refactor(copyparty): separate deployment and service policy
Move Copyparty rendering into shared dotfiles utilities, keep guest wiring focused on host/container plumbing, and let the service module derive effective volume policy.
This commit was merged in pull request #182.
This commit is contained in:
@@ -2,147 +2,135 @@
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
util,
|
||||
...
|
||||
}:
|
||||
let
|
||||
cfg = config.modules.services.copyparty; # NOLINT(let_order)
|
||||
|
||||
volumeType = lib.types.submodule {
|
||||
options = {
|
||||
path = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
description = "Filesystem path served by this volume.";
|
||||
};
|
||||
accountName = config.user.name;
|
||||
|
||||
access = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.listOf lib.types.str);
|
||||
default = { };
|
||||
example = {
|
||||
A = [ "alexion" ];
|
||||
};
|
||||
description = "Copyparty access map from permission string to account names.";
|
||||
};
|
||||
serviceGroup = "storage";
|
||||
|
||||
readOnly = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Serve this volume read-only.";
|
||||
};
|
||||
serviceStateDir = "/var/lib/copyparty";
|
||||
|
||||
flags = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
example = [ "dthumb" ];
|
||||
description = "Copyparty volume flags.";
|
||||
};
|
||||
};
|
||||
serviceUser = "copyparty";
|
||||
|
||||
writableVolumes = lib.filter (volume: !volume.readOnly) (lib.attrValues cfg.volumes);
|
||||
|
||||
port = 3923;
|
||||
defaultAccess = {
|
||||
A = [ accountName ];
|
||||
};
|
||||
|
||||
configScript = pkgs.writeShellScript "copyparty-config" ''
|
||||
set -eu
|
||||
defaultWritableFlags = {
|
||||
d2d = true;
|
||||
d2t = true;
|
||||
dthumb = true;
|
||||
};
|
||||
|
||||
umask 077
|
||||
password="$(${pkgs.coreutils}/bin/tr -d '\n' < "$CREDENTIALS_DIRECTORY/password")"
|
||||
credentialHash = builtins.substring 0 16 (builtins.hashString "sha256" accountName);
|
||||
|
||||
cat > /run/copyparty/copyparty.conf <<EOF
|
||||
[global]
|
||||
p: ${toString cfg.port}
|
||||
usernames
|
||||
http-only
|
||||
no-crt
|
||||
no-thumb
|
||||
no-snap
|
||||
no-rescan
|
||||
ses-db: ${cfg.stateDir}/sessions.db
|
||||
chpw-db: ${cfg.stateDir}/chpw.json
|
||||
shr-db: ${cfg.stateDir}/shares.db
|
||||
${renderedReverseProxy}
|
||||
[accounts]
|
||||
${cfg.accountName}: $password
|
||||
credentialName = "password-${credentialHash}";
|
||||
|
||||
${renderedVolumes}
|
||||
EOF
|
||||
'';
|
||||
renderAccess = permission: accounts: " ${permission}: ${lib.concatStringsSep ", " accounts}";
|
||||
passwordPlaceholder = "@COPYPARTY_PASSWORD_${credentialHash}@";
|
||||
|
||||
hasFlag =
|
||||
name: flags: lib.any (flag: lib.hasPrefix "${name}:" flag || lib.hasPrefix "${name}=" flag) flags;
|
||||
globalSettings = {
|
||||
i = "0.0.0.0";
|
||||
usernames = true;
|
||||
"http-only" = true;
|
||||
"no-crt" = true;
|
||||
"no-thumb" = true;
|
||||
"no-snap" = true;
|
||||
"no-rescan" = true;
|
||||
"ses-db" = "${serviceStateDir}/sessions.db";
|
||||
"chpw-db" = "${serviceStateDir}/chpw.json";
|
||||
"shr-db" = "${serviceStateDir}/shares.db";
|
||||
}
|
||||
// lib.optionalAttrs cfg.reverseProxy.enable {
|
||||
rproxy = 1;
|
||||
"xff-hdr" = "x-forwarded-for";
|
||||
};
|
||||
|
||||
defaultPermissionFlags =
|
||||
globalExtraConfig = lib.optionalString cfg.reverseProxy.enable (
|
||||
lib.concatMapStringsSep "\n" (source: "xff-src: ${source}") cfg.reverseProxy.trustedSources
