Skip to content

Commit 2199b69

Browse files
drupoldrupol
authored
nixos/privatebin: init module & privatebin: init at 1.7.4 (#344014)
2 parents f16d6cd + 2a06cac commit 2199b69

File tree

6 files changed

+287
-0
lines changed

6 files changed

+287
-0
lines changed

‎nixos/doc/manual/release-notes/rl-2411.section.md

+2
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,8 @@
7373

7474
- [Goatcounter](https://www.goatcounter.com/), Easy web analytics. No tracking of personal data. Available as [services.goatcounter](options.html#opt-services.goatcocunter.enable).
7575

76+
- [Privatebin](https://github.com/PrivateBin/PrivateBin/), A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Available as [services.privatebin](#opt-services.privatebin.enable)
77+
7678
- [UWSM](https://github.com/Vladimir-csp/uwsm), a wayland session manager to wrap Wayland Compositors into useful systemd units such as `graphical-session.target`. Available as [programs.uwsm](#opt-programs.uwsm.enable).
7779

7880
- [Open-WebUI](https://github.com/open-webui/open-webui), a user-friendly WebUI

‎nixos/modules/module-list.nix

+1
Original file line numberDiff line numberDiff line change
@@ -1489,6 +1489,7 @@
14891489
./services/web-apps/powerdns-admin.nix
14901490
./services/web-apps/pretalx.nix
14911491
./services/web-apps/pretix.nix
1492+
./services/web-apps/privatebin.nix
14921493
./services/web-apps/prosody-filer.nix
14931494
./services/web-apps/rimgo.nix
14941495
./services/web-apps/rutorrent.nix

