From 670528273d8087e8183a194a59401a1e0cbb5475 Mon Sep 17 00:00:00 2001 From: nhnn Date: Thu, 18 Apr 2024 22:22:31 +0300 Subject: [PATCH 1/8] maintainers: add nhnn --- maintainers/maintainer-list.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix index 26b84016947b1..36bc898074b45 100644 --- a/maintainers/maintainer-list.nix +++ b/maintainers/maintainer-list.nix @@ -14175,6 +14175,12 @@ githubId = 399535; name = "Niklas Hambüchen"; }; + nhnn = { + matrix = "@nhnn:nhnn.dev"; + github = "thenhnn"; + githubId = 162156666; + name = "nhnn"; + }; nhooyr = { email = "anmol@aubble.com"; github = "nhooyr"; From 5b4649b2c6a5bf62a748dfbe90d47a023f7fe62f Mon Sep 17 00:00:00 2001 From: nhnn Date: Thu, 18 Apr 2024 22:27:18 +0300 Subject: [PATCH 2/8] simplesamlphp: init at 1.19.7 --- pkgs/by-name/si/simplesamlphp/package.nix | 46 +++++++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 pkgs/by-name/si/simplesamlphp/package.nix diff --git a/pkgs/by-name/si/simplesamlphp/package.nix b/pkgs/by-name/si/simplesamlphp/package.nix new file mode 100644 index 0000000000000..8820d9168051f --- /dev/null +++ b/pkgs/by-name/si/simplesamlphp/package.nix @@ -0,0 +1,46 @@ +{ php +, fetchFromGitHub +, lib +}: +php.buildComposerProject (finalAttrs: { + pname = "simplesamlphp"; + version = "1.19.7"; + + src = fetchFromGitHub { + owner = "simplesamlphp"; + repo = "simplesamlphp"; + rev = "v${finalAttrs.version}"; + hash = "sha256-Qmy9fuZq8MBqvYV6/u3Dg92pHHicuUhdNeB22u4hwwA="; + }; + + php = php.buildEnv { + extensions = + { enabled + , all + }: + enabled + ++ (with all; [ + dom + fileinfo + filter + xml + mbstring + openssl + session + simplexml + sodium + zlib + posix + intl + ]); + }; + + vendorHash = "sha256-FMFD0AXmD7Rq4d9+aNtGVk11YuOt40FWEqxvf+gBjmI="; + + meta = { + description = "SimpleSAMLphp is an application written in native PHP that deals with authentication."; + homepage = "https://simplesamlphp.org"; + license = lib.licenses.lgpl21; + maintainers = with lib.maintainers; [ nhnn ]; + }; +}) From 1c94d744aca3a146d4720c083823c0c21b07fa80 Mon Sep 17 00:00:00 2001 From: nhnn Date: Thu, 18 Apr 2024 22:31:07 +0300 Subject: [PATCH 3/8] filesender: init at 2.47 Co-authored-by: Sandro --- pkgs/by-name/fi/filesender/package.nix | 41 +++++++++ .../fi/filesender/separate_config_dir.patch | 92 +++++++++++++++++++ .../fi/filesender/separate_log_dir.patch | 60 ++++++++++++ 3 files changed, 193 insertions(+) create mode 100644 pkgs/by-name/fi/filesender/package.nix create mode 100644 pkgs/by-name/fi/filesender/separate_config_dir.patch create mode 100644 pkgs/by-name/fi/filesender/separate_log_dir.patch diff --git a/pkgs/by-name/fi/filesender/package.nix b/pkgs/by-name/fi/filesender/package.nix new file mode 100644 index 0000000000000..9d41ac5b088e5 --- /dev/null +++ b/pkgs/by-name/fi/filesender/package.nix @@ -0,0 +1,41 @@ +{ + stdenv, + fetchFromGitHub, + lib, + nixosTests, +}: +stdenv.mkDerivation rec { + pname = "filesender"; + version = "2.47"; + + src = fetchFromGitHub { + owner = "filesender"; + repo = "filesender"; + rev = "filesender-${version}"; + hash = "sha256-49Yq2JFXA5Izl+QnGvc8hXOHIw52L09CwikGa3+F20s="; + }; + + patches = [ + # /nix/store is read-only, but filesender searches config inside of installation directory. + # This patch changes search directory to FILESENDER_CONFIG_DIR environment variable. + ./separate_config_dir.patch + # same as above, but for logs + ./separate_log_dir.patch + ]; + + installPhase = '' + mkdir -p $out/ + cp -R . $out/ + ''; + + passthru.tests = { + inherit (nixosTests) filesender; + }; + + meta = { + description = "Web application for sending large files to other users"; + homepage = "https://filesender.org/"; + license = lib.licenses.bsd3; + maintainers = with lib.maintainers; [nhnn]; + }; +} diff --git a/pkgs/by-name/fi/filesender/separate_config_dir.patch b/pkgs/by-name/fi/filesender/separate_config_dir.patch new