|
||||
);
|
||||
|
||||
volumeFlags =
|
||||
flags:
|
||||
lib.optionals (!(hasFlag "chmod_d" flags)) [ "chmod_d: 2770" ]
|
||||
++ lib.optionals (!(hasFlag "chmod_f" flags)) [ "chmod_f: 660" ];
|
||||
lib.optionalAttrs (flags != { }) (
|
||||
{
|
||||
chmod_d = "2770";
|
||||
chmod_f = "660";
|
||||
}
|
||||
// flags
|
||||
);
|
||||
|
||||
renderFlags =
|
||||
flags: lib.concatMapStringsSep "\n" (flag: " ${flag}") (flags ++ defaultPermissionFlags flags);
|
||||
renderedVolumes = lib.mapAttrs (_urlPath: volume: {
|
||||
inherit (volume) path;
|
||||
access = if volume.readOnly then { r = [ accountName ]; } else defaultAccess // volume.access;
|
||||
flags = volumeFlags (lib.optionalAttrs (!volume.readOnly) defaultWritableFlags // volume.flags);
|
||||
}) cfg.volumes;
|
||||
|
||||
renderVolume = urlPath: volume: ''
|
||||
[${urlPath}]
|
||||
${volume.path}
|
||||
accs:
|
||||
${lib.concatStringsSep "\n" (lib.mapAttrsToList renderAccess volume.access)}
|
||||
${lib.optionalString (volume.flags != [ ]) ''
|
||||
flags:
|
||||
${renderFlags volume.flags}
|
||||
''}
|
||||
configText = util.formats.copyparty.render {
|
||||
inherit globalExtraConfig;
|
||||
accounts.${accountName} = passwordPlaceholder;
|
||||
global = globalSettings;
|
||||
volumes = renderedVolumes;
|
||||
};
|
||||
|
||||
configFile = pkgs.writeText "copyparty.conf" configText;
|
||||
|
||||
replacePassword = ''
|
||||
${lib.getExe pkgs.replace-secret} ${lib.escapeShellArg passwordPlaceholder} "$CREDENTIALS_DIRECTORY/${credentialName}" /run/copyparty/copyparty.conf
|
||||
'';
|
||||
|
||||
renderTrustedSource = source: " xff-src: ${source}";
|
||||
|
||||
renderedReverseProxy = lib.optionalString cfg.reverseProxy.enable ''
|
||||
rproxy: 1
|
||||
xff-hdr: x-forwarded-for
|
||||
${lib.concatStringsSep "\n" (map renderTrustedSource cfg.reverseProxy.trustedSources)}
|
||||
'';
|
||||
|
||||
renderedVolumes = lib.concatStringsSep "\n" (lib.mapAttrsToList renderVolume cfg.volumes);
|
||||
|
||||
in
|
||||
{
|
||||
options.modules.services.copyparty = {
|
||||
enable = lib.mkEnableOption "Copyparty";
|
||||
|
||||
package = lib.mkPackageOption pkgs "copyparty-min" { };
|
||||
|
||||
port = lib.mkOption {
|
||||
type = lib.types.port;
|
||||
default = 3923;
|
||||
description = "Port Copyparty listens on.";
|
||||
};
|
||||
|
||||
user = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "copyparty";
|
||||
description = "User account that runs Copyparty.";
|
||||
};
|
||||
|
||||
group = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "storage";
|
||||
description = "Group account that owns Copyparty's writable state and served files.";
|
||||
};
|
||||
|
||||
accountName = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "alexion";
|
||||
description = "Copyparty account name configured for password authentication.";
|
||||
};
|
||||
|
||||
passwordFile = lib.mkOption {
|
||||
type = lib.types.path;
|
||||
description = "Runtime file containing the Copyparty account password.";
|
||||
};
|
||||
|
||||
stateDir = lib.mkOption {
|
||||
type = lib.types.str;
|
||||
default = "/var/lib/copyparty";
|
||||
description = "Directory where Copyparty stores service state.";
|
||||
description = "Sets the runtime file that contains the Copyparty account password.";
|
||||
};
|
||||
|
||||
volumes = lib.mkOption {
|
||||
type = lib.types.attrsOf volumeType;
|
||||
type = lib.types.attrsOf (
|
||||
lib.types.submodule {
|
||||
options = {
|
||||
path = lib.mkOption {
|
||||
