Wire up passing credentials from FediPanel to the Peertube configuration #191

New issue

Closed

opened 2025-02-24 11:32:18 +01:00 by kiara · 2 comments

kiara commented

2025-02-24 11:32:18 +01:00

Owner

As a Fediversity user,
I want to choose my initial user credentials,
so that I can log in to my Peertube instance.

Test:

Given that I am in the panel,
when I am filling the deployment form,
then I should be able to specify my initial credentials such that I can log in to my deployed instance.

implementation notes

proper approach: use LDAP (#615)
otherwise, as per the wiki:

The default administrator username is root. The initial password will be logged into the system journal, see the output of journalctl -u peertube.

this would align with the earlier idea of perhaps starting out with generated credentials.

i was able to find this journal entry:

Apr 16 12:53:22 test05 peertube[2204]: [peertube.fediversity.net:443] 2025-04-16 12:53:22.702 info: Username: root
Apr 16 12:53:22 test05 peertube[2204]: [peertube.fediversity.net:443] 2025-04-16 12:53:22.703 info: User password: <PASSWORD>

note that the service module contains an option services.peertube.serviceEnvironmentFile that allows having peertube set an initial password for its root user:

    serviceEnvironmentFile = lib.mkOption {
      type = lib.types.nullOr lib.types.path;
      default = null;
      example = "/run/keys/peertube/password-init-root";
      description = ''
        Set environment variables for the service. Mainly useful for setting the initial root password.
        For example write to file:
        PT_INITIAL_ROOT_PASSWORD=changeme
      '';
    };

currently tho, our initialUser option uses username and passwordFile, meaning in this case:

the user (root) would not align, unless we create a new user, rather than delegating this to peertube.
constructing such an environment file may involve a template utilizing said initialUser.passwordFile (if we are to prevent credentials from leaking into the store if not further into caches).
even then, i'm not sure this would adjust such a root credential on changes to this variable

an alternate approach to this is #337.

**As** a Fediversity user, **I want** to choose my initial user credentials, **so that** I can log in to my Peertube instance. Test: **Given** that I am in the panel, **when** I am filling the deployment form, **then** I should be able to specify my [initial credentials](https://git.fediversity.eu/fediversity/fediversity/pulls/215/files#diff-c959e516a3e7e73b06277e1352072cd290f6d96b) such that I can log in to my deployed instance. ### implementation notes - proper approach: use LDAP (#615) - otherwise, as per the [wiki](https://wiki.nixos.org/wiki/PeerTube): > The default administrator username is `root`. The initial password will be logged into the system journal, see the output of `journalctl -u peertube`. this would align with the [earlier idea](https://git.fediversity.eu/Fediversity/Fediversity/issues/190#issuecomment-5327) of perhaps starting out with generated credentials. i was able to find this journal entry: ``` Apr 16 12:53:22 test05 peertube[2204]: [peertube.fediversity.net:443] 2025-04-16 12:53:22.702 info: Username: root Apr 16 12:53:22 test05 peertube[2204]: [peertube.fediversity.net:443] 2025-04-16 12:53:22.703 info: User password: <PASSWORD> ``` note that the [service module](https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/services/web-apps/peertube.nix) contains an option `services.peertube.serviceEnvironmentFile` that allows having peertube set an initial password for its `root` user: ``` serviceEnvironmentFile = lib.mkOption { type = lib.types.nullOr lib.types.path; default = null; example = "/run/keys/peertube/password-init-root"; description = '' Set environment variables for the service. Mainly useful for setting the initial root password. For example write to file: PT_INITIAL_ROOT_PASSWORD=changeme ''; }; ``` currently tho, our [`initialUser` option](https://git.fediversity.eu/Fediversity/Fediversity/src/branch/main/services/fediversity/default.nix) uses `username` and `passwordFile`, meaning in this case: 1. the user (`root`) would not align, unless we create a new user, rather than delegating this to peertube. 1. constructing such an environment file may involve a [template](https://github.com/Lassulus/nix-templating) utilizing said `initialUser.passwordFile` (if we are to prevent credentials from leaking into the store if not further into caches). 1. even then, i'm not sure this would adjust such a root credential on changes to this variable an alternate approach to this is #337.

kiara added a new dependency

2025-02-24 11:33:03 +01:00

#178 admin accounts provisioned for deployed services

kiara added a new dependency

2025-02-24 11:35:13 +01:00

#194 Write a test that validates Peertube credentials are indeed valid

kiara added the

type

task

label

2025-05-01 12:01:21 +02:00

kiara referenced this issue