # This is a fixed-output derivation so it is not allowed to reference other derivations,
4623 + # but here srht-keys will be copied to vendor/ by go mod vendor
4624 + ln -s ${srht-keys} srht-keys
4625 + go mod edit -replace git.sr.ht/~sircmpwn/scm.sr.ht/srht-keys=$PWD/srht-keys
4626 + go get github.com/go-redis/redis/v8
4627 + go get github.com/go-redis/redis@none
4628 + go mod tidy
4629 + '';
4630 + # Pass updated go.{mod,sum} from go-modules to gitsrht-keys' vendor/go.{mod,sum}
4631 + postInstall = ''
4632 + cp --reflink=auto go.* $out/
4633 + '';
4634 + };
4635 +
4636 + patches = [
4637 + # Update go-redis to support Unix sockets
4638 + patches/redis-socket/git/v3-0001-gitsrht-keys-update-go-redis-to-support-Unix-sock.patch
4639 + ];
4640 + patchFlags = "-p2";
4641 + postConfigure = ''
4642 + cp -v vendor/go.{mod,sum} .
4643 + '';
4644 };
4645
4646 - buildUpdateHook = src: buildGoModule {
4647 + gitsrht-update-hook = buildGoModule rec {
4648 inherit src version;
4649 + sourceRoot = "source/gitsrht-update-hook";
4650 pname = "gitsrht-update-hook";
4651 - vendorSha256 = "0fwzqpjv8x5y3w3bfjd0x0cvqjjak23m0zj88hf32jpw49xmjkih";
4652 - };
4653 + vendorSha256 = "sha256-UoHxGVYEgTDqFzVQ2Dv6BRT4jVt+/QpNqEH3G2UWFjs=";
4654
4655 - updateHook = buildUpdateHook "${src}/gitsrht-update-hook";
4656 + # What follows is only to update go-redis
4657 + # and thus also using a patched srht-keys.
4658 +
4659 + overrideModAttrs = old: {
4660 + inherit patches patchFlags;
4661 + preBuild = ''
4662 + # This is a fixed-output derivation so it is not allowed to reference other derivations,
4663 + # but here srht-keys will be copied to vendor/ by go mod vendor
4664 + ln -s ${srht-keys} srht-keys
4665 + go mod edit -replace git.sr.ht/~sircmpwn/scm.sr.ht/srht-keys=$PWD/srht-keys
4666 + go get github.com/go-redis/redis/v8
4667 + go get github.com/go-redis/redis@none
4668 + go mod tidy
4669 + '';
4670 + # Pass updated go.{mod,sum} from go-modules to gitsrht-keys' vendor/go.{mod,sum}
4671 + postInstall = ''
4672 + cp --reflink=auto go.* $out/
4673 + '';
4674 + };
4675 +
4676 + patches = [
4677 + # Update go-redis to support Unix sockets
4678 + patches/redis-socket/git/v3-0002-gitsrht-update-hook-update-go-redis-to-support-Un.patch
4679 + ];
4680 + patchFlags = "-p2";
4681 + postConfigure = ''
4682 + cp -v vendor/go.{mod,sum} .
4683 + '';
4684 + };
4685
4686 in
4687 buildPythonPackage rec {
4688 @@ -63,19 +132,21 @@ buildPythonPackage rec {
4689
4690 postInstall = ''
4691 mkdir -p $out/bin
4692 - cp ${buildShell "${src}/gitsrht-shell"}/bin/gitsrht-shell $out/bin/gitsrht-shell
4693 - cp ${buildDispatcher "${src}/gitsrht-dispatch"}/bin/gitsrht-dispatch $out/bin/gitsrht-dispatch
4694 - cp ${buildKeys "${src}/gitsrht-keys"}/bin/gitsrht-keys $out/bin/gitsrht-keys
4695 - cp ${updateHook}/bin/gitsrht-update-hook $out/bin/gitsrht-update-hook
4696 + cp ${gitsrht-shell}/bin/gitsrht-shell $out/bin/gitsrht-shell
4697 + cp ${gitsrht-dispatch}/bin/gitsrht-dispatch $out/bin/gitsrht-dispatch
4698 + cp ${gitsrht-keys}/bin/gitsrht-keys $out/bin/gitsrht-keys
4699 + cp ${gitsrht-update-hook}/bin/gitsrht-update-hook $out/bin/gitsrht-update-hook
4700 '';
4701 passthru = {
4702 - inherit updateHook;
4703 + inherit gitsrht-shell gitsrht-dispatch gitsrht-keys gitsrht-update-hook;
4704 };
4705
4706 + pythonImportsCheck = [ "gitsrht" ];
4707 +
4708 meta = with lib; {
4709 homepage = "https://git.sr.ht/~sircmpwn/git.sr.ht";
4710 description = "Git repository hosting service for the sr.ht network";
4711 - license = licenses.agpl3;
4712 + license = licenses.agpl3Only;
4713 maintainers = with maintainers; [ eadwu ];
4714 };
4715 }
4716 diff --git a/pkgs/applications/version-management/sourcehut/hg.nix b/pkgs/applications/version-management/sourcehut/hg.nix
4717 index cddb76cabf2..1d6062d81cc 100644
4718 --- a/pkgs/applications/version-management/sourcehut/hg.nix
4719 +++ b/pkgs/applications/version-management/sourcehut/hg.nix
4720 @@ -10,12 +10,12 @@
4721
4722 buildPythonPackage rec {
4723 pname = "hgsrht";
4724 - version = "0.27.4";
4725 + version = "0.27.6";
4726
4727 src = fetchhg {
4728 url = "https://hg.sr.ht/~sircmpwn/hg.sr.ht";
4729 rev = version;
4730 - sha256 = "1c0qfi0gmbfngvds6917fy9ii2iglawn429757rh7b4bvzn7n6mr";
4731 + sha256 = "ibijvKjS4CiWTYrO6Qdh3RkD0EUE7BY8wjdPwrD6vkA=";
4732 };
4733
4734 nativeBuildInputs = srht.nativeBuildInputs;
4735 @@ -32,10 +32,12 @@ buildPythonPackage rec {
4736 export SRHT_PATH=${srht}/${python.sitePackages}/srht
4737 '';
4738
4739 + pythonImportsCheck = [ "hgsrht" ];
4740 +
4741 meta = with lib; {
4742 homepage = "https://git.sr.ht/~sircmpwn/hg.sr.ht";
4743 description = "Mercurial repository hosting service for the sr.ht network";
4744 - license = licenses.agpl3;
4745 + license = licenses.agpl3Only;
4746 maintainers = with maintainers; [ eadwu ];
4747 };
4748 }
4749 diff --git a/pkgs/applications/version-management/sourcehut/hub.nix b/pkgs/applications/version-management/sourcehut/hub.nix
4750 index 17cb3fe4b61..31975b305c5 100644
4751 --- a/pkgs/applications/version-management/sourcehut/hub.nix
4752 +++ b/pkgs/applications/version-management/sourcehut/hub.nix
4753 @@ -6,13 +6,13 @@
4754
4755 buildPythonPackage rec {
4756 pname = "hubsrht";
4757 - version = "0.13.1";
4758 + version = "0.13.11";
4759
4760 src = fetchFromSourcehut {
4761 owner = "~sircmpwn";
4762 repo = "hub.sr.ht";
4763 rev = version;
4764 - sha256 = "sha256-Kqzy4mh5Nn1emzHBco/LVuXro/tW3NX+OYqdEwBSQ/U=";
4765 + sha256 = "sha256-AIpP7gfXoBvl6s8+dA3XrjuUHsPTtKFsZqwqbjBKYUk=";
4766 };
4767
4768 nativeBuildInputs = srht.nativeBuildInputs;
4769 @@ -26,11 +26,12 @@ buildPythonPackage rec {
4770 '';
4771
4772 dontUseSetuptoolsCheck = true;
4773 + pythonImportsCheck = [ "hubsrht" ];
4774
4775 meta = with lib; {
4776 homepage = "https://git.sr.ht/~sircmpwn/hub.sr.ht";
4777 description = "Project hub service for the sr.ht network";
4778 - license = licenses.agpl3;
4779 + license = licenses.agpl3Only;
4780 maintainers = with maintainers; [ eadwu ];
4781 };
4782 }
4783 diff --git a/pkgs/applications/version-management/sourcehut/lists.nix b/pkgs/applications/version-management/sourcehut/lists.nix
4784 index b419b49f7b5..51b1a3627db 100644
4785 --- a/pkgs/applications/version-management/sourcehut/lists.nix
4786 +++ b/pkgs/applications/version-management/sourcehut/lists.nix
4787 @@ -12,13 +12,13 @@
4788
4789 buildPythonPackage rec {
4790 pname = "listssrht";
4791 - version = "0.48.19";
4792 + version = "0.50.1";
4793
4794 src = fetchFromSourcehut {
4795 owner = "~sircmpwn";
4796 repo = "lists.sr.ht";
4797 rev = version;
4798 - sha256 = "sha256-bsakEMyvWaxiE4/SGcAP4mlGG9jkdHfFxpt9H+TJn/8=";
4799 + sha256 = "sha256-FrC3Au/ZdDtJuczGgaAhAEZu0hVa74LOM8z3aOiqGZc=";
4800 };
4801
4802 nativeBuildInputs = srht.nativeBuildInputs;
4803 @@ -37,10 +37,12 @@ buildPythonPackage rec {
4804 export SRHT_PATH=${srht}/${python.sitePackages}/srht
4805 '';
4806
4807 + pythonImportsCheck = [ "listssrht" ];
4808 +
4809 meta = with lib; {
4810 homepage = "https://git.sr.ht/~sircmpwn/lists.sr.ht";
4811 description = "Mailing list service for the sr.ht network";
4812 - license = licenses.agpl3;
4813 + license = licenses.agpl3Only;
4814 maintainers = with maintainers; [ eadwu ];
4815 };
4816 }
4817 diff --git a/pkgs/applications/version-management/sourcehut/man.nix b/pkgs/applications/version-management/sourcehut/man.nix
4818 index bd331f000a7..47c6bb0ac4f 100644
4819 --- a/pkgs/applications/version-management/sourcehut/man.nix
4820 +++ b/pkgs/applications/version-management/sourcehut/man.nix
4821 @@ -8,13 +8,13 @@
4822
4823 buildPythonPackage rec {
4824 pname = "mansrht";
4825 - version = "0.15.12";
4826 + version = "0.15.20";
4827
4828 src = fetchFromSourcehut {
4829 owner = "~sircmpwn";
4830 repo = "man.sr.ht";
4831 rev = version;
4832 - sha256 = "sha256-MqH/8K9XRvEg6P7GHE6XXtWnhDP3wT8iGoNaFtYQbio=";
4833 + sha256 = "sha256-ulwdrVrw2bwdafgc3NrJ1J15evQ5btpHLTaiqsyA58U=";
4834 };
4835
4836 nativeBuildInputs = srht.nativeBuildInputs;
4837 @@ -29,10 +29,12 @@ buildPythonPackage rec {
4838 export SRHT_PATH=${srht}/${python.sitePackages}/srht
4839 '';
4840
4841 + pythonImportsCheck = [ "mansrht" ];
4842 +
4843 meta = with lib; {
4844 homepage = "https://git.sr.ht/~sircmpwn/man.sr.ht";
4845 description = "Wiki service for the sr.ht network";
4846 - license = licenses.agpl3;
4847 + license = licenses.agpl3Only;
4848 maintainers = with maintainers; [ eadwu ];
4849 };
4850 }
4851 diff --git a/pkgs/applications/version-management/sourcehut/meta.nix b/pkgs/applications/version-management/sourcehut/meta.nix
4852 index 86d293973d7..0964960fea0 100644
4853 --- a/pkgs/applications/version-management/sourcehut/meta.nix
4854 +++ b/pkgs/applications/version-management/sourcehut/meta.nix
4855 @@ -18,19 +18,19 @@
4856 , python
4857 }:
4858 let
4859 - version = "0.53.14";
4860 + version = "0.56.0";
4861
4862 src = fetchFromSourcehut {
4863 owner = "~sircmpwn";
4864 repo = "meta.sr.ht";
4865 rev = version;
4866 - sha256 = "sha256-/+r/XLDkcSTW647xPMh5bcJmR2xZNNH74AJ5jemna2k=";
4867 + sha256 = "sha256-+fCNtW+k9fmjh1TLK0WUv0EgWKGlhURYS6atUH5EOjM=";
4868 };
4869
4870 buildApi = src: buildGoModule {
4871 inherit src version;
4872 pname = "metasrht-api";
4873 - vendorSha256 = "sha256-eZyDrr2VcNMxI++18qUy7LA1Q1YDlWCoRtl00L8lfR4=";
4874 + vendorSha256 = "sha256-m9j9tmss+utTVMywI9wB1n9EK8sbElW0ej2YqK1yL5M=";
4875 };
4876
4877 in
4878 @@ -66,10 +66,12 @@ buildPythonPackage rec {
4879 cp ${buildApi "${src}/api/"}/bin/api $out/bin/metasrht-api
4880 '';
4881
4882 + pythonImportsCheck = [ "metasrht" ];
4883 +
4884 meta = with lib; {
4885 homepage = "https://git.sr.ht/~sircmpwn/meta.sr.ht";
4886 description = "Account management service for the sr.ht network";
4887 - license = licenses.agpl3;
4888 + license = licenses.agpl3Only;
4889 maintainers = with maintainers; [ eadwu ];
4890 };
4891 }
4892 diff --git a/pkgs/applications/version-management/sourcehut/pages.nix b/pkgs/applications/version-management/sourcehut/pages.nix
4893 new file mode 100644
4894 index 00000000000..4a3d9f8c7d0
4895 --- /dev/null
4896 +++ b/pkgs/applications/version-management/sourcehut/pages.nix
4897 @@ -0,0 +1,32 @@
