From 2e5268e2a5d559b03f293f96a6dce5f4b16de8fa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E0=B9=82=E0=B8=97=E0=B8=AA=E0=B8=95=E0=B8=B1=E0=B8=A5?= Date: Wed, 11 Dec 2024 20:19:58 +0700 Subject: [PATCH 1/7] =?UTF-8?q?use=20movim=E2=80=99s=20database=20user?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- nixos/modules/services/web-apps/movim.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nixos/modules/services/web-apps/movim.nix b/nixos/modules/services/web-apps/movim.nix index 51c3156fef06..b3ddce693c08 100644 --- a/nixos/modules/services/web-apps/movim.nix +++ b/nixos/modules/services/web-apps/movim.nix @@ -575,7 +575,7 @@ in package = mkDefault pkgs.mariadb; ensureDatabases = [ cfg.database.name ]; ensureUsers = [{ - name = cfg.user; + name = cfg.database.user; ensureDBOwnership = true; }]; }; @@ -584,7 +584,7 @@ in enable = mkDefault true; ensureDatabases = [ cfg.database.name ]; ensureUsers = [{ - name = cfg.user; + name = cfg.database.user; ensureDBOwnership = true; }]; authentication = '' From 431afe7289d8d6c233c21f08222bb202abb743a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E0=B9=82=E0=B8=97=E0=B8=AA=E0=B8=95=E0=B8=B1=E0=B8=A5?= Date: Wed, 11 Dec 2024 20:27:03 +0700 Subject: [PATCH 2/7] use mkDefaults for Nginx config --- nixos/modules/services/web-apps/movim.nix | 171 +++++++++++----------- 1 file changed, 86 insertions(+), 85 deletions(-) diff --git a/nixos/modules/services/web-apps/movim.nix b/nixos/modules/services/web-apps/movim.nix index b3ddce693c08..4cb18c6b9b31 100644 --- a/nixos/modules/services/web-apps/movim.nix +++ b/nixos/modules/services/web-apps/movim.nix @@ -483,92 +483,93 @@ in }; }; - nginx = mkIf (cfg.nginx != null) { - enable = true; - recommendedOptimisation = true; - recommendedGzipSettings = true; - recommendedBrotliSettings = true; - recommendedProxySettings = true; - # TODO: recommended cache options already in Nginx⁇ - appendHttpConfig = /* nginx */ '' - fastcgi_cache_path /tmp/nginx_cache levels=1:2 keys_zone=nginx_cache:100m inactive=60m; - fastcgi_cache_key "$scheme$request_method$host$request_uri"; - ''; - virtualHosts."${cfg.domain}" = mkMerge [ - cfg.nginx - { - root = lib.mkForce "${package}/share/php/movim/public"; - locations = { - "/favicon.ico" = { - priority = 100; - extraConfig = /* nginx */ '' - access_log off; - log_not_found off; - ''; + nginx = mkIf (cfg.nginx != null) + { + enable = true; + recommendedOptimisation = mkDefault true; + recommendedProxySettings = true; + # TODO: recommended cache options already in Nginx⁇ + appendHttpConfig = /* nginx */ '' + fastcgi_cache_path /tmp/nginx_cache levels=1:2 keys_zone=nginx_cache:100m inactive=60m; + fastcgi_cache_key "$scheme$request_method$host$request_uri"; + ''; + virtualHosts."${cfg.domain}" = mkMerge [ + cfg.nginx + { + root = lib.mkForce "${package}/share/php/movim/public"; + locations = { + "/favicon.ico" = { + priority = 100; + extraConfig = /* nginx */ '' + access_log off; + log_not_found off; + ''; + }; + "/robots.txt" = { + priority = 100; + extraConfig = /* nginx */ '' + access_log off; + log_not_found off; + ''; + }; + "~ /\\.(?!well-known).