diff --git a/services/pds/default.nix b/services/pds/default.nix index d8f7514..8419fde 100644 --- a/services/pds/default.nix +++ b/services/pds/default.nix @@ -7,14 +7,14 @@ pds = { enable = true; package = pkgs.callPackage ./pkg/pds { }; - # Enable when pds merged + # https://github.com/NixOS/nixpkgs/pull/350645 Enable when pds merged # pdsadmin.enable = true; environmentFiles = [ "/etc/secrets/bluesky.env" ]; settings = { - PDS_PORT = "3001"; + PDS_PORT = 3001; PDS_HOSTNAME = "bsky.ee"; #PDS_EMAIL_SMTP_URL = "smtps://bluesky@bsky.ee:password@mx1.sly.ee:465"; @@ -32,7 +32,7 @@ } handle /xrpc/* { - reverse_proxy :${config.services.pds.settings.PDS_PORT} + reverse_proxy :${toString config.services.pds.settings.PDS_PORT} } # https://github.com/mary-ext/atproto-scraping @@ -41,7 +41,7 @@ } handle /.well-known/* { - reverse_proxy :${config.services.pds.settings.PDS_PORT} + reverse_proxy :${toString config.services.pds.settings.PDS_PORT} } root * ${inputs.bsky-website} diff --git a/services/pds/module.nix b/services/pds/module.nix index 419e838..f01eccd 100644 --- a/services/pds/module.nix +++ b/services/pds/module.nix @@ -24,11 +24,16 @@ in settings = mkOption { type = types.submodule { - freeformType = types.attrsOf (types.nullOr types.str); + freeformType = types.attrsOf ( + types.oneOf [ + (types.nullOr types.str) + types.port + ] + ); options = { PDS_PORT = mkOption { - type = types.str; - default = "3000"; + type = types.port; + default = 3000; description = "Port to listen on"; }; @@ -41,7 +46,7 @@ in PDS_BLOB_UPLOAD_LIMIT = mkOption { type = types.str; default = "52428800"; - description = "Size limit of uploaded blobs"; + description = "Size limit of uploaded blobs in bytes"; }; PDS_DID_PLC_URL = mkOption { @@ -103,7 +108,8 @@ in description = '' Environment variables to set for the service. Secrets should be specified using {option}`environmentFile`. - Refer to for available environment variables. + + Refer to for available environment variables. ''; }; @@ -113,12 +119,16 @@ in description = '' File to load environment variables from. Loaded variables override values set in {option}`environment`. + Use it to set values of `PDS_JWT_SECRET`, `PDS_ADMIN_PASSWORD`, and `PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX` secrets. - You can generate initial values with + `PDS_JWT_SECRET` and `PDS_ADMIN_PASSWORD` can be generated with ``` - nix-build -A pds.passthru.generateSecrets - ./result/bin/generate-pds-secrets > secrets.env + openssl rand --hex 16 + ``` + `PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX` can be generated with + ``` + openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32 ``` ''; }; @@ -127,12 +137,14 @@ in config = mkIf cfg.enable { systemd.services.pds = { description = "pds"; + + after = [ "network-online.target" ]; wants = [ "network-online.target" ]; wantedBy = [ "multi-user.target" ]; serviceConfig = { ExecStart = getExe cfg.package; - Environment = lib.mapAttrsToList (k: v: "${k}=${v}") ( + Environment = lib.mapAttrsToList (k: v: "${k}=${if builtins.isInt v then toString v else v}") ( lib.filterAttrs (_: v: v != null) cfg.settings ); @@ -154,7 +166,7 @@ in ProtectKernelModules = true; PrivateMounts = true; SystemCallArchitectures = [ "native" ]; - MemoryDenyWriteExecute = false; # V8 JIT + MemoryDenyWriteExecute = false; # required by V8 JIT RestrictNamespaces = true; RestrictSUIDSGID = true; ProtectHostname = true; @@ -180,7 +192,6 @@ in users = { users.pds = { group = "pds"; - createHome = false; isSystemUser = true; }; groups.pds = { }; diff --git a/services/pds/pkg/pds/default.nix b/services/pds/pkg/pds/default.nix index 9f61199..07fb106 100644 --- a/services/pds/pkg/pds/default.nix +++ b/services/pds/pkg/pds/default.nix @@ -3,38 +3,18 @@ , removeReferencesTo , srcOnly , python3 -, pnpm +, pnpm_9 , fetchFromGitHub , nodejs , vips , pkg-config -, writeShellApplication -, bash -, xxd -, openssl , lib , }: let - generateSecrets = writeShellApplication { - name = "generate-pds-secrets"; - - runtimeInputs = [ - xxd - openssl - ]; - - # Commands from https://github.com/bluesky-social/pds/blob/8b9fc24cec5f30066b0d0b86d2b0ba3d66c2b532/installer.sh - text = '' - echo "PDS_JWT_SECRET=$(openssl rand --hex 16)" - echo "PDS_ADMIN_PASSWORD=$(openssl rand --hex 16)" - echo "PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX=$(openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32)" - ''; - }; - nodeSources = srcOnly nodejs; - customPython3 = python3.withPackages (p: [ p.setuptools ]); + pythonEnv = python3.withPackages (p: [ p.setuptools ]); in stdenv.mkDerivation (finalAttrs: { @@ -53,15 +33,16 @@ stdenv.mkDerivation (finalAttrs: { nativeBuildInputs = [ makeBinaryWrapper nodejs - customPython3 + pythonEnv pkg-config - pnpm.configHook + pnpm_9.configHook + removeReferencesTo ]; # Required for `sharp` NPM dependency buildInputs = [ vips ]; - pnpmDeps = pnpm.fetchDeps { + pnpmDeps = pnpm_9.fetchDeps { inherit (finalAttrs) pname version @@ -73,36 +54,33 @@ stdenv.mkDerivation (finalAttrs: { buildPhase = '' runHook preBuild - for f in $(find -path '*/node_modules/better-sqlite3' -type d); do - (cd "$f" && ( - npm run build-release --offline --nodedir="${nodeSources}" - find build -type f -exec \ - ${lib.getExe removeReferencesTo} \ - -t "${nodeSources}" {} \; - )) - done + + pushd ./node_modules/.pnpm/better-sqlite3@*/node_modules/better-sqlite3 + npm run build-release --offline --nodedir="${nodeSources}" + find build -type f -exec remove-references-to -t "${nodeSources}" {} \; + popd + makeWrapper "${lib.getExe nodejs}" "$out/bin/pds" \ - --add-flags --enable-source-maps \ - --add-flags "$out/lib/pds/index.js" \ + --add-flags --enable-source-maps \ + --add-flags "$out/lib/pds/index.js" \ --set-default NODE_ENV production + runHook postBuild ''; installPhase = '' runHook preInstall + mkdir -p $out/{bin,lib/pds} mv node_modules $out/lib/pds mv index.js $out/lib/pds + runHook postInstall ''; - passthru = { - inherit generateSecrets; - }; - meta = { description = "Bluesky Personal Data Server (PDS)"; - homepage = "https://bsky.social"; + homepage = "https://github.com/bluesky-social/pds"; license = with lib.licenses; [ mit asl20