4898 +{ lib
4899 +, fetchFromSourcehut
4900 +, buildGoModule
4901 +}:
4902 +let
4903 + version = "0.4.10";
4904 +
4905 + src = fetchFromSourcehut {
4906 + owner = "~sircmpwn";
4907 + repo = "pages.sr.ht";
4908 + rev = version;
4909 + sha256 = "sha256-Lq/xCCAywxxjX5nHbOvmCaQ4wtLgjcMo3Qc7xO1fdAs=";
4910 + };
4911 +
4912 +in
4913 +buildGoModule {
4914 + inherit src version;
4915 + pname = "pagessrht";
4916 + vendorSha256 = "sha256-YFRBoflFy48ipTvXdZ4qPSEgTIYvm4752JRZSzRG++U=";
4917 +
4918 + postInstall = ''
4919 + mkdir -p $out/share/sql/
4920 + cp -r -t $out/share/sql/ schema.sql migrations
4921 + '';
4922 +
4923 + meta = with lib; {
4924 + homepage = "https://git.sr.ht/~sircmpwn/pages.sr.ht";
4925 + description = "Web hosting service for the sr.ht network";
4926 + license = licenses.agpl3Only;
4927 + maintainers = with maintainers; [ eadwu ];
4928 + };
4929 +}
4930 diff --git a/pkgs/applications/version-management/sourcehut/paste.nix b/pkgs/applications/version-management/sourcehut/paste.nix
4931 index 0d8c9135493..ecd31c25deb 100644
4932 --- a/pkgs/applications/version-management/sourcehut/paste.nix
4933 +++ b/pkgs/applications/version-management/sourcehut/paste.nix
4934 @@ -8,13 +8,13 @@
4935
4936 buildPythonPackage rec {
4937 pname = "pastesrht";
4938 - version = "0.12.1";
4939 + version = "0.12.4";
4940
4941 src = fetchFromSourcehut {
4942 owner = "~sircmpwn";
4943 repo = "paste.sr.ht";
4944 rev = version;
4945 - sha256 = "sha256-QQhd2LeH9BLmlHilhsv+9fZ+RPNmEMSmOpFA3dsMBFc=";
4946 + sha256 = "sha256-hFjWa7L7JiQoG3Hm9NyoP2FNypDiW+nGDmQ2DoZkAIw=";
4947 };
4948
4949 nativeBuildInputs = srht.nativeBuildInputs;
4950 @@ -29,10 +29,12 @@ buildPythonPackage rec {
4951 export SRHT_PATH=${srht}/${python.sitePackages}/srht
4952 '';
4953
4954 + pythonImportsCheck = [ "pastesrht" ];
4955 +
4956 meta = with lib; {
4957 homepage = "https://git.sr.ht/~sircmpwn/paste.sr.ht";
4958 description = "Ad-hoc text file hosting service for the sr.ht network";
4959 - license = licenses.agpl3;
4960 + license = licenses.agpl3Only;
4961 maintainers = with maintainers; [ eadwu ];
4962 };
4963 }
4964 diff --git a/pkgs/applications/version-management/sourcehut/disable-npm-install.patch b/pkgs/applications/version-management/sourcehut/patches/disable-npm-install.patch
4965 similarity index 100%
4966 rename from pkgs/applications/version-management/sourcehut/disable-npm-install.patch
4967 rename to pkgs/applications/version-management/sourcehut/patches/disable-npm-install.patch
4968 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/v3-0001-worker-update-go-redis-to-support-Unix-sockets.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/v3-0001-worker-update-go-redis-to-support-Unix-sockets.patch
4969 new file mode 100644
4970 index 00000000000..4efd12be875
4971 --- /dev/null
4972 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/v3-0001-worker-update-go-redis-to-support-Unix-sockets.patch
4973 @@ -0,0 +1,113 @@
4974 +From 5991960a5d412f0e1bdc505b970248c68b44a720 Mon Sep 17 00:00:00 2001
4975 +From: Julien Moutinho <julm+srht@sourcephile.fr>
4976 +Date: Wed, 15 Sep 2021 19:45:41 +0200
4977 +Subject: [PATCH builds.sr.ht v3 1/2] worker: update go-redis to support Unix
4978 + sockets
4979 +
4980 +---
4981 + worker/context.go | 4 ++--
4982 + worker/main.go | 11 +++++++----
4983 + worker/tasks.go | 10 +++++-----
4984 + 3 files changed, 14 insertions(+), 11 deletions(-)
4985 +
4986 +diff --git a/worker/context.go b/worker/context.go
4987 +index f84a60c..be54717 100644
4988 +--- a/worker/context.go
4989 ++++ b/worker/context.go
4990 +@@ -14,7 +14,7 @@ import (
4991 + "strings"
4992 + "time"
4993 +
4994 +- "github.com/go-redis/redis"
4995 ++ goredis "github.com/go-redis/redis/v8"
4996 + "github.com/google/shlex"
4997 + "github.com/pkg/errors"
4998 + "github.com/prometheus/client_golang/prometheus"
4999 +@@ -41,7 +41,7 @@ var (
5000 +
5001 + type WorkerContext struct {
5002 + Db *sql.DB
5003 +- Redis *redis.Client
5004 ++ Redis *goredis.Client
5005 + Conf func(section, key string) string
5006 + }
5007 +
5008 +diff --git a/worker/main.go b/worker/main.go
5009 +index 274ba68..e22ab6b 100644
5010 +--- a/worker/main.go
5011 ++++ b/worker/main.go
5012 +@@ -1,6 +1,7 @@
5013 + package main
5014 +
5015 + import (
5016 ++ "context"
5017 + "database/sql"
5018 + "flag"
5019 + "log"
5020 +@@ -9,7 +10,7 @@ import (
5021 + "runtime"
5022 + "sync"
5023 +
5024 +- "github.com/go-redis/redis"
5025 ++ goredis "github.com/go-redis/redis/v8"
5026 + "github.com/vaughan0/go-ini"
5027 + "git.sr.ht/~sircmpwn/core-go/crypto"
5028 +
5029 +@@ -26,6 +27,8 @@ var (
5030 + jobsMutex sync.Mutex
5031 + )
5032 +
5033 ++var redisctx = context.Background()
5034 ++
5035 + func main() {
5036 + flag.IntVar(&workers, "workers", runtime.NumCPU(),
5037 + "configure number of workers")
5038 +@@ -68,12 +71,12 @@ func main() {
5039 + if !ok {
5040 + redisHost = "redis://localhost:6379"
5041 + }
5042 +- ropts, err := redis.ParseURL(redisHost)
5043 ++ ropts, err := goredis.ParseURL(redisHost)
5044 + if err != nil {
5045 + panic(err)
5046 + }
5047 +- localRedis := redis.NewClient(ropts)
5048 +- if _, err := localRedis.Ping().Result(); err != nil {
5049 ++ localRedis := goredis.NewClient(ropts)
5050 ++ if _, err := localRedis.Ping(redisctx).Result(); err != nil {
5051 + panic(err)
5052 + }
5053 +
5054 +diff --git a/worker/tasks.go b/worker/tasks.go
5055 +index d27bf33..d0c28f1 100644
5056 +--- a/worker/tasks.go
5057 ++++ b/worker/tasks.go
5058 +@@ -19,7 +19,7 @@ import (
5059 + "time"
5060 +
5061 + "git.sr.ht/~sircmpwn/core-go/auth"
5062 +- "github.com/go-redis/redis"
5063 ++ goredis "github.com/go-redis/redis/v8"
5064 + "github.com/kr/pty"
5065 + "github.com/minio/minio-go/v6"
5066 + "github.com/pkg/errors"
5067 +@@ -39,12 +39,12 @@ var (
5068 + }, []string{"image", "arch"})
5069 + )
5070 +
5071 +-func (ctx *JobContext) Boot(r *redis.Client) func() {
5072 +- port, err := r.Incr("builds.sr.ht.ssh-port").Result()
5073 ++func (ctx *JobContext) Boot(r *goredis.Client) func() {
5074 ++ port, err := r.Incr(ctx.Context, "builds.sr.ht.ssh-port").Result()
5075 + if err == nil && port < 22000 {
5076 +- err = r.Set("builds.sr.ht.ssh-port", 22100, 0).Err()
5077 ++ err = r.Set(ctx.Context, "builds.sr.ht.ssh-port", 22100, 0).Err()
5078 + } else if err == nil && port >= 23000 {
5079 +- err = r.Set("builds.sr.ht.ssh-port", 22000, 0).Err()
5080 ++ err = r.Set(ctx.Context, "builds.sr.ht.ssh-port", 22000, 0).Err()
5081 + }
5082 + if err != nil {
5083 + panic(errors.Wrap(err, "assign port"))
5084 +--
5085 +2.32.0
5086 +
5087 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/v3-0002-worker-update-go.-mod-sum-for-go-redis.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/v3-0002-worker-update-go.-mod-sum-for-go-redis.patch
5088 new file mode 100644
5089 index 00000000000..c9368d05c18
5090 --- /dev/null
5091 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/build/v3-0002-worker-update-go.-mod-sum-for-go-redis.patch
5092 @@ -0,0 +1,378 @@
5093 +From eac18e913e4ee48895b94acfa56cf1c6a3fb49fa Mon Sep 17 00:00:00 2001
5094 +From: Julien Moutinho <julm+srht@sourcephile.fr>
5095 +Date: Wed, 15 Sep 2021 20:11:49 +0200
5096 +Subject: [PATCH builds.sr.ht v3 2/2] worker: update go.{mod,sum} for go-redis
5097 +
5098 +---
5099 + worker/go.mod | 8 +------
5100 + worker/go.sum | 64 +++++++++++++++++++--------------------------------
5101 + 2 files changed, 25 insertions(+), 47 deletions(-)
5102 +
5103 +diff --git a/worker/go.mod b/worker/go.mod
5104 +index 6e9a11c..4893dfa 100644
5105 +--- a/worker/go.mod
5106 ++++ b/worker/go.mod
5107 +@@ -2,24 +2,18 @@ module git.sr.ht/~sircmpwn/builds.sr.ht/worker
5108 +
5109 + require (
5110 + git.sr.ht/~sircmpwn/core-go v0.0.0-20210108160653-070566136c1a
5111 +- github.com/go-gomail/gomail v0.0.0-20160411212932-81ebce5c23df
5112 +- github.com/go-redis/redis v6.15.2+incompatible
5113 ++ github.com/go-redis/redis/v8 v8.2.3
5114 + github.com/gocelery/gocelery v0.0.0-20201111034804-825d89059344
5115 +- github.com/gomodule/redigo v2.0.0+incompatible // indirect
5116 + github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
5117 +- github.com/jpillora/longestcommon v0.0.0-20161227235612-adb9d91ee629
5118 + github.com/kr/pty v1.1.3
5119 + github.com/lib/pq v1.8.0
5120 + github.com/martinlindhe/base36 v1.1.0
5121 +- github.com/matttproud/golang_protobuf_extensions v1.0.1 // indirect
5122 + github.com/minio/minio-go/v6 v6.0.49
5123 + github.com/mitchellh/mapstructure v1.1.2
5124 + github.com/pkg/errors v0.9.1
5125 + github.com/prometheus/client_golang v1.7.1
5126 +- github.com/shicky/gocelery v0.0.0-20180807061531-b2f0dd7ec05b
5127 + github.com/streadway/amqp v1.0.0 // indirect
5128 + github.com/vaughan0/go-ini v0.0.0-20130923145212-a98ad7ee00ec
5129 +- golang.org/x/sys v0.0.0-20201013132646-2da7054afaeb
5130 + gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
5131 + gopkg.in/mail.v2 v2.3.1
5132 + gopkg.in/yaml.v2 v2.3.0
5133 +diff --git a/worker/go.sum b/worker/go.sum
5134 +index 1cd3989..4a2d6d9 100644
5135 +--- a/worker/go.sum
5136 ++++ b/worker/go.sum
5137 +@@ -10,6 +10,7 @@ git.sr.ht/~sircmpwn/go-bare v0.0.0-20200812160916-d2c72e1a5018/go.mod h1:BVJwbDf
5138 + github.com/99designs/gqlgen v0.13.0 h1:haLTcUp3Vwp80xMVEg5KRNwzfUrgFdRmtBY8fuB8scA=
5139 + github.com/99designs/gqlgen v0.13.0/go.mod h1:NV130r6f4tpRWuAI+zsrSdooO/eWUv+Gyyoi3rEfXIk=
5140 + github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
5141 ++github.com/DATA-DOG/go-sqlmock v1.5.0 h1:Shsta01QNfFxHCfpW6YH2STWB0MudeXXEWMr20OEh60=
5142 + github.com/DATA-DOG/go-sqlmock v1.5.0/go.mod h1:f/Ixk793poVmq4qj/V1dPUg2JEAKC73Q5eFN3EC/SaM=
5143 + github.com/Knetic/govaluate v3.0.1-0.20171022003610-9aa49832a739+incompatible/go.mod h1:r7JcOSlj0wfOMncg0iLm8Leh48TZaKVeNIfJntJ2wa0=
5144 + github.com/Masterminds/squirrel v1.4.0 h1:he5i/EXixZxrBUWcxzDYMiju9WZ3ld/l7QBNuo/eN3w=
5145 +@@ -25,6 +26,7 @@ github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuy
5146 + github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
5147 + github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
5148 + github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk541a8SKzHPHnH3zbiI+7dagKZ0cgpgrD7Fyho=
