sourcehut: include module #65109

eadwu · 2019-07-19T22:17:18Z

In case I ever finish this or if someone wants to see some sort of thing as reference.

Motivation for this change

Things done

ghost · 2019-09-15T11:17:04Z

nixos/modules/services/misc/sourcehut/default.nix

+      # from other sites in your network.
+      #
+      # Use the srht-webhook-keygen command to generate a key.
+      webhooks.private-key = mkDefault null;


Serious security problem here.
Any idea? I thought of just appending this part from the content of a secure file, creating a third, non-store config for the service to use.

IIRC services e.g. ssh generate keys on service start if they're not present...

Appending won't fix the problem, it'll still end up in the store. If you don't want it to be in the store, the only option is to have as an external file and you're better off setting it up yourself since I can't access the settings unless I parse the file's contents.

I'm pretty sure the generated key isn't suppose to be used for ssh connections.

Why wont appending fix the problem? I dont think you understood what I meant. The file we're appending from is not in the store, and neiter is the file were appending to. Only the 'base' file (the one created here, without private keys) would be in the store.

As far as I know, the only configuration file for sourcehut lies in /etc/sr.ht/config.ini since the relative config.ini is out of the question unless one starts overriding the derivation.

a = 1; ${builtins.readFile path_to_external_file}

Would have the file contents of path_to_external_file in the file in the store.

This really is a sourcehut bug. Secrets dont go in config files.

matthiasbeyer · 2019-12-22T10:09:48Z

Any progress here?

eadwu · 2019-12-27T02:38:04Z

All the web interfaces should work fine? At least when I ran a couple of qemu vms through nixops it seemed everything worked fine locally in terms of the interface. For the lists and other integration things (like mailbox server) things I have no clue. I basically only host an instance with meta/git/paste locally.

matthiasbeyer · 2020-02-26T10:25:25Z

Could you share your configuration.nix for the setup you have? I plan on trying to host an installation on a server I have, probably deployed to individual nspawn containers (not sure about how to do it right yet) and test it.

I have a mailserver running on that server, as well as postgres and redis, but no cron (yet, as I use systemd timers). I wonder how to properly set this up using containers for everything (or VMs, as said not sure which way to go, yet).

eadwu · 2020-02-26T22:29:26Z

https://git.sr.ht/~eadwu/nixos-configuration/tree/master/nixops/sourcehut

Some configuration options might be missing in this PR.

Basically a port from git TESTED Creating a repo through the web interface Cloning through https `hg clone --insecure`

TESTED Creating a ticket through the web interface Responding, resolving, blah, blah through the web interface

rnhmjoj · 2020-06-23T10:55:03Z

nixos/modules/services/misc/sourcehut/default.nix

+    };
+
+    settings = mkOption {
+      type = with types; attrsOf (attrsOf (nullOr (either bool (either int (either float (either str path))))));


This will produce a crazy type like the one in #86402. Can you add a decription with // { description = "..."; }?

Isn't there already a description for this in line 73?

I think he meant an example maybe?

pinpox · 2020-10-21T09:36:46Z

Hey, what is the status of this PR? I'm looking to setup sourcehut on my nixOS server, is there anything I can do to get this finished? Any help needed?

EDIT: I would need a bit of guidance, I'm quite new to the nix world

happysalada · 2020-11-16T04:25:30Z

@pinpox I am by no means an expert, so take my advice with a grain of salt.
The first step is to test the current PR.
for that, you need to copy the files of this PR on a nixos machine, add an imports = [ ./sourcehut.nix] in the imports of your configuration.nix file. sourcehut.nix should just include the content of the sourcehut/default.nix from this PR. Then you can add inside your configuration.nix the proper configuration for the sourcehut service. I've found the configuration that @eadwu uses https://github.com/eadwu/nixos-configuration/tree/master/nixops/sourcehut for reference

Let me know if anything doesn't make sense.

tgunnoe · 2021-02-11T17:48:05Z

Why was this closed?