‎nixos/modules/services/web-apps/privatebin.nix

+228
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,228 @@
1+
{
2+
pkgs,
3+
config,
4+
lib,
5+
...
6+
}:
7+
8+
let
9+
cfg = config.services.privatebin;
10+
11+
customToINI = lib.generators.toINI {
12+
mkKeyValue = lib.generators.mkKeyValueDefault {
13+
mkValueString =
14+
v:
15+
if v == true then
16+
''true''
17+
else if v == false then
18+
''false''
19+
else if builtins.isInt v then
20+
''${builtins.toString v}''
21+
else if builtins.isPath v then
22+
''"${builtins.toString v}"''
23+
else if builtins.isString v then
24+
''"${v}"''
25+
else
26+
lib.generators.mkValueStringDefault { } v;
27+
} "=";
28+
};
29+
30+
privatebinSettings = pkgs.writeTextDir "conf.php" (customToINI cfg.settings);
31+
32+
user = cfg.user;
33+
group = cfg.group;
34+
35+
defaultUser = "privatebin";
36+
defaultGroup = "privatebin";
37+
38+
in
39+
{
40+
41+
options.services.privatebin = {
42+
43+
enable = lib.mkEnableOption "Privatebin: A minimalist, open source online
44+
pastebin where the server has zero knowledge of pasted data.";
45+
46+
user = lib.mkOption {
47+
type = lib.types.str;
48+
default = defaultUser;
49+
description = "User account under which privatebin runs.";
50+
};
51+
52+
group = lib.mkOption {
53+
type = lib.types.str;
54+
default = if cfg.enableNginx then "nginx" else defaultGroup;
55+
defaultText = "If `services.privatebin.enableNginx` is true then `nginx` else ${defaultGroup}";
56+
description = ''
57+
Group under which privatebin runs. It is best to set this to the group
58+
of whatever webserver is being used as the frontend.
59+
'';
60+
};
61+
62+
dataDir = lib.mkOption {
63+
type = lib.types.path;
64+
default = "/var/lib/privatebin";
65+
description = ''
66+
The place where privatebin stores its state.
67+
'';
68+
};
69+
70+
package = lib.mkPackageOption pkgs "privatebin" { };
71+
72+
enableNginx = lib.mkOption {
73+
type = lib.types.bool;
74+
default = false;
75+
description = ''
76+
Whether to enable nginx or not. If enabled, an nginx virtual host will
77+
be created for access to firefly-iii. If not enabled, then you may use
78+
`''${config.services.firefly-iii.package}` as your document root in
79+
whichever webserver you wish to setup.
80+
'';
81+
};
82+
83+
virtualHost = lib.mkOption {
84+
type = lib.types.str;
85+
default = "localhost";
86+
description = ''
87+
The hostname at which you wish privatebin to be served. If you have
88+
enabled nginx using `services.privatebin.enableNginx` then this will
89+
be used.
90+
'';
91+
};
92+
93+
poolConfig = lib.mkOption {
94+
type = lib.types.attrsOf (
95+
lib.types.oneOf [
96+
lib.types.str
97+
lib.types.int
98+
lib.types.bool
99+
]
100+
);
101+
defaultText = lib.literalExpression ''
102+
{
103+
"pm" = "dynamic";
104+
"pm.max_children" = 32;
105+
"pm.start_servers" = 2;
106+
"pm.min_spare_servers" = 2;
107+
"pm.max_spare_servers" = 4;
108+
"pm.max_requests" = 500;
109+
}
110+
'';
111+
default = { };
112+
description = ''
113+
Options for the PrivateBin PHP pool. See the documentation on <literal>php-fpm.conf</literal>
114+
for details on configuration directives.
115+
'';
116+
};
117+
118+
settings = lib.mkOption {
119+
default = { };
120+
description = ''
121+
Options for privatebin configuration. Refer to
122+
<https://github.com/PrivateBin/PrivateBin/wiki/Configuration> for
123+
details on supported values.
124+
'';
125+
example = lib.literalExpression ''
126+
{
127+
main = {
128+
name = "NixOS Based Privatebin";
129+
discussion = false;
130+
defaultformatter = "plalib.types.intext";
131+
qrcode = true
132+
};
133+
model.class = "Filesystem";
134+
model_options.dir = "/var/lib/privatebin/data";
135+
}
136+
'';
137+
type = lib.types.submodule { freeformType = lib.types.attrsOf lib.types.anything; };
138+
};
139+
};
140+
141+
config = lib.mkIf cfg.enable {
142+
143+
services.privatebin.settings = {
144+
main = lib.mkDefault { };
145+
model.class = lib.mkDefault "Filesystem";
146+
model_options.dir = lib.mkDefault "${cfg.dataDir}/data";
147+
purge.dir = lib.mkDefault "${cfg.dataDir}/purge";
148+
traffic = {
149+
dir = lib.mkDefault "${cfg.dataDir}/traffic";
150+
header = "X_FORWARDED_FOR";
151+
};
152+
};
153+
154+
services.phpfpm.pools.privatebin = {
155+
inherit user group;
156+
phpPackage = pkgs.php83;
157+
phpOptions = ''
158+
log_errors = on
159+
'';
160+
settings = {
161+
"listen.mode" = lib.mkDefault "0660";
162+
"listen.owner" = lib.mkDefault user;
163+
"listen.group" = lib.mkDefault group;
164+
"pm" = lib.mkDefault "dynamic";
165+
"pm.max_children" = lib.mkDefault 32;
166+
"pm.start_servers" = lib.mkDefault 2;
167+
"pm.min_spare_servers" = lib.mkDefault 2;
168+
"pm.max_spare_servers" = lib.mkDefault 4;
169+
"pm.max_requests" = lib.mkDefault 500;
170+
};
171+
phpEnv.CONFIG_PATH = lib.strings.removeSuffix "/conf.php" (builtins.toString privatebinSettings);
172+
};
173+
174+
services.nginx = lib.mkIf cfg.enableNginx {
175+
enable = true;
176+
recommendedTlsSettings = lib.mkDefault true;
177+
recommendedOptimisation = lib.mkDefault true;
178+
recommendedGzipSettings = lib.mkDefault true;
179+
virtualHosts.${cfg.virtualHost} = {
180+
root = "${cfg.package}";
181+
locations = {
182+
"/" = {
183+
tryFiles = "$uri $uri/ /index.php?$query_string";
184+
index = "index.php";
185+
extraConfig = ''
186+
sendfile off;
187+
'';
188+
};
189+
"~ \.php$" = {
190+
extraConfig = ''
191+
include ${config.services.nginx.package}/conf/fastcgi_params ;
192+
fastcgi_param SCRIPT_FILENAME $request_filename;
193+
fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
194+
fastcgi_pass unix:${config.services.phpfpm.pools.privatebin.socket};
195+
'';
196+
};
197+
};
198+
};
199+
};
200+
201+
systemd.tmpfiles.settings."10-privatebin" =
202+
lib.attrsets.genAttrs
203+
[
204+
"${cfg.dataDir}/data"
205+
"${cfg.dataDir}/traffic"
206+
"${cfg.dataDir}/purge"
207+
]
208+
(n: {
209+
d = {
210+
group = group;
211+
mode = "0750";
212+
user = user;
213+
};
214+
});
215+
216+
users = {
217+
users = lib.mkIf (user == defaultUser) {
218+
${defaultUser} = {
219+
description = "Privatebin service user";
220+
inherit group;
221+
isSystemUser = true;
222+
home = cfg.dataDir;
223+
};
224+
};
225+
groups = lib.mkIf (group == defaultGroup) { ${defaultGroup} = { }; };
226+
};
227+
};
228+
}