5149 ++github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
5150 + github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
5151 + github.com/apache/thrift v0.12.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
5152 + github.com/apache/thrift v0.13.0/go.mod h1:cp2SuWMxlEZw2r+iP2GNCdIi4C1qmUzdZFSVb+bacwQ=
5153 +@@ -36,7 +38,6 @@ github.com/aryann/difflib v0.0.0-20170710044230-e206f873d14a/go.mod h1:DAHtR1m6l
5154 + github.com/aws/aws-lambda-go v1.13.3/go.mod h1:4UKl9IzQMoD+QF79YdCuzCwp8VbmG4VAQwij/eHl5CU=
5155 + github.com/aws/aws-sdk-go v1.27.0/go.mod h1:KmX6BPdI08NWTb3/sm4ZGu5ShLoqVDhKgpiN924inxo=
5156 + github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g=
5157 +-github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973 h1:xJ4a3vCFaGF/jqvzLMYoU8P317H5OQ+Via4RmuPwCS0=
5158 + github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
5159 + github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
5160 + github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
5161 +@@ -58,8 +59,10 @@ github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:ma
5162 + github.com/creack/pty v1.1.7/go.mod h1:lj5s0c3V2DBrqTV7llrYr5NG6My20zk30Fl46Y7DoTY=
5163 + github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
5164 + github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5165 ++github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
5166 + github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5167 + github.com/dgrijalva/jwt-go v3.2.0+incompatible/go.mod h1:E3ru+11k8xSBh+hMPgOLZmtrrCbhqsmaPHjLKYnJCaQ=
5168 ++github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
5169 + github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
5170 + github.com/dgryski/trifles v0.0.0-20190318185328-a8d75aae118c/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
5171 + github.com/dustin/go-humanize v0.0.0-20171111073723-bb3d318650d4/go.mod h1:HtrtbFcZ19U5GC7JDqmcUSB87Iq5E25KnS6fMYU6eOk=
5172 +@@ -84,22 +87,18 @@ github.com/fernet/fernet-go v0.0.0-20191111064656-eff2850e6001/go.mod h1:2H9hjfb
5173 + github.com/franela/goblin v0.0.0-20200105215937-c9ffbefa60db/go.mod h1:7dvUGVsVBjqR7JHJk0brhHOZYGmfBYOrK0ZhYMEtBr4=
5174 + github.com/franela/goreq v0.0.0-20171204163338-bcd34c9993f8/go.mod h1:ZhphrRTfi2rbfLwlschooIH4+wKKDR4Pdxhh+TRoA20=
5175 + github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
5176 ++github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
5177 + github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
5178 + github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
5179 + github.com/go-chi/chi v3.3.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
5180 + github.com/go-chi/chi v4.1.2+incompatible/go.mod h1:eB3wogJHnLi3x/kFX2A+IbTBlXxmMeXJVKy9tTv1XzQ=
5181 +-github.com/go-gomail/gomail v0.0.0-20160411212932-81ebce5c23df h1:Bao6dhmbTA1KFVxmJ6nBoMuOJit2yjEgLJpIMYpop0E=
5182 +-github.com/go-gomail/gomail v0.0.0-20160411212932-81ebce5c23df/go.mod h1:GJr+FCSXshIwgHBtLglIg9M2l2kQSi6QjVAngtzI08Y=
5183 + github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
5184 + github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
5185 + github.com/go-kit/kit v0.10.0/go.mod h1:xUsJbQ/Fp4kEt7AFgCuvyX4a71u8h9jB8tj/ORgOZ7o=
5186 + github.com/go-logfmt/logfmt v0.3.0/go.mod h1:Qt1PoO58o5twSAckw1HlFXLmHsOX5/0LbT9GBnD5lWE=
5187 + github.com/go-logfmt/logfmt v0.4.0/go.mod h1:3RMwSq7FuexP4Kalkev3ejPJsZTpXXBr9+V4qmtdjCk=
5188 + github.com/go-logfmt/logfmt v0.5.0/go.mod h1:wCYkCAKZfumFQihp8CzCvQ3paCTfi41vtzG1KdI/P7A=
5189 +-github.com/go-redis/redis v6.14.1+incompatible h1:kSJohAREGMr344uMa8PzuIg5OU6ylCbyDkWkkNOfEik=
5190 +-github.com/go-redis/redis v6.14.1+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
5191 +-github.com/go-redis/redis v6.15.2+incompatible h1:9SpNVG76gr6InJGxoZ6IuuxaCOQwDAhzyXg+Bs+0Sb4=
5192 +-github.com/go-redis/redis v6.15.2+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
5193 ++github.com/go-redis/redis/v8 v8.2.3 h1:eNesND+DWt/sjQOtPFxAbQkTIXaXX00qNLxjVWkZ70k=
5194 + github.com/go-redis/redis/v8 v8.2.3/go.mod h1:ysgGY09J/QeDYbu3HikWEIPCwaeOkuNoTgKayTEaEOw=
5195 + github.com/go-sql-driver/mysql v1.4.0/go.mod h1:zAC/RDZ24gD3HViQzih4MyKcchzm+sOG5ZlKdlhCg5w=
5196 + github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
5197 +@@ -114,7 +113,6 @@ github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfU
5198 + github.com/golang/groupcache v0.0.0-20160516000752-02826c3e7903/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
5199 + github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
5200 + github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
5201 +-github.com/golang/protobuf v1.2.0 h1:P3YflyNX/ehuJFLhxviNdFxQPkGK5cDcApsge1SqnvM=
5202 + github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
5203 + github.com/golang/protobuf v1.3.1/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
5204 + github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
5205 +@@ -136,12 +134,14 @@ github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
5206 + github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
5207 + github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
5208 + github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
5209 ++github.com/google/go-cmp v0.5.1 h1:JFrFEBb2xKufg6XkJsJr+WbKb4FQlURi5RUcBveYu9k=
5210 + github.com/google/go-cmp v0.5.1/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
5211 + github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
5212 + github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
5213 + github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
5214 + github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
5215 + github.com/google/uuid v1.0.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
5216 ++github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
5217 + github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
5218 + github.com/gorilla/context v0.0.0-20160226214623-1ea25387ff6f/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
5219 + github.com/gorilla/context v1.1.1/go.mod h1:kBGZzfjB9CEq2AlWe17Uuf7NDRt0dE0s8S51q0aT7Yg=
5220 +@@ -180,12 +180,11 @@ github.com/influxdata/influxdb1-client v0.0.0-20191209144304-8bf82d3c094d/go.mod
5221 + github.com/jmespath/go-jmespath v0.0.0-20180206201540-c2b33e8439af/go.mod h1:Nht3zPeWKUH0NzdCt2Blrr5ys8VGpn0CEB0cQHVjt7k=
5222 + github.com/jonboulle/clockwork v0.1.0/go.mod h1:Ii8DK3G1RaLaWxj9trq07+26W01tbo22gdxWY5EU2bo=
5223 + github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
5224 +-github.com/jpillora/longestcommon v0.0.0-20161227235612-adb9d91ee629 h1:1dSBUfGlorLAua2CRx0zFN7kQsTpE2DQSmr7rrTNgY8=
5225 +-github.com/jpillora/longestcommon v0.0.0-20161227235612-adb9d91ee629/go.mod h1:mb5nS4uRANwOJSZj8rlCWAfAcGi72GGMIXx+xGOjA7M=
5226 + github.com/json-iterator/go v1.1.6/go.mod h1:+SdeFBvtyEkXs7REEP0seUULqWtbJapLOCVDaaPEHmU=
5227 + github.com/json-iterator/go v1.1.7/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
5228 + github.com/json-iterator/go v1.1.8/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
5229 + github.com/json-iterator/go v1.1.10/go.mod h1:KdQUCv79m/52Kvf8AW2vK1V8akMuk1QjK/uOdHXbAo4=
5230 ++github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
5231 + github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
5232 + github.com/julienschmidt/httprouter v1.2.0/go.mod h1:SYymIcj16QtmaHHD7aYtjjsJG7VTCxuUUipMqKk8s4w=
5233 + github.com/julienschmidt/httprouter v1.3.0/go.mod h1:JR6WtHb+2LUe8TCKY3cZOxFyyO8IZAc4RVcycCCAKdM=
5234 +@@ -200,20 +199,18 @@ github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
5235 + github.com/kr/pty v1.1.3 h1:/Um6a/ZmD5tF7peoOJ5oN5KMQ0DrGVQSXLNwyckutPk=
5236 + github.com/kr/pty v1.1.3/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
5237 + github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
5238 ++github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
5239 + github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
5240 + github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 h1:SOEGU9fKiNWd/HOJuq6+3iTQz8KNCLtVX6idSoTLdUw=
5241 + github.com/lann/builder v0.0.0-20180802200727-47ae307949d0/go.mod h1:dXGbAdH5GtBTC4WfIxhKZfyBF/HBFgRZSWwZ9g/He9o=
5242 + github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 h1:P6pPBnrTSX3DEVR4fDembhRWSsG5rVo6hYhAB/ADZrk=
5243 + github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0/go.mod h1:vmVJ0l/dxyfGW6FmdpVm2joNMFikkuWg0EoCKLGUMNw=
5244 +-github.com/lib/pq v1.0.0 h1:X5PMW56eZitiTeO7tKzZxFCSpbFZJtkMMooicw2us9A=
5245 +-github.com/lib/pq v1.0.0/go.mod h1:5WUZQaWbwv1U+lTReE5YruASi9Al49XbQIvNi/34Woo=
5246 + github.com/lib/pq v1.8.0 h1:9xohqzkUwzR4Ga4ivdTcawVS89YSDVxXMa3xJX3cGzg=
5247 + github.com/lib/pq v1.8.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
5248 + github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-bc2310a04743/go.mod h1:qklhhLq1aX+mtWk9cPHPzaBjWImj5ULL6C7HFJtXQMM=
5249 + github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4=
5250 + github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381/go.mod h1:7rIyQOR62GCctdiQpZ/zOJlFyk6y+94wXzv6RNZgaR4=
5251 + github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ=
5252 +-github.com/martinlindhe/base36 v1.0.0 h1:eYsumTah144C0A8P1T/AVSUk5ZoLnhfYFM3OGQxB52A=
5253 + github.com/martinlindhe/base36 v1.0.0/go.mod h1:+AtEs8xrBpCeYgSLoY/aJ6Wf37jtBuR0s35750M27+8=
5254 + github.com/martinlindhe/base36 v1.1.0 h1:cIwvvwYse/0+1CkUPYH5ZvVIYG3JrILmQEIbLuar02Y=
5255 + github.com/martinlindhe/base36 v1.1.0/go.mod h1:+AtEs8xrBpCeYgSLoY/aJ6Wf37jtBuR0s35750M27+8=
5256 +@@ -228,7 +225,6 @@ github.com/mattn/go-runewidth v0.0.2/go.mod h1:LwmH8dsx7+W8Uxz3IHJYH5QSwggIsqBzp
5257 + github.com/matttproud/golang_protobuf_extensions v1.0.1 h1:4hp9jkHxhMHkqkrB3Ix0jegS5sx/RkqARlsWZ6pIwiU=
5258 + github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
5259 + github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3Nrg=
5260 +-github.com/minio/minio-go v6.0.14+incompatible h1:fnV+GD28LeqdN6vT2XdGKW8Qe/IfjJDswNVuni6km9o=
5261 + github.com/minio/minio-go/v6 v6.0.49 h1:bU4kIa/qChTLC1jrWZ8F+8gOiw1MClubddAJVR4gW3w=
5262 + github.com/minio/minio-go/v6 v6.0.49/go.mod h1:qD0lajrGW49lKZLtXKtCB4X/qkMf0a5tBvN2PaZg7Gg=