file mode 100644 index 0000000000000..d1626ca142150 --- /dev/null +++ b/pkgs/by-name/fi/filesender/separate_config_dir.patch @@ -0,0 +1,92 @@ +diff --git a/classes/utils/Config.class.php b/classes/utils/Config.class.php +index 163d1c82..58fc20a2 100644 +--- a/classes/utils/Config.class.php ++++ b/classes/utils/Config.class.php +@@ -30,7 +30,7 @@ + * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +-if (!defined('FILESENDER_BASE')) { // Require environment (fatal) ++if (!defined('FILESENDER_BASE') || !defined("FILESENDER_CONFIG_DIR")) { // Require environment (fatal) + die('Missing environment'); + } + +@@ -116,7 +116,7 @@ class Config + } + + // Check if main config exists +- $main_config_file = FILESENDER_BASE.'/config/config.php'; ++ $main_config_file = FILESENDER_CONFIG_DIR.'/config.php'; + if (!file_exists($main_config_file)) { + throw new ConfigFileMissingException($main_config_file); + } +@@ -136,7 +136,7 @@ class Config + + + // load password file if it is there +- $pass_config_file = FILESENDER_BASE.'/config/config-passwords.php'; ++ $pass_config_file = FILESENDER_CONFIG_DIR.'/config-passwords.php'; + if (file_exists($pass_config_file)) { + $config = array(); + include_once($pass_config_file); +@@ -153,7 +153,7 @@ class Config + throw new ConfigBadParameterException('virtualhost'); + } + +- $config_file = FILESENDER_BASE.'/config/'.$virtualhost.'/config.php'; ++ $config_file = FILESENDER_CONFIG_DIR.$virtualhost.'/config.php'; + if (!file_exists($config_file)) { + throw new ConfigFileMissingException($config_file); + } // Should exist even if empty +@@ -174,7 +174,7 @@ class Config + } + foreach ($regex_and_configs as $regex => $extra_config_name) { + if (preg_match('`'.$regex.'`', $auth_attrs[$attr])) { +- $extra_config_file = FILESENDER_BASE.'/config/config-' . $extra_config_name . '.php'; ++ $extra_config_file = FILESENDER_CONFIG_DIR.'/config-' . $extra_config_name . '.php'; + if (file_exists($extra_config_file)) { + $config = array(); + include_once($extra_config_file); +@@ -203,7 +203,7 @@ class Config + // Load config overrides if any + $overrides_cfg = self::get('config_overrides'); + if ($overrides_cfg) { +- $overrides_file = FILESENDER_BASE.'/config/'.($virtualhost ? $virtualhost.'/' : '').'config_overrides.json'; ++ $overrides_file = FILESENDER_CONFIG_DIR.($virtualhost ? $virtualhost.'/' : '').'config_overrides.json'; + + $overrides = file_exists($overrides_file) ? json_decode(trim(file_get_contents($overrides_file))) : new StdClass(); + +@@ -430,7 +430,7 @@ class Config + public static function getVirtualhosts() + { + $virtualhosts = array(); +- foreach (scandir(FILESENDER_BASE.'/config') as $item) { ++ foreach (scandir(FILESENDER_CONFIG_DIR) as $item) { + if (!preg_match('`^(.+)\.conf\.php$`', $item, $match)) { + continue; + } +diff --git a/includes/ConfigValidation.php b/includes/ConfigValidation.php +index 5c1e7f61..cd34c625 100644 +--- a/includes/ConfigValidation.php ++++ b/includes/ConfigValidation.php +@@ -33,7 +33,7 @@ + // Require environment (fatal) + if(!defined('FILESENDER_BASE')) die('Missing environment'); + +-if(!file_exists(FILESENDER_BASE.'/config/config.php')) ++if(!file_exists(FILESENDER_CONFIG_DIR.'/config.php')) + die('Configuration file not found'); + + ConfigValidator::addCheck('site_url', 'string'); +diff --git a/includes/init.php b/includes/init.php +index ba7fa82f..f2f51b8f 100644 +--- a/includes/init.php ++++ b/includes/init.php +@@ -35,6 +35,7 @@ if(PHP_INT_SIZE !== 8) { + } + + define('FILESENDER_BASE', dirname( __DIR__ )); ++define('FILESENDER_CONFIG_DIR', getenv('FILESENDER_CONFIG_DIR', true) ?: (FILESENDER_BASE.'/config')); + + // Include classes autoloader + require_once(FILESENDER_BASE.'