forked from Fediversity/Fediversity
Valentin Gagarin
7c33e8aaf3
This setup is greatly inspired by the one used for [0], although with notable modifications, such as: - a SASS preprocessor and CSS compressor - more streamlined NixOS integration tests - cleaned up service configuration - a few notes on how to do things better in the future [0]: https://github.com/Nix-Security-WG/nix-security-tracker/ Apart from cloning the Nix setup, there were additional steps: - Create an empty `src` directory, since the package requires it - In the development shell, run `django-admin startproject panel src` Note that while you can already do ```bash manage migrate manage runserver ``` the NixOS integration tests will fail, since `settings.py` needs careful massaging to expose knobs that can be turned from our systemd wrapper. The required changes are introduced in the next commit to make them observable. Noteworthy related work: - https://github.com/sephii/django.nix Rather mature setup with a clean interface, uses Caddy as reverse proxy. - https://git.dgnum.eu/mdebray/djangonix A work-in-progress attempt to capture more moving parts through the module system, in particular secrets. - https://github.com/DavHau/django-nixos Out of date and somewhat simplistic, but serves as a reasonable example for what can be done I chose the variant I'm intimately familiar with in order to be able to pass on knowledge or help with maintenance. But for the future I strongly recommend picking the good bits from the other implementations that control complexity in static configuration parts through Nix expressions.
53 lines
1.3 KiB
Nix
53 lines
1.3 KiB
Nix
{
|
|
system ? builtins.currentSystem,
|
|
sources ? import ../npins,
|
|
pkgs ? import sources.nixpkgs {
|
|
inherit system;
|
|
config = { };
|
|
overlays = [ ];
|
|
},
|
|
}:
|
|
let
|
|
package =
|
|
let
|
|
callPackage = pkgs.lib.callPackageWith (pkgs // pkgs.python3.pkgs);
|
|
in
|
|
callPackage ./nix/package.nix { };
|
|
|
|
pkgs' = pkgs.extend (_final: _prev: { panel = package; });
|
|
|
|
manage = pkgs.writeScriptBin "manage" ''
|
|
exec ${pkgs.lib.getExe pkgs.python3} ${toString ./src/manage.py} $@
|
|
'';
|
|
in
|
|
{
|
|
shell = pkgs.mkShellNoCC {
|
|
inputsFrom = [ package ];
|
|
packages = [
|
|
pkgs.npins
|
|
manage
|
|
];
|
|
env = {
|
|
NPINS_DIRECTORY = toString ../npins;
|
|
};
|
|
shellHook = ''
|
|
# in production, secrets are passed via CREDENTIALS_DIRECTORY by systemd.
|
|
# use this directory for testing with local secrets
|
|
mkdir -p .credentials
|
|
echo secret > ${builtins.toString ./.credentials}/SECRET_KEY
|
|
export CREDENTIALS_DIRECTORY=${builtins.toString ./.credentials}
|
|
export DATABASE_URL="sqlite:///${toString ./src}/db.sqlite3"
|
|
'';
|
|
};
|
|
|
|
tests = pkgs'.callPackage ./nix/tests.nix { };
|
|
inherit package;
|
|
|
|
# re-export inputs so they can be overridden granularly
|
|
# (they can't be accessed from the outside any other way)
|
|
inherit
|
|
sources
|
|
system
|
|
pkgs
|
|
;
|
|
}
|