Compare commits
7 Commits
aa6b33bb46
...
849bc8592b
Author | SHA1 | Date |
---|---|---|
Tim Van Baak | 849bc8592b | |
Tim Van Baak | 6b2be50146 | |
Tim Van Baak | f396498bbb | |
Tim Van Baak | c75082e3af | |
Tim Van Baak | ae20f13046 | |
Tim Van Baak | c5727b48c1 | |
Tim Van Baak | a5d5be3462 |
21
flake.nix
21
flake.nix
|
@ -39,26 +39,6 @@
|
|||
'';
|
||||
};
|
||||
};
|
||||
|
||||
checks.${system}.test-module = let
|
||||
test-lib = import "${nixpkgs}/nixos/lib/testing-python.nix" {
|
||||
inherit system;
|
||||
};
|
||||
in
|
||||
test-lib.makeTest {
|
||||
name = "inquisitor-test-module";
|
||||
nodes = {
|
||||
host = { ... }: {
|
||||
imports = [ self.nixosModules.default ];
|
||||
services.inquisitor.enable = true;
|
||||
};
|
||||
};
|
||||
testScript = ''
|
||||
start_all()
|
||||
host.wait_for_unit("multi-user.target")
|
||||
host.succeed("[ -e /var/lib/inquisitor ]")
|
||||
'';
|
||||
};
|
||||
};
|
||||
in (my-flake.outputs-for each systems) // {
|
||||
overlays.default = final: prev: {
|
||||
|
@ -66,6 +46,5 @@
|
|||
projectDir = ./.;
|
||||
};
|
||||
};
|
||||
nixosModules.default = import ./module.nix self;
|
||||
};
|
||||
}
|
||||
|
|
|
@ -276,11 +276,6 @@ def nocommand(args):
|
|||
|
||||
def main():
|
||||
"""CLI entry point"""
|
||||
# Enable piping
|
||||
from signal import signal, SIGPIPE, SIG_DFL
|
||||
|
||||
signal(SIGPIPE, SIG_DFL)
|
||||
|
||||
# Collect the commands from this module
|
||||
import inquisitor.cli
|
||||
|
||||
|
|
154
module.nix
154
module.nix
|
@ -1,154 +0,0 @@
|
|||
flake: { config, lib, pkgs, ... }:
|
||||
|
||||
let
|
||||
inherit (lib) mkIf mkOption types;
|
||||
|
||||
cfg = config.services.inquisitor;
|
||||
in
|
||||
{
|
||||
options = {
|
||||
services.inquisitor = {
|
||||
enable = mkOption {
|
||||
type = types.bool;
|
||||
default = true;
|
||||
description = "Enable the Inquisitor aggregator.";
|
||||
};
|
||||
|
||||
listen.addr = mkOption {
|
||||
type = types.str;
|
||||
default = "0.0.0.0";
|
||||
description = "Listen address passed to nginx.";
|
||||
};
|
||||
|
||||
listen.port = mkOption {
|
||||
type = types.port;
|
||||
default = 80;
|
||||
description = "Listen port passed to nginx.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config =
|
||||
let
|
||||
# Get the inquisitor package from the flake.
|
||||
inquisitor = flake.packages.${pkgs.stdenv.hostPlatform.system}.default;
|
||||
|
||||
# Define the inquisitor state directory.
|
||||
stateDir = "/var/lib/inquisitor";
|
||||
|
||||
# Define an scp helper for item callbacks to use.
|
||||
scp-helper = pkgs.writeShellScriptBin "scp-helper" ''
|
||||
${pkgs.openssh}/bin/scp -i ${stateDir}/.ssh/inquisitor.key -oStrictHostKeyChecking=no "$@"
|
||||
'';
|
||||
|
||||
# Define the inquisitor service user.
|
||||
svcUser = {
|
||||
name = "inquisitor";
|
||||
group = "inquisitor";
|
||||
description = "Inquisitor service user";
|
||||
isSystemUser = true;
|
||||
shell = pkgs.bashInteractive;
|
||||
packages = [ inquisitor pkgs.cron ];
|
||||
};