type = lib.types.externalPath;
|
||||
description = "Sets the filesystem path served by this volume.";
|
||||
};
|
||||
|
||||
access = lib.mkOption {
|
||||
type = lib.types.attrsOf (lib.types.listOf lib.types.str);
|
||||
default = { };
|
||||
example = {
|
||||
A = [ "alexion" ];
|
||||
};
|
||||
description = "Maps Copyparty permission strings to account names.";
|
||||
};
|
||||
|
||||
readOnly = lib.mkOption {
|
||||
type = lib.types.bool;
|
||||
default = false;
|
||||
description = "Serves this volume read-only.";
|
||||
};
|
||||
|
||||
flags = lib.mkOption {
|
||||
type = lib.types.attrs;
|
||||
default = { };
|
||||
example = {
|
||||
dthumb = true;
|
||||
};
|
||||
description = "Sets Copyparty volume flags.";
|
||||
};
|
||||
};
|
||||
}
|
||||
);
|
||||
default = { };
|
||||
description = "Copyparty volumes keyed by their URL path.";
|
||||
description = "Defines Copyparty volumes by URL path.";
|
||||
};
|
||||
|
||||
reverseProxy = {
|
||||
@@ -151,7 +139,7 @@ in
|
||||
trustedSources = lib.mkOption {
|
||||
type = lib.types.listOf lib.types.str;
|
||||
default = [ ];
|
||||
description = "IP ranges that may supply Copyparty's forwarded client IP header.";
|
||||
description = "Lists proxy sources that can set Copyparty's forwarded client IP header.";
|
||||
};
|
||||
};
|
||||
};
|
||||
@@ -173,46 +161,49 @@ in
|
||||
}
|
||||
];
|
||||
|
||||
users.users.${cfg.user} = {
|
||||
users.users.${serviceUser} = {
|
||||
isSystemUser = true;
|
||||
uid = config.registry."stable-uid".${config.networking.hostName}.copyparty;
|
||||
inherit (cfg) group;
|
||||
home = cfg.stateDir;
|
||||
group = serviceGroup;
|
||||
home = serviceStateDir;
|
||||
};
|
||||
|
||||
systemd.services.copyparty = {
|
||||
description = "Copyparty file server";
|
||||
after = [ "network.target" ];
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
preStart = ''
|
||||
${lib.getExe' pkgs.coreutils "install"} -m 600 ${configFile} /run/copyparty/copyparty.conf
|
||||
${replacePassword}
|
||||
'';
|
||||
serviceConfig = {
|
||||
ReloadSignal = "SIGUSR1";
|
||||
Type = "simple";
|
||||
User = cfg.user;
|
||||
Group = cfg.group;
|
||||
WorkingDirectory = cfg.stateDir;
|
||||
User = serviceUser;
|
||||
Group = serviceGroup;
|
||||
WorkingDirectory = serviceStateDir;
|
||||
Environment = [
|
||||
"HOME=${cfg.stateDir}"
|
||||
"XDG_CONFIG_HOME=${cfg.stateDir}"
|
||||
"HOME=${serviceStateDir}"
|
||||
"XDG_CONFIG_HOME=${serviceStateDir}"
|
||||
];
|
||||
StateDirectory = "copyparty";
|
||||
RuntimeDirectory = "copyparty";
|
||||
RuntimeDirectoryMode = "0700";
|
||||
LoadCredential = [ "password:${cfg.passwordFile}" ];
|
||||
ExecStartPre = configScript;
|
||||
ExecStart = "${lib.getExe cfg.package} -c /run/copyparty/copyparty.conf";
|
||||
LoadCredential = [ "${credentialName}:${cfg.passwordFile}" ];
|
||||
ExecStart = "${lib.getExe pkgs.copyparty-min} -c /run/copyparty/copyparty.conf";
|
||||
Restart = "on-failure";
|
||||
NoNewPrivileges = true;
|
||||
PrivateTmp = true;
|
||||
ProtectSystem = "strict";
|
||||
ProtectHome = true;
|
||||
ReadWritePaths = [
|
||||
cfg.stateDir
|
||||
serviceStateDir
|
||||
]
|
||||
++ map (volume: volume.path) (lib.filter (volume: !volume.readOnly) (lib.attrValues cfg.volumes));
|
||||
++ map (volume: volume.path) writableVolumes;
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ cfg.port ];
|
||||
networking.firewall.allowedTCPPorts = [ port ];
|
||||
})
|
||||
];
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user