nixos/privatebin: init
This commit is contained in:
Savyasachee Jha
parent
11a96562ba
commit
22e2e02118
@ -69,6 +69,8 @@
|
||||
|
||||
- [Goatcounter](https://www.goatcounter.com/), Easy web analytics. No tracking of personal data. Available as [services.goatcounter](options.html#opt-services.goatcocunter.enable).
|
||||
|
||||
- [Privatebin](https://github.com/PrivateBin/PrivateBin/), A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Available as [services.privatebin](#opt-services.privatebin.enable)
|
||||
|
||||
- [UWSM](https://github.com/Vladimir-csp/uwsm), a wayland session manager to wrap Wayland Compositors into useful systemd units such as `graphical-session.target`. Available as [programs.uwsm](#opt-programs.uwsm.enable).
|
||||
|
||||
- [Open-WebUI](https://github.com/open-webui/open-webui), a user-friendly WebUI
|
||||
|
||||
@ -1480,6 +1480,7 @@
|
||||
./services/web-apps/powerdns-admin.nix
|
||||
./services/web-apps/pretalx.nix
|
||||
./services/web-apps/pretix.nix
|
||||
./services/web-apps/privatebin.nix
|
||||
./services/web-apps/prosody-filer.nix
|
||||
./services/web-apps/rimgo.nix
|
||||
./services/web-apps/rutorrent.nix
|
||||
|
||||
228
nixos/modules/services/web-apps/privatebin.nix
Normal file
228
nixos/modules/services/web-apps/privatebin.nix
Normal file
@ -0,0 +1,228 @@
|
||||
{
|
||||
pkgs,
|
||||
config,
|
||||
lib,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
cfg = config.services.privatebin;
|
||||
|
||||
customToINI = lib.generators.toINI {
|
||||
mkKeyValue = lib.generators.mkKeyValueDefault {
|
||||
mkValueString =
|
||||
v:
|
||||
if v == true then
|
||||
''true''
|
||||
else if v == false then
|
||||
''false''
|
||||
else if builtins.isInt v then
|
||||
''${builtins.toString v}''
|
||||
else if builtins.isPath v then
|
||||
''"${builtins.toString v}"''
|
||||
else if builtins.isString v then
|
||||
''"${v}"''
|
||||
else
|
||||
lib.generators.mkValueStringDefault { } v;
|
||||
} "=";
|
||||
};
|
||||
|
||||
privatebinSettings = pkgs.writeTextDir "conf.php" (customToINI cfg.settings);
|
||||
|
||||
user = cfg.user;
|
||||
group = cfg.group;
|
||||
|
||||
defaultUser = "privatebin";
|
||||
defaultGroup = "privatebin";
|
||||
|
||||
in
|
||||
{
|
||||
|
||||
options.services.privatebin = {
|
||||
|
||||
enable = lib.mkEnableOption "Privatebin: A minimalist, open source online
|
||||
pastebin where the server has zero knowledge of pasted data.";
|
||||
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = defaultUser;
|
||||
description = "User account under which privatebin runs.";
|
||||
};
|
||||
|
||||
group = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = if cfg.enableNginx then "nginx" else defaultGroup;
|
||||
defaultText = "If `services.privatebin.enableNginx` is true then `nginx` else ${defaultGroup}";
|
||||
description = ''
|
||||
Group under which privatebin runs. It is best to set this to the group
|
||||
of whatever webserver is being used as the frontend.
|
||||
'';
|
||||
};
|
||||
|
||||
dataDir = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
default = "/var/lib/privatebin";
|
||||
description = ''
|
||||
The place where privatebin stores its state.
|
||||
'';
|
||||
};
|
||||
|
||||
package = lib.mkPackageOption pkgs "privatebin" { };
|
||||
|
||||
enableNginx = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Whether to enable nginx or not. If enabled, an nginx virtual host will
|
||||
be created for access to firefly-iii. If not enabled, then you may use
|
||||
`''${config.services.firefly-iii.package}` as your document root in
|
||||
whichever webserver you wish to setup.
|
||||
'';
|
||||
};
|
||||
|
||||
virtualHost = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "localhost";
|
||||
description = ''
|
||||
The hostname at which you wish privatebin to be served. If you have
|
||||
enabled nginx using `services.privatebin.enableNginx` then this will
|
||||
be used.
|
||||
'';
|
||||
};
|
||||
|
||||
poolConfig = lib.mkOption {
|
||||
type = lib.types.attrsOf (
|
||||
lib.types.oneOf [
|
||||
lib.types.str
|
||||
lib.types.int
|
||||
lib.types.bool
|
||||
]
|
||||
);
|
||||
defaultText = lib.literalExpression ''
|
||||
{
|
||||
"pm" = "dynamic";
|
||||
"pm.max_children" = 32;
|
||||
"pm.start_servers" = 2;
|
||||
"pm.min_spare_servers" = 2;
|
||||
"pm.max_spare_servers" = 4;
|
||||
"pm.max_requests" = 500;
|
||||
}
|
||||
'';
|
||||
default = { };
|
||||
description = ''
|
||||
Options for the PrivateBin PHP pool. See the documentation on <literal>php-fpm.conf</literal>
|
||||
for details on configuration directives.
