Skip to content

Commit 22e2e02

Browse files
savyajhasavyajha
committed
nixos/privatebin: init
1 parent 11a9656 commit 22e2e02

File tree

3 files changed

+231
-0
lines changed

3 files changed

+231
-0
lines changed

‎nixos/doc/manual/release-notes/rl-2411.section.md

+2
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,8 @@
6969

7070
- [Goatcounter](https://www.goatcounter.com/), Easy web analytics. No tracking of personal data. Available as [services.goatcounter](options.html#opt-services.goatcocunter.enable).
7171

72+
- [Privatebin](https://github.com/PrivateBin/PrivateBin/), A minimalist, open source online pastebin where the server has zero knowledge of pasted data. Available as [services.privatebin](#opt-services.privatebin.enable)
73+
7274
- [UWSM](https://github.com/Vladimir-csp/uwsm), a wayland session manager to wrap Wayland Compositors into useful systemd units such as `graphical-session.target`. Available as [programs.uwsm](#opt-programs.uwsm.enable).
7375

7476
- [Open-WebUI](https://github.com/open-webui/open-webui), a user-friendly WebUI

‎nixos/modules/module-list.nix

+1
Original file line numberDiff line numberDiff line change
@@ -1480,6 +1480,7 @@
14801480
./services/web-apps/powerdns-admin.nix
14811481
./services/web-apps/pretalx.nix
14821482
./services/web-apps/pretix.nix
1483+
./services/web-apps/privatebin.nix
14831484
./services/web-apps/prosody-filer.nix
14841485
./services/web-apps/rimgo.nix
14851486
./services/web-apps/rutorrent.nix

