From ecda4f249d78c9191cf4469f8f2504897a359174 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nicolas=20=E2=80=9CNiols=E2=80=9D=20Jeannerod?= Date: Fri, 20 Sep 2024 17:13:35 +0200 Subject: [PATCH] =?UTF-8?q?Rework=20definition=20of=20=E2=80=9Cconstants?= =?UTF-8?q?=E2=80=9D?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - make things such as `fediversity.garage.api.port` into actual options with the right default value - move them under `fediversity.internal` Co-authored-by: Taeer Bar-Yam --- fediversity/default.nix | 91 ++++++++++++++++++++++++++++----------- fediversity/garage.nix | 28 ++++++------ fediversity/mastodon.nix | 8 ++-- fediversity/peertube.nix | 10 ++--- fediversity/pixelfed.nix | 6 +-- tests/mastodon-garage.nix | 4 +- tests/pixelfed-garage.nix | 4 +- vm/mastodon-vm.nix | 2 +- vm/pixelfed-vm.nix | 2 +- 9 files changed, 98 insertions(+), 57 deletions(-) diff --git a/fediversity/default.nix b/fediversity/default.nix index 9c60d61..a6e0682 100644 --- a/fediversity/default.nix +++ b/fediversity/default.nix @@ -17,42 +17,83 @@ in { fediversity = { enable = mkEnableOption "the collection of services bundled under Fediversity"; - garage = mkOption { - type = types.anything; - }; - domain = mkOption { type = types.str; + description = '' + root domain for the Fediversity services + + For instance, if this option is set to `foo.example.com`, then + Pixelfed might be under `pixelfed.foo.example.com`. + ''; }; mastodon.enable = mkEnableOption "default Fediversity Mastodon configuration"; pixelfed.enable = mkEnableOption "default Fediversity Pixelfed configuration"; peertube.enable = mkEnableOption "default Fediversity PeerTube configuration"; - }; - }; - config.fediversity = { - garage = { - api = rec { - domain = "s3.garage.${config.fediversity.domain}"; - port = 3900; - url = "http://${domain}:${toString port}"; - }; + internal = mkOption { + description = "options that are only meant to be used internally; change at your own risk"; + default = {}; + type = types.submodule { + options = { + garage = { + api = { + domain = mkOption { + type = types.str; + default = "s3.garage.${config.fediversity.domain}"; + }; + port = mkOption { + type = types.int; + default = 3900; + }; + url = mkOption { + type = types.str; + default = "http://${config.fediversity.internal.garage.api.domain}:${toString config.fediversity.internal.garage.api.port}"; + }; + }; - rpc = rec { - port = 3901; - }; + rpc = { + port = mkOption { + type = types.int; + default = 3901; + }; + }; - web = rec { - rootDomain = "web.garage.${config.fediversity.domain}"; - port = 3902; - rootDomainAndPort = "${rootDomain}:${toString port}"; - urlFor = bucket: "http://${bucket}.${rootDomainAndPort}"; + web = { + rootDomain = mkOption { + type = types.str; + default = "web.garage.${config.fediversity.domain}"; + }; + port = mkOption { + type = types.int; + default = 3902; + }; + rootDomainAndPort = mkOption { + type = types.str; + default = "${config.fediversity.internal.garage.web.rootDomain}:${toString config.fediversity.internal.garage.web.port}"; + }; + urlFor = mkOption { + type = types.functionTo types.str; + default = bucket: "http://${bucket}.${config.fediversity.internal.garage.web.rootDomainAndPort}"; + }; + }; + }; + + pixelfed.domain = mkOption { + type = types.str; + default = "pixelfed.${config.fediversity.domain}"; + }; + mastodon.domain = mkOption { + type = types.str; + default = "mastdodon.${config.fediversity.domain}"; + }; + peertube.domain = mkOption { + type = types.str; + default = "peertube.${config.fediversity.domain}"; + }; + }; + }; }; }; - - pixelfed.domain = "pixelfed.