* Move the Subversion/Repoman module out of the NixOS tree.
svn path=/nixos/trunk/; revision=27000
This commit is contained in:
Eelco Dolstra
parent
e3a2cd58e0
commit
56f1918e1c
@ -1,458 +0,0 @@
|
||||
{ config, pkgs, serverInfo, servicesPath, ... }:
|
||||
|
||||
let
|
||||
|
||||
inherit (pkgs.lib) mkOption;
|
||||
|
||||
urlPrefix = config.urlPrefix;
|
||||
dbDir = "${config.dataDir}/db";
|
||||
reposDir = "${config.dataDir}/repos";
|
||||
backupsDir = "${config.dataDir}/backup";
|
||||
distsDir = "${config.dataDir}/dist";
|
||||
tmpDir = "${config.dataDir}/tmp";
|
||||
logDir = "${config.dataDir}/log";
|
||||
idString = if config.id == "" then "" else "${config.id}-";
|
||||
postCommitHook = "/var/run/current-system/sw/bin/svn-server-${idString}post-commit-hook";
|
||||
fsType = "fsfs";
|
||||
adminAddr = serverInfo.adminAddr;
|
||||
|
||||
|
||||
|
||||
# Build a Subversion instance with Apache modules and Swig/Python bindings.
|
||||
subversion = pkgs.subversion.override (origArgs: {
|
||||
bdbSupport = true;
|
||||
httpServer = true;
|
||||
sslSupport = true;
|
||||
compressionSupport = true;
|
||||
pythonBindings = true;
|
||||
});
|
||||
|
||||
|
||||
# Build the maintenance scripts and commit hooks.
|
||||
scripts = substituteInAll {
|
||||
name = "svn-server-scripts";
|
||||
src = /* pkgs.lib.cleanSource */ "${servicesPath}/subversion/src/scripts";
|
||||
|
||||
# The variables to substitute:
|
||||
|
||||
inherit reposDir dbDir logDir distsDir backupsDir tmpDir
|
||||
urlPrefix adminAddr fsType subversion postCommitHook mailer;
|
||||
inherit (config) notificationSender userCreationDomain;
|
||||
orgUrl = config.organisation.url;
|
||||
orgLogoUrl = config.organisation.logo;
|
||||
orgName = config.organisation.name;
|
||||
|
||||
perl = "${pkgs.perl}/bin/perl";
|
||||
|
||||
sendmail = "${pkgs.ssmtp}/sbin/sendmail";
|
||||
|
||||
inherit (pkgs) libxslt enscript db4 coreutils diffutils gzip bzip2 python;
|
||||
|
||||
inherit (serverInfo) canonicalName;
|
||||
|
||||
inherit (serverInfo.serverConfig) user group;
|
||||
|
||||
# Urgh, most of these are dependencies of Email::Send, should figure them out automatically.
|
||||
perlFlags = map (x: "-I${x}/lib/perl5/site_perl") [
|
||||
pkgs.perlPackages.BerkeleyDB pkgs.perlPackages.EmailSend
|
||||
pkgs.perlPackages.EmailSimple pkgs.perlPackages.ModulePluggable
|
||||
pkgs.perlPackages.ReturnValue pkgs.perlPackages.EmailAddress
|
||||
pkgs.perlPackages.CryptPasswordMD5
|
||||
pkgs.perlPackages.StringMkPasswd
|
||||
];
|
||||
|
||||
pythonPath = "${subversion}/lib/${pkgs.python.libPrefix}/site-packages";
|
||||
|
||||
# Do a syntax check on the generated file.
|
||||
postInstall = ''
|
||||
$perl -c -T $out/cgi-bin/repoman.pl
|
||||
$perl -c $out/bin/svn-server-create-user.pl
|
||||
if test -n "${config.id}"; then
|
||||
for i in $(cd $out/bin && echo *); do
|
||||
mv "$out/bin/$i" "$out/bin/$(echo $i | sed s^svn-server-^svn-server-${config.id}-^)"
|
||||
done
|
||||
fi
|
||||
'';
|
||||
};
|
||||
|
||||
|
||||
# Extract the mailer script from the Subversion source distribution.
|
||||
mailer = pkgs.runCommand "svn-mailer.py" { inherit (subversion) src; }
|
||||
''
|
||||
unpackFile $src
|
||||
cp subversion-*/tools/hook-scripts/mailer/mailer.py $out
|
||||
'';