|
||||
'';
|
||||
};
|
||||
|
||||
settings = lib.mkOption {
|
||||
default = { };
|
||||
description = ''
|
||||
Options for privatebin configuration. Refer to
|
||||
<https://github.com/PrivateBin/PrivateBin/wiki/Configuration> for
|
||||
details on supported values.
|
||||
'';
|
||||
example = lib.literalExpression ''
|
||||
{
|
||||
main = {
|
||||
name = "NixOS Based Privatebin";
|
||||
discussion = false;
|
||||
defaultformatter = "plalib.types.intext";
|
||||
qrcode = true
|
||||
};
|
||||
model.class = "Filesystem";
|
||||
model_options.dir = "/var/lib/privatebin/data";
|
||||
}
|
||||
'';
|
||||
type = lib.types.submodule { freeformType = lib.types.attrsOf lib.types.anything; };
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
services.privatebin.settings = {
|
||||
main = lib.mkDefault { };
|
||||
model.class = lib.mkDefault "Filesystem";
|
||||
model_options.dir = lib.mkDefault "${cfg.dataDir}/data";
|
||||
purge.dir = lib.mkDefault "${cfg.dataDir}/purge";
|
||||
traffic = {
|
||||
dir = lib.mkDefault "${cfg.dataDir}/traffic";
|
||||
header = "X_FORWARDED_FOR";
|
||||
};
|
||||
};
|
||||
|
||||
services.phpfpm.pools.privatebin = {
|
||||
inherit user group;
|
||||
phpPackage = pkgs.php83;
|
||||
phpOptions = ''
|
||||
log_errors = on
|
||||
'';
|
||||
settings = {
|
||||
"listen.mode" = lib.mkDefault "0660";
|
||||
"listen.owner" = lib.mkDefault user;
|
||||
"listen.group" = lib.mkDefault group;
|
||||
"pm" = lib.mkDefault "dynamic";
|
||||
"pm.max_children" = lib.mkDefault 32;
|
||||
"pm.start_servers" = lib.mkDefault 2;
|
||||
"pm.min_spare_servers" = lib.mkDefault 2;
|
||||
"pm.max_spare_servers" = lib.mkDefault 4;
|
||||
"pm.max_requests" = lib.mkDefault 500;
|
||||
};
|
||||
phpEnv.CONFIG_PATH = lib.strings.removeSuffix "/conf.php" (builtins.toString privatebinSettings);
|
||||
};
|
||||
|
||||
services.nginx = lib.mkIf cfg.enableNginx {
|
||||
enable = true;
|
||||
recommendedTlsSettings = lib.mkDefault true;
|
||||
recommendedOptimisation = lib.mkDefault true;
|
||||
recommendedGzipSettings = lib.mkDefault true;
|
||||
virtualHosts.${cfg.virtualHost} = {
|
||||
root = "${cfg.package}";
|
||||
locations = {
|
||||
"/" = {
|
||||
tryFiles = "$uri $uri/ /index.php?$query_string";
|
||||
index = "index.php";
|
||||
extraConfig = ''
|
||||
sendfile off;
|
||||
'';
|
||||
};
|
||||
"~ \.php$" = {
|
||||
extraConfig = ''
|
||||
include ${config.services.nginx.package}/conf/fastcgi_params ;
|
||||
fastcgi_param SCRIPT_FILENAME $request_filename;
|
||||
fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
|
||||
fastcgi_pass unix:${config.services.phpfpm.pools.privatebin.socket};
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
systemd.tmpfiles.settings."10-privatebin" =
|
||||
lib.attrsets.genAttrs
|
||||
[
|
||||
"${cfg.dataDir}/data"
|
||||
"${cfg.dataDir}/traffic"
|
||||
"${cfg.dataDir}/purge"
|
||||
]
|
||||
(n: {
|
||||
d = {
|
||||
group = group;
|
||||
mode = "0750";
|
||||
user = user;
|
||||
};
|
||||
});
|
||||
|
||||
users = {
|
||||
users = lib.mkIf (user == defaultUser) {
|
||||
${defaultUser} = {
|
||||
description = "Privatebin service user";
|
||||
inherit group;
|
||||
isSystemUser = true;
|
||||
home = cfg.dataDir;
|
||||
};
|
||||
};
|
||||
groups = lib.mkIf (group == defaultGroup) { ${defaultGroup} = { }; };
|
||||
};
|
||||
};
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user