From a47513760ea75028c710cde6030c0e22f9b9f0a2 Mon Sep 17 00:00:00 2001 From: NullCube Date: Mon, 14 Apr 2025 22:31:51 -0700 Subject: [PATCH 1/4] nixos/anubis: add nullcube as maintainer --- nixos/modules/services/networking/anubis.nix | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/nixos/modules/services/networking/anubis.nix b/nixos/modules/services/networking/anubis.nix index e2d9fdc0f290..8bc93f73aa13 100644 --- a/nixos/modules/services/networking/anubis.nix +++ b/nixos/modules/services/networking/anubis.nix @@ -309,6 +309,9 @@ in ) enabledInstances; }; - meta.maintainers = with lib.maintainers; [ soopyc ]; + meta.maintainers = with lib.maintainers; [ + soopyc + nullcube + ]; meta.doc = ./anubis.md; } From f826658cb4fb93908b7abd770efee68b07fa0723 Mon Sep 17 00:00:00 2001 From: NullCube Date: Mon, 14 Apr 2025 22:29:15 -0700 Subject: [PATCH 2/4] nixos/anubis: fix user-defined defaultOptions not applying to instances --- nixos/modules/services/networking/anubis.nix | 3 +++ 1 file changed, 3 insertions(+) diff --git a/nixos/modules/services/networking/anubis.nix b/nixos/modules/services/networking/anubis.nix index 8bc93f73aa13..745dc9719906 100644 --- a/nixos/modules/services/networking/anubis.nix +++ b/nixos/modules/services/networking/anubis.nix @@ -224,6 +224,9 @@ in and socket paths. ''; type = types.attrsOf (types.submodule (commonSubmodule false)); + + # Merge defaultOptions into each instance + apply = lib.mapAttrs (_: lib.recursiveUpdate cfg.defaultOptions); }; }; From b2714cd7578d456be1bb3ecdaa4074288c95865b Mon Sep 17 00:00:00 2001 From: NullCube Date: Mon, 14 Apr 2025 22:31:07 -0700 Subject: [PATCH 3/4] nixos/anubis: adjust provided options --- nixos/modules/services/networking/anubis.nix | 26 +++++++++++++++----- 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/nixos/modules/services/networking/anubis.nix b/nixos/modules/services/networking/anubis.nix index 745dc9719906..2d63fa4ecc59 100644 --- a/nixos/modules/services/networking/anubis.nix +++ b/nixos/modules/services/networking/anubis.nix @@ -122,12 +122,6 @@ let example = "tcp"; type = types.str; }; - SOCKET_MODE = mkDefaultOption "settings.SOCKET_MODE" { - default = "0770"; - description = "The permissions on the Unix domain sockets created."; - example = "0700"; - type = types.str; - }; DIFFICULTY = mkDefaultOption "settings.DIFFICULTY" { default = 4; description = '' @@ -146,6 +140,26 @@ let ''; type = types.bool; }; + OG_PASSTHROUGH = mkDefaultOption "settings.OG_PASSTHROUGH" { + default = false; + description = '' + Whether to enable Open Graph tag passthrough. + + This enables social previews of resources protected by + Anubis without having to exempt each scraper individually. + ''; + type = types.bool; + }; + WEBMASTER_EMAIL = mkDefaultOption "settings.WEBMASTER_EMAIL" { + default = null; + description = '' + If set, shows a contact email address when rendering error pages. + + This email address will be how users can get in contact with administrators. + ''; + example = "alice@example.com"; + type = types.nullOr types.str; + }; # generated by default POLICY_FNAME = mkDefaultOption "settings.POLICY_FNAME" { From 5a0db60d73721ce24d6cf4ae7c55e7cacc8c8443 Mon Sep 17 00:00:00 2001 From: NullCube Date: Mon, 14 Apr 2025 23:05:52 -0700 Subject: [PATCH 4/4] nixos/tests/anubis: add testing for user-defined settings --- nixos/tests/anubis.nix | 59 ++++++++++++++++++++++++++++++------------ 1 file changed, 42 insertions(+), 17 deletions(-) diff --git a/nixos/tests/anubis.nix b/nixos/tests/anubis.nix index f00a2a827326..e5f643ed1cca 100644 --- a/nixos/tests/anubis.nix +++ b/nixos/tests/anubis.nix @@ -1,7 +1,10 @@ { lib, ... }: { name = "anubis"; - meta.maintainers = [ lib.maintainers.soopyc ]; + meta.maintainers = with lib.maintainers; [ + soopyc + nullcube + ]; nodes.machine = { @@ -10,24 +13,34 @@ ... }: { - services.anubis.instances = { - "".settings.TARGET = "http://localhost:8080"; - - "tcp" = { - user = "anubis-tcp"; - group = "anubis-tcp"; - settings = { - TARGET = "http://localhost:8080"; - BIND = ":9000"; - BIND_NETWORK = "tcp"; - METRICS_BIND = ":9001"; - METRICS_BIND_NETWORK = "tcp"; - }; + services.anubis = { + defaultOptions.settings = { + DIFFICULTY = 3; + USER_DEFINED_DEFAULT = true; }; + instances = { + "".settings = { + TARGET = "http://localhost:8080"; + DIFFICULTY = 5; + USER_DEFINED_INSTANCE = true; + }; - "unix-upstream" = { - group = "nginx"; - settings.TARGET = "unix:///run/nginx/nginx.sock"; + "tcp" = { + user = "anubis-tcp"; + group = "anubis-tcp"; + settings = { + TARGET = "http://localhost:8080"; + BIND = ":9000"; + BIND_NETWORK = "tcp"; + METRICS_BIND = ":9001"; + METRICS_BIND_NETWORK = "tcp"; + }; + }; + + "unix-upstream" = { + group = "nginx"; + settings.TARGET = "unix:///run/nginx/nginx.sock"; + }; }; }; @@ -94,5 +107,17 @@ # Upstream is a unix socket mode machine.succeed('curl -f http://unix.localhost/index.html | grep "it works"') + + # Default user-defined environment variables + machine.succeed('cat /run/current-system/etc/systemd/system/anubis.service | grep "USER_DEFINED_DEFAULT"') + machine.succeed('cat /run/current-system/etc/systemd/system/anubis-tcp.service | grep "USER_DEFINED_DEFAULT"') + + # Instance-specific user-specified environment variables + machine.succeed('cat /run/current-system/etc/systemd/system/anubis.service | grep "USER_DEFINED_INSTANCE"') + machine.fail('cat /run/current-system/etc/systemd/system/anubis-tcp.service | grep "USER_DEFINED_INSTANCE"') + + # Make sure defaults don't overwrite themselves + machine.succeed('cat /run/current-system/etc/systemd/system/anubis.service | grep "DIFFICULTY=5"') + machine.succeed('cat /run/current-system/etc/systemd/system/anubis-tcp.service | grep "DIFFICULTY=3"') ''; }