gogs: remove
Upstream development has stalled and several critical vulnerabilities that weren't addressed within a year[1][2]. Back then it was fair to mark it as insecure, but given nothing has happened since, it's time to remove it. [1] https://forgejo.org/2023-11-release-v1-20-5-1/ [2] https://github.com/gogs/gogs/issues/7777
This commit is contained in:
Maximilian Bosch
parent
dd5aae5e50
commit
875f00ed40
@ -207,6 +207,10 @@
|
||||
|
||||
- `deno` has been updated to v2 which has breaking changes. Upstream will be abandoning v1 soon but for now you can use `deno_1` if you are yet to migrate (will be removed prior to cutting a final 24.11 release).
|
||||
|
||||
- `gogs` has been removed. Upstream development has stalled and it has several
|
||||
[critical vulnerabilities](https://github.com/gogs/gogs/issues/7777) that weren't addressed
|
||||
within a year. Consider migrating to `forgejo` or `gitea`.
|
||||
|
||||
- `knot-dns` has been updated to version 3.4.x. Check the [migration guide](https://www.knot-dns.cz/docs/latest/html/migration.html#upgrade-3-3-x-to-3-4-x) for breaking changes.
|
||||
|
||||
- `services.kubernetes.kubelet.clusterDns` now accepts a list of DNS resolvers rather than a single string, bringing the module more in line with the upstream Kubelet configuration schema.
|
||||
|
||||
@ -296,7 +296,7 @@ in
|
||||
sickbeard = 265;
|
||||
headphones = 266;
|
||||
# couchpotato = 267; # unused, removed 2022-01-01
|
||||
gogs = 268;
|
||||
# gogs = 268; # unused, removed in 2024-10-12
|
||||
#pdns-recursor = 269; # dynamically allocated as of 2020-20-18
|
||||
#kresd = 270; # switched to "knot-resolver" with dynamic ID
|
||||
rpc = 271;
|
||||
@ -607,7 +607,7 @@ in
|
||||
sickbeard = 265;
|
||||
headphones = 266;
|
||||
# couchpotato = 267; # unused, removed 2022-01-01
|
||||
gogs = 268;
|
||||
# gogs = 268; # unused, removed in 2024-10-12
|
||||
#kresd = 270; # switched to "knot-resolver" with dynamic ID
|
||||
#rpc = 271; # unused
|
||||
#geoip = 272; # unused
|
||||
|
||||
@ -759,7 +759,6 @@
|
||||
./services/misc/gitlab.nix
|
||||
./services/misc/gitolite.nix
|
||||
./services/misc/gitweb.nix
|
||||
./services/misc/gogs.nix
|
||||
./services/misc/gollum.nix
|
||||
./services/misc/gotenberg.nix
|
||||
./services/misc/gpsd.nix
|
||||
|
||||
@ -1,271 +0,0 @@
|
||||
{ config, lib, options, pkgs, ... }:
|
||||
let
|
||||
cfg = config.services.gogs;
|
||||
opt = options.services.gogs;
|
||||
configFile = pkgs.writeText "app.ini" ''
|
||||
BRAND_NAME = ${cfg.appName}
|
||||
RUN_USER = ${cfg.user}
|
||||
RUN_MODE = prod
|
||||
|
||||
[database]
|
||||
TYPE = ${cfg.database.type}
|
||||
HOST = ${cfg.database.host}:${toString cfg.database.port}
|
||||
NAME = ${cfg.database.name}
|
||||
USER = ${cfg.database.user}
|
||||
PASSWORD = #dbpass#
|
||||
PATH = ${cfg.database.path}
|
||||
|
||||
[repository]
|
||||
ROOT = ${cfg.repositoryRoot}
|
||||
|
||||
[server]
|
||||
DOMAIN = ${cfg.domain}
|
||||
HTTP_ADDR = ${cfg.httpAddress}
|
||||
HTTP_PORT = ${toString cfg.httpPort}
|
||||
EXTERNAL_URL = ${cfg.rootUrl}
|
||||
|
||||
[session]
|
||||
COOKIE_NAME = session
|
||||
COOKIE_SECURE = ${lib.boolToString cfg.cookieSecure}
|
||||
|
||||
[security]
|
||||
SECRET_KEY = #secretkey#
|
||||
INSTALL_LOCK = true
|
||||
|
||||
[log]
|
||||
ROOT_PATH = ${cfg.stateDir}/log
|
||||
|
||||
${cfg.extraConfig}
|
||||
'';
|
||||
in
|
||||
|
||||
{
|
||||
options = {
|
||||
services.gogs = {
|
||||
enable = lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
description = "Enable Go Git Service.";
|