/classes/autoload.php'); diff --git a/pkgs/by-name/fi/filesender/separate_log_dir.patch b/pkgs/by-name/fi/filesender/separate_log_dir.patch new file mode 100644 index 0000000000000..c961c6a2b469e --- /dev/null +++ b/pkgs/by-name/fi/filesender/separate_log_dir.patch @@ -0,0 +1,60 @@ +diff --git a/config/csrf-protector-config.php b/config/csrf-protector-config.php +index 83759ca4..ea4a3173 100755 +--- a/config/csrf-protector-config.php ++++ b/config/csrf-protector-config.php +@@ -40,7 +40,7 @@ return array( + // The following should be set correctly from your config.php + // information + "jsUrl" => $config['site_url'] . "/js/csrfprotector.js", +- "logDirectory" => FILESENDER_BASE.'/log/', ++ "logDirectory" => FILESENDER_LOG_DIR, + + // I found that leaving this with the _ as default + // caused the implicit token to be stripped +diff --git a/docs/v2.0/admin/configuration/index.md b/docs/v2.0/admin/configuration/index.md +index 8f2a24b3..3351f046 100644 +--- a/docs/v2.0/admin/configuration/index.md ++++ b/docs/v2.0/admin/configuration/index.md +@@ -2877,7 +2877,7 @@ This is only for old, existing transfers which have no roundtriptoken set. + * __description:__ defines where FileSender logging is sent. You can sent logging to a file, to syslog or to the default PHP log facility (as configured through your webserver's PHP module). The directive takes an array of one or more logging targets. Logging can be sent to multiple targets simultaneously. Each logging target is a list containing the name of the logging target and a number of attributes which vary per log target. See below for the exact definiation of each log target. + * __mandatory:__ no + * __type:__ array of log targets. Each target has a type and a number of parameters +-* __default:__ array('type' => 'file', 'path' => FILESENDER_BASE.'/log/', 'rotate' => 'hourly')) ++* __default:__ array('type' => 'file', 'path' => FILESENDER_LOG_DIR, 'rotate' => 'hourly')) + * __available:__ since version 2.0 + * __1.x name:__ + * __comment:__ +@@ -2960,7 +2960,7 @@ This will log everything to a file in log that is rotated every hour + $config['log_facilities'] = + array(array( + 'type' => 'file', +- 'path' => FILESENDER_BASE.'/log/', ++ 'path' => FILESENDER_LOG_DIR, + 'rotate' => 'hourly' + )); + +diff --git a/includes/ConfigDefaults.php b/includes/ConfigDefaults.php +index 3143d544..6b682008 100644 +--- a/includes/ConfigDefaults.php ++++ b/includes/ConfigDefaults.php +@@ -224,7 +224,7 @@ $default = array( + 'log_facilities' => array( + array( + 'type' => 'file', +- 'path' => FILESENDER_BASE.'/log/', ++ 'path' => FILESENDER_LOG_DIR, + 'rotate' => 'hourly' + ) + ), +diff --git a/includes/init.php b/includes/init.php +index f2f51b8f..31812c54 100644 +--- a/includes/init.php ++++ b/includes/init.php +@@ -36,6 +36,7 @@ if(PHP_INT_SIZE !== 8) { + + define('FILESENDER_BASE', dirname( __DIR__ )); + define('FILESENDER_CONFIG_DIR', getenv('FILESENDER_CONFIG_DIR', true) ?: (FILESENDER_BASE.'/config')); ++define('FILESENDER_LOG_DIR', getenv('FILESENDER_LOG_DIR', true) ?: (FILESENDER_BASE.'/log')); + + // Include classes autoloader + require_once(FILESENDER_BASE.'/classes/autoload.php'); From f0d5b5f95e3393c4d713ca15a40cfb36448bd663 Mon Sep 17 00:00:00 2001 From: nhnn Date: Sat, 20 Apr 2024 09:42:56 +0300 Subject: [PATCH 4/8] pkgs: add PHP to formats.nix --- pkgs/pkgs-lib/formats.nix | 79 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 79 insertions(+) diff --git a/pkgs/pkgs-lib/formats.nix b/pkgs/pkgs-lib/formats.nix index 1b72270b43ca4..b3c54b09e898d 100644 --- a/pkgs/pkgs-lib/formats.nix +++ b/pkgs/pkgs-lib/formats.nix @@ -274,6 +274,85 @@ rec { }; + # Format for defining configuration of some PHP services, that use "config.php" approach. + php = {finalVariable}: let + phpLib = { + phpFile = x: " ${phpLib.buildPhpExpression v}")) + (lib.concatStringsSep ", ") + ] + + ")" + else + "array(" + + lib.pipe x [ + (lib.mapAttrsToList (k: v: "${phpLib.buildPhpExpression k} => ${phpLib.buildPhpExpression v}")) + (lib.concatStringsSep ", ") + ] + + ")" + else throw "incompatible php value: ${toString x}"; + in + value; + }; + + type = with lib.types; + nullOr (oneOf [ + bool + int + float + str + (attrsOf type) + (listOf type) + ]) + // { + description = "PHP value"; + }; + in { + + inherit type; + lib = phpLib; + + generate = name: value: pkgs.writeTextFile { + name = "config.php"; + text = phpLib.phpFile "${finalVariable} = ${phpLib.buildPhpExpression value };"; + }; + + }; + /* For configurations of Elixir project, like config.exs or runtime.exs Most Elixir project are configured using the [Config] Elixir DSL From 16e903fdd886a16b4fde08f7f274b36d30a66338 Mon Sep 17 00:00:00 2001 From: nhnn Date: Sat, 20 Apr 2024 10:26:06 +0300 Subject: [PATCH 5/8] nixos/simplesamlphp: init module Co-authored-by: Sandro --- nixos/modules/module-list.nix | 1 + .../services/web-apps/simplesamlphp.nix | 122 ++++++++++++++++++ 2 files changed, 123 insertions(+) create mode 100644 nixos/modules/services/web-apps/simplesamlphp.nix diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 9fc036f9213a5..8dd8883ee19f2 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1394,6 +1394,7 @@ ./services/web-apps/selfoss.nix ./services/web-apps/shiori.nix ./services/web-apps/silverbullet.nix + ./services/web-apps/simplesamlphp.nix ./services/web-apps/slskd.nix ./services/web-apps/snipe-it.nix ./services/web-apps/sogo.nix diff --git a/nixos/modules/services/web-apps/simplesamlphp.nix b/nixos/modules/services/web-apps/simplesamlphp.nix new file mode 100644 index 0000000000000..3761efbafb572 --- /dev/null +++ b/nixos/modules/services/web-apps/simplesamlphp.nix @@ -0,0 +1,122 @@ +{ config +, lib +, pkgs +, ... +}: +let + cfg = config.services.simplesamlphp; + + format = pkgs.formats.php { finalVariable = "$config"; }; + + phpPackage = pkgs.php.withExtensions ( + { enabled + , all + }: with all; + [ + xml + mbstring + ] + ++ enabled + ); + + genSSPConfigForOpts = opts: pkgs.runCommand "simplesamlphp-config" {} '' + mkdir $out + cp ${format.generate "config.php" opts.settings} $out/config.php + cp ${format.generate "authsources.php" opts.authSources} $out/authsources.php + ''; +in +{ + meta = { + maintainers = with lib.maintainers; [ nhnn ]; + }; + + options.services.simplesamlphp = with lib; mkOption { + type = types.attrsOf (lib.types.submodule ({ config, ...}: { + options = { + package = mkPackageOption pkgs "simplesamlphp" { }; + configureNginx = mkOption { + type = types.bool; + default = true; + description = "Configure nginx as a reverse proxy for SimpleSAMLphp."; + }; + localDomain = mkOption { + type = types.str; + description = "The domain serving your SimpleSAMLphp instance. This option modifies only /saml"; + }; + settings = mkOption { + type = lib.types.submodule { + freeformType = format.type; + options = { + baseurlpath = mkOption { + type = types.str; + example = "https://filesender.example.com/saml/"; + description = "URL where SimpleSAMLphp can be reached."; + }; + }; + }; + default = { }; + description = '' + Configuration options used by SimpleSAMLphp. + See [](https://simplesamlphp.org/docs/stable/simplesamlphp-install) + for available options. + ''; + }; + + authSources = mkOption { + type = with types; format.type; + default = { }; + description = '' + Auth sources options used by SimpleSAMLphp. + ''; + }; + + libDir = mkOption { + type = types.str; + readOnly = true; + description = '' + Path to the SimpleSAMLphp library directory. + ''; + }; + configDir = mkOption { + type = types.str; + readOnly = true; + description = '' + Path to the SimpleSAMLphp config directory. + ''; + }; + }; + config = { + libDir = "${config.package}/share/php/simplesamlphp/"; + configDir = "${genSSPConfigForOpts config}"; + }; + })); + default = {}; + description = "Instances of SimpleSAMLphp. should refer to valid phpfpm instance."; + }; + + config = { + services.phpfpm.pools = lib.mapAttrs (phpfpmName: opts: { + phpEnv.SIMPLESAMLPHP_CONFIG_DIR = "${genSSPConfigForOpts opts}"; + }) cfg; + + services.nginx.virtualHosts = lib.mapAttrs' (phpfpmName: opts: let + in + lib.nameValuePair opts.localDomain (lib.mkIf opts.configureNginx { + locations."