5263 + github.com/minio/sha256-simd v0.1.1 h1:5QHSlgo3nt5yKOJrC7W8w7X+NFl8cMPZm96iu8kKUJU=
5264 +@@ -242,8 +238,6 @@ github.com/mitchellh/gox v0.4.0/go.mod h1:Sd9lOJ0+aimLBi73mGofS1ycjY8lL3uZM3JPS4
5265 + github.com/mitchellh/iochan v1.0.0/go.mod h1:JwYml1nuB7xOzsp52dPpHFffvOCDupsG0QubkSMEySY=
5266 + github.com/mitchellh/mapstructure v0.0.0-20160808181253-ca63d7c062ee/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
5267 + github.com/mitchellh/mapstructure v0.0.0-20180203102830-a4e142e9c047/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
5268 +-github.com/mitchellh/mapstructure v1.0.0 h1:vVpGvMXJPqSDh2VYHF7gsfQj8Ncx+Xw5Y1KHeTRY+7I=
5269 +-github.com/mitchellh/mapstructure v1.0.0/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
5270 + github.com/mitchellh/mapstructure v1.1.2 h1:fmNYVwqnSfB9mZU6OS2O6GsXM+wcskZDuKQzvN1EDeE=
5271 + github.com/mitchellh/mapstructure v1.1.2/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y=
5272 + github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
5273 +@@ -259,7 +253,9 @@ github.com/nats-io/nats.go v1.9.1/go.mod h1:ZjDU1L/7fJ09jvUSRVBR2e7+RnLiiIQyqyzE
5274 + github.com/nats-io/nkeys v0.1.0/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxziKVo7w=
5275 + github.com/nats-io/nkeys v0.1.3/go.mod h1:xpnFELMwJABBLVhffcfd1MZx6VsNRFpEugbxziKVo7w=
5276 + github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
5277 ++github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
5278 + github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e/go.mod h1:zD1mROLANZcx1PVRCS0qkT7pwLkGfwJo4zjcN/Tysno=
5279 ++github.com/nxadm/tail v1.4.4 h1:DQuhQpB1tVlglWS2hLQ5OV6B5r8aGxSrPc5Qo6uTN78=
5280 + github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
5281 + github.com/oklog/oklog v0.3.2/go.mod h1:FCV+B7mhrz4o+ueLpx+KqkyXRGMWOYEvfiXtdGtbWGs=
5282 + github.com/oklog/run v1.0.0/go.mod h1:dlhp/R75TPv97u0XWUtDeV/lRKWPKSdTuV0TZvrmrQA=
5283 +@@ -267,10 +263,12 @@ github.com/olekukonko/tablewriter v0.0.0-20170122224234-a0225b3f23b5/go.mod h1:v
5284 + github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
5285 + github.com/onsi/ginkgo v1.7.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
5286 + github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
5287 ++github.com/onsi/ginkgo v1.14.1 h1:jMU0WaQrP0a/YAEq8eJmJKjBoMs+pClEr1vDMlM/Do4=
5288 + github.com/onsi/ginkgo v1.14.1/go.mod h1:iSB4RoI2tjJc9BBv4NKIKWKya62Rps+oPG/Lv9klQyY=
5289 + github.com/onsi/gomega v1.4.3/go.mod h1:ex+gbHU/CVuBBDIJjb2X0qEXbFg53c61hWP/1CpauHY=
5290 + github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
5291 + github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
5292 ++github.com/onsi/gomega v1.10.2 h1:aY/nuoWlKJud2J6U0E3NWsjlg+0GtwXxgEqthRdzlcs=
5293 + github.com/onsi/gomega v1.10.2/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
5294 + github.com/op/go-logging v0.0.0-20160315200505-970db520ece7/go.mod h1:HzydrMdWErDVzsI23lYNej1Htcns9BCg93Dk0bBINWk=
5295 + github.com/opentracing-contrib/go-observer v0.0.0-20170622124052-a52f23424492/go.mod h1:Ngi6UdF0k5OKD5t5wlmGhe/EDKPoUM3BXZSSfIuJbis=
5296 +@@ -287,22 +285,20 @@ github.com/pborman/uuid v1.2.0/go.mod h1:X/NO0urCmaxf9VXbdlT7C2Yzkj2IKimNn4k+gtP
5297 + github.com/performancecopilot/speed v3.0.0+incompatible/go.mod h1:/CLtqpZ5gBg1M9iaPbIdPPGyKcA8hKdoy6hAWba7Yac=
5298 + github.com/pierrec/lz4 v1.0.2-0.20190131084431-473cd7ce01a1/go.mod h1:3/3N9NVKO0jef7pBehbT1qWhCMrIgbYNnFAZCqQ5LRc=
5299 + github.com/pierrec/lz4 v2.0.5+incompatible/go.mod h1:pdkljMzZIN41W+lC3N2tnIh5sFi+IEE17M5jbnwPHcY=
5300 +-github.com/pkg/errors v0.8.0 h1:WdK/asTD0HN+q6hsWO3/vpuAkAr+tw6aNJNDFFf0+qw=
5301 + github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
5302 + github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
5303 + github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
5304 + github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
5305 + github.com/pkg/profile v1.2.1/go.mod h1:hJw3o1OdXxsrSjjVksARp5W95eeEaEfptyVZyv6JUPA=
5306 ++github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
5307 + github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
5308 + github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
5309 +-github.com/prometheus/client_golang v0.9.1 h1:K47Rk0v/fkEfwfQet2KWhscE0cJzjgCCDBG2KHZoVno=
5310 + github.com/prometheus/client_golang v0.9.1/go.mod h1:7SWBe2y4D6OKWSNQJUaRYU/AaXPKyh/dDVn+NZz0KFw=
5311 + github.com/prometheus/client_golang v0.9.3-0.20190127221311-3c4408c8b829/go.mod h1:p2iRAGwDERtqlqzRXnrOVns+ignqQo//hLXqYxZYVNs=
5312 + github.com/prometheus/client_golang v1.0.0/go.mod h1:db9x61etRT2tGnBNRi70OPL5FsnadC4Ky3P0J6CfImo=
5313 + github.com/prometheus/client_golang v1.3.0/go.mod h1:hJaj2vgQTGQmVCsAACORcieXFeDPbaTKGT+JTgUa3og=
5314 + github.com/prometheus/client_golang v1.7.1 h1:NTGy1Ja9pByO+xAeH/qiWnLrKtr3hJPNjaVUwnjpdpA=
5315 + github.com/prometheus/client_golang v1.7.1/go.mod h1:PY5Wy2awLA44sXw4AOSfFBetzPP4j5+D6mVACh+pe2M=
5316 +-github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910 h1:idejC8f05m9MGOsuEi1ATq9shN03HrxNkD/luQvxCv8=
5317 + github.com/prometheus/client_model v0.0.0-20180712105110-5c3871d89910/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
5318 + github.com/prometheus/client_model v0.0.0-20190115171406-56726106282f/go.mod h1:MbSGuTsp3dbXC40dX6PRTWyKYBIrTGTE9sqQNg2J8bo=
5319 + github.com/prometheus/client_model v0.0.0-20190129233127-fd36f4220a90/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
5320 +@@ -310,15 +306,12 @@ github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:
5321 + github.com/prometheus/client_model v0.1.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
5322 + github.com/prometheus/client_model v0.2.0 h1:uq5h0d+GuxiXLJLNABMgp2qUWDPiLvgCzz2dUR+/W/M=
5323 + github.com/prometheus/client_model v0.2.0/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
5324 +-github.com/prometheus/common v0.0.0-20181020173914-7e9e6cabbd39 h1:Cto4X6SVMWRPBkJ/3YHn1iDGDGc/Z+sW+AEMKHMVvN4=
5325 +-github.com/prometheus/common v0.0.0-20181020173914-7e9e6cabbd39/go.mod h1:daVV7qP5qjZbuso7PdcryaAu0sAZbrN9i7WWcTMWvro=
5326 + github.com/prometheus/common v0.2.0/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
5327 + github.com/prometheus/common v0.4.1/go.mod h1:TNfzLD0ON7rHzMJeJkieUDPYmFC7Snx/y86RQel1bk4=
5328 + github.com/prometheus/common v0.7.0/go.mod h1:DjGbpBbp5NYNiECxcL/VnbXCCaQpKd3tt26CguLLsqA=
5329 + github.com/prometheus/common v0.10.0/go.mod h1:Tlit/dnDKsSWFlCLTWaA1cyBgKHSMdTB80sz/V91rCo=
5330 + github.com/prometheus/common v0.14.0 h1:RHRyE8UocrbjU+6UvRzwi6HjiDfxrrBU91TtbKzkGp4=
5331 + github.com/prometheus/common v0.14.0/go.mod h1:U+gB1OBLb1lF3O42bTCL+FK18tX9Oar16Clt/msog/s=
5332 +-github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d h1:GoAlyOgbOEIFdaDqxJVlbOQ1DtGmZWs/Qau0hIlk+WQ=
5333 + github.com/prometheus/procfs v0.0.0-20181005140218-185b4288413d/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
5334 + github.com/prometheus/procfs v0.0.0-20190117184657-bf6a532e95b1/go.mod h1:c3At6R/oaqEKCNdg8wHV1ftS6bRYblBhIjjI8uT2IGk=
5335 + github.com/prometheus/procfs v0.0.2/go.mod h1:TjEm7ze935MbeOT/UhFTIMYKhuLP4wbCsTZCD3I8kEA=
5336 +@@ -333,36 +326,28 @@ github.com/rs/cors v1.6.0/go.mod h1:gFx+x8UowdsKA9AchylcLynDq+nNFfI8FkUZdN/jGCU=
5337 + github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
5338 + github.com/ryanuber/columnize v0.0.0-20160712163229-9b3edd62028f/go.mod h1:sm1tb6uqfes/u+d4ooFouqFdy9/2g9QGwK3SQygK0Ts=
5339 + github.com/samuel/go-zookeeper v0.0.0-20190923202752-2cc03de413da/go.mod h1:gi+0XIa01GRL2eRQVjQkKGqKF3SF9vZR/HnPullcV2E=
5340 +-github.com/satori/go.uuid v1.1.0 h1:B9KXyj+GzIpJbV7gmr873NsY6zpbxNy24CBtGrk7jHo=
5341 +-github.com/satori/go.uuid v1.1.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
5342 +-github.com/satori/go.uuid v1.2.0 h1:0uYX9dsZ2yD7q2RtLRtPSdGDWzjeM3TbMJP9utgA0ww=
5343 +-github.com/satori/go.uuid v1.2.0/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
5344 +-github.com/satori/go.uuid v1.2.1-0.20180103174451-36e9d2ebbde5 h1:Jw7W4WMfQDxsXvfeFSaS2cHlY7bAF4MGrgnbd0+Uo78=
5345 +-github.com/satori/go.uuid v1.2.1-0.20180103174451-36e9d2ebbde5/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
5346 + github.com/satori/go.uuid v1.2.1-0.20181028125025-b2ce2384e17b h1:gQZ0qzfKHQIybLANtM3mBXNUtOfsCFXeTsnBqCsx1KM=
5347 + github.com/satori/go.uuid v1.2.1-0.20181028125025-b2ce2384e17b/go.mod h1:dA0hQrYB0VpLJoorglMZABFdXlWrHn1NEOzdhQKdks0=
5348 + github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529/go.mod h1:DxrIzT+xaE7yg65j358z/aeFdxmN0P9QXhEzd20vsDc=
5349 + github.com/sergi/go-diff v1.0.0/go.mod h1:0CfEIISq7TuYL3j771MWULgwwjU+GofnZX9QAmXWZgo=
5350 ++github.com/sergi/go-diff v1.1.0 h1:we8PVUC3FE2uYfodKH/nBHMSetSfHDR6scGdBi+erh0=
5351 + github.com/sergi/go-diff v1.1.0/go.mod h1:STckp+ISIX8hZLjrqAeVduY0gWCT9IjLuqbuNXdaHfM=
5352 +-github.com/shicky/gocelery v0.0.0-20180807061531-b2f0dd7ec05b h1:7kJLeBNcPG1orS3ksAFN0qoJGtf8jvwgOh5Q+bsNZvc=
5353 +-github.com/shicky/gocelery v0.0.0-20180807061531-b2f0dd7ec05b/go.mod h1:kn4CkFIzvsrXBvbNk2hX9DpIM8xo/74mYhiYTpGhYXE=
5354 + github.com/shurcooL/httpfs v0.0.0-20171119174359-809beceb2371/go.mod h1:ZY1cvUeJuFPAdZ/B6v7RHavJWZn2YPVFQ1OSXhCGOkg=
5355 + github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
5356 + github.com/shurcooL/vfsgen v0.0.0-20180121065927-ffb13db8def0/go.mod h1:TrYk7fJVaAttu97ZZKrO9UbRa8izdowaMIZcxYMbVaw=
5357 + github.com/sirupsen/logrus v1.2.0/go.mod h1:LxeOpSwHxABJmUn/MG1IvRgCAasNZTLOkJPxbbu5VWo=
5358 + github.com/sirupsen/logrus v1.4.2/go.mod h1:tLMulIdttU9McNUspp0xgXVQah82FyeX6MwdIuYE2rE=
5359 + github.com/sirupsen/logrus v1.6.0/go.mod h1:7uNnSEd1DgxDLC74fIahvMZmmYsHGZGEOFrfsX/uA88=
5360 ++github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
5361 + github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
5362 + github.com/smartystreets/goconvey v0.0.0-20190330032615-68dc04aab96a/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
5363 ++github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
5364 + github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
5365 + github.com/soheilhy/cmux v0.1.4/go.mod h1:IM3LyeVVIOuxMH7sFAkER9+bJ4dT7Ms6E4xg4kGIyLM=