*" = { + priority = 210; + extraConfig = /* nginx */ '' + deny all; + ''; + }; + # Ask nginx to cache every URL starting with "/picture" + "/picture" = { + priority = 400; + tryFiles = "$uri $uri/ /index.php$is_args$args"; + extraConfig = /* nginx */ '' + set $no_cache 0; # Enable cache only there + ''; + }; + "/" = { + priority = 490; + tryFiles = "$uri $uri/ /index.php$is_args$args"; + extraConfig = /* nginx */ '' + # https://github.com/movim/movim/issues/314 + add_header Content-Security-Policy "default-src 'self'; img-src 'self' aesgcm: https:; media-src 'self' aesgcm: https:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline';"; + set $no_cache 1; + ''; + }; + "~ \\.php$" = { + priority = 500; + tryFiles = "$uri =404"; + extraConfig = /* nginx */ '' + include ${config.services.nginx.package}/conf/fastcgi.conf; + add_header X-Cache $upstream_cache_status; + fastcgi_ignore_headers "Cache-Control" "Expires" "Set-Cookie"; + fastcgi_cache nginx_cache; + fastcgi_cache_valid any 7d; + fastcgi_cache_bypass $no_cache; + fastcgi_no_cache $no_cache; + fastcgi_split_path_info ^(.+\.php)(/.+)$; + fastcgi_index index.php; + fastcgi_pass unix:${fpm.socket}; + ''; + }; + "/ws/" = { + priority = 900; + proxyPass = "http://${cfg.settings.DAEMON_INTERFACE}:${builtins.toString cfg.port}/"; + proxyWebsockets = true; + recommendedProxySettings = true; + extraConfig = /* nginx */ '' + proxy_set_header X-Forwarded-Proto $scheme; + proxy_redirect off; + ''; + }; }; - "/robots.txt" = { - priority = 100; - extraConfig = /* nginx */ '' - access_log off; - log_not_found off; - ''; - }; - "~ /\\.(?!well-known).*" = { - priority = 210; - extraConfig = /* nginx */ '' - deny all; - ''; - }; - # Ask nginx to cache every URL starting with "/picture" - "/picture" = { - priority = 400; - tryFiles = "$uri $uri/ /index.php$is_args$args"; - extraConfig = /* nginx */ '' - set $no_cache 0; # Enable cache only there - ''; - }; - "/" = { - priority = 490; - tryFiles = "$uri $uri/ /index.php$is_args$args"; - extraConfig = /* nginx */ '' - # https://github.com/movim/movim/issues/314 - add_header Content-Security-Policy "default-src 'self'; img-src 'self' aesgcm: https:; media-src 'self' aesgcm: https:; script-src 'self' 'unsafe-eval' 'unsafe-inline'; style-src 'self' 'unsafe-inline';"; - set $no_cache 1; - ''; - }; - "~ \\.php$" = { - priority = 500; - tryFiles = "$uri =404"; - extraConfig = /* nginx */ '' - include ${config.services.nginx.package}/conf/fastcgi.conf; - add_header X-Cache $upstream_cache_status; - fastcgi_ignore_headers "Cache-Control" "Expires" "Set-Cookie"; - fastcgi_cache nginx_cache; - fastcgi_cache_valid any 7d; - fastcgi_cache_bypass $no_cache; - fastcgi_no_cache $no_cache; - fastcgi_split_path_info ^(.+\.php)(/.+)$; - fastcgi_index index.php; - fastcgi_pass unix:${fpm.socket}; - ''; - }; - "/ws/" = { - priority = 900; - proxyPass = "http://${cfg.settings.DAEMON_INTERFACE}:${builtins.toString cfg.port}/"; - proxyWebsockets = true; - recommendedProxySettings = true; - extraConfig = /* nginx */ '' - proxy_set_header X-Forwarded-Proto $scheme; - proxy_redirect off; - ''; - }; - }; - extraConfig = /* ngnix */ '' - index index.php; - ''; - } - ]; - }; + extraConfig = /* ngnix */ '' + index index.php; + ''; + } + ]; + } + // lib.optionalAttrs (cfg.precompressStaticFiles.gzip.enable) { recommendedGzipSettings = mkDefault true; } + // lib.optionalAttrs (cfg.precompressStaticFiles.brotli.enable) { recommendedBrotliSettings = mkDefault true; }; mysql = mkIf (cfg.database.createLocally && cfg.database.type == "mysql") { enable = mkDefault true; From c15c466d29f4e80bd04ad5c679e0c081f66fcad2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E0=B9=82=E0=B8=97=E0=B8=AA=E0=B8=95=E0=B8=B1=E0=B8=A5?