nixos/postfixadmin: refactor, replace use of deprecated postgresql port option with new one, set -o pipefail (#362463)

This commit is contained in:
Wolfgang Walther
2025-03-01 13:20:05 +01:00
committed by GitHub
+28 -13
View File
@@ -1,8 +1,14 @@
{ lib, config, pkgs, ... }:
{
lib,
config,
pkgs,
...
}:
let
cfg = config.services.postfixadmin;
fpm = config.services.phpfpm.pools.postfixadmin;
localDB = cfg.database.host == "localhost";
pgsql = config.services.postgresql;
user = if localDB then cfg.database.username else "nginx";
in
{
@@ -52,6 +58,7 @@ in
If `database.host` is set to `localhost`, a unix user and group of the same name will be created as well.
'';
};
host = lib.mkOption {
type = lib.types.str;
default = "localhost";
@@ -62,10 +69,12 @@ in
permissions.
'';
};
passwordFile = lib.mkOption {
type = lib.types.path;
description = "Password file for the postgresql connection. Must be readable by user `nginx`.";
};
dbname = lib.mkOption {
type = lib.types.str;
default = "postfixadmin";
@@ -89,7 +98,9 @@ in
$CONF['database_type'] = 'pgsql';
$CONF['database_host'] = ${if localDB then "null" else "'${cfg.database.host}'"};
${lib.optionalString localDB "$CONF['database_user'] = '${cfg.database.username}';"}
$CONF['database_password'] = ${if localDB then "'dummy'" else "file_get_contents('${cfg.database.passwordFile}')"};
$CONF['database_password'] = ${
if localDB then "'dummy'" else "file_get_contents('${cfg.database.passwordFile}')"
};
$CONF['database_name'] = '${cfg.database.dbname}';
$CONF['configured'] = true;
@@ -126,14 +137,17 @@ in
services.postgresql = lib.mkIf localDB {
enable = true;
ensureUsers = [ {
name = cfg.database.username;
} ];
ensureUsers = [
{
name = cfg.database.username;
}
];
};
# The postgresql module doesn't currently support concepts like
# objects owners and extensions; for now we tack on what's needed
# here.
systemd.services.postfixadmin-postgres = let pgsql = config.services.postgresql; in lib.mkIf localDB {
systemd.services.postfixadmin-postgres = lib.mkIf localDB {
after = [ "postgresql.service" ];
bindsTo = [ "postgresql.service" ];
wantedBy = [ "multi-user.target" ];
@@ -142,23 +156,23 @@ in
pkgs.util-linux
];
script = ''
set -eu
set -euo pipefail
PSQL() {
psql --port=${toString pgsql.port} "$@"
psql --port=${toString pgsql.settings.port} "$@"
}
PSQL -tAc "SELECT 1 FROM pg_database WHERE datname = '${cfg.database.dbname}'" | grep -q 1 || PSQL -tAc 'CREATE DATABASE "${cfg.database.dbname}" OWNER "${cfg.database.username}"'
current_owner=$(PSQL -tAc "SELECT pg_catalog.pg_get_userbyid(datdba) FROM pg_catalog.pg_database WHERE datname = '${cfg.database.dbname}'")
if [[ "$current_owner" != "${cfg.database.username}" ]]; then
PSQL -tAc 'ALTER DATABASE "${cfg.database.dbname}" OWNER TO "${cfg.database.username}"'
if [[ -e "${config.services.postgresql.dataDir}/.reassigning_${cfg.database.dbname}" ]]; then
if [[ -e "${pgsql.dataDir}/.reassigning_${cfg.database.dbname}" ]]; then
echo "Reassigning ownership of database ${cfg.database.dbname} to user ${cfg.database.username} failed on last boot. Failing..."
exit 1
fi
touch "${config.services.postgresql.dataDir}/.reassigning_${cfg.database.dbname}"
touch "${pgsql.dataDir}/.reassigning_${cfg.database.dbname}"
PSQL "${cfg.database.dbname}" -tAc "REASSIGN OWNED BY \"$current_owner\" TO \"${cfg.database.username}\""
rm "${config.services.postgresql.dataDir}/.reassigning_${cfg.database.dbname}"
rm "${pgsql.dataDir}/.reassigning_${cfg.database.dbname}"
fi
'';
@@ -174,7 +188,8 @@ in
isSystemUser = true;
createHome = false;
};
users.groups.${user} = lib.mkIf localDB {};
users.groups.${user} = lib.mkIf localDB { };
services.phpfpm.pools.postfixadmin = {
user = user;
@@ -183,7 +198,7 @@ in
error_log = 'stderr'
log_errors = on
'';
settings = lib.mapAttrs (name: lib.mkDefault) {
settings = lib.mapAttrs (_: lib.mkDefault) {
"listen.owner" = "nginx";
"listen.group" = "nginx";
"listen.mode" = "0660";