||||
};
|
||||
|
||||
useWizard = lib.mkOption {
|
||||
default = false;
|
||||
type = lib.types.bool;
|
||||
description = "Do not generate a configuration and use Gogs' installation wizard instead. The first registered user will be administrator.";
|
||||
};
|
||||
|
||||
stateDir = lib.mkOption {
|
||||
default = "/var/lib/gogs";
|
||||
type = lib.types.str;
|
||||
description = "Gogs data directory.";
|
||||
};
|
||||
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "gogs";
|
||||
description = "User account under which Gogs runs.";
|
||||
};
|
||||
|
||||
group = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "gogs";
|
||||
description = "Group account under which Gogs runs.";
|
||||
};
|
||||
|
||||
database = {
|
||||
type = lib.mkOption {
|
||||
type = lib.types.enum [ "sqlite3" "mysql" "postgres" ];
|
||||
example = "mysql";
|
||||
default = "sqlite3";
|
||||
description = "Database engine to use.";
|
||||
};
|
||||
|
||||
host = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "127.0.0.1";
|
||||
description = "Database host address.";
|
||||
};
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 3306;
|
||||
description = "Database host port.";
|
||||
};
|
||||
|
||||
name = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "gogs";
|
||||
description = "Database name.";
|
||||
};
|
||||
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "gogs";
|
||||
description = "Database user.";
|
||||
};
|
||||
|
||||
password = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
description = ''
|
||||
The password corresponding to {option}`database.user`.
|
||||
Warning: this is stored in cleartext in the Nix store!
|
||||
Use {option}`database.passwordFile` instead.
|
||||
'';
|
||||
};
|
||||
|
||||
passwordFile = lib.mkOption {
|
||||
type = lib.types.nullOr lib.types.path;
|
||||
default = null;
|
||||
example = "/run/keys/gogs-dbpassword";
|
||||
description = ''
|
||||
A file containing the password corresponding to
|
||||
{option}`database.user`.
|
||||
'';
|
||||
};
|
||||
|
||||
path = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${cfg.stateDir}/data/gogs.db";
|
||||
defaultText = lib.literalExpression ''"''${config.${opt.stateDir}}/data/gogs.db"'';
|
||||
description = "Path to the sqlite3 database file.";
|
||||
};
|
||||
};
|
||||
|
||||
appName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "Gogs: Go Git Service";
|
||||
description = "Application name.";
|
||||
};
|
||||
|
||||
repositoryRoot = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "${cfg.stateDir}/repositories";
|
||||
defaultText = lib.literalExpression ''"''${config.${opt.stateDir}}/repositories"'';
|
||||
description = "Path to the git repositories.";
|
||||
};
|
||||
|
||||
domain = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "localhost";
|
||||
description = "Domain name of your server.";
|
||||
};
|
||||
|
||||
rootUrl = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "http://localhost:3000/";
|
||||
description = "Full public URL of Gogs server.";
|
||||
};
|
||||
|
||||
httpAddress = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "0.0.0.0";
|
||||
description = "HTTP listen address.";
|
||||
};
|
||||
|
||||
httpPort = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 3000;
|
||||
description = "HTTP listen port.";
|
||||
};
|
||||
|
||||
cookieSecure = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Marks session cookies as "secure" as a hint for browsers to only send
|
||||
them via HTTPS. This option is recommend, if Gogs is being served over HTTPS.
