Copy upstream pds PR changes

services/pds/default.nix

@@ -7,14 +7,14 @@
     pds = {
       enable = true;
       package = pkgs.callPackage ./pkg/pds { };
-      # Enable when pds merged
+      # https://github.com/NixOS/nixpkgs/pull/350645 Enable when pds merged
       # pdsadmin.enable = true;
 
       environmentFiles = [
         "/etc/secrets/bluesky.env"
       ];
       settings = {
-        PDS_PORT = "3001";
+        PDS_PORT = 3001;
         PDS_HOSTNAME = "bsky.ee";
 
         #PDS_EMAIL_SMTP_URL = "smtps://bluesky@bsky.ee:password@mx1.sly.ee:465";
@@ -32,7 +32,7 @@
         }
 
         handle /xrpc/* {
-          reverse_proxy :${config.services.pds.settings.PDS_PORT}
+          reverse_proxy :${toString config.services.pds.settings.PDS_PORT}
         }
 
         # https://github.com/mary-ext/atproto-scraping
@@ -41,7 +41,7 @@
         }
 
         handle /.well-known/* {
-          reverse_proxy :${config.services.pds.settings.PDS_PORT}
+          reverse_proxy :${toString config.services.pds.settings.PDS_PORT}
         }
 
         root * ${inputs.bsky-website}

services/pds/module.nix

@@ -24,11 +24,16 @@ in
 
     settings = mkOption {
       type = types.submodule {
-        freeformType = types.attrsOf (types.nullOr types.str);
+        freeformType = types.attrsOf (
+          types.oneOf [
+            (types.nullOr types.str)
+            types.port
+          ]
+        );
         options = {
           PDS_PORT = mkOption {
-            type = types.str;
-            default = "3000";
+            type = types.port;
+            default = 3000;
             description = "Port to listen on";
           };
 
@@ -41,7 +46,7 @@ in
           PDS_BLOB_UPLOAD_LIMIT = mkOption {
             type = types.str;
             default = "52428800";
-            description = "Size limit of uploaded blobs";
+            description = "Size limit of uploaded blobs in bytes";
           };
 
           PDS_DID_PLC_URL = mkOption {
@@ -103,7 +108,8 @@ in
       description = ''
         Environment variables to set for the service. Secrets should be
         specified using {option}`environmentFile`.
-        Refer to <https://github.com/bluesky-social/atproto/blob/92cd7a84ad207278c241afce8c8491e73b0a24e0/packages/pds/src/config/env.ts> for available environment variables.
+
+        Refer to <https://github.com/bluesky-social/atproto/blob/main/packages/pds/src/config/env.ts> for available environment variables.
       '';
     };
 
@@ -113,12 +119,16 @@ in
       description = ''
         File to load environment variables from. Loaded variables override
         values set in {option}`environment`.
+
         Use it to set values of `PDS_JWT_SECRET`, `PDS_ADMIN_PASSWORD`,
         and `PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX` secrets.
-        You can generate initial values with
+        `PDS_JWT_SECRET` and `PDS_ADMIN_PASSWORD` can be generated with
         ```
-        nix-build -A pds.passthru.generateSecrets
-        ./result/bin/generate-pds-secrets > secrets.env
+        openssl rand --hex 16
+        ```
+        `PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX` can be generated with
+        ```
+        openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32
         ```
       '';
     };
@@ -127,12 +137,14 @@ in
   config = mkIf cfg.enable {
     systemd.services.pds = {
       description = "pds";
+
+      after = [ "network-online.target" ];
       wants = [ "network-online.target" ];
       wantedBy = [ "multi-user.target" ];
 
       serviceConfig = {
         ExecStart = getExe cfg.package;
-        Environment = lib.mapAttrsToList (k: v: "${k}=${v}") (
+        Environment = lib.mapAttrsToList (k: v: "${k}=${if builtins.isInt v then toString v else v}") (
           lib.filterAttrs (_: v: v != null) cfg.settings
         );
 