eadwu · 2021-02-11T19:07:49Z

It is extremely unlikely that I will ever finish the entire module. I don't use some of the sub-services at all (such as builds or lists) nor do I have the experience of setting up build clusters correctly.

happysalada · 2021-02-11T22:37:29Z

If anybody ever picks this up again, just put a comment here, I'm interested in helping the person test the PR and merge it.

tgunnoe · 2021-02-14T06:00:30Z

ok thanks @eadwu for the update. I'll take a hit at it as soon as I figure it well

tomberek · 2021-02-14T18:57:56Z

Had to update some of the available settings, but the existing setup seems to function (https://todo.srht.tomberek.info/).

Registration + email works.
git: https://git.srht.tomberek.info/~tomberek2/thing
todo: https://todo.srht.tomberek.info/~tomberek2/something-to-track

There are some fiddly things. The current one:
git update hooks don't seem to be called with the right Arg[0]: https://git.sr.ht/~sircmpwn/git.sr.ht/commit/84afd9d7b0298b6b418684daf7feab7f74635fa1#gitsrht-update-hook/main.go-1-31 And I get errors like:

Enumerating objects: 11, done.
Counting objects: 100% (11/11), done.
Delta compression using up to 4 threads
Compressing objects: 100% (11/11), done.
Writing objects: 100% (11/11), 10.05 KiB | 3.35 MiB/s, done.
Total 11 (delta 4), reused 0 (delta 0), pack-reused 0
remote: Unknown git hook /nix/store/jzad97p554fhb589027igf1rrfmabr1b-python3.8-gitsrht-0.61.10/bin/gitsrht-update-hook
To git.srht.tomberek.info:~tomberek2/sourcehut-nix
 ! [remote rejected] master -> master (pre-receive hook declined)
error: failed to push some refs to 'git.srht.tomberek.info:~tomberek2/sourcehut-nix'

eadwu · 2021-02-14T19:30:31Z

I believe the original approach in this PR was a workaround for a bug in the implementation but it was since fixed upstream. Sadly I don't remember the specifics.

tomberek · 2021-02-14T19:39:03Z

This is in relation to gtsrht-update-hook. It seems os.Args[0] is the full path, not the relative path and symlink. It is expecting something like "hooks/pre-receive". The links exist on disk. Looks okay. Was thinking there might be some obscure git setting "don't resolve symlinks before calling them".

tomberek · 2021-02-14T21:11:18Z

Did a mass update to the latest sources and added the 5100 API (not exactly sure if i did that right, but until I did, none of the web services were responding at all). Still have the same issue with the gitsrht-update-hook.

tomberek · 2021-02-14T21:50:30Z

The arg0 was an artifact caused by Nix. The python builder wraps all the executables in bin and changes arg0 in doing so. The fix is to point the setting directly at the generated go binary instead of through the wrapper.

tomberek · 2021-02-14T21:58:07Z

Putting my WIP here: https://git.srht.tomberek.info/~tomberek2/sourcehut-nix
Has the module in root, updated package code in sourcehut/, and example settings in nginx.nix.

@eadwu can we reopen this, or should we start a new PR?

eadwu · 2021-02-14T23:26:52Z

A new PR, I won't be able to review it since as stated above I don't use all the services anyway.

ofborg bot added 6.topic: nixos Issues or PRs affecting NixOS modules, or package usability issues specific to NixOS 8.has: module (update) This PR changes an existing module in `nixos/` labels Jul 19, 2019

eadwu force-pushed the sourcehut/include-module branch from 27741ab to 958e98b Compare July 20, 2019 01:06

ofborg bot added 10.rebuild-darwin: 0 This PR does not cause any packages to rebuild on Darwin 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux labels Jul 20, 2019

eadwu force-pushed the sourcehut/include-module branch from 958e98b to 3948461 Compare July 27, 2019 02:57

eadwu force-pushed the sourcehut/include-module branch 3 times, most recently from 88e4c6d to 17cf6fe Compare August 10, 2019 01:23