|
||||
|
||||
|
||||
# Build our custom authentication modules.
|
||||
authModules = import "${servicesPath}/subversion/src/auth" {
|
||||
inherit (pkgs) stdenv apacheHttpd;
|
||||
};
|
||||
|
||||
|
||||
commonAuth = ''
|
||||
AuthType Basic
|
||||
AuthName "Subversion repositories"
|
||||
AuthBasicProvider dbm
|
||||
AuthDBMType DB
|
||||
AuthDBMUserFile ${dbDir}/svn-users
|
||||
'';
|
||||
|
||||
|
||||
# Access controls for /repos and /repos-xml.
|
||||
reposConfig = dirName: ''
|
||||
${commonAuth}
|
||||
|
||||
AuthAllowNone on
|
||||
|
||||
AuthzRepoPrefix ${urlPrefix}/${dirName}/
|
||||
AuthzRepoDBType DB
|
||||
AuthzRepoReaders ${dbDir}/svn-readers
|
||||
AuthzRepoWriters ${dbDir}/svn-writers
|
||||
|
||||
<LimitExcept GET PROPFIND OPTIONS REPORT>
|
||||
Require repo-writer
|
||||
</LimitExcept>
|
||||
|
||||
<Limit GET PROPFIND OPTIONS REPORT>
|
||||
Require repo-reader
|
||||
</Limit>
|
||||
|
||||
DAV svn
|
||||
SVNParentPath ${reposDir}
|
||||
SVNAutoversioning ${if config.autoVersioning then "on" else "off"}
|
||||
'';
|
||||
|
||||
|
||||
# Build ViewVC.
|
||||
viewvc = import "${servicesPath}/subversion/src/viewvc" {
|
||||
inherit (pkgs) fetchurl stdenv python enscript;
|
||||
inherit urlPrefix reposDir adminAddr subversion;
|
||||
};
|
||||
|
||||
|
||||
viewerConfig = dirName: ''
|
||||
${commonAuth}
|
||||
AuthAllowNone on
|
||||
AuthzRepoPrefix ${urlPrefix}/${dirName}/
|
||||
AuthzRepoDBType DB
|
||||
AuthzRepoReaders ${dbDir}/svn-readers
|
||||
Require repo-reader
|
||||
'';
|
||||
|
||||
|
||||
viewvcConfig = ''
|
||||
ScriptAlias ${urlPrefix}/viewvc ${viewvc}/viewvc/bin/mod_python/viewvc.py
|
||||
|
||||
<Location ${urlPrefix}/viewvc>
|
||||
AddHandler python-program .py
|
||||
# Note: we write \" instead of ' to work around a lexer bug in Nix 0.11.
|
||||
PythonPath "[\"${viewvc}/viewvc/bin/mod_python\", \"${subversion}/lib/${pkgs.python.libPrefix}/site-packages\"] + sys.path"
|
||||
PythonHandler handler
|
||||
${viewerConfig "viewvc"}
|
||||
</Location>
|
||||
|
||||
Alias ${urlPrefix}/viewvc-doc ${viewvc}/viewvc/templates/docroot
|
||||
|
||||
Redirect permanent ${urlPrefix}/viewcvs ${serverInfo.canonicalName}/${urlPrefix}/viewvc
|
||||
'';