^~ /saml/" = { + alias = "${opts.package}/share/php/simplesamlphp/www/"; + extraConfig = '' + location ~ ^(?/saml)(?.+?\.php)(?/.*)?$ { + include ${pkgs.nginx}/conf/fastcgi.conf; + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_pass unix:${config.services.phpfpm.pools.${phpfpmName}.socket}; + fastcgi_intercept_errors on; + fastcgi_param SCRIPT_FILENAME $document_root$phpfile; + fastcgi_param SCRIPT_NAME /saml$phpfile; + fastcgi_param PATH_INFO $pathinfo if_not_empty; + } + ''; + }; + }) + ) cfg; + }; +} From d58b11c1e0ae893dd218947e6142f414139dd700 Mon Sep 17 00:00:00 2001 From: nhnn Date: Thu, 18 Apr 2024 22:36:28 +0300 Subject: [PATCH 6/8] nixos/filesender: init module Co-authored-by: Sandro --- nixos/modules/module-list.nix | 1 + .../modules/services/web-apps/filesender.nix | 256 ++++++++++++++++++ 2 files changed, 257 insertions(+) create mode 100644 nixos/modules/services/web-apps/filesender.nix diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index 8dd8883ee19f2..13f846b642a7f 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -1324,6 +1324,7 @@ ./services/web-apps/dolibarr.nix ./services/web-apps/engelsystem.nix ./services/web-apps/ethercalc.nix + ./services/web-apps/filesender.nix ./services/web-apps/fluidd.nix ./services/web-apps/freshrss.nix ./services/web-apps/galene.nix diff --git a/nixos/modules/services/web-apps/filesender.nix b/nixos/modules/services/web-apps/filesender.nix new file mode 100644 index 0000000000000..633f3e923ac6b --- /dev/null +++ b/nixos/modules/services/web-apps/filesender.nix @@ -0,0 +1,256 @@ +{ config +, lib +, pkgs +, ... +}: +let + format = pkgs.formats.php { finalVariable = "$config"; }; + + cfg = config.services.filesender; + simpleSamlCfg = config.services.simplesamlphp.filesender; + fpm = config.services.phpfpm.pools.filesender; + + phpPackage = pkgs.php.withExtensions ( + { enabled + , all + }: with all; + [ + xml + mbstring + ] + ++ enabled + ); + + filesenderConfigDirectory = pkgs.runCommand "filesender-config" {} '' + mkdir $out + cp ${format.generate "config.php" cfg.settings} $out/config.php + ''; +in +{ + meta = { + maintainers = with lib.maintainers; [ nhnn ]; + }; + + options.services.filesender = with lib; { + enable = mkEnableOption "Filesender"; + package = mkPackageOption pkgs "filesender" { }; + user = lib.mkOption { + description = "User under which filesender runs."; + type = lib.types.str; + default = "filesender"; + }; + database = { + createLocally = mkOption { + type = types.bool; + default = true; + description = '' + Create the PostgreSQL database and database user locally. + ''; + }; + hostname = mkOption { + type = types.str; + default = "/run/postgresql"; + description = "Database hostname."; + }; + port = mkOption { + type = types.port; + default = 5432; + description = "Database port."; + }; + name = mkOption { + type = types.str; + default = "filesender"; + description = "Database name."; + }; + user = mkOption { + type = types.str; + default = "filesender"; + description = "Database user."; + }; + passwordFile = mkOption { + type = types.nullOr types.path; + default = null; + example = "/run/keys/filesender-dbpassword"; + description = '' + A file containing the password corresponding to + [](#opt-services.filesender.database.user). + ''; + }; + }; + settings = mkOption { + type = lib.types.submodule { + freeformType = format.type; + options = { + site_url = mkOption { + type = types.str; + description = "Site URL. Used in emails, to build URLs for logging in, logging out, build URL for upload endpoint for web workers, to include scripts etc."; + }; + admin = mkOption { + type = types.commas; + description = '' + UIDs (as per the configured