‎nixos/modules/services/web-apps/privatebin.nix

+228
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,228 @@
1+
{
2+
pkgs,
3+
config,
4+
lib,
5+
...
6+
}:
7+
8+
let
9+
cfg = config.services.privatebin;
10+
11+
customToINI = lib.generators.toINI {
12+
mkKeyValue = lib.generators.mkKeyValueDefault {
13+
mkValueString =
14+
v:
15+
if v == true then
16+
''true''
17+
else if v == false then
18+
''false''
19+
else if builtins.isInt v then
20+
''${builtins.toString v}''
21+
else if builtins.isPath v then
22+
''"${builtins.toString v}"''
23+
else if builtins.isString v then
24+
''"${v}"''
25+
else
26+
lib.generators.mkValueStringDefault { } v;
27+
} "=";
28+
};
29+
30+
privatebinSettings = pkgs.writeTextDir "conf.php" (customToINI cfg.settings);
31+
32+
user = cfg.user;
33+
group = cfg.group;
34+
35+
defaultUser = "privatebin";
36+
defaultGroup = "privatebin";
37+
38+
in
39+
{
40+
41+
options.services.privatebin = {
42+
43+
enable = lib.mkEnableOption "Privatebin: A minimalist, open source online
44+
pastebin where the server has zero knowledge of pasted data.";
45+
46+
user = lib.mkOption {
47+
type = lib.types.str;
48+
default = defaultUser;
49+
description = "User account under which privatebin runs.";
50+
};
51+
52+
group = lib.mkOption {
53+
type = lib.types.str;
54+
default = if cfg.enableNginx then "nginx" else defaultGroup;
55+
defaultText = "If `services.privatebin.enableNginx` is true then `nginx` else ${defaultGroup}";
56+
description = ''
57+
Group under which privatebin runs. It is best to set this to the group
58+
of whatever webserver is being used as the frontend.
59+
'';
60+
};
61+
62+
dataDir = lib.mkOption {
63+
type = lib.types.path;
64+
default = "/var/lib/privatebin";
65+
description = ''
66+
The place where privatebin stores its state.
67+
'';
68+
};
69+
70+
package = lib.mkPackageOption pkgs "privatebin" { };
71+
72+
enableNginx = lib.mkOption {
73+
type = lib.types.bool;
74+
default = false;
75+
description = ''
76+
Whether to enable nginx or not. If enabled, an nginx virtual host will
77+
be created for access to firefly-iii. If not enabled, then you may use
78+
`''${config.services.firefly-iii.package}` as your document root in
79+
whichever webserver you wish to setup.
80+
'';
81+
};
82+
83+
virtualHost = lib.mkOption {
84+
type = lib.types.str;
85+
default = "localhost";
86+
description = ''
87+
The hostname at which you wish privatebin to be served. If you have
88+
enabled nginx using `services.privatebin.enableNginx` then this will
89+
be used.
90+
'';
91+
};
92+
93+
poolConfig = lib.mkOption {
94+
type = lib.types.attrsOf (
95+
lib.types.oneOf [
96+
lib.types.str
97+
lib.types.int
98+
lib.types.bool
99+
]
100+
);
101+
defaultText = lib.literalExpression ''
102+
{
103+
"pm" = "dynamic";
104+
"pm.max_children" = 32;
105+
"pm.start_servers" = 2;
106+
"pm.min_spare_servers" = 2;
107+
"pm.max_spare_servers" = 4;
108+
"pm.max_requests" = 500;
109+
}
110+
'';
111+
default = { };
112+
description = ''
113+
Options for the PrivateBin PHP pool. See the documentation on <literal>php-fpm.conf</literal>
114+
for details on configuration directives.
115+
'';
116+
};
117+
118+
settings = lib.mkOption {
119+
default = { };
120+
description = ''
121+
Options for privatebin configuration. Refer to
122+
<https://github.com/PrivateBin/PrivateBin/wiki/Configuration> for
123+
details on supported values.
124+
'';
125+
example = lib.literalExpression ''
126+
{
127+
main = {
128+
name = "NixOS Based Privatebin";
129+
discussion = false;
130+
defaultformatter = "plalib.types.intext";
131+
qrcode = true
132+
};
133+
model.class = "Filesystem";
134+
model_options.dir = "/var/lib/privatebin/data";
135+
}
136+
'';
137+
type = lib.types.submodule { freeformType = lib.types.attrsOf lib.types.anything; };
138+
};
139+
};
140+
141+
config = lib.mkIf cfg.enable {
142+
143+
services.privatebin.settings = {
144+
main = lib.mkDefault { };
145+
model.class = lib.mkDefault "Filesystem";
146+
model_options.dir = lib.mkDefault "${cfg.dataDir}/data";
147+
purge.dir = lib.mkDefault "${cfg.dataDir}/purge";
148+
traffic = {
149+
dir = lib.mkDefault "${cfg.dataDir}/traffic";
150+
header = "X_FORWARDED_FOR";
151+
};
152+
};
153+
154+
services.phpfpm.pools.privatebin = {
155+
inherit user group;
156+
phpPackage = pkgs.php83;
157+
phpOptions = ''
158+
log_errors = on
159+
'';
160+
settings = {
161+
"listen.mode" = lib.mkDefault "0660";
162+
"listen.owner" = lib.mkDefault user;
163+
"listen.group" = lib.mkDefault group;
164+
"pm" = lib.mkDefault "dynamic";
165+
"pm.max_children" = lib.mkDefault 32;
166+
"pm.start_servers" = lib.mkDefault 2;
167+
"pm.min_spare_servers" = lib.mkDefault 2;
168+
"pm.max_spare_servers" = lib.mkDefault 4;
169+
"pm.max_requests" = lib.mkDefault 500;
170+
};
171+
phpEnv.CONFIG_PATH = lib.strings.removeSuffix "/conf.php" (builtins.toString privatebinSettings);
172+
};
173+
174+
services.nginx = lib.mkIf cfg.enableNginx {
175+
enable = true;
176+
recommendedTlsSettings = lib.mkDefault true;
177+
recommendedOptimisation = lib.mkDefault true;
178+
recommendedGzipSettings = lib.mkDefault true;
179+
virtualHosts.${cfg.virtualHost} = {
180+
root = "${cfg.package}";
181+
locations = {
182+
"/" = {
183+
tryFiles = "$uri $uri/ /index.php?$query_string";
184+
index = "index.php";
185+
extraConfig = ''
186+
sendfile off;
187+
'';
188+
};
189+
"~ \.php$" = {
190+
extraConfig = ''
191+
include ${config.services.nginx.package}/conf/fastcgi_params ;
192+
fastcgi_param SCRIPT_FILENAME $request_filename;
193+
fastcgi_param modHeadersAvailable true; #Avoid sending the security headers twice
194+
fastcgi_pass unix:${config.services.phpfpm.pools.privatebin.socket};
195+
'';
196+
};
197+
};
198+
};
199+
};
200+
201+
systemd.tmpfiles.settings."10-privatebin" =
202+
lib.attrsets.genAttrs
203+
[
204+
"${cfg.dataDir}/data"
205+
"${cfg.dataDir}/traffic"
206+
"${cfg.dataDir}/purge"
207+
]
208+
(n: {
209+
d = {
210+
group = group;
211+
mode = "0750";
212+
user = user;
213+
};
214+
});
215+
216+
users = {
217+
users = lib.mkIf (user == defaultUser) {
218+
${defaultUser} = {
219+
description = "Privatebin service user";
220+
inherit group;
221+
isSystemUser = true;
222+
home = cfg.dataDir;
223+
};
224+
};
225+
groups = lib.mkIf (group == defaultGroup) { ${defaultGroup} = { }; };
226+
};
227+
};
228+
}

0 commit comments

Comments
 (0)