|
||||
|
||||
# Create a config file pointing to the state directory.
|
||||
inqConfig = pkgs.writeTextFile {
|
||||
name = "inquisitor.conf";
|
||||
text = ''
|
||||
DataPath = ${stateDir}/data/
|
||||
SourcePath = ${stateDir}/sources/
|
||||
CachePath = ${stateDir}/cache/
|
||||
Verbose = false
|
||||
LogFile = ${stateDir}/inquisitor.log
|
||||
'';
|
||||
};
|
||||
|
||||
# Create a setup script to ensure the service directory state.
|
||||
inqSetup = pkgs.writeShellScript "inquisitor-setup.sh" ''
|
||||
# Ensure the required directories exist.
|
||||
${pkgs.coreutils}/bin/mkdir -p ${stateDir}/data/inquisitor/
|
||||
${pkgs.coreutils}/bin/mkdir -p ${stateDir}/sources/
|
||||
${pkgs.coreutils}/bin/mkdir -p ${stateDir}/cache/
|
||||
if [ ! -f ${stateDir}/data/inquisitor/state ]; then
|
||||
${pkgs.coreutils}/bin/echo "{}" > ${stateDir}/data/inquisitor/state
|
||||
fi
|
||||
|
||||
# Ensure the service owns the folders.
|
||||
${pkgs.coreutils}/bin/chown -R ${svcUser.name} ${stateDir}
|
||||
|
||||
# Ensure the scp helper is present
|
||||
if [ -f ${stateDir}/scp-helper ]; then
|
||||
${pkgs.coreutils}/bin/rm ${stateDir}/scp-helper
|
||||
fi
|
||||
ln -s -t ${stateDir}/scp-helper ${scp-helper}/bin/scp-helper
|
||||
'';
|
||||
|
||||
# Create a run script for the service.
|
||||
inqRun = pkgs.writeShellScript "inquisitor-run.sh" ''
|
||||
cd ${stateDir}
|
||||
${inquisitor}/bin/gunicorn \
|
||||
--bind=localhost:24133 \
|
||||
--workers=4 \
|
||||
--timeout 120 \
|
||||
--log-level debug \
|
||||
"inquisitor.app:wsgi()"
|
||||
'';
|
||||
|
||||
# Create a wrapper to execute the cli as the service user.
|
||||
# (needed to avoid creating files in the state dir the service can't read)
|
||||
inqWrapper = pkgs.writeShellScriptBin "inq" ''
|
||||
sudo --user=${svcUser.name} ${inquisitor}/bin/inquisitor "$@"
|
||||
'';
|
||||
in mkIf cfg.enable
|
||||
{
|
||||
users.users.inquisitor = svcUser;
|
||||
users.groups.inquisitor = {};
|
||||
|
||||
# Link the config in /etc to avoid envvar shenanigans
|
||||
environment.etc."inquisitor.conf".source = inqConfig;
|
||||
|
||||
# Give all users the wrapper program.
|
||||
environment.systemPackages = [ inqWrapper ];
|
||||
# Allow the sudo in the cli wrapper without password.
|
||||
security.sudo.extraRules = [{
|
||||
commands = [{
|
||||
command = "${inquisitor}/bin/inquisitor";
|
||||
options = [ "NOPASSWD" ];
|
||||
}];
|
||||
runAs = svcUser.name;
|
||||
groups = [ "users" ];
|
||||
}];
|
||||
|
||||
# Run the setup script on activation.
|
||||
system.activationScripts.inquisitorSetup = "${inqSetup}";
|
||||
|
||||
# Set up the inquisitor service.
|
||||
systemd.services.inquisitor = {
|
||||
description = "Inquisitor server";
|
||||
script = "${inqRun}";
|
||||
serviceConfig = {
|
||||
User = svcUser.name;
|
||||
Type = "simple";
|
||||
};
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
after = [ "network.target" ];
|
||||
enable = true;
|
||||
};
|
||||
|
||||
# Set up the nginx reverse proxy to the server.
|
||||
services.nginx.enable = true;
|
||||
services.nginx.virtualHosts.inquisitorHost = {
|
||||
listen = [ cfg.listen ];
|
||||
locations."/".extraConfig = ''
|
||||
access_log /var/log/nginx/access.inquisitor.log;
|
||||
proxy_buffering off;
|
||||
proxy_pass http://localhost:24133/;
|
||||
'';
|
||||
};
|
||||
networking.firewall.allowedTCPPorts = [ cfg.listen.port ];
|
||||
|
||||
# Enable cron so the service can use it to schedule fetches.
|
||||
services.cron.enable = true;
|
||||
};
|
||||
}
|
||||
|
Loading…
Reference in New Issue