${config.fediversity.domain}"; - mastodon.domain = "mastdodon.${config.fediversity.domain}"; - peertube.domain = "peertube.${config.fediversity.domain}"; }; } diff --git a/fediversity/garage.nix b/fediversity/garage.nix index 92cbd88..84af662 100644 --- a/fediversity/garage.nix +++ b/fediversity/garage.nix @@ -42,7 +42,7 @@ let ${optionalString corsRules.enable '' garage bucket allow --read --write --owner ${bucketArg} --key tmp # TODO: endpoin-url should not be hard-coded - aws --region ${cfg.settings.s3_api.s3_region} --endpoint-url ${config.fediversity.garage.api.url} s3api put-bucket-cors --bucket ${bucketArg} --cors-configuration ${corsRulesJSON} + aws --region ${cfg.settings.s3_api.s3_region} --endpoint-url ${config.fediversity.internal.garage.api.url} s3api put-bucket-cors --bucket ${bucketArg} --cors-configuration ${corsRulesJSON} garage bucket deny --read --write --owner ${bucketArg} --key tmp ''} ''; @@ -136,21 +136,21 @@ in virtualisation.forwardPorts = [ { from = "host"; - host.port = config.fediversity.garage.rpc.port; - guest.port = config.fediversity.garage.rpc.port; + host.port = config.fediversity.internal.garage.rpc.port; + guest.port = config.fediversity.internal.garage.rpc.port; } { from = "host"; - host.port = config.fediversity.garage.web.port; - guest.port = config.fediversity.garage.web.port; + host.port = config.fediversity.internal.garage.web.port; + guest.port = config.fediversity.internal.garage.web.port; } ]; environment.systemPackages = [ pkgs.minio-client pkgs.awscli ]; networking.firewall.allowedTCPPorts = [ - config.fediversity.garage.rpc.port - config.fediversity.garage.web.port + config.fediversity.internal.garage.rpc.port + config.fediversity.internal.garage.web.port ]; services.garage = { enable = true; @@ -160,15 +160,15 @@ in # TODO: use a secret file rpc_secret = "d576c4478cc7d0d94cfc127138cbb82018b0155c037d1c827dfb6c36be5f6625"; # TODO: why does this have to be set? is there not a sensible default? - rpc_bind_addr = "[::]:${toString config.fediversity.garage.rpc.port}"; - rpc_public_addr = "[::1]:${toString config.fediversity.garage.rpc.port}"; - s3_api.api_bind_addr = "[::]:${toString config.fediversity.garage.api.port}"; - s3_web.bind_addr = "[::]:${toString config.fediversity.garage.web.port}"; - s3_web.root_domain = ".${config.fediversity.garage.web.rootDomain}"; + rpc_bind_addr = "[::]:${toString config.fediversity.internal.garage.rpc.port}"; + rpc_public_addr = "[::1]:${toString config.fediversity.internal.garage.rpc.port}"; + s3_api.api_bind_addr = "[::]:${toString config.fediversity.internal.garage.api.port}"; + s3_web.bind_addr = "[::]:${toString config.fediversity.internal.garage.web.port}"; + s3_web.root_domain = ".${config.fediversity.internal.garage.web.rootDomain}"; index = "index.html"; s3_api.s3_region = "garage"; - s3_api.root_domain = ".${config.fediversity.garage.api.domain}"; + s3_api.root_domain = ".${config.fediversity.internal.garage.api.domain}"; }; }; systemd.services.ensure-garage = { @@ -183,7 +183,7 @@ in # Give Garage time to start up by waiting until somethings speaks HTTP # behind Garage's API URL. - until ${pkgs.curl}/bin/curl -sio /dev/null ${config.fediversity.garage.api.url}; do sleep 1; done + until ${pkgs.curl}/bin/curl -sio /dev/null ${config.fediversity.internal.garage.api.url}; do sleep 1; done # XXX: this is very sensitive to being a single instance # (doing the bare minimum to get garage up and running) diff --git a/fediversity/mastodon.nix b/fediversity/mastodon.nix index 8740c8c..62599b5 100644 --- a/fediversity/mastodon.nix +++ b/fediversity/mastodon.nix @@ -38,7 +38,7 @@ lib.mkIf (config.fediversity.enable && config.fediversity.mastodon.enable) { extraConfig = rec { S3_ENABLED = "true"; # TODO: this shouldn't be hard-coded, it should come from the garage configuration - S3_ENDPOINT = config.fediversity.garage.api.url; + S3_ENDPOINT = config.fediversity.internal.garage.api.url; S3_REGION = "garage"; S3_BUCKET = "mastodon"; # use . @@ -46,7 +46,7 @@ lib.mkIf (config.fediversity.enable && config.fediversity.mastodon.enable) { AWS_ACCESS_KEY_ID = snakeoil_key.id; AWS_SECRET_ACCESS_KEY = snakeoil_key.secret; S3_PROTOCOL = "http"; - S3_HOSTNAME = config.fediversity.garage.web.rootDomainAndPort; + S3_HOSTNAME = config.fediversity.internal.garage.web.rootDomainAndPort; # by default it tries to use "/" S3_ALIAS_HOST = "${S3_BUCKET}.${S3_HOSTNAME}"; # SEE: the last section in https://docs.joinmastodon.org/admin/optional/object-storage/ @@ -63,12 +63,12 @@ lib.mkIf (config.fediversity.enable && config.fediversity.mastodon.enable) { services.mastodon = { enable = true; - localDomain = config.fediversity.mastodon.domain; + localDomain = config.fediversity.internal.mastodon.domain; configureNginx = true; # TODO: configure a mailserver so this works smtp = { - fromAddress = "noreply@${config.fediversity.mastodon.domain}"; + fromAddress = "noreply@${config.fediversity.internal.mastodon.domain}"; createLocally = false; }; diff --git a/fediversity/peertube.nix b/fediversity/peertube.nix index 41c6cd1..88d26e1 100644 --- a/fediversity/peertube.nix +++ b/fediversity/peertube.nix @@ -54,7 +54,7 @@ lib.mkIf (config.fediversity.enable && config.fediversity.peertube.enable) { services.peertube = { enable = true; - localDomain = config.fediversity.peertube.domain; + localDomain = config.fediversity.internal.peertube.domain; # TODO: in most of nixpkgs, these are true by default. upstream that unless there's a good reason not to. redis.createLocally = true; @@ -64,7 +64,7 @@ lib.mkIf (config.fediversity.enable && config.fediversity.peertube.enable) { settings = { object_storage = { enabled = true; - endpoint = config.fediversity.garage.api.url; + endpoint = config.fediversity.internal.garage.api.url; region = "garage"; # not supported by garage @@ -74,17 +74,17 @@ lib.mkIf (config.fediversity.enable && config.fediversity.peertube.enable) { web_videos = rec { bucket_name = "peertube-videos"; prefix = ""; - base_url = config.fediversity.garage.web.urlFor bucket_name; + base_url = config.fediversity.internal.garage.web.urlFor bucket_name; }; videos = rec { bucket_name = "peertube-videos"; prefix = ""; - base_url = config.fediversity.garage.web.urlFor bucket_name; + base_url = config.fediversity.internal.garage.web.urlFor bucket_name; }; streaming_playlists = rec { bucket_name = "peertube-playlists"; prefix = ""; - base_url = config.fediversity.garage.web.urlFor bucket_name; + base_url = config.fediversity.internal.garage.web.urlFor bucket_name; }; }; }; diff --git a/fediversity/pixelfed.nix b/fediversity/pixelfed.nix index 95703ba..1edc914 100644 --- a/fediversity/pixelfed.nix +++ b/fediversity/pixelfed.nix @@ -37,7 +37,7 @@ lib.mkIf (config.fediversity.enable && config.fediversity.pixelfed.enable) { services.pixelfed = { enable = true; - domain = config.fediversity.pixelfed.domain; + domain = config.fediversity.internal.pixelfed.domain; }; services.pixelfed.settings = { @@ -47,9 +47,9 @@ lib.mkIf (config.fediversity.enable && config.fediversity.pixelfed.enable) { AWS_ACCESS_KEY_ID = snakeoil_key.id; AWS_SECRET_ACCESS_KEY = snakeoil_key.secret; AWS_DEFAULT_REGION = "garage"; - AWS_URL = config.fediversity.garage.web.urlFor "pixelfed"; + AWS_URL = config.fediversity.internal.garage.web.urlFor "pixelfed"; AWS_BUCKET = "pixelfed"; - AWS_ENDPOINT = config.fediversity.garage.api.url; + AWS_ENDPOINT = config.fediversity.internal.garage.api.url; AWS_USE_PATH_STYLE_ENDPOINT = false; }; diff --git a/tests/mastodon-garage.nix b/tests/mastodon-garage.nix index c35e799..c109ea1 100644 --- a/tests/mastodon-garage.nix +++ b/tests/mastodon-garage.nix @@ -95,7 +95,7 @@ pkgs.nixosTest { server.succeed("toot post --media $POST_MEDIA") with subtest("access garage"): - ## REVIEW: could we grab `config.fediversity.garage.api.url` here in some way? + ## REVIEW: could we grab `config.fediversity.internal.garage.api.url` here in some way? server.succeed("mc alias set garage http://s3.garage.localhost:3900 --api s3v4 --path off $AWS_ACCESS_KEY_ID $AWS_SECRET_ACCESS_KEY") server.succeed("mc ls garage/mastodon") @@ -122,7 +122,7 @@ pkgs.nixosTest { raise Exception("mastodon did not send a content security policy header") csp = csp_match.group(1) # the img-src content security policy should include the garage server - ## REVIEW: could we grab `config.fediversity.garage.web.url` here in some way? + ## REVIEW: could we grab `config.fediversity.internal.garage.web.url` here in some way? garage_csp = re.match(".*; img-src[^;]*web\.garage\.localhost:3902.*", csp) if garage_csp is None: raise Exception("Mastodon's content security policy does not include garage server. image will not be displayed properly on mastodon.") diff --git a/tests/pixelfed-garage.nix b/tests/pixelfed-garage.nix index a474b1c..9bf2944 100644 --- a/tests/pixelfed-garage.nix +++ b/tests/pixelfed-garage.nix @@ -186,7 +186,7 @@ pkgs.nixosTest { raise Exception("cannot detect the uploaded image on pixelfed page.") with subtest("access garage"): - ## REVIEW: could we grab `config.fediversity.garage.api.url` here in some way? + ## REVIEW: could we grab `config.fediversity.internal.garage.api.url` here in some way? server.succeed("mc alias set garage http://s3.garage.localhost:3900 --api s3v4 --path off $AWS_ACCESS_KEY_ID $AWS_SECRET_ACCESS_KEY") server.succeed("mc ls garage/pixelfed") @@ -203,7 +203,7 @@ pkgs.nixosTest { with subtest("Check that image comes from garage"): src = server.succeed("su - selenium -c 'selenium-script-get-src ${email} ${password}'") - ## REVIEW: could we grab `config.fediversity.garage.web.url` here in some way? + ## REVIEW: could we grab `config.fediversity.internal.garage.web.url` here in some way? if not src.startswith("http://pixelfed.web.garage.localhost:3902/"): raise Exception("image does not come from garage") ''; diff --git a/vm/mastodon-vm.nix b/vm/mastodon-vm.nix index caf1ca6..ea17f27 100644 --- a/vm/mastodon-vm.nix +++ b/vm/mastodon-vm.nix @@ -57,7 +57,7 @@ BIND = "0.0.0.0"; # for letter_opener (still doesn't work though) REMOTE_DEV = "true"; - LOCAL_DOMAIN = "${config.fediversity.mastodon.domain}:8443"; + LOCAL_DOMAIN = "${config.fediversity.internal.mastodon.domain}:8443"; }; }; diff --git a/vm/pixelfed-vm.nix b/vm/pixelfed-vm.nix index f12b9c5..8f97180 100644 --- a/vm/pixelfed-vm.nix +++ b/vm/pixelfed-vm.nix @@ -24,7 +24,7 @@ # I feel like this should have an `enable` option and be configured via `services.nginx` rather than mirroring those options in services.pixelfed.nginx # TODO: If that indeed makes sense, upstream it. nginx = { - # locations."/public/".proxyPass = "${config.fediversity.garage.web.urlFor "pixelfed"}/public/"; + # locations."/public/".proxyPass = "${config.fediversity.internal.garage.web.urlFor "pixelfed"}/public/"; }; }; virtualisation.memorySize = 2048;