5366 + github.com/sony/gobreaker v0.4.1/go.mod h1:ZKptC7FHNvhBz7dN2LGjPVBz2sZJmc0/PkyDJOjmxWY=
5367 + github.com/spf13/cobra v0.0.3/go.mod h1:1l0Ry5zgKvJasoi3XT1TypsSe7PqH0Sj9dhYf7v3XqQ=
5368 + github.com/spf13/pflag v1.0.1/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
5369 +-github.com/streadway/amqp v0.0.0-20180806233856-70e15c650864 h1:Oj3PUEs+OUSYUpn35O+BE/ivHGirKixA3+vqA0Atu9A=
5370 +-github.com/streadway/amqp v0.0.0-20180806233856-70e15c650864/go.mod h1:1WNBiOZtZQLpVAyu0iTduoJL9hEsMloAK5XWrtW0xdY=
5371 + github.com/streadway/amqp v0.0.0-20190404075320-75d898a42a94/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
5372 +-github.com/streadway/amqp v0.0.0-20190827072141-edfb9018d271 h1:WhxRHzgeVGETMlmVfqhRn8RIeeNoPr2Czh33I4Zdccw=
5373 + github.com/streadway/amqp v0.0.0-20190827072141-edfb9018d271/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
5374 + github.com/streadway/amqp v1.0.0 h1:kuuDrUJFZL1QYL9hUNuCxNObNzB0bV/ZG5jV3RWAQgo=
5375 + github.com/streadway/amqp v1.0.0/go.mod h1:AZpEONHx3DKn8O/DFsRAY58/XVQiIPMTMB1SddzLXVw=
5376 +@@ -373,6 +358,7 @@ github.com/stretchr/testify v1.2.1/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf
5377 + github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
5378 + github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
5379 + github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
5380 ++github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
5381 + github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
5382 + github.com/tmc/grpc-websocket-proxy v0.0.0-20170815181823-89b8d40f7ca8/go.mod h1:ncp9v5uamzpCO7NfCPTXjqaC+bZgJeR0sMTm6dMHP7U=
5383 + github.com/urfave/cli v1.20.0/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=
5384 +@@ -391,6 +377,7 @@ go.etcd.io/etcd v0.0.0-20191023171146-3cf2f69b5738/go.mod h1:dnLIgRNXwCJa5e+c6mI
5385 + go.opencensus.io v0.20.1/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
5386 + go.opencensus.io v0.20.2/go.mod h1:6WKK9ahsWS3RSO+PY9ZHZUfv2irvY6gN279GOPZjmmk=
5387 + go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
5388 ++go.opentelemetry.io/otel v0.11.0 h1:IN2tzQa9Gc4ZVKnTaMbPVcHjvzOdg5n9QfnmlqiET7E=
5389 + go.opentelemetry.io/otel v0.11.0/go.mod h1:G8UCk+KooF2HLkgo8RHX9epABH/aRGYET7gQOqBVdB0=
5390 + go.uber.org/atomic v1.3.2/go.mod h1:gD2HeocX3+yG+ygLZcrzQJaqmWj9AIm7n08wl/qW/PE=
5391 + go.uber.org/atomic v1.5.0/go.mod h1:sABNBOSYdrvTF6hTgEIbc7YasKWGhgEQZyfxyTvoXHQ=
5392 +@@ -403,7 +390,6 @@ golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnf
5393 + golang.org/x/crypto v0.0.0-20181029021203-45a5f77698d3/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4=
5394 + golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
5395 + golang.org/x/crypto v0.0.0-20190510104115-cbcb75029529/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
5396 +-golang.org/x/crypto v0.0.0-20190513172903-22d7a77e9e5f h1:R423Cnkcp5JABoeemiGEPlt9tHXFfw5kvc0yqlxRPWo=
5397 + golang.org/x/crypto v0.0.0-20190513172903-22d7a77e9e5f/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
5398 + golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
5399 + golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
5400 +@@ -431,7 +417,6 @@ golang.org/x/net v0.0.0-20190125091013-d26f9f9a57f3/go.mod h1:mL1N/T3taQHkDXs73r
5401 + golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
5402 + golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
5403 + golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
5404 +-golang.org/x/net v0.0.0-20190522155817-f3200d17e092 h1:4QSRKanuywn15aTZvI/mIDEgPQpswuFndXpOj3rKEco=
5405 + golang.org/x/net v0.0.0-20190522155817-f3200d17e092/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
5406 + golang.org/x/net v0.0.0-20190603091049-60506f45cf65/go.mod h1:HSz+uSET+XFnRR8LxR5pz3Of3rY3CfYBVs4xY44aLks=
5407 + golang.org/x/net v0.0.0-20190613194153-d28f0bde5980/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
5408 +@@ -451,7 +436,6 @@ golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJ
5409 + golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5410 + golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5411 + golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5412 +-golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e h1:o3PsSEY8E4eXWkXrIP9YJALUkVZqzHJT5DOasTyn8Vs=
5413 + golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5414 + golang.org/x/sys v0.0.0-20181026203630-95b1ffbd15a5/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5415 + golang.org/x/sys v0.0.0-20181107165924-66b7b1311ac8/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5416 +@@ -460,7 +444,6 @@ golang.org/x/sys v0.0.0-20181122145206-62eef0e2fa9b/go.mod h1:STP8DvDyc/dI5b8T5h
5417 + golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5418 + golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5419 + golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5420 +-golang.org/x/sys v0.0.0-20190422165155-953cdadca894 h1:Cz4ceDQGXuKRnVBDTS23GTn/pU5OE2C0WrNTOYK1Uuc=
5421 + golang.org/x/sys v0.0.0-20190422165155-953cdadca894/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5422 + golang.org/x/sys v0.0.0-20190502145724-3ef323f4f1fd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5423 + golang.org/x/sys v0.0.0-20190726091711-fc99dfbffb4e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5424 +@@ -477,7 +460,6 @@ golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1/go.mod h1:h1NjWce9XRLGQEsW7w
5425 + golang.org/x/sys v0.0.0-20200625212154-ddb9806d33ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5426 + golang.org/x/sys v0.0.0-20201013132646-2da7054afaeb h1:HS9IzC4UFbpMBLQUDSQcU+ViVT1vdFCQVjdPVpTlZrs=
5427 + golang.org/x/sys v0.0.0-20201013132646-2da7054afaeb/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5428 +-golang.org/x/text v0.3.0 h1:g61tztE5qeGQ89tm6NTjjM9VPIm088od1l6aSorWRWg=
5429 + golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
5430 + golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
5431 + golang.org/x/text v0.3.4-0.20201021145329-22f1617af38e h1:0kyKOEC0chG7FKmnf/1uNwvDLc3NtNTRip2rXAN9nwI=
5432 +@@ -502,6 +484,7 @@ golang.org/x/tools v0.0.0-20200103221440-774c71fcf114/go.mod h1:TB2adYChydJhpapK
5433 + golang.org/x/tools v0.0.0-20200114235610-7ae403b6b589/go.mod h1:TB2adYChydJhpapKDTa4BR/hXlZSLoq2Wpct/0txZ28=
5434 + golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
5435 + golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
5436 ++golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543 h1:E7g+9GITq07hpfrRu66IVDexMakfv52eLZ2CXBWiKr4=
5437 + golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
5438 + google.golang.org/api v0.3.1/go.mod h1:6wY9I6uQWHQ8EM57III9mq/AjF+i8G65rmVagqKMtkk=
5439 + google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
5440 +@@ -539,6 +522,7 @@ gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc/go.mod
5441 + gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
5442 + gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
5443 + gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
5444 ++gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
5445 + gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
5446 + gopkg.in/cheggaaa/pb.v1 v1.0.25/go.mod h1:V/YB90LKu/1FcN3WVnfiiE5oMCibMjukxqG/qStrOgw=
5447 + gopkg.in/errgo.v2 v2.1.0/go.mod h1:hNsd1EY+bozCKY1Ytp96fpM3vjJbqLJn88ws8XvfDNI=
5448 +@@ -549,6 +533,7 @@ gopkg.in/ini.v1 v1.42.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
5449 + gopkg.in/mail.v2 v2.3.1 h1:WYFn/oANrAGP2C0dcV6/pbkPzv8yGzqTjPmTeO7qoXk=
5450 + gopkg.in/mail.v2 v2.3.1/go.mod h1:htwXN1Qh09vZJ1NVKxQqHPBaCBbzKhp5GzuJEA4VJWw=
5451 + gopkg.in/resty.v1 v1.12.0/go.mod h1:mDo4pnntr5jdWRML875a/NmxYqAlA73dVijT2AXvQQo=
5452 ++gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
5453 + gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
5454 + gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
5455 + gopkg.in/yaml.v2 v2.0.0-20170812160011-eb3733d160e7/go.mod h1:JAlM8MvJe8wmxCU4Bli9HhUf9+ttbYbLASfIpnQbh74=
5456 +@@ -556,10 +541,9 @@ gopkg.in/yaml.v2 v2.2.1/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5457 + gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5458 + gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5459 + gopkg.in/yaml.v2 v2.2.5/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5460 +-gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10=
5461 +-gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5462 + gopkg.in/yaml.v2 v2.3.0 h1:clyUAQHOM3G0M3f5vQj7LuJrETvjVot3Z5el9nffUtU=
5463 + gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5464 ++gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
5465 + gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
5466 + honnef.co/go/tools v0.0.0-20180728063816-88497007e858/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
5467 + honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
5468 +--
5469 +2.32.0
5470 +
5471 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/core/v3-0001-add-Unix-socket-support-for-redis-host.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/core/v3-0001-add-Unix-socket-support-for-redis-host.patch
5472 new file mode 100644
5473 index 00000000000..299ad3d83c5
5474 --- /dev/null
5475 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/core/v3-0001-add-Unix-socket-support-for-redis-host.patch
5476 @@ -0,0 +1,30 @@
5477 +From c0ccc8db051a2f8278edf59b41ed238fa71aa4c0 Mon Sep 17 00:00:00 2001
5478 +From: Julien Moutinho <julm+srht@sourcephile.fr>
5479 +Date: Mon, 23 Aug 2021 18:43:18 +0200
5480 +Subject: [PATCH core.sr.ht v3] add Unix socket support for redis-host=
5481 +
5482 +---
5483 + srht/redis.py | 11 ++---------
5484 + 1 file changed, 2 insertions(+), 9 deletions(-)
5485 +
5486 +diff --git a/srht/redis.py b/srht/redis.py
5487 +index 8a9347c..2e91c35 100644
5488 +--- a/srht/redis.py
5489 ++++ b/srht/redis.py
5490 +@@ -1,11 +1,4 @@
5491 +-from redis import Redis
5492 ++from redis import from_url
5493 + from srht.config import cfg
5494 +-from urllib.parse import urlparse
5495 +
5496 +-url = cfg("sr.ht", "redis-host", "redis://localhost")
5497 +-url = urlparse(url)