|
||||
|
||||
|
||||
# Build WebSVN.
|
||||
websvn = import "${servicesPath}/subversion/src/websvn" {
|
||||
inherit (pkgs) fetchurl stdenv writeText enscript gnused diffutils;
|
||||
inherit urlPrefix reposDir subversion;
|
||||
cacheDir = tmpDir;
|
||||
};
|
||||
|
||||
|
||||
websvnConfig = ''
|
||||
Alias ${urlPrefix}/websvn ${websvn}/wsvn.php
|
||||
Alias ${urlPrefix}/templates ${websvn}/templates
|
||||
|
||||
<Location ${urlPrefix}/websvn>
|
||||
${viewerConfig "websvn"}
|
||||
</Location>
|
||||
|
||||
<Directory ${websvn}/templates>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Directory>
|
||||
'';
|
||||
|
||||
|
||||
distConfig = ''
|
||||
Alias ${urlPrefix}/dist ${distsDir}
|
||||
|
||||
<Directory "${distsDir}">
|
||||
AllowOverride None
|
||||
Options Indexes FollowSymLinks
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
IndexOptions +SuppressDescription +NameWidth=*
|
||||
IndexIgnore *.rev *.lock
|
||||
IndexStyleSheet ${urlPrefix}/style.css
|
||||
</Directory>
|
||||
|
||||
<Location ${urlPrefix}/dist>
|
||||
${viewerConfig "dist"}
|
||||
</Location>
|
||||
'';
|
||||
|
||||
|
||||
repomanConfig = ''
|
||||
ScriptAlias ${urlPrefix}/repoman ${scripts}/cgi-bin/repoman.pl
|
||||
|
||||
<Location ${urlPrefix}/repoman/listdetails>
|
||||
${commonAuth}
|
||||
Require valid-user
|
||||
</Location>
|
||||
|
||||
<Location ${urlPrefix}/repoman/adduser>
|
||||
Order deny,allow
|
||||
Deny from all
|
||||
Allow from 127.0.0.1
|
||||
Allow from ${config.userCreationDomain}
|
||||
</Location>
|
||||
|
||||
<Location ${urlPrefix}/repoman/edituser>
|
||||
${commonAuth}
|
||||
Require valid-user
|
||||
</Location>
|
||||
|
||||
<Location ${urlPrefix}/repoman/create>
|
||||
${commonAuth}
|
||||
Require valid-user
|
||||
Order deny,allow
|
||||
Deny from all
|
||||
Allow from 127.0.0.1
|
||||
Allow from ${config.userCreationDomain}
|
||||
</Location>
|
||||
|
||||
<Location ${urlPrefix}/repoman/update>
|
||||
${commonAuth}
|
||||
Require valid-user
|
||||
</Location>
|
||||
|
||||
<Location ${urlPrefix}/repoman/dump>
|
||||
${viewerConfig "repoman/dump"}
|
||||
</Location>
|
||||
'';
|
||||
|
||||
|
||||
staticFiles = substituteInSome {
|
||||
name = "svn-static-files";
|
||||
src = /* pkgs.lib.cleanSource */ "${servicesPath}/subversion/root";
|
||||
files = ["xsl/svnindex.xsl"];
|
||||
inherit urlPrefix;
|
||||
};
|
||||
|
||||
staticFilesConfig = ''
|
||||
Alias ${urlPrefix}/svn-files ${staticFiles}/
|
||||
<Directory ${staticFiles}>
|
||||
Order allow,deny
|
||||
Allow from all
|
||||
</Directory>
|
||||
'';
|
||||
|
||||
|
||||
# !!! should be in Nixpkgs.
|
||||
substituteInSome = args: pkgs.stdenv.mkDerivation ({
|
||||
buildCommand = ''
|
||||
ensureDir $out
|
||||
cp -prd $src/* $out
|
||||
chmod -R u+w $out
|
||||
for i in $files; do
|
||||
args=
|
||||
substituteAll $out/$i $out/$i
|
||||
done
|
||||
'';
|
||||
} // args); # */
|
||||
|
||||
substituteInAll = args: pkgs.stdenv.mkDerivation ({
|
||||
buildCommand = ''
|
||||
ensureDir $out
|
||||
cp -prd $src/* $out
|
||||
chmod -R u+w $out
|
||||
find $out -type f -print | while read fn; do
|
||||
args=
|
||||
substituteAll $fn $fn
|
||||
done
|
||||
eval "$postInstall"
|
||||
'';
|
||||
} // args); # */
|
||||
|
||||
|
||||
in {
|
||||
|
||||
extraModulesPre = [
|
||||
# Allow anonymous access to repositories that are world-readable
|
||||
# without prompting for a username/password.
|
||||
{ name = "authn_noauth"; path = "${authModules}/modules/mod_authn_noauth.so"; }
|
||||
# Check whether the user is allowed read or write access to a
|
||||
# repository.
|
||||
{ name = "authz_dyn"; path = "${authModules}/modules/mod_authz_dyn.so"; }
|
||||
];
|
||||
|
||||
extraModules = [
|
||||
{ name = "python"; path = "${pkgs.mod_python}/modules/mod_python.so"; }
|
||||
{ name = "dav_svn"; path = "${subversion}/modules/mod_dav_svn.so"; }
|
||||
];
|
||||
|
||||
enablePHP = true;
|
||||
|
||||
|
||||
extraConfig = ''
|
||||
|
||||
<Location ${urlPrefix}/repos>
|
||||
${reposConfig "repos"}
|
||||
</Location>
|
||||
|
||||
<Location ${urlPrefix}/repos-xml>
|
||||
${reposConfig "repos-xml"}
|
||||
SVNIndexXSLT "${urlPrefix}/svn-files/xsl/svnindex.xsl"
|
||||
</Location>
|
||||
|
||||
${viewvcConfig}
|
||||
|
||||
${websvnConfig}
|
||||
|
||||
${repomanConfig}
|
||||
|
||||
${distConfig}
|
||||
|
||||
${staticFilesConfig}
|
||||
|
||||
${if config.toplevelRedirect then ''
|
||||
<Location ${urlPrefix}/>
|
||||
DirectoryIndex repoman
|
||||
</Location>
|
||||
'' else ""}
|
||||
|
||||
'';
|
||||
|
||||
|
||||
robotsEntries = ''
|
||||
User-agent: *
|
||||
Disallow: ${urlPrefix}/viewcvs/
|
||||
Disallow: ${urlPrefix}/viewvc/
|
||||
Disallow: ${urlPrefix}/websvn/
|
||||
Disallow: ${urlPrefix}/repos-xml/
|
||||
'';