‎nixos/tests/all-tests.nix

+1
Original file line numberDiff line numberDiff line change
@@ -825,6 +825,7 @@ in {
825825
printing-socket = handleTest ./printing.nix { socket = true; };
826826
printing-service = handleTest ./printing.nix { socket = false; };
827827
private-gpt = handleTest ./private-gpt.nix {};
828+
privatebin = runTest ./privatebin.nix;
828829
privoxy = handleTest ./privoxy.nix {};
829830
prometheus = handleTest ./prometheus {};
830831
prometheus-exporters = handleTest ./prometheus-exporters.nix {};

‎nixos/tests/privatebin.nix

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{ lib, ... }:
2+
3+
{
4+
name = "privatebin";
5+
meta.maintainers = [ lib.maintainers.savyajha ];
6+
7+
nodes.dataImporter =
8+
{ ... }:
9+
{
10+
services.privatebin = {
11+
enable = true;
12+
enableNginx = true;
13+
};
14+
};
15+
16+
testScript = ''
17+
dataImporter.wait_for_unit("phpfpm-privatebin.service")
18+
dataImporter.wait_for_unit("nginx.service")
19+
dataImporter.succeed("curl -fvvv -Ls http://localhost/ | grep 'PrivateBin'")
20+
'';
21+
}

‎pkgs/by-name/pr/privatebin/package.nix

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
{
2+
lib,
3+
stdenvNoCC,
4+
fetchFromGitHub,
5+
nixosTests,
6+
}:
7+
8+
stdenvNoCC.mkDerivation (finalAttrs: {
9+
pname = "privatebin";
10+
version = "1.7.4";
11+
src = fetchFromGitHub {
12+
owner = "PrivateBin";
13+
repo = "PrivateBin";
14+
rev = "refs/tags/${finalAttrs.version}";
15+
hash = "sha256-RFP6rhzfBzTmqs4eJXv7LqdniWoeBJpQQ6fLdoGd5Fk=";
16+
};
17+
18+
installPhase = ''
19+
runHook preInstall
20+
mkdir -p $out
21+
cp -R $src/* $out
22+
runHook postInstall
23+
'';
24+
25+
passthru.tests = nixosTests.privatebin;
26+
27+
meta = {
28+
changelog = "https://github.com/PrivateBin/PrivateBin/releases/tag/${finalAttrs.version}";
29+
description = "Minimalist, open source online pastebin where the server has zero knowledge of pasted data.";
30+
homepage = "https://privatebin.info";
31+
license = lib.licenses.gpl2;
32+
maintainers = [ lib.maintainers.savyajha ];
33+
};
34+
})

0 commit comments

Comments
 (0)