diff options
author | Sandro <sandro.jaeckel@gmail.com> | 2022-10-03 20:25:06 +0200 |
---|---|---|
committer | GitHub <noreply@github.com> | 2022-10-03 20:25:06 +0200 |
commit | 1385382014f250913ea12c182fd194aa46523c1d (patch) | |
tree | 93098ff1f3c58bf1757e4b1eb823a5b7f33104c4 /nixos | |
parent | 75ac727dbd241f2e8497f0a22d47de21e0fd4894 (diff) | |
parent | 83f5c2d5ecb08d1aaaae1df0a5d2af02befeea0e (diff) |
Merge pull request #191532 from ambroisie/add-tandoor-recipes
Diffstat (limited to 'nixos')
-rw-r--r-- | nixos/doc/manual/from_md/release-notes/rl-2211.section.xml | 7 | ||||
-rw-r--r-- | nixos/doc/manual/release-notes/rl-2211.section.md | 2 | ||||
-rw-r--r-- | nixos/modules/module-list.nix | 1 | ||||
-rw-r--r-- | nixos/modules/services/misc/tandoor-recipes.nix | 144 | ||||
-rw-r--r-- | nixos/tests/all-tests.nix | 1 | ||||
-rw-r--r-- | nixos/tests/tandoor-recipes.nix | 43 |
6 files changed, 198 insertions, 0 deletions
diff --git a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml index ad08caf3ce5c..582b1715d1a4 100644 --- a/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml +++ b/nixos/doc/manual/from_md/release-notes/rl-2211.section.xml @@ -196,6 +196,13 @@ </listitem> <listitem> <para> + <link xlink:href="https://tandoor.dev">Tandoor Recipes</link>, + a self-hosted multi-tenant recipe collection. Available as + <link xlink:href="options.html#opt-services.tandoor-recipes.enable">services.tandoor-recipes</link>. + </para> + </listitem> + <listitem> + <para> <link xlink:href="https://hbase.apache.org/">HBase cluster</link>, a distributed, scalable, big data store. Available as diff --git a/nixos/doc/manual/release-notes/rl-2211.section.md b/nixos/doc/manual/release-notes/rl-2211.section.md index 85c35b993ac4..3e38f85b8f10 100644 --- a/nixos/doc/manual/release-notes/rl-2211.section.md +++ b/nixos/doc/manual/release-notes/rl-2211.section.md @@ -72,6 +72,8 @@ In addition to numerous new and upgraded packages, this release has the followin - [Komga](https://komga.org/), a free and open source comics/mangas media server. Available as [services.komga](#opt-services.komga.enable). +- [Tandoor Recipes](https://tandoor.dev), a self-hosted multi-tenant recipe collection. Available as [services.tandoor-recipes](options.html#opt-services.tandoor-recipes.enable). + - [HBase cluster](https://hbase.apache.org/), a distributed, scalable, big data store. Available as [services.hadoop.hbase](options.html#opt-services.hadoop.hbase.enable). - [Sachet](https://github.com/messagebird/sachet/), an SMS alerting tool for the Prometheus Alertmanager. Available as [services.prometheus.sachet](#opt-services.prometheus.sachet.enable). diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index dec66e395aad..b53c2701892e 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -653,6 +653,7 @@ ./services/misc/svnserve.nix ./services/misc/synergy.nix ./services/misc/sysprof.nix + ./services/misc/tandoor-recipes.nix ./services/misc/taskserver ./services/misc/tiddlywiki.nix ./services/misc/tp-auto-kbbl.nix diff --git a/nixos/modules/services/misc/tandoor-recipes.nix b/nixos/modules/services/misc/tandoor-recipes.nix new file mode 100644 index 000000000000..a349bcac9321 --- /dev/null +++ b/nixos/modules/services/misc/tandoor-recipes.nix @@ -0,0 +1,144 @@ +{ config, pkgs, lib, ... }: + +with lib; +let + cfg = config.services.tandoor-recipes; + pkg = cfg.package; + + # SECRET_KEY through an env file + env = { + GUNICORN_CMD_ARGS = "--bind=${cfg.address}:${toString cfg.port}"; + DEBUG = "0"; + MEDIA_ROOT = "/var/lib/tandoor-recipes"; + } // optionalAttrs (config.time.timeZone != null) { + TIMEZONE = config.time.timeZone; + } // ( + lib.mapAttrs (_: toString) cfg.extraConfig + ); + + manage = + let + setupEnv = lib.concatStringsSep "\n" (mapAttrsToList (name: val: "export ${name}=\"${val}\"") env); + in + pkgs.writeShellScript "manage" '' + ${setupEnv} + exec ${pkg}/bin/tandoor-recipes "$@" + ''; +in +{ + meta.maintainers = with maintainers; [ ambroisie ]; + + options.services.tandoor-recipes = { + enable = mkOption { + type = lib.types.bool; + default = false; + description = lib.mdDoc '' + Enable Tandoor Recipes. + + When started, the Tandoor Recipes database is automatically created if + it doesn't exist and updated if the package has changed. Both tasks are + achieved by running a Django migration. + + A script to manage the