|
||||
'';
|
||||
};
|
||||
|
||||
extraConfig = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "";
|
||||
description = "Configuration lines appended to the generated Gogs configuration file.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config = lib.mkIf cfg.enable {
|
||||
|
||||
systemd.services.gogs = {
|
||||
description = "Gogs (Go Git Service)";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
path = [ pkgs.gogs ];
|
||||
|
||||
preStart = let
|
||||
runConfig = "${cfg.stateDir}/custom/conf/app.ini";
|
||||
secretKey = "${cfg.stateDir}/custom/conf/secret_key";
|
||||
in ''
|
||||
mkdir -p ${cfg.stateDir}
|
||||
|
||||
# copy custom configuration and generate a random secret key if needed
|
||||
${lib.optionalString (cfg.useWizard == false) ''
|
||||
mkdir -p ${cfg.stateDir}/custom/conf
|
||||
cp -f ${configFile} ${runConfig}
|
||||
|
||||
if [ ! -e ${secretKey} ]; then
|
||||
head -c 16 /dev/urandom | base64 > ${secretKey}
|
||||
fi
|
||||
|
||||
KEY=$(head -n1 ${secretKey})
|
||||
DBPASS=$(head -n1 ${cfg.database.passwordFile})
|
||||
sed -e "s,#secretkey#,$KEY,g" \
|
||||
-e "s,#dbpass#,$DBPASS,g" \
|
||||
-i ${runConfig}
|
||||
''}
|
||||
|
||||
mkdir -p ${cfg.repositoryRoot}
|
||||
# update all hooks' binary paths
|
||||
HOOKS=$(find ${cfg.repositoryRoot} -mindepth 4 -maxdepth 4 -type f -wholename "*git/hooks/*")
|
||||
if [ "$HOOKS" ]
|
||||
then
|
||||
sed -ri 's,/nix/store/[a-z0-9.-]+/bin/gogs,${pkgs.gogs}/bin/gogs,g' $HOOKS
|
||||
sed -ri 's,/nix/store/[a-z0-9.-]+/bin/env,${pkgs.coreutils}/bin/env,g' $HOOKS
|
||||
sed -ri 's,/nix/store/[a-z0-9.-]+/bin/bash,${pkgs.bash}/bin/bash,g' $HOOKS
|
||||
sed -ri 's,/nix/store/[a-z0-9.-]+/bin/perl,${pkgs.perl}/bin/perl,g' $HOOKS
|
||||
fi
|
||||
'';
|
||||
|
||||
serviceConfig = {
|
||||
Type = "simple";
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
WorkingDirectory = cfg.stateDir;
|
||||
ExecStart = "${pkgs.gogs}/bin/gogs web";
|
||||
Restart = "always";
|
||||
UMask = "0027";
|
||||
};
|
||||
|
||||
environment = {
|
||||
USER = cfg.user;
|
||||
HOME = cfg.stateDir;
|
||||
GOGS_WORK_DIR = cfg.stateDir;
|
||||
};
|
||||
};
|
||||
|
||||
users = lib.mkIf (cfg.user == "gogs") {
|
||||
users.gogs = {
|
||||
description = "Go Git Service";
|
||||
uid = config.ids.uids.gogs;
|
||||
group = "gogs";
|
||||
home = cfg.stateDir;
|
||||
createHome = true;
|
||||
shell = pkgs.bash;
|
||||
};
|
||||
groups.gogs.gid = config.ids.gids.gogs;
|
||||
};
|
||||
|
||||
warnings = lib.optional (cfg.database.password != "")
|
||||
''config.services.gogs.database.password will be stored as plaintext
|
||||
in the Nix store. Use database.passwordFile instead.'';
