Something went wrong. Try again.
An ATProto Powered Reputation Network
Something went wrong. Try again.
5.9 kB · 141 lines
Nix
at master
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142{ config, lib, pkgs, ...}:let cfg = config.services.provenance.appview; common = import ./common.nix { inherit lib; };in{ options.services.provenance.appview = { enable = lib.mkEnableOption "the Provenance appview";
package = lib.mkOption { type = lib.types.package; default = pkgs.callPackage ../package.nix { pname = "provenance-appview"; subPackages = [ "cmd/appview" ]; }; defaultText = lib.literalExpression "the Provenance appview package"; description = "Package that provides bin/appview."; };
listenAddress = lib.mkOption { type = lib.types.str; default = "127.0.0.1:8001"; description = "HTTP listen address in host:port form. Use brackets for IPv6 hosts."; };
stateDirectory = common.stateOption "provenance-appview"; dataDirectory = common.dataOption cfg.stateDirectory; externalWorkers = common.externalWorkersOption; logLevel = common.logLevelOption; traceEndpoint = lib.mkOption { type = lib.types.nullOr lib.types.str; default = null; example = "http://127.0.0.1:10428/insert/opentelemetry/v1/traces"; description = "Full OTLP/HTTP trace ingest URL. Null disables tracing. Do not include credentials, query parameters, or fragments."; }; databaseFile = common.databaseOption "appview.db"; serviceKeyFile = common.secretOption "Absolute runtime path to the shared service key. Keep the file outside the Nix store.";
jetstreamURL = lib.mkOption { type = lib.types.str; default = "wss://jetstream.fire.hose.cam/subscribe"; description = "Jetstream endpoint. Public Microcosm instances and self-hosted instances are supported."; };
jetstreamReplay = lib.mkEnableOption "historical Jetstream v2 replay with live cutover"; jetstreamReplayURL = lib.mkOption { type = lib.types.str; default = "https://jetstream.us-west.bsky.network"; description = "Jetstream v2 archive origin. Sequence checkpoints belong to this origin."; }; jetstreamAPIKeyFile = common.secretOption "Runtime path to the Jetstream archive API key. Keep the file outside the Nix store."; jetstreamAfterSequence = lib.mkOption { type = lib.types.ints.unsigned; default = 0; description = "Exclusive subset start sequence. Set an end sequence to disable live cutover."; }; jetstreamBeforeSequence = lib.mkOption { type = lib.types.ints.unsigned; default = 0; description = "Inclusive subset end sequence. Zero selects full archive replay with live cutover."; };
slingshotURL = lib.mkOption { type = lib.types.str; default = "https://slingshot.microcosm.blue"; description = "Slingshot origin for missing event payloads."; };
hopPenalty = lib.mkOption { type = lib.types.addCheck (lib.types.either lib.types.float lib.types.int) (value: value >= 0); default = 0.1; description = "Trust penalty for each edge after the first edge. The value must be nonnegative."; };
trustCacheTTL = lib.mkOption { type = lib.types.str; default = "24h"; description = "Trust cache lifetime as a positive Go duration, such as 24h or 30m."; };
enableSoftVouch = lib.mkEnableOption "Bluesky follows and blocks as virtual trust assertions"; softVouchLists = lib.mkEnableOption "blocked-list soft assertions when enableSoftVouch is active"; softVouchAllAuthors = lib.mkEnableOption "soft assertions from all observed stream authors"; };
config = lib.mkIf cfg.enable ( lib.mkMerge [ (common.dataConfig "appview" cfg.stateDirectory cfg.dataDirectory) { assertions = [ { assertion = !cfg.softVouchAllAuthors || cfg.enableSoftVouch; message = "softVouchAllAuthors requires enableSoftVouch."; } { assertion = common.validSecret cfg.serviceKeyFile; message = "services.provenance.appview.serviceKeyFile must name an absolute runtime file outside the Nix store."; } { assertion = !cfg.jetstreamReplay || common.validSecret cfg.jetstreamAPIKeyFile; message = "Historical replay requires jetstreamAPIKeyFile outside the Nix store."; } ];
systemd.services.provenance-appview = common.unit { inherit (cfg) package stateDirectory dataDirectory; binary = "appview"; credentials = { PROVENANCE_SERVICE_KEY = cfg.serviceKeyFile; } // lib.optionalAttrs cfg.jetstreamReplay { JETSTREAM_API_KEY_FILE = cfg.jetstreamAPIKeyFile; }; environment = { PROVENANCE_APPVIEW_ADDR = cfg.listenAddress; PROVENANCE_APPVIEW_DB = "${cfg.dataDirectory}/${cfg.databaseFile}"; PROVENANCE_JETSTREAM_URL = cfg.jetstreamURL; PROVENANCE_JETSTREAM_REPLAY = lib.boolToString cfg.jetstreamReplay; PROVENANCE_JETSTREAM_REPLAY_URL = cfg.jetstreamReplayURL; PROVENANCE_JETSTREAM_AFTER_SEQ = toString cfg.jetstreamAfterSequence; PROVENANCE_JETSTREAM_BEFORE_SEQ = toString cfg.jetstreamBeforeSequence; PROVENANCE_SLINGSHOT_URL = cfg.slingshotURL; PROVENANCE_HOP_PENALTY = toString cfg.hopPenalty; PROVENANCE_TRUST_CACHE_TTL = cfg.trustCacheTTL; PROVENANCE_EXTERNAL_WORKERS = toString cfg.externalWorkers; PROVENANCE_LOG_LEVEL = cfg.logLevel; ENABLE_SOFT_VOUCH = lib.boolToString cfg.enableSoftVouch; ENABLE_SOFT_VOUCH_LISTS = lib.boolToString cfg.softVouchLists; ENABLE_SOFT_VOUCH_ALL_AUTHORS = lib.boolToString cfg.softVouchAllAuthors; } // lib.optionalAttrs (cfg.traceEndpoint != null) { PROVENANCE_TRACE_ENDPOINT = cfg.traceEndpoint; }; }; } ] );}