From 74bec372931c5ad12e9bac9a0a77841d2452c92d Mon Sep 17 00:00:00 2001 From: freezeboy Date: Thu, 12 Nov 2020 23:55:18 +0100 Subject: [PATCH 1/3] plik,plikd: init at 1.3.1 The client and the servers are separated so that a simple user just gets the necessary binary. Currently the server frontend has a very old build, I could not build this asset myself, so for the moment I simply extracted it from the binary release of the project. Once this build procedure will have been updated I will transition to a full build --- pkgs/servers/plik/default.nix | 25 ++++++++++++++++++++ pkgs/servers/plik/programs.nix | 42 +++++++++++++++++++++++++++++++++ pkgs/top-level/all-packages.nix | 3 +++ 3 files changed, 70 insertions(+) create mode 100644 pkgs/servers/plik/default.nix create mode 100644 pkgs/servers/plik/programs.nix diff --git a/pkgs/servers/plik/default.nix b/pkgs/servers/plik/default.nix new file mode 100644 index 000000000000..b66ca14e415d --- /dev/null +++ b/pkgs/servers/plik/default.nix @@ -0,0 +1,25 @@ +{ lib, fetchurl, makeWrapper, runCommand, callPackage }: + +let + version = "1.3.1"; + + programs = callPackage ./programs.nix {}; + + webapp = fetchurl { + url = "https://github.com/root-gg/plik/releases/download/${version}/plik-${version}-linux-amd64.tar.gz"; + sha256 = "KN6cp29KKdGamYnfL3jYltx0EDx6syDPfV0jShOk7Zw="; + }; + +in { + + inherit (programs) plik plikd-unwrapped; + + plikd = runCommand "plikd-${version}" { nativeBuildInputs = [ makeWrapper ]; } '' + mkdir -p $out/libexec/plikd/{bin,webapp} $out/bin + tar xf ${webapp} plik-${version}-linux-amd64/webapp/dist/ + mv plik-*/webapp/dist $out/libexec/plikd/webapp + cp ${programs.plikd-unwrapped}/bin/plikd $out/libexec/plikd/bin/plikd + makeWrapper $out/libexec/plikd/bin/plikd $out/bin/plikd \ + --run "cd $out/libexec/plikd/bin" + ''; +} diff --git a/pkgs/servers/plik/programs.nix b/pkgs/servers/plik/programs.nix new file mode 100644 index 000000000000..ff83ec5ff689 --- /dev/null +++ b/pkgs/servers/plik/programs.nix @@ -0,0 +1,42 @@ +{ lib, buildGoModule, fetchFromGitHub, fetchurl, makeWrapper, runCommand }: + +let + version = "1.3.1"; + + src = fetchFromGitHub { + owner = "root-gg"; + repo = "plik"; + rev = version; + sha256 = "C/1Uwjsqd9n3WSXlnlq9K3EJHkLOSavS9cPqF2UqmGo="; + }; + + vendorSha256 = "klmWXC3tkoOcQHhiQZjR2C5jqaRJqMQOLtVxZ0cFq/Y="; + + meta = with lib; { + homepage = "https://plik.root.gg/"; + description = "Scalable & friendly temporary file upload system"; + maintainers = with maintainers; [ freezeboy ]; + license = licenses.mit; + }; +in { + + plik = buildGoModule { + pname = "plik"; + inherit version meta src vendorSha256; + + subPackages = [ "client" ]; + postInstall = '' + mv $out/bin/client $out/bin/plik + ''; + }; + + plikd-unwrapped = buildGoModule { + pname = "plikd-unwrapped"; + inherit version src vendorSha256; + + subPackages = [ "server" ]; + postFixup = '' + mv $out/bin/server $out/bin/plikd + ''; + }; +} diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix index 6d6fe1396d9a..1de7b3608125 100644 --- a/pkgs/top-level/all-packages.nix +++ b/pkgs/top-level/all-packages.nix @@ -7176,6 +7176,9 @@ in plujain-ramp = callPackage ../applications/audio/plujain-ramp { }; + inherit (callPackage ../servers/plik { }) + plik plikd; + plex = callPackage ../servers/plex { }; plexRaw = callPackage ../servers/plex/raw.nix { }; From fc2ae7d79e31aade4bbbabc66ba57a456851b4df Mon Sep 17 00:00:00 2001 From: freezeboy Date: Fri, 13 Nov 2020 10:07:16 +0100 Subject: [PATCH 2/3] nixos/plikd: Add new service module --- nixos/modules/module-list.nix | 1 + nixos/modules/services/misc/plikd.nix | 82 +++++++++++++++++++++++++++ 2 files changed, 83 insertions(+) create mode 100644 nixos/modules/services/misc/plikd.nix diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix index f831e302b161..37e918cd0a1d 100644 --- a/nixos/modules/module-list.nix +++ b/nixos/modules/module-list.nix @@ -509,6 +509,7 @@ ./services/misc/paperless.nix ./services/misc/parsoid.nix ./services/misc/plex.nix + ./services/misc/plikd.nix ./services/misc/tautulli.nix ./services/misc/pinnwand.nix ./services/misc/pykms.nix diff --git a/nixos/modules/services/misc/plikd.nix b/nixos/modules/services/misc/plikd.nix new file mode 100644 index 000000000000..a62dbef1d2af --- /dev/null +++ b/nixos/modules/services/misc/plikd.nix @@ -0,0 +1,82 @@ +{ config, pkgs, lib, ... }: + +with lib; + +let + cfg = config.services.plikd; + + format = pkgs.formats.toml {}; + plikdCfg = format.generate "plikd.cfg" cfg.settings; +in +{ + options = { + services.plikd = { + enable = mkEnableOption "the plikd server"; + + openFirewall = mkOption { + type = types.bool; + default = false; + description = "Open ports in the firewall for the plikd."; + }; + + settings = mkOption { + type = format.type; + default = {}; + description = '' + Configuration for plikd, see + for supported values. + ''; + }; + }; + }; + + config = mkIf cfg.enable { + services.plikd.settings = mapAttrs (name: mkDefault) { + ListenPort = 8080; + ListenAddress = "localhost"; + DataBackend = "file"; + DataBackendConfig = { + Directory = "/var/lib/plikd"; + }; + MetadataBackendConfig = { + Driver = "sqlite3"; + ConnectionString = "/var/lib/plikd/plik.db"; + }; + }; + + systemd.services.plikd = { + description = "Plikd file sharing server"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + serviceConfig = { + Type = "simple"; + ExecStart = "${pkgs.plikd}/bin/plikd --config ${plikdCfg}"; + Restart = "on-failure"; + StateDirectory = "plikd"; + LogsDirectory = "plikd"; + DynamicUser = true; + + # Basic hardening + NoNewPrivileges = "yes"; + PrivateTmp = "yes"; + PrivateDevices = "yes"; + DevicePolicy = "closed"; + ProtectSystem = "strict"; + ProtectHome = "read-only"; + ProtectControlGroups = "yes"; + ProtectKernelModules = "yes"; + ProtectKernelTunables = "yes"; + RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6 AF_NETLINK"; + RestrictNamespaces = "yes"; + RestrictRealtime = "yes"; + RestrictSUIDSGID = "yes"; + MemoryDenyWriteExecute = "yes"; + LockPersonality = "yes"; + }; + }; + + networking.firewall = mkIf cfg.openFirewall { + allowedTCPPorts = [ cfg.settings.ListenPort ]; + }; + }; +} From 10fa80fd300ce9cd081b578621861332ddf3e411 Mon Sep 17 00:00:00 2001 From: freezeboy Date: Fri, 13 Nov 2020 15:00:34 +0100 Subject: [PATCH 3/3] nixos/tests: new test for plikd --- nixos/tests/all-tests.nix | 1 + nixos/tests/plikd.nix | 27 +++++++++++++++++++++++++++ 2 files changed, 28 insertions(+) create mode 100644 nixos/tests/plikd.nix diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix index 541e0bc0a5cf..ab8d79981fb7 100644 --- a/nixos/tests/all-tests.nix +++ b/nixos/tests/all-tests.nix @@ -306,6 +306,7 @@ in pinnwand = handleTest ./pinnwand.nix {}; plasma5 = handleTest ./plasma5.nix {}; pleroma = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./pleroma.nix {}; + plikd = handleTest ./plikd.nix {}; plotinus = handleTest ./plotinus.nix {}; podman = handleTestOn ["x86_64-linux"] ./podman.nix {}; postfix = handleTest ./postfix.nix {}; diff --git a/nixos/tests/plikd.nix b/nixos/tests/plikd.nix new file mode 100644 index 000000000000..8fec93c01f6b --- /dev/null +++ b/nixos/tests/plikd.nix @@ -0,0 +1,27 @@ +import ./make-test-python.nix ({ lib, ... }: { + name = "plikd"; + meta = with lib.maintainers; { + maintainers = [ freezeboy ]; + }; + + machine = { pkgs, ... }: let + in { + services.plikd.enable = true; + environment.systemPackages = [ pkgs.plik ]; + }; + + testScript = '' + # Service basic test + machine.wait_for_unit("plikd") + + # Network test + machine.wait_for_open_port("8080") + machine.succeed("curl --fail -v http://localhost:8080") + + # Application test + machine.execute("echo test > /tmp/data.txt") + machine.succeed("plik --server http://localhost:8080 /tmp/data.txt | grep curl") + + machine.succeed("diff data.txt /tmp/data.txt") + ''; +})