saml_uid_attribute) of FileSender administrators. + Accounts with these UIDs can access the Admin page through the web UI. + ''; + }; + admin_email = mkOption { + type = types.commas; + description = '' + Email address of FileSender administrator(s). + Emails regarding disk full etc. are sent here. + You should use a role-address here. + ''; + }; + storage_filesystem_path = mkOption { + type = types.nullOr types.str; + description = "When using storage type filesystem this is the absolute path to the file system where uploaded files are stored until they expire. Your FileSender storage root."; + }; + log_facilities = mkOption { + type = format.type; + default = [ + { + type = "syslog"; + } + ]; + description = "Defines where FileSender logging is sent. You can sent logging to a file, to syslog or to the default PHP log facility (as configured through your webserver's PHP module). The directive takes an array of one or more logging targets. Logging can be sent to multiple targets simultaneously. Each logging target is a list containing the name of the logging target and a number of attributes which vary per log target. See below for the exact definiation of each log target."; + }; + }; + }; + default = { }; + description = '' + Configuration options used by Filesender. + See [](https://docs.filesender.org/filesender/v2.0/admin/configuration/) + for available options. + ''; + }; + + configureNginx = mkOption { + type = types.bool; + default = true; + description = "Configure nginx as a reverse proxy for Filesender."; + }; + localDomain = mkOption { + type = types.str; + example = "filesender.example.org"; + description = "The domain serving your Filesender instance."; + }; + poolSettings = mkOption { + type = with types; attrsOf (oneOf [ str int bool ]); + default = { + "pm" = "dynamic"; + "pm.max_children" = "32"; + "pm.start_servers" = "2"; + "pm.min_spare_servers" = "2"; + "pm.max_spare_servers" = "4"; + "pm.max_requests" = "500"; + }; + description = '' + Options for Filesender's PHP pool. See the documentation on `php-fpm.conf` for details on configuration directives. + ''; + }; + }; + config = lib.mkIf cfg.enable { + services.simplesamlphp.filesender = { + localDomain = cfg.localDomain; + }; + + services.phpfpm = { + pools.filesender = { + user = cfg.user; + group = config.services.nginx.group; + inherit phpPackage; + phpEnv = { + FILESENDER_CONFIG_DIR = filesenderConfigDirectory; + SIMPLESAMLPHP_CONFIG_DIR = simpleSamlCfg.configDir; + }; + settings = { + "listen.owner" = config.services.nginx.user; + "listen.group" = config.services.nginx.group; + } // cfg.poolSettings; + }; + }; + + services.nginx = lib.mkIf cfg.configureNginx { + enable = true; + virtualHosts.${cfg.localDomain} = { + root = "${cfg.package}/www"; + extraConfig = '' + index index.php; + ''; + locations = { + "/".extraConfig = '' + try_files $uri $uri/ /index.php?args; + ''; + "~ [^/]\\.php(/|$)" = { + extraConfig = '' + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_pass unix:${fpm.socket}; + include ${pkgs.nginx}/conf/fastcgi.conf; + fastcgi_intercept_errors on; + fastcgi_param PATH_INFO $fastcgi_path_info; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + ''; + }; + "~ /\\.".extraConfig = "deny all;"; + }; + }; + }; + + services.postgresql = lib.mkIf cfg.database.createLocally { + enable = true; + ensureDatabases = [ cfg.database.name ]; + ensureUsers = [ + { + name = cfg.database.user; + ensureDBOwnership = true; + } + ]; + }; + + services.filesender.settings = lib.mkMerge [ + (lib.mkIf cfg.database.createLocally { + db_host = "/run/postgresql"; + db_port = "5432"; + db_password = "test"; + }) + (lib.mkIf (!cfg.database.createLocally) { + db_host = cfg.database.hostname; + db_port = toString cfg.database.port; + db_password._secret = cfg.database.passwordFile; + }) + { + db_type = "pgsql"; + db_username = cfg.database.user; + db_database = cfg.database.name; + "auth_sp_saml_simplesamlphp_url" = "/saml"; + "auth_sp_saml_simplesamlphp_location" = "${simpleSamlCfg.libDir}"; + } + ]; + + systemd.services.filesender-initdb = { + description = "Init filesender DB"; + + wantedBy = [ "multi-user.target" "phpfpm-filesender.service" ]; + after = [ "postgresql.service" ]; + + restartIfChanged = true; + + serviceConfig = { + Environment = [ + "FILESENDER_CONFIG_DIR=${filesenderConfigDirectory}" + "SIMPLESAMLPHP_CONFIG_DIR=${simpleSamlCfg.configDir}" + ]; + Type = "oneshot"; + Group = config.services.nginx.group; + User = "filesender"; + ExecStart = "${phpPackage}/bin/php ${cfg.package}/scripts/upgrade/database.php"; + }; + }; + + users.extraUsers.filesender = lib.mkIf (cfg.user == "filesender") { + home = "/var/lib/filesender"; + group = config.services.nginx.group; + createHome = true; + isSystemUser = true; + }; + }; +} From ee1341392cb2007d7a4188a83de95ea6e6d595a1 Mon Sep 17 00:00:00 2001 From: nhnn Date: Thu, 18 Apr 2024 22:43:29 +0300 Subject: [PATCH 7/8] nixos/tests: add filesender test --- nixos/tests/all-tests.nix | 1 + nixos/tests/filesender.nix | 157 +++++++++++++++++++++++++++++++++++++ 2 files changed, 158 insertions(+) create mode 100644 nixos/tests/filesender.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 7d120d6bc09e8..6d9429b389b37 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -305,6 +305,7 @@ in { fenics = handleTest ./fenics.nix {}; ferm = handleTest ./ferm.nix {}; ferretdb = handleTest ./ferretdb.nix {}; + filesender = handleTest ./filesender.nix {}; filesystems-overlayfs = runTest ./filesystems-overlayfs.nix; firefox = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox; }; firefox-beta = handleTest ./firefox.nix { firefoxPackage = pkgs.firefox-beta; }; diff --git a/nixos/tests/filesender.nix b/nixos/tests/filesender.nix new file mode 100644 index 0000000000000..885daf4a7c8f1 --- /dev/null +++ b/nixos/tests/filesender.nix @@ -0,0 +1,157 @@ +import ./make-test-python.nix ({ pkgs, lib, ... }: { + name = "filesender"; + meta = with lib.maintainers; { + maintainers = [ nhnn ]; + }; + + nodes.filesender = { nodes, ... }: { + networking.firewall.allowedTCPPorts = [ 80 ]; + + services.filesender.enable = true; + services.filesender.localDomain = "filesender"; + services.filesender.settings = { + auth_sp_saml_authentication_source = "default"; + auth_sp_saml_uid_attribute = "uid"; + storage_filesystem_path = "/tmp"; + site_url = "http://filesender"; + force_ssl = false; + admin = ""; + admin_email = "admin@localhost"; + email_reply_to = "noreply@nixos.org"; + }; + services.simplesamlphp.filesender = { + settings = { + baseurlpath = "http://filesender/saml"; + "module.enable".exampleauth = true; + }; + authSources = { + admin = [ "core:AdminPassword" ]; + default = { + "" = [ "exampleauth:UserPass" ]; + "user:password" = { + uid = [ "user" ]; + cn = [ "user" ]; + mail = [ "user@nixos.org" ]; + }; + }; + }; + }; + }; + + nodes.client = + { pkgs + , nodes + , ... + }: + let + filesenderIP = (builtins.head (nodes.filesender.networking.interfaces.eth1.ipv4.addresses)).address; + in + { + networking.hosts.${filesenderIP} = [ "filesender" ]; + + environment.systemPackages = + let + username = "user"; + password = "password"; + browser-test = + pkgs.writers.writePython3Bin "browser-test" + { + libraries = [ pkgs.python3Packages.selenium ]; + flakeIgnore = [ "E124" "E501" ]; + } '' + from selenium.webdriver.common.by import By + from selenium.webdriver import Firefox + from selenium.webdriver.firefox.options import Options + from selenium.webdriver.firefox.firefox_profile import FirefoxProfile + from selenium.webdriver.firefox.service import Service + from selenium.webdriver.support.ui import WebDriverWait + from selenium.webdriver.support import expected_conditions as EC + from subprocess import STDOUT + import string + import random + import logging + import time + + selenium_logger = logging.getLogger("selenium") + selenium_logger.setLevel(logging.DEBUG) + selenium_logger.addHandler(logging.StreamHandler()) + + profile = FirefoxProfile() + profile.set_preference("browser.download.folderList", 2) + profile.set_preference("browser.download.manager.showWhenStarting", False) + profile.set_preference("browser.download.dir", "/tmp/firefox") + profile.set_preference("browser.helperApps.neverAsk.saveToDisk", "text/plain;text/txt") + + options = Options() + options.profile = profile + options.add_argument('--headless') + service = Service(log_output=STDOUT) + driver = Firefox(options=options) + driver.set_window_size(1024, 768) + driver.implicitly_wait(30) + + driver.get('http://filesender/') + + wait = WebDriverWait(driver, 20) + wait.until(EC.title_contains("FileSender")) + + driver.find_element(By.ID, "btn_logon").click() + + wait.until(EC.title_contains("Enter your username and password")) + + driver.find_element(By.ID, 'username').send_keys( + '${username}' + ) + driver.find_element(By.ID, 'password').send_keys( + '${password}' + ) + driver.find_element(By.ID, "submit_button").click() + + wait.until(EC.title_contains("FileSender")) + + wait.until(EC.presence_of_element_located((By.ID, "topmenu_logoff"))) + + test_string = "".join(random.choices(string.ascii_uppercase + string.digits, k=20)) + with open("/tmp/test_file.txt", "w") as file: + file.write(test_string) + + driver.find_element(By.ID, "files").send_keys("/tmp/test_file.txt") + + time.sleep(2) + + driver.find_element(By.CSS_SELECTOR, '.start').click() + + wait.until(EC.presence_of_element_located((By.CSS_SELECTOR, ".download_link"))) + + download_link = driver.find_element(By.CSS_SELECTOR, '.download_link > textarea').get_attribute('value').strip() + + driver.get(download_link) + + wait.until(EC.presence_of_element_located((By.CSS_SELECTOR, ".download"))) + driver.find_element(By.CSS_SELECTOR, '.download').click() + + wait.until(EC.presence_of_element_located((By.CSS_SELECTOR, ".ui-dialog-buttonset > button:nth-child(2)"))) + driver.find_element(By.CSS_SELECTOR, ".ui-dialog-buttonset > button:nth-child(2)").click() + + driver.close() + driver.quit() + ''; + in + [ + pkgs.firefox-unwrapped + pkgs.geckodriver + browser-test + ]; + }; + + testScript = '' + start_all() + filesender.wait_for_file("/run/phpfpm/filesender.sock") + filesender.wait_for_open_port(80) + + if "If you have received an invitation to access this site as a guest" not in client.wait_until_succeeds("curl -sS -f http://filesender"): + raise Exception("filesender returned invalid html") + + client.succeed("browser-test") + ''; +}) From c28137ad813ea47757392d61683ecafc9dca09e1 Mon Sep 17 00:00:00 2001 From: nhnn Date: Sat, 20 Apr 2024 11:17:49 +0300 Subject: [PATCH 8/8] nixos/doc: add simplesamlphp and filesender modules mention --- nixos/doc/manual/release-notes/rl-2405.section.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/nixos/doc/manual/release-notes/rl-2405.section.md b/nixos/doc/manual/release-notes/rl-2405.section.md index a8cefa0da6048..6e8e7be6211da 100644 --- a/nixos/doc/manual/release-notes/rl-2405.section.md +++ b/nixos/doc/manual/release-notes/rl-2405.section.md @@ -165,6 +165,10 @@ The pre-existing [services.ankisyncd](#opt-services.ankisyncd.enable) has been m - [prometheus-nats-exporter](https://github.com/nats-io/prometheus-nats-exporter), a Prometheus exporter for NATS. Available as [services.prometheus.exporters.nats](#opt-services.prometheus.exporters.nats.enable). +- [SimpleSAMLphp](https://simplesamlphp.org/), an application written in native PHP that deals with authentication. Available as [services.simplesamlphp](#opt-services.simplesamlphp). + +- [Filesender](https://filesender.org/), a file sharing software. Available as [services.filesender](#opt-services.filesender.enable). + ## Backward Incompatibilities {#sec-release-24.05-incompatibilities}