nixos/modules/services/misc/sourcehut/default.nix

   1 { config, pkgs, lib, ... }:
   2
   3 with lib;
   4 let
   5   cfg = config.services.sourcehut;
   6   cfgIni = cfg.settings;
   7   settingsFormat = pkgs.formats.ini { };
   8
   9   # Specialized python containing all the modules
  10   python = pkgs.sourcehut.python.withPackages (ps: with ps; [
  11     gunicorn
  12     # Sourcehut services
  13     srht
  14     buildsrht
  15     dispatchsrht
  16     gitsrht
  17     hgsrht
  18     hubsrht
  19     listssrht
  20     mansrht
  21     metasrht
  22     pastesrht
  23     todosrht
  24   ]);
  25 in
  26 {
  27   imports =
  28     [
  29       ./git.nix
  30       ./hg.nix
  31       ./hub.nix
  32       ./todo.nix
  33       ./man.nix
  34       ./meta.nix
  35       ./paste.nix
  36       ./builds.nix
  37       ./lists.nix
  38       ./dispatch.nix
  39       (mkRemovedOptionModule [ "services" "sourcehut" "nginx" "enable" ] ''
  40         The sourcehut module supports `nginx` as a local reverse-proxy by default and doesn't
  41         support other reverse-proxies officially.
  42
  43         However it's possible to use an alternative reverse-proxy by
  44
  45           * disabling nginx
  46           * adjusting the relevant settings for server addresses and ports directly
  47
  48         Further details about this can be found in the `Sourcehut`-section of the NixOS-manual.
  49       '')
  50     ];
  51
  52   options.services.sourcehut = {
  53     enable = mkOption {
  54       type = types.bool;
  55       default = false;
  56       description = ''
  57         Enable sourcehut - git hosting, continuous integration, mailing list, ticket tracking,
  58         task dispatching, wiki and account management services
  59       '';
  60     };
  61
  62     services = mkOption {
  63       type = types.nonEmptyListOf (types.enum [ "builds" "dispatch" "git" "hub" "hg" "lists" "man" "meta" "paste" "todo" ]);
  64       default = [ "man" "meta" "paste" ];
  65       example = [ "builds" "dispatch" "git" "hub" "hg" "lists" "man" "meta" "paste" "todo" ];
  66       description = ''
  67         Services to enable on the sourcehut network.
  68       '';
  69     };
  70
  71     originBase = mkOption {
  72       type = types.str;
  73       default = with config.networking; hostName + lib.optionalString (domain != null) ".${domain}";
  74       description = ''
  75         Host name used by reverse-proxy and for default settings. Will host services at git."''${originBase}". For example: git.sr.ht
  76       '';
  77     };
  78
  79     address = mkOption {
  80       type = types.str;
  81       default = "127.0.0.1";
  82       description = ''
  83         Address to bind to.
  84       '';
  85     };
  86
  87     python = mkOption {
  88       internal = true;
  89       type = types.package;
  90       default = python;
  91       description = ''
  92         The python package to use. It should contain references to the *srht modules and also
  93         gunicorn.
  94       '';
  95     };
  96
  97     statePath = mkOption {
  98       type = types.path;
  99       default = "/var/lib/sourcehut";
 100       description = ''
 101         Root state path for the sourcehut network. If left as the default value
 102         this directory will automatically be created before the sourcehut server
 103         starts, otherwise the sysadmin is responsible for ensuring the
 104         directory exists with appropriate ownership and permissions.
 105       '';
 106     };
 107
 108     settings = mkOption {
 109       type = lib.types.submodule {
 110         freeformType = settingsFormat.type;
 111       };
 112       default = { };
 113       description = ''
 114         The configuration for the sourcehut network.
 115       '';
 116     };
 117   };
 118
 119   config = mkIf cfg.enable {
 120     assertions =
 121       [
 122         {
 123           assertion = with cfgIni.webhooks; private-key != null && stringLength private-key == 44;
 124           message = "The webhook's private key must be defined and of a 44 byte length.";
 125         }
 126
 127         {
 128           assertion = hasAttrByPath [ "meta.sr.ht" "origin" ] cfgIni && cfgIni."meta.sr.ht".origin != null;
 129           message = "meta.sr.ht's origin must be defined.";
 130         }
 131       ];
 132
 133     virtualisation.docker.enable = true;
 134     environment.etc."sr.ht/config.ini".source =
 135       settingsFormat.generate "sourcehut-config.ini" (mapAttrsRecursive
 136         (
 137           path: v: if v == null then "" else v
 138         )
 139         cfg.settings);
 140
 141     environment.systemPackages = [ pkgs.sourcehut.coresrht ];
 142
 143     # PostgreSQL server
 144     services.postgresql.enable = mkOverride 999 true;
 145     # Mail server
 146     services.postfix.enable = mkOverride 999 true;
 147     # Cron daemon
 148     services.cron.enable = mkOverride 999 true;
 149     # Redis server
 150     services.redis.enable = mkOverride 999 true;
 151     services.redis.bind = mkOverride 999 "127.0.0.1";
 152
 153     services.sourcehut.settings = {
 154       # The name of your network of sr.ht-based sites
 155       "sr.ht".site-name = mkDefault "sourcehut";
 156       # The top-level info page for your site
 157       "sr.ht".site-info = mkDefault "https://sourcehut.org";
 158       # {{ site-name }}, {{ site-blurb }}
 159       "sr.ht".site-blurb = mkDefault "the hacker's forge";
 160       # If this != production, we add a banner to each page
 161       "sr.ht".environment = mkDefault "development";
 162       # Contact information for the site owners
 163       "sr.ht".owner-name = mkDefault "Drew DeVault";
 164       "sr.ht".owner-email = mkDefault "sir@cmpwn.com";
 165       # The source code for your fork of sr.ht
 166       "sr.ht".source-url = mkDefault "https://git.sr.ht/~sircmpwn/srht";
 167       # A secret key to encrypt session cookies with
 168       "sr.ht".secret-key = mkDefault null;
 169       "sr.ht".global-domain = mkDefault null;
 170
 171       # Outgoing SMTP settings
 172       mail.smtp-host = mkDefault null;
 173       mail.smtp-port = mkDefault null;
 174       mail.smtp-user = mkDefault null;
 175       mail.smtp-password = mkDefault null;
 176       mail.smtp-from = mkDefault null;
 177       # Application exceptions are emailed to this address
 178       mail.error-to = mkDefault null;
 179       mail.error-from = mkDefault null;
 180       # Your PGP key information (DO NOT mix up pub and priv here)
 181       # You must remove the password from your secret key, if present.
 182       # You can do this with gpg --edit-key [key-id], then use the passwd
 183       # command and do not enter a new password.
 184       mail.pgp-privkey = mkDefault null;
 185       mail.pgp-pubkey = mkDefault null;
 186       mail.pgp-key-id = mkDefault null;
 187
 188       # base64-encoded Ed25519 key for signing webhook payloads. This should be
 189       # consistent for all *.sr.ht sites, as we'll use this key to verify signatures
 190       # from other sites in your network.
 191       #
 192       # Use the srht-webhook-keygen command to generate a key.
 193       webhooks.private-key = mkDefault null;
 194     };
 195   };
 196   meta.doc = ./sourcehut.xml;
 197   meta.maintainers = with maintainers; [ tomberek ];
 198 }