eadwu mentioned this pull request Aug 10, 2019

sourcehut: init #54425

Merged

10 tasks

eadwu force-pushed the sourcehut/include-module branch 3 times, most recently from 729bf36 to c01ec1c Compare August 17, 2019 01:25

ghost reviewed Sep 15, 2019

View reviewed changes

eadwu added 8 commits April 7, 2020 14:14

sourcehut: include module

a22657c

sourcehut: work on new module

0dfe29f

sourcehut: meta

469d040

sourcehut: git

6783593

sourcehut: paste

262b8d0

sourcehut: somewhat tested hg

6c61706

Basically a port from git TESTED Creating a repo through the web interface Cloning through https `hg clone --insecure`

sourcehut: somewhat tested todo

6dd2765

TESTED Creating a ticket through the web interface Responding, resolving, blah, blah through the web interface

sourcehut: should work fine man

b015be3

eadwu force-pushed the sourcehut/include-module branch from c01ec1c to b015be3 Compare April 7, 2020 18:16

ofborg bot added 10.rebuild-linux: 1-10 10.rebuild-linux: 1 and removed 10.rebuild-linux: 0 This PR does not cause any packages to rebuild on Linux labels Apr 7, 2020

rnhmjoj reviewed Jun 23, 2020

View reviewed changes

eadwu closed this Nov 17, 2020

eadwu deleted the sourcehut/include-module branch November 17, 2020 23:34

tomberek mentioned this pull request Feb 16, 2021

nixos/sourcehut: init #113244

Merged

17 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

sourcehut: include module #65109

sourcehut: include module #65109

eadwu commented Jul 19, 2019 •

edited

Loading

ghost Sep 15, 2019

vikanezrimaya Sep 15, 2019

eadwu Sep 15, 2019

ghost Sep 16, 2019

eadwu Sep 16, 2019

ghost Sep 19, 2019

matthiasbeyer commented Dec 22, 2019

eadwu commented Dec 27, 2019

matthiasbeyer commented Feb 26, 2020

eadwu commented Feb 26, 2020

rnhmjoj Jun 23, 2020

pinpox Oct 21, 2020

happysalada Nov 16, 2020

pinpox commented Oct 21, 2020 •

edited

Loading

happysalada commented Nov 16, 2020 •

edited

Loading

tgunnoe commented Feb 11, 2021

eadwu commented Feb 11, 2021

happysalada commented Feb 11, 2021

tgunnoe commented Feb 14, 2021

tomberek commented Feb 14, 2021

eadwu commented Feb 14, 2021 •

edited

Loading

tomberek commented Feb 14, 2021

tomberek commented Feb 14, 2021

tomberek commented Feb 14, 2021

tomberek commented Feb 14, 2021

eadwu commented Feb 14, 2021

sourcehut: include module #65109

sourcehut: include module #65109

Conversation

eadwu commented Jul 19, 2019 • edited Loading

Motivation for this change

Things done

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

matthiasbeyer commented Dec 22, 2019

eadwu commented Dec 27, 2019

matthiasbeyer commented Feb 26, 2020

eadwu commented Feb 26, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pinpox commented Oct 21, 2020 • edited Loading

happysalada commented Nov 16, 2020 • edited Loading

tgunnoe commented Feb 11, 2021

eadwu commented Feb 11, 2021

happysalada commented Feb 11, 2021

tgunnoe commented Feb 14, 2021

tomberek commented Feb 14, 2021

eadwu commented Feb 14, 2021 • edited Loading

tomberek commented Feb 14, 2021

tomberek commented Feb 14, 2021

tomberek commented Feb 14, 2021

tomberek commented Feb 14, 2021

eadwu commented Feb 14, 2021

eadwu commented Jul 19, 2019 •

edited

Loading

pinpox commented Oct 21, 2020 •

edited

Loading

happysalada commented Nov 16, 2020 •

edited

Loading

eadwu commented Feb 14, 2021 •

edited

Loading