Something went wrong. Try again.
This repository has no description
Something went wrong. Try again.
9.1 kB · 296 lines
Nix
123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297{ config, pkgs, lib, ...}: let cfg = config.services.tangled.knot;in with lib; { options = { services.tangled.knot = { enable = mkOption { type = types.bool; default = false; description = "Enable a tangled knot"; };
package = mkOption { type = types.package; description = "Package to use for the knot"; };
appviewEndpoint = mkOption { type = types.str; default = "https://tangled.org"; description = "Appview endpoint"; };
gitUser = mkOption { type = types.str; default = "git"; description = "User that hosts git repos and performs git operations"; };
openFirewall = mkOption { type = types.bool; default = true; description = "Open port 22 in the firewall for ssh"; };
stateDir = mkOption { type = types.path; default = "/home/${cfg.gitUser}"; description = "Tangled knot data directory"; };
repo = { scanPath = mkOption { type = types.path; default = cfg.stateDir; description = "Path where repositories are scanned from"; };
readme = mkOption { type = types.listOf types.str; default = [ "README.md" "readme.md" "README" "readme" "README.markdown" "readme.markdown" "README.txt" "readme.txt" "README.rst" "readme.rst" "README.org" "readme.org" "README.asciidoc" "readme.asciidoc" ]; description = "List of README filenames to look for (in priority order)"; };
mainBranch = mkOption { type = types.str; default = "main"; description = "Default branch name for repositories"; }; };
git = { userName = mkOption { type = types.str; default = "Tangled"; description = "Git user name used as committer"; };
userEmail = mkOption { type = types.str; default = "noreply@tangled.org"; description = "Git user email used as committer"; }; };
motd = mkOption { type = types.nullOr types.str; default = null; description = '' Message of the day
The contents are shown as-is; eg. you will want to add a newline if setting a non-empty message since the knot won't do this for you. ''; };
motdFile = mkOption { type = types.nullOr types.path; default = null; description = '' File containing message of the day
The contents are shown as-is; eg. you will want to add a newline if setting a non-empty message since the knot won't do this for you. ''; };
server = { listenAddr = mkOption { type = types.str; default = "0.0.0.0:5555"; description = "Address to listen on"; };
internalListenAddr = mkOption { type = types.str; default = "127.0.0.1:5444"; description = "Internal address for inter-service communication"; };
owner = mkOption { type = types.str; example = "did:plc:qfpnj4og54vl56wngdriaxug"; description = "DID of owner (required)"; };
dbPath = mkOption { type = types.path; default = "${cfg.stateDir}/knotserver.db"; description = "Path to the database file"; };
hostname = mkOption { type = types.str; example = "my.knot.com"; description = "Hostname for the server (required)"; };
plcUrl = mkOption { type = types.str; default = "https://plc.directory"; description = "atproto PLC directory"; };
jetstreamEndpoint = mkOption { type = types.str; default = "wss://jetstream1.us-west.bsky.network/subscribe"; description = "Jetstream endpoint to subscribe to"; };
logDids = mkOption { type = types.bool; default = true; description = "Enable logging of DIDs"; };
dev = mkOption { type = types.bool; default = false; description = "Enable development mode (disables signature verification)"; }; };
environmentFile = mkOption { type = with types; nullOr path; default = null; example = "/etc/appview.env"; description = '' Additional environment file as defined in {manpage}`systemd.exec(5)`.
Sensitive secrets such as {env}`KNOT_COOKIE_SECRET`, {env}`KNOT_OAUTH_CLIENT_SECRET`, and {env}`KNOT_OAUTH_CLIENT_KID` may be passed to the service without making them world readable in the nix store. ''; }; }; };
config = mkIf cfg.enable { environment.systemPackages = [ pkgs.git cfg.package ];
users.users.${cfg.gitUser} = { isSystemUser = true; useDefaultShell = true; home = cfg.stateDir; createHome = true; group = cfg.gitUser; };
users.groups.${cfg.gitUser} = {};
services.openssh = { enable = true; extraConfig = '' Match User ${cfg.gitUser} AuthorizedKeysCommand /etc/ssh/keyfetch_wrapper AuthorizedKeysCommandUser nobody ChallengeResponseAuthentication no PasswordAuthentication no ''; };
environment.etc."ssh/keyfetch_wrapper" = { mode = "0555"; text = '' #!${pkgs.stdenv.shell} ${cfg.package}/bin/knot keys \ -config ${cfg.stateDir}/config.yml \ -output authorized-keys ''; };
systemd.services.knot = { description = "knot service"; after = ["network.target" "sshd.service"]; wantedBy = ["multi-user.target"]; enableStrictShellChecks = true;
preStart = let setMotd = if cfg.motdFile != null && cfg.motd != null then throw "motdFile and motd cannot be both set" else '' ${optionalString (cfg.motdFile != null) "cat ${cfg.motdFile} > ${cfg.stateDir}/motd"} ${optionalString (cfg.motd != null) ''printf "${cfg.motd}" > ${cfg.stateDir}/motd''} ''; in '' mkdir -p "${cfg.repo.scanPath}" chown -R ${cfg.gitUser}:${cfg.gitUser} "${cfg.repo.scanPath}"
mkdir -p "${cfg.stateDir}/.config/git" cat > "${cfg.stateDir}/.config/git/config" << EOF [user] name = ${cfg.git.userName} email = ${cfg.git.userEmail} [receive] advertisePushOptions = true [uploadpack] allowFilter = true EOF ${setMotd} chown -R ${cfg.gitUser}:${cfg.gitUser} "${cfg.stateDir}" '';
serviceConfig = { User = cfg.gitUser; PermissionsStartOnly = true; WorkingDirectory = cfg.stateDir; Environment = [ "KNOT_REPO_SCAN_PATH=${cfg.repo.scanPath}" "KNOT_REPO_README=${concatStringsSep "," cfg.repo.readme}" "KNOT_REPO_MAIN_BRANCH=${cfg.repo.mainBranch}" "KNOT_GIT_USER_NAME=${cfg.git.userName}" "KNOT_GIT_USER_EMAIL=${cfg.git.userEmail}" "APPVIEW_ENDPOINT=${cfg.appviewEndpoint}" "KNOT_SERVER_INTERNAL_LISTEN_ADDR=${cfg.server.internalListenAddr}" "KNOT_SERVER_LISTEN_ADDR=${cfg.server.listenAddr}" "KNOT_SERVER_DB_PATH=${cfg.server.dbPath}" "KNOT_SERVER_HOSTNAME=${cfg.server.hostname}" "KNOT_SERVER_PLC_URL=${cfg.server.plcUrl}" "KNOT_SERVER_JETSTREAM_ENDPOINT=${cfg.server.jetstreamEndpoint}" "KNOT_SERVER_OWNER=${cfg.server.owner}" "KNOT_SERVER_LOG_DIDS=${ if cfg.server.logDids then "true" else "false" }" "KNOT_SERVER_DEV=${ if cfg.server.dev then "true" else "false" }" ]; EnvironmentFile = mkIf (cfg.environmentFile != null) cfg.environmentFile; ExecStart = "${cfg.package}/bin/knot server -config ${cfg.stateDir}/config.yml"; Restart = "always"; RestartSec = 5; }; };
networking.firewall.allowedTCPPorts = mkIf cfg.openFirewall [22]; }; }