5498 +-
5499 +-redis = Redis(host=url.hostname,
5500 +- port=(url.port or 6379),
5501 +- password=url.password,
5502 +- db=int(url.path[1:]) if url.path else 0)
5503 ++redis = from_url(cfg("sr.ht", "redis-host", "redis://localhost"))
5504 +--
5505 +2.32.0
5506 +
5507 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0001-gitsrht-keys-update-go-redis-to-support-Unix-sock.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0001-gitsrht-keys-update-go-redis-to-support-Unix-sock.patch
5508 new file mode 100644
5509 index 00000000000..48e91ac739b
5510 --- /dev/null
5511 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0001-gitsrht-keys-update-go-redis-to-support-Unix-sock.patch
5512 @@ -0,0 +1,26 @@
5513 +From 083e4791771d998c9a6c881a4101d24296e38252 Mon Sep 17 00:00:00 2001
5514 +From: Julien Moutinho <julm+srht@sourcephile.fr>
5515 +Date: Fri, 27 Aug 2021 15:38:28 +0200
5516 +Subject: [PATCH git.sr.ht v3 1/3] gitsrht-keys: update go-redis to support
5517 + Unix sockets
5518 +
5519 +---
5520 + gitsrht-keys/main.go | 2 +-
5521 + 1 file changed, 1 insertion(+), 1 deletion(-)
5522 +
5523 +diff --git a/gitsrht-keys/main.go b/gitsrht-keys/main.go
5524 +index 0c1aea1..fa17183 100644
5525 +--- a/gitsrht-keys/main.go
5526 ++++ b/gitsrht-keys/main.go
5527 +@@ -5,7 +5,7 @@ import (
5528 + "os"
5529 + "path"
5530 +
5531 +- goredis "github.com/go-redis/redis"
5532 ++ goredis "github.com/go-redis/redis/v8"
5533 + "github.com/vaughan0/go-ini"
5534 + "git.sr.ht/~sircmpwn/scm.sr.ht/srht-keys"
5535 + )
5536 +--
5537 +2.32.0
5538 +
5539 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0002-gitsrht-update-hook-update-go-redis-to-support-Un.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0002-gitsrht-update-hook-update-go-redis-to-support-Un.patch
5540 new file mode 100644
5541 index 00000000000..41847ac8717
5542 --- /dev/null
5543 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0002-gitsrht-update-hook-update-go-redis-to-support-Un.patch
5544 @@ -0,0 +1,109 @@
5545 +From d9683aced0dc3a94c56de2fde31c1765054900fa Mon Sep 17 00:00:00 2001
5546 +From: Julien Moutinho <julm+srht@sourcephile.fr>
5547 +Date: Fri, 27 Aug 2021 15:39:29 +0200
5548 +Subject: [PATCH git.sr.ht v3 2/3] gitsrht-update-hook: update go-redis to
5549 + support Unix sockets
5550 +
5551 +---
5552 + gitsrht-update-hook/options.go | 12 +++++++-----
5553 + gitsrht-update-hook/post-update.go | 4 ++--
5554 + gitsrht-update-hook/update.go | 4 ++--
5555 + 3 files changed, 11 insertions(+), 9 deletions(-)
5556 +
5557 +diff --git a/gitsrht-update-hook/options.go b/gitsrht-update-hook/options.go
5558 +index 8efbb0a..962502a 100644
5559 +--- a/gitsrht-update-hook/options.go
5560 ++++ b/gitsrht-update-hook/options.go
5561 +@@ -1,15 +1,17 @@
5562 + package main
5563 +
5564 + import (
5565 ++ "context"
5566 + "fmt"
5567 + "os"
5568 + "strconv"
5569 + "strings"
5570 + "time"
5571 +
5572 +- goredis "github.com/go-redis/redis"
5573 ++ goredis "github.com/go-redis/redis/v8"
5574 + )
5575 +
5576 ++var ctx = context.Background()
5577 + var options map[string]string
5578 +
5579 + func loadOptions() {
5580 +@@ -35,10 +37,10 @@ func loadOptions() {
5581 + var n int
5582 + if nopts, ok := os.LookupEnv("GIT_PUSH_OPTION_COUNT"); ok {
5583 + n, _ = strconv.Atoi(nopts)
5584 +- redis.Set(fmt.Sprintf("git.sr.ht.options.%s", uuid),
5585 ++ redis.Set(ctx, fmt.Sprintf("git.sr.ht.options.%s", uuid),
5586 + nopts, 10*time.Minute)
5587 + } else {
5588 +- nopts, err := redis.Get(fmt.Sprintf(
5589 ++ nopts, err := redis.Get(ctx, fmt.Sprintf(
5590 + "git.sr.ht.options.%s", uuid)).Result()
5591 + if err != nil {
5592 + return
5593 +@@ -51,12 +53,12 @@ func loadOptions() {
5594 + opt, ok := os.LookupEnv(fmt.Sprintf("GIT_PUSH_OPTION_%d", i))
5595 + optkey := fmt.Sprintf("git.sr.ht.options.%s.%d", uuid, i)
5596 + if !ok {
5597 +- opt, err = redis.Get(optkey).Result()
5598 ++ opt, err = redis.Get(ctx, optkey).Result()
5599 + if err != nil {
5600 + return
5601 + }
5602 + } else {
5603 +- redis.Set(optkey, opt, 10*time.Minute)
5604 ++ redis.Set(ctx, optkey, opt, 10*time.Minute)
5605 + }
5606 + parts := strings.SplitN(opt, "=", 2)
5607 + if len(parts) == 1 {
5608 +diff --git a/gitsrht-update-hook/post-update.go b/gitsrht-update-hook/post-update.go
5609 +index d14d616..fcd7864 100644
5610 +--- a/gitsrht-update-hook/post-update.go
5611 ++++ b/gitsrht-update-hook/post-update.go
5612 +@@ -15,7 +15,7 @@ import (
5613 + "github.com/go-git/go-git/v5/plumbing"
5614 + "github.com/go-git/go-git/v5/plumbing/object"
5615 + "github.com/go-git/go-git/v5/plumbing/storer"
5616 +- goredis "github.com/go-redis/redis"
5617 ++ goredis "github.com/go-redis/redis/v8"
5618 + _ "github.com/lib/pq"
5619 + )
5620 +
5621 +@@ -220,7 +220,7 @@ func postUpdate() {
5622 + var oldref, newref string
5623 + var oldobj, newobj object.Object
5624 + updateKey := fmt.Sprintf("update.%s.%s", pushUuid, refname)
5625 +- update, err := redis.Get(updateKey).Result()
5626 ++ update, err := redis.Get(ctx, updateKey).Result()
5627 + if update == "" || err != nil {
5628 + logger.Println("redis.Get: missing key")
5629 + continue
5630 +diff --git a/gitsrht-update-hook/update.go b/gitsrht-update-hook/update.go
5631 +index 72c661a..e33fd4b 100644
5632 +--- a/gitsrht-update-hook/update.go
5633 ++++ b/gitsrht-update-hook/update.go
5634 +@@ -5,7 +5,7 @@ import (
5635 + "os"
5636 + "time"
5637 +
5638 +- goredis "github.com/go-redis/redis"
5639 ++ goredis "github.com/go-redis/redis/v8"
5640 + )
5641 +
5642 + // XXX: This is run once for every single ref that's pushed. If someone pushes
5643 +@@ -31,6 +31,6 @@ func update() {
5644 + logger.Fatalf("Failed to parse redis host: %v", err)
5645 + }
5646 + redis := goredis.NewClient(ropts)
5647 +- redis.Set(fmt.Sprintf("update.%s.%s", pushUuid, refname),
5648 ++ redis.Set(ctx, fmt.Sprintf("update.%s.%s", pushUuid, refname),
5649 + fmt.Sprintf("%s:%s", oldref, newref), 10*time.Minute)
5650 + }
5651 +--
5652 +2.32.0
5653 +
5654 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0003-gitsrht-dispatch-add-support-for-supplementary-gr.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0003-gitsrht-dispatch-add-support-for-supplementary-gr.patch
5655 new file mode 100644
5656 index 00000000000..9a4b0300921
5657 --- /dev/null
5658 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/git/v3-0003-gitsrht-dispatch-add-support-for-supplementary-gr.patch
5659 @@ -0,0 +1,57 @@
5660 +From fcbec39a406562c29dfcf7eeef6f284da28bc619 Mon Sep 17 00:00:00 2001
5661 +From: Julien Moutinho <julm+srht@sourcephile.fr>
5662 +Date: Fri, 27 Aug 2021 17:42:33 +0200
5663 +Subject: [PATCH git.sr.ht v3 3/3] gitsrht-dispatch: add support for
5664 + supplementary groups
5665 +
5666 +---
5667 + gitsrht-dispatch/main.go | 17 ++++++++++++++---
5668 + 1 file changed, 14 insertions(+), 3 deletions(-)
5669 +
5670 +diff --git a/gitsrht-dispatch/main.go b/gitsrht-dispatch/main.go
5671 +index d7aee14..5f17b75 100644
5672 +--- a/gitsrht-dispatch/main.go
5673 ++++ b/gitsrht-dispatch/main.go
5674 +@@ -17,6 +17,7 @@ type Dispatcher struct {
5675 + cmd string
5676 + uid int
5677 + gid int
5678 ++ gids []int
5679 + }
5680 +
5681 + func main() {
5682 +@@ -70,11 +71,20 @@ AuthorizedKeysUser=root`, os.Args[0])
5683 + if err != nil {
5684 + logger.Fatalf("Error looking up group %s: %v", spec[1], err)
5685 + }
5686 ++ groups, err := user.GroupIds()
5687 ++ if err != nil {
5688 ++ logger.Fatalf("Error looking up supplementary groups of user %s: %v", spec[0], err)
5689 ++ }
5690 ++ gids := make([]int, len(groups))
5691 ++ for i, grp := range groups {
5692 ++ sgid, _ := strconv.Atoi(grp)
5693 ++ gids[i] = sgid
5694 ++ }
5695 + uid, _ := strconv.Atoi(user.Uid)
5696 + gid, _ := strconv.Atoi(group.Gid)
5697 +- dispatchers[uid] = Dispatcher{cmd, uid, gid}
5698 +- logger.Printf("Registered dispatcher for %s(%d):%s(%d): %s",
5699 +- spec[0], uid, spec[1], gid, cmd)
5700 ++ dispatchers[uid] = Dispatcher{cmd, uid, gid, gids}
5701 ++ logger.Printf("Registered dispatcher for %s(%d):%s(%d):(%s): %s",
5702 ++ spec[0], uid, spec[1], gid, strings.Join(groups, ","), cmd)
5703 + }
5704 +
5705 + var user *osuser.User
5706 +@@ -93,6 +103,7 @@ AuthorizedKeysUser=root`, os.Args[0])
5707 +
5708 + if dispatcher, ok := dispatchers[uid]; ok {
5709 + logger.Printf("Dispatching to %s", dispatcher.cmd)
5710 ++ syscall.Setgroups(dispatcher.gids)
5711 + syscall.Setgid(dispatcher.gid)
5712 + syscall.Setuid(dispatcher.uid)
5713 + if err := syscall.Exec(dispatcher.cmd, append([]string{
5714 +--
5715 +2.32.0
5716 +
5717 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/scm/v3-0001-srht-keys-update-go-redis-to-support-Unix-sockets.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/scm/v3-0001-srht-keys-update-go-redis-to-support-Unix-sockets.patch
5718 new file mode 100644
5719 index 00000000000..191ff61b826
5720 --- /dev/null
5721 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/scm/v3-0001-srht-keys-update-go-redis-to-support-Unix-sockets.patch
5722 @@ -0,0 +1,61 @@
5723 +From e244cb7398758f91cc6deaabf278a1b6412ee477 Mon Sep 17 00:00:00 2001
5724 +From: Julien Moutinho <julm+srht@sourcephile.fr>
5725 +Date: Fri, 27 Aug 2021 12:48:56 +0200
5726 +Subject: [PATCH scm.sr.ht v3 1/2] srht-keys: update go-redis to support Unix
5727 + sockets
5728 +
5729 +---
5730 + srht-keys/srhtkeys.go | 9 ++++++---
5731 + 1 file changed, 6 insertions(+), 3 deletions(-)
5732 +
5733 +diff --git a/srht-keys/srhtkeys.go b/srht-keys/srhtkeys.go
5734 +index be925ed..1a300d5 100644
5735 +--- a/srht-keys/srhtkeys.go
5736 ++++ b/srht-keys/srhtkeys.go
5737 +@@ -1,6 +1,7 @@
5738 + package srhtkeys
5739 +
5740 + import (
5741 ++ "context"
5742 + "database/sql"
5743 + "encoding/json"
5744 + "errors"
5745 +@@ -12,7 +13,7 @@ import (
5746 + "path"
5747 + "time"
5748 +
5749 +- goredis "github.com/go-redis/redis"
5750 ++ goredis "github.com/go-redis/redis/v8"
5751 + "github.com/google/uuid"
5752 + _ "github.com/lib/pq"
5753 + "github.com/vaughan0/go-ini"
5754 +@@ -37,6 +38,8 @@ type MetaSSHKey struct {
5755 + Owner MetaUser `json:"owner"`
5756 + }
5757 +
5758 ++var ctx = context.Background()
5759 ++
5760 + // Stores the SSH key in the database and returns the user's ID.