instance (by wrapping Django's manage.py) is linked to + `/var/lib/tandoor-recipes/tandoor-recipes-manage`. + ''; + }; + + address = mkOption { + type = types.str; + default = "localhost"; + description = lib.mdDoc "Web interface address."; + }; + + port = mkOption { + type = types.port; + default = 8080; + description = lib.mdDoc "Web interface port."; + }; + + extraConfig = mkOption { + type = types.attrs; + default = { }; + description = lib.mdDoc '' + Extra tandoor recipes config options. + + See [the example dot-env file](https://raw.githubusercontent.com/vabene1111/recipes/master/.env.template) + for available options. + ''; + example = { + ENABLE_SIGNUP = "1"; + }; + }; + + package = mkOption { + type = types.package; + default = pkgs.tandoor-recipes; + defaultText = literalExpression "pkgs.tandoor-recipes"; + description = lib.mdDoc "The Tandoor Recipes package to use."; + }; + }; + + config = mkIf cfg.enable { + systemd.services.tandoor-recipes = { + description = "Tandoor Recipes server"; + + serviceConfig = { + ExecStart = '' + ${pkg.python.pkgs.gunicorn}/bin/gunicorn recipes.wsgi + ''; + Restart = "on-failure"; + + User = "tandoor_recipes"; + DynamicUser = true; + StateDirectory = "tandoor-recipes"; + WorkingDirectory = "/var/lib/tandoor-recipes"; + RuntimeDirectory = "tandoor-recipes"; + + BindReadOnlyPaths = [ + "${config.environment.etc."ssl/certs/ca-certificates.crt".source}:/etc/ssl/certs/ca-certificates.crt" + builtins.storeDir + "-/etc/resolv.conf" + "-/etc/nsswitch.conf" + "-/etc/hosts" + "-/etc/localtime" + "-/run/postgresql" + ]; + CapabilityBoundingSet = ""; + LockPersonality = true; + MemoryDenyWriteExecute = true; + PrivateDevices = true; + PrivateUsers = true; + ProtectClock = true; + ProtectControlGroups = true; + ProtectHome = true; + ProtectHostname = true; + ProtectKernelLogs = true; + ProtectKernelModules = true; + ProtectKernelTunables = true; + RestrictAddressFamilies = [ "AF_UNIX" "AF_INET" "AF_INET6" ]; + RestrictNamespaces = true; + RestrictRealtime = true; + SystemCallArchitectures = "native"; + # gunicorn needs setuid + SystemCallFilter = [ "@system-service" "~@privileged" "@resources" "@setuid" "@keyring" ]; + UMask = "0066"; + } // lib.optionalAttrs (cfg.port < 1024) { + AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ]; + CapabilityBoundingSet = [ "CAP_NET_BIND_SERVICE" ]; + }; + + wantedBy = [ "multi-user.target" ]; + + preStart = '' + ln -sf ${manage} tandoor-recipes-manage + + # Let django migrate the DB as needed + ${pkg}/bin/tandoor-recipes migrate + ''; + + environment = env // { + PYTHONPATH = "${pkg.python.pkgs.makePythonPath pkg.propagatedBuildInputs}:${pkg}/lib/tandoor-recipes"; + }; + }; + }; +} diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 36c51b573100..8c44d4cf7805 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -612,6 +612,7 @@ in { systemd-shutdown = handleTest ./systemd-shutdown.nix {}; systemd-timesyncd = handleTest ./systemd-timesyncd.nix {}; systemd-misc = handleTest ./systemd-misc.nix {}; + tandoor-recipes = handleTest ./tandoor-recipes.nix {}; taskserver = handleTest ./taskserver.nix {}; teeworlds = handleTest ./teeworlds.nix {}; telegraf = handleTest ./telegraf.nix {}; diff --git a/nixos/tests/tandoor-recipes.nix b/nixos/tests/tandoor-recipes.nix new file mode 100644 index 000000000000..54456238fe63 --- /dev/null +++ b/nixos/tests/tandoor-recipes.nix @@ -0,0 +1,43 @@ +import ./make-test-python.nix ({ lib, ... }: { + name = "tandoor-recipes"; + meta.maintainers = with lib.maintainers; [ ambroisie ]; + + nodes.machine = { pkgs, ... }: { + # Setup using Postgres + services.tandoor-recipes = { + enable = true; + + extraConfig = { + DB_ENGINE = "django.db.backends.postgresql"; + POSTGRES_HOST = "/run/postgresql"; + POSTGRES_USER = "tandoor_recipes"; + POSTGRES_DB = "tandoor_recipes"; + }; + }; + + services.postgresql = { + enable = true; + ensureDatabases = [ "tandoor_recipes" ]; + ensureUsers = [ + { + name = "tandoor_recipes"; + ensurePermissions."DATABASE tandoor_recipes" = "ALL PRIVILEGES"; + } + ]; + }; + + systemd.services = { + tandoor-recipes = { + after = [ "postgresql.service" ]; + }; + }; + }; + + testScript = '' + machine.wait_for_unit("tandoor-recipes.service") + + with subtest("Web interface gets ready"): + # Wait until server accepts connections + machine.wait_until_succeeds("curl -fs localhost:8080") + ''; +}) |