|
||||
|
||||
# Create database passwordFile default when password is configured.
|
||||
services.gogs.database.passwordFile =
|
||||
(lib.mkDefault (toString (pkgs.writeTextFile {
|
||||
name = "gogs-database-password";
|
||||
text = cfg.database.password;
|
||||
})));
|
||||
};
|
||||
}
|
||||
@ -1,54 +0,0 @@
|
||||
{ lib, buildGoModule, fetchFromGitHub, makeWrapper
|
||||
, git, bash, gzip, openssh, pam
|
||||
, sqliteSupport ? true
|
||||
, pamSupport ? true
|
||||
}:
|
||||
|
||||
buildGoModule rec {
|
||||
pname = "gogs";
|
||||
version = "0.13.0";
|
||||
|
||||
src = fetchFromGitHub {
|
||||
owner = "gogs";
|
||||
repo = "gogs";
|
||||
rev = "v${version}";
|
||||
sha256 = "sha256-UfxE+NaqDr3XUXpvlV989Iwjq/lsAwpMTDAPkcOmma8=";
|
||||
};
|
||||
|
||||
vendorHash = "sha256-ISJOEJ1DWO4nnMpDuZ36Nq528LhgekDh3XUF8adlj2w=";
|
||||
|
||||
subPackages = [ "." ];
|
||||
|
||||
postPatch = ''
|
||||
patchShebangs .
|
||||
'';
|
||||
|
||||
nativeBuildInputs = [ makeWrapper openssh ];
|
||||
|
||||
buildInputs = lib.optional pamSupport pam;
|
||||
|
||||
tags =
|
||||
( lib.optional sqliteSupport "sqlite"
|
||||
++ lib.optional pamSupport "pam");
|
||||
|
||||
postInstall = ''
|
||||
|
||||
wrapProgram $out/bin/gogs \
|
||||
--prefix PATH : ${lib.makeBinPath [ bash git gzip openssh ]}
|
||||
'';
|
||||
|
||||
meta = with lib; {
|
||||
description = "Painless self-hosted Git service";
|
||||
homepage = "https://gogs.io";
|
||||
license = licenses.mit;
|
||||
maintainers = [ maintainers.schneefux ];
|
||||
mainProgram = "gogs";
|
||||
knownVulnerabilities = [ ''
|
||||
Gogs has known unpatched vulnerabilities and upstream maintainers appears to be unresponsive.
|
||||
|
||||
More information can be found in forgejo's blogpost: https://forgejo.org/2023-11-release-v1-20-5-1/
|
||||
|
||||
You might want to consider migrating to Gitea or forgejo.
|
||||
'' ];
|
||||
};
|
||||
}
|
||||
@ -561,6 +561,12 @@ mapAliases {
|
||||
gmtp = throw "'gmtp' has been removed due to lack of maintenance upstream. Consider using 'gnome-music' instead"; # Added 2024-09-14
|
||||
gnome-latex = throw "'gnome-latex' has been superseded by 'enter-tex'"; # Added 2024-09-18
|
||||
gnu-cobol = gnucobol; # Added 2024-09-17
|
||||
gogs = throw ''
|
||||
Gogs development has stalled. Also, it has several unpatched, critical vulnerabilities that
|
||||
weren't addressed within a year: https://github.com/gogs/gogs/issues/7777
|
||||
|
||||
Consider migrating to forgejo or gitea.
|
||||
''; # Added 2024-10-12
|
||||
go-dependency-manager = throw "'go-dependency-manager' is unmaintained and the go community now uses 'go.mod' mostly instead"; # Added 2023-10-04
|
||||
gotktrix = throw "'gotktrix' has been removed, as it was broken and unmaintained"; # Added 2023-12-06
|
||||
git-backup = throw "git-backup has been removed, as it has been abandoned upstream. Consider using git-backup-go instead.";
|
||||
|
||||
@ -7893,8 +7893,6 @@ with pkgs;
|
||||
|
||||
gitqlient = libsForQt5.callPackage ../applications/version-management/gitqlient { };
|
||||
|
||||
gogs = callPackage ../applications/version-management/gogs { };
|
||||
|
||||
git-latexdiff = callPackage ../tools/typesetting/git-latexdiff { };
|
||||
|
||||
gokart = callPackage ../development/tools/gokart { };
|
||||
|
||||
Loading…
Reference in New Issue
Block a user