5761 + func storeKey(logger *log.Logger, db *sql.DB, key *MetaSSHKey) (int, error) {
5762 + logger.Println("Storing meta.sr.ht key in database")
5763 +@@ -145,7 +148,7 @@ func fetchKeysFromMeta(logger *log.Logger, config ini.File,
5764 + if err != nil {
5765 + logger.Printf("Caching SSH key in redis failed: %v", err)
5766 + } else {
5767 +- redis.Set(cacheKey, cacheBytes, 7*24*time.Hour)
5768 ++ redis.Set(ctx, cacheKey, cacheBytes, 7*24*time.Hour)
5769 + }
5770 +
5771 + return key.Owner.Username, userId
5772 +@@ -168,7 +171,7 @@ func UserFromKey(logger *log.Logger, config ini.File,
5773 +
5774 + cacheKey := fmt.Sprintf("%s.ssh-keys.%s", service, b64key)
5775 + logger.Printf("Cache key for SSH key lookup: %s", cacheKey)
5776 +- cacheBytes, err := redis.Get(cacheKey).Bytes()
5777 ++ cacheBytes, err := redis.Get(ctx, cacheKey).Bytes()
5778 + var (
5779 + username string
5780 + userId int
5781 +--
5782 +2.32.0
5783 +
5784 diff --git a/pkgs/applications/version-management/sourcehut/patches/redis-socket/scm/v3-0002-srht-keys-update-go.-mod-sum-for-go-redis.patch b/pkgs/applications/version-management/sourcehut/patches/redis-socket/scm/v3-0002-srht-keys-update-go.-mod-sum-for-go-redis.patch
5785 new file mode 100644
5786 index 00000000000..c5407a26491
5787 --- /dev/null
5788 +++ b/pkgs/applications/version-management/sourcehut/patches/redis-socket/scm/v3-0002-srht-keys-update-go.-mod-sum-for-go-redis.patch
5789 @@ -0,0 +1,155 @@
5790 +From aeb3e0dc2270e6ab3cd0f651ea735275e527e7ce Mon Sep 17 00:00:00 2001
5791 +From: Julien Moutinho <julm+srht@sourcephile.fr>
5792 +Date: Fri, 27 Aug 2021 13:06:27 +0200
5793 +Subject: [PATCH scm.sr.ht v3 2/2] srht-keys: update go.{mod,sum} for go-redis
5794 +
5795 +---
5796 + srht-keys/go.mod | 2 +-
5797 + srht-keys/go.sum | 103 ++++++++++++++++++++++++++++++++++++++++++++---
5798 + 2 files changed, 99 insertions(+), 6 deletions(-)
5799 +
5800 +diff --git a/srht-keys/go.mod b/srht-keys/go.mod
5801 +index d275913..8d1c10a 100644
5802 +--- a/srht-keys/go.mod
5803 ++++ b/srht-keys/go.mod
5804 +@@ -4,7 +4,7 @@ go 1.13
5805 +
5806 + require (
5807 + git.sr.ht/~sircmpwn/core-go v0.0.0-20201005173246-a9e49d17a1e6
5808 +- github.com/go-redis/redis v6.15.9+incompatible
5809 ++ github.com/go-redis/redis/v8 v8.11.3
5810 + github.com/google/uuid v1.1.1
5811 + github.com/lib/pq v1.8.0
5812 + github.com/vaughan0/go-ini v0.0.0-20130923145212-a98ad7ee00ec
5813 +diff --git a/srht-keys/go.sum b/srht-keys/go.sum
5814 +index 974326e..a264a26 100644
5815 +--- a/srht-keys/go.sum
5816 ++++ b/srht-keys/go.sum
5817 +@@ -1,26 +1,119 @@
5818 +-git.sr.ht/~sircmpwn/core-go v0.0.0-20200820135923-98806e712f5e h1:TJqf/neVU5peFAS9WcR1aADXcflPOvAd7ABEirmU7m0=
5819 +-git.sr.ht/~sircmpwn/core-go v0.0.0-20200820135923-98806e712f5e/go.mod h1:aXSNgRsGoI3tTFKlwD0xm2htbEzKlR2xUm1osRxfhOM=
5820 + git.sr.ht/~sircmpwn/core-go v0.0.0-20201005173246-a9e49d17a1e6 h1:Ky6HzcRmbMUxOrWXv04+mb97GkyxO/Nx7v8uJBUdpNk=
5821 + git.sr.ht/~sircmpwn/core-go v0.0.0-20201005173246-a9e49d17a1e6/go.mod h1:HpPX22ilJUWKOA4NDhrOcIyblQhdiKHPg4oMJFYdh0Y=
5822 ++github.com/cespare/xxhash/v2 v2.1.1 h1:6MnRN8NT7+YBpUIWxHtefFZOKTAPgGjpQSxqLNn0+qY=
5823 ++github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
5824 + github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5825 ++github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
5826 ++github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
5827 ++github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78=
5828 ++github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc=
5829 ++github.com/fernet/fernet-go v0.0.0-20191111064656-eff2850e6001 h1:/UMxx5lGDg30aioUL9e7xJnbJfJeX7vhcm57fa5udaI=
5830 + github.com/fernet/fernet-go v0.0.0-20191111064656-eff2850e6001/go.mod h1:2H9hjfbpSMHwY503FclkV/lZTBh2YlOmLLSda12uL8c=
5831 +-github.com/go-redis/redis v6.15.9+incompatible h1:K0pv1D7EQUjfyoMql+r/jZqCLizCGKFlFgcHWWmHQjg=
5832 +-github.com/go-redis/redis v6.15.9+incompatible/go.mod h1:NAIEuMOZ/fxfXJIrKDQDz8wamY7mA7PouImQ2Jvg6kA=
5833 ++github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
5834 ++github.com/fsnotify/fsnotify v1.4.9 h1:hsms1Qyu0jgnwNXIxa+/V/PDsU6CfLf6CNO8H7IWoS4=
5835 ++github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
5836 ++github.com/go-redis/redis/v8 v8.11.3 h1:GCjoYp8c+yQTJfc0n69iwSiHjvuAdruxl7elnZCxgt8=
5837 ++github.com/go-redis/redis/v8 v8.11.3/go.mod h1:xNJ9xDG09FsIPwh3bWdk+0oDWHbtF9rPN0F/oD9XeKc=
5838 ++github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
5839 ++github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
5840 ++github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
5841 ++github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
5842 ++github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
5843 ++github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
5844 ++github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
5845 ++github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
5846 ++github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
5847 ++github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
5848 ++github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
5849 ++github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
5850 ++github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
5851 ++github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
5852 ++github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
5853 ++github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=
5854 ++github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
5855 + github.com/google/uuid v1.1.1 h1:Gkbcsh/GbpXz7lPftLA3P6TYMwjCLYm83jiFQZF/3gY=
5856 + github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
5857 ++github.com/hpcloud/tail v1.0.0/go.mod h1:ab1qPbhIpdTxEkNHXyeSf5vhxWSCs/tWer42PpOxQnU=
5858 + github.com/lib/pq v1.8.0 h1:9xohqzkUwzR4Ga4ivdTcawVS89YSDVxXMa3xJX3cGzg=
5859 + github.com/lib/pq v1.8.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
5860 ++github.com/nxadm/tail v1.4.4/go.mod h1:kenIhsEOeOJmVchQTgglprH7qJGnHDVpk1VPCcaMI8A=
5861 ++github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
5862 ++github.com/nxadm/tail v1.4.8/go.mod h1:+ncqLTQzXmGhMZNUePPaPqPvBxHAIsmXswZKocGu+AU=
5863 ++github.com/onsi/ginkgo v1.6.0/go.mod h1:lLunBs/Ym6LB5Z9jYTR76FiuTmxDTDusOGeTQH+WWjE=
5864 ++github.com/onsi/ginkgo v1.12.1/go.mod h1:zj2OWP4+oCPe1qIXoGWkgMRwljMUYCdkwsT2108oapk=
5865 ++github.com/onsi/ginkgo v1.16.4 h1:29JGrr5oVBm5ulCWet69zQkzWipVXIol6ygQUe/EzNc=
5866 ++github.com/onsi/ginkgo v1.16.4/go.mod h1:dX+/inL/fNMqNlz0e9LfyB9TswhZpCVdJM/Z6Vvnwo0=
5867 ++github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
5868 ++github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
5869 ++github.com/onsi/gomega v1.15.0 h1:WjP/FQ/sk43MRmnEcT+MlDw2TFvkrXlprrPST/IudjU=
5870 ++github.com/onsi/gomega v1.15.0/go.mod h1:cIuvLEne0aoVhAgh/O6ac0Op8WWw9H6eYCriF+tEHG0=
5871 ++github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
5872 + github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
5873 + github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
5874 ++github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
5875 ++github.com/stretchr/testify v1.6.1 h1:hDPOHmpOpP40lSULcqw7IrRb/u7w6RpDC9399XyoNd0=
5876 + github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
5877 + github.com/vaughan0/go-ini v0.0.0-20130923145212-a98ad7ee00ec h1:DGmKwyZwEB8dI7tbLt/I/gQuP559o/0FrAkHKlQM/Ks=
5878 + github.com/vaughan0/go-ini v0.0.0-20130923145212-a98ad7ee00ec/go.mod h1:owBmyHYMLkxyrugmfwE/DLJyW8Ro9mkphwuVErQ0iUw=
5879 ++github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
5880 + golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
5881 +-golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de h1:ikNHVSjEfnvz6sxdSPCaPt572qowuyMDMJLLm3Db3ig=
5882 ++golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
5883 ++golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
5884 + golang.org/x/crypto v0.0.0-20200728195943-123391ffb6de/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
5885 ++golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
5886 ++golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
5887 + golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
5888 ++golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
5889 ++golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
5890 ++golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
5891 ++golang.org/x/net v0.0.0-20210428140749-89ef3d95e781 h1:DzZ89McO9/gWPsQXS/FVKAlG02ZjaQ6AlZRBimEYOd0=
5892 ++golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
5893 ++golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
5894 ++golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
5895 ++golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
5896 ++golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5897 + golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
5898 + golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5899 ++golang.org/x/sys v0.0.0-20190904154756-749cb33beabd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5900 ++golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5901 ++golang.org/x/sys v0.0.0-20191120155948-bd437916bb0e/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5902 ++golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5903 ++golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5904 ++golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5905 ++golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5906 ++golang.org/x/sys v0.0.0-20210423082822-04245dca01da h1:b3NXsE2LusjYGGjL5bxEVZZORm/YEFFrWFjR8eFrw/c=