@@ -154,7 +166,7 @@ in
         ProtectKernelModules = true;
         PrivateMounts = true;
         SystemCallArchitectures = [ "native" ];
-        MemoryDenyWriteExecute = false; # V8 JIT
+        MemoryDenyWriteExecute = false; # required by V8 JIT
         RestrictNamespaces = true;
         RestrictSUIDSGID = true;
         ProtectHostname = true;
@@ -180,7 +192,6 @@ in
     users = {
       users.pds = {
         group = "pds";
-        createHome = false;
         isSystemUser = true;
       };
       groups.pds = { };

services/pds/pkg/pds/default.nix

@@ -3,38 +3,18 @@
 , removeReferencesTo
 , srcOnly
 , python3
-, pnpm
+, pnpm_9
 , fetchFromGitHub
 , nodejs
 , vips
 , pkg-config
-, writeShellApplication
-, bash
-, xxd
-, openssl
 , lib
 ,
 }:
 
 let
-  generateSecrets = writeShellApplication {
-    name = "generate-pds-secrets";
-
-    runtimeInputs = [
-      xxd
-      openssl
-    ];
-
-    # Commands from https://github.com/bluesky-social/pds/blob/8b9fc24cec5f30066b0d0b86d2b0ba3d66c2b532/installer.sh
-    text = ''
-      echo "PDS_JWT_SECRET=$(openssl rand --hex 16)"
-      echo "PDS_ADMIN_PASSWORD=$(openssl rand --hex 16)"
-      echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32)"
-    '';
-  };
-
   nodeSources = srcOnly nodejs;
-  customPython3 = python3.withPackages (p: [ p.setuptools ]);
+  pythonEnv = python3.withPackages (p: [ p.setuptools ]);
 in
 
 stdenv.mkDerivation (finalAttrs: {
@@ -53,15 +33,16 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     makeBinaryWrapper
     nodejs
-    customPython3
+    pythonEnv
     pkg-config
-    pnpm.configHook
+    pnpm_9.configHook
+    removeReferencesTo
   ];
 
   # Required for `sharp` NPM dependency
   buildInputs = [ vips ];
 
-  pnpmDeps = pnpm.fetchDeps {
+  pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs)
       pname
       version
@@ -73,36 +54,33 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildPhase = ''
     runHook preBuild
-    for f in $(find -path '*/node_modules/better-sqlite3' -type d); do
-      (cd "$f" && (
-      npm run build-release --offline --nodedir="${nodeSources}"
-      find build -type f -exec           \
-        ${lib.getExe removeReferencesTo} \
-        -t "${nodeSources}" {}           \;
-      ))
-    done
+
+    pushd ./node_modules/.pnpm/better-sqlite3@*/node_modules/better-sqlite3
+    npm run build-release --offline --nodedir="${nodeSources}"
+    find build -type f -exec remove-references-to -t "${nodeSources}" {} \;
+    popd
+
     makeWrapper "${lib.getExe nodejs}" "$out/bin/pds" \
-      --add-flags --enable-source-maps                \
-      --add-flags "$out/lib/pds/index.js"             \
+      --add-flags --enable-source-maps \
+      --add-flags "$out/lib/pds/index.js" \
       --set-default NODE_ENV production
+
     runHook postBuild
   '';
 
   installPhase = ''
     runHook preInstall
+
     mkdir -p $out/{bin,lib/pds}
     mv node_modules $out/lib/pds
     mv index.js $out/lib/pds
+
     runHook postInstall
   '';
 
-  passthru = {
-    inherit generateSecrets;
-  };
-
   meta = {
     description = "Bluesky Personal Data Server (PDS)";
-    homepage = "https://bsky.social";
+    homepage = "https://github.com/bluesky-social/pds";
     license = with lib.licenses; [
       mit
       asl20