|
||||
|
||||
|
||||
# mod_python's own Python modules must be in the initial Python
|
||||
# path, they cannot be set through the PythonPath directive.
|
||||
globalEnvVars = [
|
||||
{ name = "PYTHONPATH"; value = "${pkgs.mod_python}/lib/${pkgs.python.libPrefix}/site-packages"; }
|
||||
];
|
||||
|
||||
|
||||
extraServerPath = [
|
||||
# Needed for ViewVC.
|
||||
"${pkgs.diffutils}/bin"
|
||||
"${pkgs.gnused}/bin"
|
||||
];
|
||||
|
||||
|
||||
extraPath = [scripts];
|
||||
|
||||
|
||||
startupScript = "${scripts}/bin/svn-server-${idString}startup-hook.sh";
|
||||
|
||||
|
||||
options = {
|
||||
|
||||
id = mkOption {
|
||||
default = "";
|
||||
example = "test";
|
||||
description = "
|
||||
A unique identifier necessary to keep multiple Subversion server
|
||||
instances on the same machine apart. This is used to
|
||||
disambiguate the administrative scripts, which get names like
|
||||
svn-server-<id>-delete-repo.pl. In particular it keeps
|
||||
the post-commit hooks of different instances apart.
|
||||
";
|
||||
};
|
||||
|
||||
urlPrefix = mkOption {
|
||||
default = "/subversion";
|
||||
description = "
|
||||
The URL prefix under which the Subversion service appears.
|
||||
Use the empty string to have it appear in the server root.
|
||||
";
|
||||
};
|
||||
|
||||
toplevelRedirect = mkOption {
|
||||
default = true;
|
||||
description = "
|
||||
Whether <varname>urlPrefix</varname> without any suffix
|
||||
(except a slash) should redirect to
|
||||
<varname>urlPrefix</varname><literal>/repoman</literal>.
|
||||
";
|
||||
};
|
||||
|
||||
notificationSender = mkOption {
|
||||
default = "svn-server@example.org";
|
||||
example = "svn-server@example.org";
|
||||
description = "
|
||||
The email address used in the Sender field of commit
|
||||
notification messages sent by the Subversion subservice.
|
||||
";
|
||||
};
|
||||
|
||||
userCreationDomain = mkOption {
|
||||
default = "example.org";
|
||||
example = "example.org";
|
||||
description = "
|
||||
The domain from which user creation is allowed. A client can
|
||||
only create a new user account if its IP address resolves to
|
||||
this domain.
|
||||
";
|
||||
};
|
||||
|
||||
autoVersioning = mkOption {
|
||||
default = false;
|
||||
description = "
|
||||
Whether you want the Subversion subservice to support
|
||||
auto-versioning, which enables Subversion repositories to be
|
||||
mounted as read/writable file systems on operating systems that
|
||||
support WebDAV.
|
||||
";
|
||||
};
|
||||
|
||||
dataDir = mkOption {
|
||||
example = "/data/subversion";
|
||||
description = "
|
||||
Path to the directory that holds the repositories, user database, etc.
|
||||
";
|
||||
};
|
||||
|
||||
organisation = {
|
||||
|
||||
name = mkOption {
|
||||
default = null;
|
||||
description = "
|
||||
Name of the organization hosting the Subversion service.
|
||||
";
|
||||
};
|
||||
|
||||
url = mkOption {
|
||||
default = null;
|
||||
description = "
|
||||
URL of the website of the organization hosting the Subversion service.
|
||||
";
|
||||
};
|
||||
|
||||
logo = mkOption {
|
||||
default = null;
|
||||
description = "
|
||||
Logo the organization hosting the Subversion service.
|
||||
";
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
};
|
||||
|
||||
}
|
||||
Loading…
Reference in New Issue
Block a user