5907 ++golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
5908 ++golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
5909 + golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
5910 ++golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
5911 ++golang.org/x/text v0.3.6 h1:aRYxNxv6iGQlyVaZmk6ZgYEDa+Jg18DxebPSrd6bg1M=
5912 ++golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
5913 ++golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
5914 ++golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
5915 ++golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
5916 ++golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
5917 ++golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
5918 ++golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
5919 ++golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
5920 ++golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
5921 ++google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
5922 ++google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
5923 ++google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
5924 ++google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
5925 ++google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
5926 ++google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
5927 ++google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
5928 ++google.golang.org/protobuf v1.26.0 h1:bxAC2xTBsZGibn2RTntX0oH50xLsqy1OxA9tTL3p/lk=
5929 ++google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
5930 ++gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
5931 + gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
5932 ++gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
5933 ++gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
5934 ++gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
5935 ++gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5936 ++gopkg.in/yaml.v2 v2.2.4/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5937 ++gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
5938 ++gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
5939 ++gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
5940 ++gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c h1:dUUwHk2QECo/6vqA44rthZ8ie2QXMNeKRTHCNY2nXvo=
5941 + gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
5942 +--
5943 +2.32.0
5944 +
5945 diff --git a/pkgs/applications/version-management/sourcehut/scm.nix b/pkgs/applications/version-management/sourcehut/scm.nix
5946 index 1f385265360..257f8deaf90 100644
5947 --- a/pkgs/applications/version-management/sourcehut/scm.nix
5948 +++ b/pkgs/applications/version-management/sourcehut/scm.nix
5949 @@ -1,22 +1,58 @@
5950 { lib
5951 , fetchFromSourcehut
5952 +, buildGoModule
5953 , buildPythonPackage
5954 , srht
5955 , redis
5956 , pyyaml
5957 -, buildsrht
5958 -, writeText
5959 +, applyPatches
5960 }:
5961
5962 buildPythonPackage rec {
5963 pname = "scmsrht";
5964 - version = "0.22.9";
5965 + version = "0.22.13";
5966
5967 src = fetchFromSourcehut {
5968 owner = "~sircmpwn";
5969 repo = "scm.sr.ht";
5970 rev = version;
5971 - sha256 = "sha256-327G6C8FW+iZx+167D7TQsFtV6FGc8MpMVo9L/cUUqU=";
5972 + sha256 = "sha256-9iRmQBt4Cxr5itTk34b8iDRyXYDHTDfZjV0SIDT/kkM=";
5973 + };
5974 +
5975 + passthru = {
5976 + srht-keys = buildGoModule rec {
5977 + inherit src version;
5978 + sourceRoot = "source/srht-keys";
5979 + pname = "srht-keys";
5980 + vendorSha256 = "sha256-lQk1dymMCefHMFJhO3yC/muBP/cxI//5Yz991D2YZY4=";
5981 +
5982 + # What follows is only to update go-redis
5983 + # go.{mod,sum} could be patched directly but that would be less resilient
5984 + # to changes from upstream, and thus harder to maintain the patching
5985 + # while it hasn't been merged upstream.
5986 +
5987 + overrideModAttrs = old: {
5988 + inherit patches patchFlags;
5989 + preBuild = ''
5990 + go get github.com/go-redis/redis/v8
5991 + go get github.com/go-redis/redis@none
5992 + go mod tidy
5993 + '';
5994 + # Pass updated go.{mod,sum} from go-modules to srht-keys's vendor/go.{mod,sum}
5995 + postInstall = ''
5996 + cp --reflink=auto go.* $out
5997 + '';
5998 + };
5999 +
6000 + patches = [
6001 + # Update go-redis to support Unix sockets
6002 + patches/redis-socket/scm/v3-0001-srht-keys-update-go-redis-to-support-Unix-sockets.patch
6003 + ];
6004 + patchFlags = "-p2";
6005 + postInstall = ''
6006 + cp --reflink=auto *.go vendor/go.* $out
6007 + '';
6008 + };
6009 };
6010
6011 nativeBuildInputs = srht.nativeBuildInputs;
6012 @@ -25,7 +61,6 @@ buildPythonPackage rec {
6013 srht
6014 redis
6015 pyyaml
6016 - buildsrht
6017 ];
6018
6019 preBuild = ''
6020 @@ -33,11 +68,12 @@ buildPythonPackage rec {
6021 '';
6022
6023 dontUseSetuptoolsCheck = true;
6024 + pythonImportsCheck = [ "scmsrht" ];
6025
6026 meta = with lib; {
6027 homepage = "https://git.sr.ht/~sircmpwn/git.sr.ht";
6028 description = "Shared support code for sr.ht source control services.";
6029 - license = licenses.agpl3;
6030 + license = licenses.agpl3Only;
6031 maintainers = with maintainers; [ eadwu ];
6032 };
6033 }
6034 diff --git a/pkgs/applications/version-management/sourcehut/todo.nix b/pkgs/applications/version-management/sourcehut/todo.nix
6035 index 85e1f5637b6..88b7a33495a 100644
6036 --- a/pkgs/applications/version-management/sourcehut/todo.nix
6037 +++ b/pkgs/applications/version-management/sourcehut/todo.nix
6038 @@ -12,13 +12,13 @@
6039
6040 buildPythonPackage rec {
6041 pname = "todosrht";
6042 - version = "0.64.14";
6043 + version = "0.64.28";
6044
6045 src = fetchFromSourcehut {
6046 owner = "~sircmpwn";
6047 repo = "todo.sr.ht";
6048 rev = version;
6049 - sha256 = "sha256-huIAhn6h1F5w5ST4/yBwr82kAzyYwhLu+gpRuOQgnsE=";
6050 + sha256 = "sha256-uClWcR0saH4dUGRRTueLv7T4IBefMVSI5khCdeDBRv4=";
6051 };
6052
6053 nativeBuildInputs = srht.nativeBuildInputs;
6054 @@ -42,11 +42,12 @@ buildPythonPackage rec {
6055 ];
6056
6057 dontUseSetuptoolsCheck = true;
6058 + pythonImportsCheck = [ "todosrht" ];
6059
6060 meta = with lib; {
6061 homepage = "https://todo.sr.ht/~sircmpwn/todo.sr.ht";
6062 description = "Ticket tracking service for the sr.ht network";
6063 - license = licenses.agpl3;
6064 + license = licenses.agpl3Only;
6065 maintainers = with maintainers; [ eadwu ];
6066 };
6067 }
6068 diff --git a/pkgs/applications/version-management/sourcehut/update.sh b/pkgs/applications/version-management/sourcehut/update.sh
6069 index 156d4cc35e4..6733046d000 100755
6070 --- a/pkgs/applications/version-management/sourcehut/update.sh
6071 +++ b/pkgs/applications/version-management/sourcehut/update.sh
6072 @@ -1,8 +1,11 @@
6073 #! /usr/bin/env nix-shell
6074 #! nix-shell -i bash -p git mercurial common-updater-scripts
6075 +set -x
6076
6077 -cd "$(dirname "${BASH_SOURCE[0]}")"
6078 +cd "$(dirname "${BASH_SOURCE[0]}")" || exit 1
6079 root=../../../..
6080 +tmp=$(mktemp -d)
6081 +trap 'rm -rf "$tmp"' EXIT
6082
6083 default() {
6084 (cd "$root" && nix-instantiate --eval --strict -A "sourcehut.python.pkgs.$1.meta.position" | sed -re 's/^"(.*):[0-9]+"$/\1/')
6085 @@ -13,19 +16,18 @@ version() {
6086 }
6087
6088 src_url() {
6089 - (cd "$root" && nix-instantiate --eval --strict -A "sourcehut.python.pkgs.$1.src.drvAttrs.url" | tr -d '"')
6090 + nix-instantiate --eval --strict --expr " with import $root {}; let src = sourcehut.python.pkgs.$1.drvAttrs.src; in src.url or src.meta.homepage" | tr -d '"'
6091 }
6092
6093 get_latest_version() {
6094 src="$(src_url "$1")"
6095 - tmp=$(mktemp -d)
6096 -
6097 + rm -rf "$tmp"
6098 if [ "$1" = "hgsrht" ]; then
6099 - hg clone "$src" "$tmp" &> /dev/null
6100 + hg clone "$src" "$tmp" >/dev/null
6101 printf "%s" "$(cd "$tmp" && hg log --limit 1 --template '{latesttag}')"
6102 else
6103 - git clone "$src" "$tmp"
6104 - printf "%s" "$(cd "$tmp" && git describe $(git rev-list --tags --max-count=1))"
6105 + git clone "$src" "$tmp" >/dev/null
6106 + printf "%s" "$(cd "$tmp" && git describe "$(git rev-list --tags --max-count=1)")"
6107 fi
6108 }
6109
6110 @@ -36,19 +38,33 @@ update_version() {
6111
6112 (cd "$root" && update-source-version "sourcehut.python.pkgs.$1" "$version")
6113
6114 + # Update vendorSha256 of Go modules
6115 + nixFile="${1%srht}".nix
6116 + nixFile="${nixFile/build/builds}"
6117 + retry=true
6118 + while "$retry"; do
6119 + retry=false;
6120 + exec < <(exec nix -L build -f "$root" sourcehut.python.pkgs."$1" 2>&1)
6121 + while IFS=' :' read -r origin hash; do
6122 + case "$origin" in
6123 + (expected|specified) oldHash="$hash";;
6124 + (got) sed -i "s|$oldHash|$(nix hash to-sri --type sha256 "$hash")|" "$nixFile"; retry=true; break;;
6125 + (*) printf >&2 "%s\n" "$origin${hash:+:$hash}"
6126 + esac
6127 + done
6128 + done
6129 +
6130 git add "$default_nix"
6131 - git commit -m "$1: $version_old -> $version"
6132 + git commit -m "sourcehut.$1: $version_old -> $version"
6133 }
6134
6135 -services=( "srht" "buildsrht" "dispatchsrht" "gitsrht" "hgsrht" "hubsrht" "listssrht" "mansrht"
6136 - "metasrht" "pastesrht" "todosrht" "scmsrht" )
6137 -
6138 -# Whether or not a specific service is requested
6139 -if [ -n "$1" ]; then
6140 - version="$(get_latest_version "$1")"
6141 - (cd "$root" && update-source-version "sourcehut.python.pkgs.$1" "$version")
6142 +if [ $# -gt 0 ]; then
6143 + services=("$@")
6144 else
6145 - for service in "${services[@]}"; do
6146 - update_version "$service"
6147 - done
6148 + services=( "srht" "buildsrht" "dispatchsrht" "gitsrht" "hgsrht" "hubsrht" "listssrht" "mansrht"
6149 + "metasrht" "pagessrht" "pastesrht" "todosrht" "scmsrht" )
6150 fi
6151 +
6152 +for service in "${services[@]}"; do
6153 + update_version "$service"
6154 +done
NixOS configurations for Sourcephile's infrastructure