= Date: Wed, 11 Dec 2024 20:28:05 +0700 Subject: [PATCH 3/7] typo in script name --- nixos/modules/services/web-apps/movim.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/web-apps/movim.nix b/nixos/modules/services/web-apps/movim.nix index 4cb18c6b9b31..96090a7b0a1d 100644 --- a/nixos/modules/services/web-apps/movim.nix +++ b/nixos/modules/services/web-apps/movim.nix @@ -113,7 +113,7 @@ let (lib.optionalString gzip.enable '' echo -n "Precompressing static files with Gzip …" find ${appDir}/public -type f ${findTextFileNames} -print0 \ - | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_broti" '' + | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_gzip" '' file="$1" ${lib.getExe gzip.package} -c -${builtins.toString gzip.compressionLevel} $file > $file.gz ''} From 22c7e68534e76001fffea10181a3d63fb84c2e12 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E0=B9=82=E0=B8=97=E0=B8=AA=E0=B8=95=E0=B8=B1=E0=B8=A5?= Date: Thu, 12 Dec 2024 01:50:53 +0700 Subject: [PATCH 4/7] syntax hints for tree-sitter --- nixos/modules/services/web-apps/movim.nix | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/nixos/modules/services/web-apps/movim.nix b/nixos/modules/services/web-apps/movim.nix index 96090a7b0a1d..5d15b8e12ecb 100644 --- a/nixos/modules/services/web-apps/movim.nix +++ b/nixos/modules/services/web-apps/movim.nix @@ -60,7 +60,7 @@ let let appDir = "$out/share/php/${finalAttrs.pname}"; - stateDirectories = '' + stateDirectories = /* sh */ '' # Symlinking in our state directories rm -rf $out/.env $out/cache ${appDir}/public/cache ln -s ${cfg.dataDir}/.env ${appDir}/.env @@ -69,7 +69,7 @@ let ln -s ${cfg.runtimeDir}/cache ${appDir}/cache ''; - exposeComposer = '' + exposeComposer = /* sh */ '' # Expose PHP Composer for scripts mkdir -p $out/bin echo "#!${lib.getExe pkgs.dash}" > $out/bin/movim-composer @@ -85,10 +85,10 @@ let # Disable all Admin panel options that were set in the # `cfg.podConfig` to prevent confusing situtions where the # values are rewritten on server reboot - '' - substituteInPlace ${appDir}/app/Widgets/AdminMain/adminmain.tpl \ - --replace-warn 'name="${k}"' 'name="${k}" readonly' - '') + /* sh */ '' + substituteInPlace ${appDir}/app/Widgets/AdminMain/adminmain.tpl \ + --replace-warn 'name="${k}"' 'name="${k}" readonly' + '') [ ] cfg.podConfig)); @@ -101,7 +101,7 @@ let [ "css" "ini" "js" "json" "manifest" "mjs" "svg" "webmanifest" ]); in lib.concatStringsSep "\n" [ - (lib.optionalString brotli.enable '' + (lib.optionalString brotli.enable /* sh */ '' echo -n "Precompressing static files with Brotli …" find ${appDir}/public -type f ${findTextFileNames} -print0 \ | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_broti" '' @@ -110,7 +110,7 @@ let ''} echo " done." '') - (lib.optionalString gzip.enable '' + (lib.optionalString gzip.enable /* sh */ '' echo -n "Precompressing static files with Gzip …" find ${appDir}/public -type f ${findTextFileNames} -print0 \ | xargs -0 -n 1 -P $NIX_BUILD_CORES ${pkgs.writeShellScript "movim_precompress_gzip" '' @@ -637,7 +637,7 @@ in LoadCredential = "env-secrets:${cfg.secretFile}"; }; - script = '' + script = /* sh */ '' # Env vars rm -f ${cfg.dataDir}/.env cp --no-preserve=all ${configFile} ${cfg.dataDir}/.env From 0d59a5928e712e3a87c7c0cfef7fbb40f0e53975 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E0=B9=82=E0=B8=97=E0=B8=AA=E0=B8=95=E0=B8=B1=E0=B8=A5?= Date: Thu, 12 Dec 2024 12:14:47 +0700 Subject: [PATCH 5/7] optionally add group to nginx user --- nixos/modules/services/web-apps/movim.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/services/web-apps/movim.nix b/nixos/modules/services/web-apps/movim.nix index 5d15b8e12ecb..58827170ef79 100644 --- a/nixos/modules/services/web-apps/movim.nix +++ b/nixos/modules/services/web-apps/movim.nix @@ -440,6 +440,7 @@ in isSystemUser = true; group = cfg.group; }; + } // lib.optionalAttrs (cfg.nginx != null) { "${config.services.nginx.user}".extraGroups = [ cfg.group ]; }; groups = { From 180c953138c3371620197dee79cee3afd6c0ae1c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E0=B9=82=E0=B8=97=E0=B8=AA=E0=B8=95=E0=B8=B1=E0=B8=A5?= Date: Mon, 16 Dec 2024 17:36:53 +0700 Subject: [PATCH 6/7] nixos/movim: rm logs if found --- nixos/modules/services/web-apps/movim.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/services/web-apps/movim.nix b/nixos/modules/services/web-apps/movim.nix index 58827170ef79..78efbcf7b1b2 100644 --- a/nixos/modules/services/web-apps/movim.nix +++ b/nixos/modules/services/web-apps/movim.nix @@ -62,7 +62,7 @@ let stateDirectories = /* sh */ '' # Symlinking in our state directories - rm -rf $out/.env $out/cache ${appDir}/public/cache + rm -rf $out/{.env,cache} ${appDir}/{log,public/cache} ln -s ${cfg.dataDir}/.env ${appDir}/.env ln -s ${cfg.dataDir}/public/cache ${appDir}/public/cache ln -s ${cfg.logDir} ${appDir}/log From 8b4fd3e8d61280c3d690723ca3a8ee2dd4556e56 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E0=B9=82=E0=B8=97=E0=B8=AA=E0=B8=95=E0=B8=B1=E0=B8=A5?= Date: Mon, 16 Dec 2024 18:07:19 +0700 Subject: [PATCH 7/7] movim: make mainProgram name match --- pkgs/by-name/mo/movim/package.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/pkgs/by-name/mo/movim/package.nix b/pkgs/by-name/mo/movim/package.nix index 5aa5f4ed70ff..bc4b138ecc4e 100644 --- a/pkgs/by-name/mo/movim/package.nix +++ b/pkgs/by-name/mo/movim/package.nix @@ -155,8 +155,9 @@ php.buildComposerProject (finalAttrs: { postInstall = '' mkdir -p $out/bin echo "#!${lib.getExe dash}" > $out/bin/movim - echo "${lib.getExe finalAttrs.php} $out/share/php/${finalAttrs.pname}/daemon.php \"\$@\"" >> $out/bin/movim - chmod +x $out/bin/movim + echo "${lib.getExe finalAttrs.php} $out/share/php/${finalAttrs.pname}/daemon.php \"\$@\"" >> $out/bin/${finalAttrs.meta.mainProgram} + chmod +x $out/bin/${finalAttrs.meta.mainProgram} + mkdir -p $out/share/{bash-completion/completion,fish/vendor_completions.d,zsh/site-functions} $out/bin/movim completion bash | sed "s/daemon.php/movim/g" > $out/share/bash-completion/completion/movim.bash